Two Years of IAEA Guidance on AI in Nuclear Operations

Two years after the IAEA’s Considerations for Deploying Artificial Intelligence Applications in the Nuclear Power Industry took effect on October 27, 2024, its message remains clear: AI’s potential benefits do not remove the need for reliable data, understandable decisions and human control. The guideline has been in effect throughout that period, but it is not itself legally binding; enforceability depends on incorporation into national laws or regulatory frameworks.

What's changing

The anniversary marks two years of an established guideline, not the arrival of a new obligation. Its substance is a framework for integrating AI into nuclear activities without treating improved performance as proof of safety or security.

Risk assessment is central. Organizations are expected to examine the risks of each AI application, including cyber-attacks and other vulnerabilities, and weigh anticipated benefits against the uncertainties the technology introduces. An application that improves monitoring, for example, still needs scrutiny of how it behaves when inputs are unreliable or conditions differ from those used during development.

Data quality and integrity are another core concern. Information used to train and operate AI models should be accurate, reliable and protected against manipulation. That makes data governance an operational issue, not simply a task completed before deployment. A model’s output cannot be more trustworthy than the information and processes supporting it.

The guideline also emphasizes explainable AI, often called XAI. Operators and regulators need to understand an AI system’s decision-making well enough to evaluate its outputs. The practical objective is meaningful transparency: people responsible for nuclear safety and security should be able to assess why a system produced a recommendation and recognize when that recommendation deserves challenge.

Human oversight remains paramount, particularly in safety-critical applications. The ability to intervene matters as much as the existence of an explanation. A technically impressive system is not an adequate substitute for clear responsibility and effective human control.

These are recommendations within an IAEA guideline, not a stand-alone international enforcement regime. Member States can incorporate them into domestic requirements, where they can become enforceable. The guideline alone does not establish a universal penalty schedule or demonstrate that any particular country has adopted its recommendations.

Who is affected

The guideline addresses IAEA Member States, their regulatory bodies and nuclear operators, alongside organizations developing, deploying or using AI in the nuclear sector. Its reach is international: it is not an instrument issued by a particular state, province or other sub-national government.

Despite the title’s focus on nuclear power, the described scope extends beyond commercial power plants. It includes research reactors, nuclear waste management and transport, as well as AI applications supporting nuclear safety, security and international safeguards verification.

That brings both operators and technology suppliers into the picture. Operators need to understand how an application fits into their responsibilities and procedures. Developers need to provide evidence and explanations that make informed assessment possible. Regulators need to evaluate how AI affects the activities they oversee.

No company-size threshold is specified in the supplied scope. A smaller developer should therefore not assume its work is irrelevant to the guideline merely because it supplies one component. Equally, an organization should distinguish the guideline’s broad audience from the precise legal duties imposed by its applicable national framework.

Three things to do this week

1. Refresh the AI inventory and risk assessments. Identify where AI is being developed, tested or used across relevant operations. For each application, record its purpose, responsible owner, inputs and potential safety or security consequences. Revisit cyber vulnerabilities and the uncertainties introduced by AI, rather than relying only on expected efficiency gains. Check separately which national requirements apply.

2. Trace the data and test its protection. Review where training and operational data came from, how accuracy is checked and who can change it. Look for weak points in access controls, data transfers and update procedures. As a practical way to support the guideline’s data-integrity recommendations, retain evidence of these checks so operators can investigate questionable outputs.

3. Check explanations and human intervention together. Ask operators to work through a realistic scenario involving an unexpected AI recommendation. Can they understand the basis for the output, identify its limitations and intervene effectively? Record gaps and assign corrective actions. This is a practical implementation exercise, not a prescribed test format or deadline established by the guideline.

Related context

The first review cycle was initiated on October 27, 2026, the two-year anniversary of the effective date. That review does not, by itself, replace the existing guideline or establish new requirements.

For comparison, the NIST AI RMF Profile for Trustworthy AI in Critical Infrastructure, ICAO Guidance on AI in Aviation and ISO/IEC TR 5469:2024 on functional safety and AI systems offer related context. They are separate instruments, not substitutes for assessing this guideline and applicable national requirements.

Note: this article was drafted by AI - OpenAI GPT-6.1