Critical Infrastructure (CI)
Systems and assets vital to national security, economic security, public health, or safety, whose incapacitation would be debilitating.
How the laws define this
Both instruments establish that Critical Infrastructure consists of physical or virtual systems and assets so vital or essential to the United States that their incapacitation or destruction would cause a debilitating impact on national economic security, public health or safety, and security. They agree on key foundational examples, both citing energy, water, and transportation. The primary divergence appears in their additional sector inclusions and explicit focus on risk. The NIST AI RMF Profile for Trustworthy AI in Critical Infrastructure lists emergency services as a primary sector example. In contrast, the Concept Note: AI RMF Profile on Trustworthy AI in Critical Infrastructure highlights communications instead, while explicitly adding that integrating artificial intelligence into these sectors requires careful risk management. Compliance assessments must account for these differing sector focus areas.
Synthesised from the 2 statutory definitions below. Each one is quoted in full, with its source.
What it triggers
- Under the NIST AI RMF Profile for Trustworthy AI in Critical Infrastructure, which is a guideline (NOT BINDING), operators of critical infrastructure are recommended to manage AI risks in vital sectors like energy, water, transportation, and emergency services.source
- In the Concept Note: AI RMF Profile on Trustworthy AI in Critical Infrastructure, careful risk management is called for where AI is integrated into critical infrastructure sectors like energy, water, transportation, and communications.
Definitions (2)
Critical Infrastructure (CI) encompasses physical or virtual systems and assets so vital to the United States that their incapacitation or destruction would have a debilitating impact on national security, national economic security, national public health or safety, or any combination thereof. This includes sectors like energy, water, transportation, and emergency services.
Critical Infrastructure (CI) refers to the physical and virtual systems and assets that are so essential to the United States that their incapacitation or destruction would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters. This includes sectors like energy, water, transportation, and communications, where AI integration requires careful risk management.
Questions and answers
What sectors are included in critical infrastructure under NIST guidelines?
Critical infrastructure includes sectors like energy, water, transportation, and emergency services. The Concept Note also mentions communications.
Is the NIST AI RMF Profile for critical infrastructure binding?
No, it is a guideline (NOT BINDING) that guides U.S. infrastructure operators in managing AI risks.
What is the impact if critical infrastructure is incapacitated?
Incapacitation or destruction of critical infrastructure would have a debilitating impact on national security, national economic security, national public health or safety, or any combination thereof.