OT Networks and Why AI Must Stay Out

Every few months a slide appears with a lightning bolt between a large language model and a turbine. The bolt is labelled closed loop. The presenter says the plant will be autonomous. The OT lead, if one is in the room, looks at the door.

Operational technology networks exist so that a mistake in IT does not become a physical event. That separation is older than transformers in the machine-learning sense. Prompt injection, tool-calling, and helpful vendors do not repeal it.

This is an opinion we will not soften to win a plant pilot. Prcept AI will read a one-way copy you already trust. We will not sit on the DCS. If that loses the deal, the deal was a future incident report.

What OT is, in this argument

OT here means the networks and hosts that sense and act on physical processes: PLC, DCS, SCADA, SIS, historians as OT operates them, engineering workstations, relay settings, and the jump hosts that exist only to touch those things.

IT means the corporate and plant-IT networks where mail, ERP, and now agents live. The Purdue-style levels you already draw are good enough as a conversation. We are not certifying your drawing. We are saying the agent belongs on the IT side of whatever line your OT lead will sign.

Critical information infrastructure, where NCIIPC's remit applies, makes the argument stricter, not looser. Do not wait for a special AI-on-OT circular to refuse a write path.

Why language models are the wrong actuator

They are probabilistic. They take instruction from text, including text in a retrieved PDF. They are operated by people who will paste. They grow tools the way ivy grows. None of that is how you want a set-point changed.

A confident token is not a validated write. An acknowledgement in chat is not an alarm acknowledgement. A recommendation displayed on a tablet beside the panel will be mistaken for an instruction at 3 a.m.

If you want closed-loop optimisation, that is a control-engineering project with the OEM and the SIS philosophy. It is not a use case for an agent platform. Do not launder it through our category.

The only honest integration

1. OT designs a one-way export: diode, unidirectional gateway, or a manual or scheduled dump they already accept.
2. The export lands on an IT store with a timestamp and a completeness flag.
3. The agent reads that store and IT documents — manuals, signed logs, circulars.
4. Outputs are drafts for humans: handover, retrieval, incident-form completeness.
5. No tool in the agent runtime can open a socket toward OT. Test that. Fail the build if a socket appears.
6. Jump hosts into OT remain human, ticketed, and out of the agent's identity set.

How the ivy grows if you let it

Week one: read-only historian API just for tags we already export. Week six: a write to acknowledge. Week twelve: a vendor engineer adds a management VLAN because the API was flaky. You now have a two-way path and a model that reads PDFs.

Write the refusal in week one. Put it in the board memo. Put it in the SI contract. Put it in the change-advisory board. Ivy is a change-control failure, not a surprise.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note.

[Air-gap](/blog/air-gapped-vs-on-prem-vs-sovereign-cloud) is old thinking

Air-gap is how you still have a plant when IT has a bad day. New thinking that removes it for a chatbot is not thinking. It is a sales cycle.

We will use a read-only service account

Read-only accounts become write when someone adds a method. They also exfiltrate enough to plan harm. Prefer a one-way copy OT already understands.

IEC 62443 / our auditor wants monitoring

Monitoring OT is an OT project. Mirroring selected events one way into a SOC is not the same as giving a language model a historian SDK. Do not confuse the two.

The OEM's new suite includes AI on the DCS

Then it is the OEM's safety case, not a third-party chat runtime. Demand the safety case. Do not bolt our agent onto their controller and call it the same thing.

Four weeks to make the refusal real

1. Week 1: walk the plant with OT. Mark every path between the proposed agent VLAN and OT. Photograph patching you were told did not exist.
2. Week 2: write the one-way export or write no integration. Kill any live API plan.
3. Week 3: add a build test that fails on unexpected destinations. Include it in CAB.
4. Week 4: put the no-write, no-socket sentence in the board memo and the SI contract. Brief night shift that tablets are not instruments.

How this shows up in the file

Subject: Separation of agent systems from operational technology.

Language-model agents shall not be installed on OT networks, engineering workstations, or jump hosts. They shall not hold credentials that can open sockets toward OT. Any use of plant data shall be via a one-way copy designed by OT.

No agent shall write set-points, acknowledgements or permits. This note is an internal aid. It is not a safety certification.

Why we will lose some plants

Some buyers want the lightning bolt. They will find a vendor who draws it. That vendor will not be sitting in the inquiry after a trip. We would rather lose the PO than be the named intern with a wrench.

Prcept AI ships on-prem and air-gapped agents for IT-side work. The air gap we mean includes OT. If your RFP requires a write tool into SCADA, do not invite us. Invite the OEM and their safety case.

This article is informational field guidance for Indian public institutions, not legal, procurement, security-accreditation, engineering or board advice. Confirm against the live Gazette, GFR, GeM term, CVC instruction, CERT-In direction, UIDAI regulation, DPE guideline, DPDP text, departmental charter, plant safety manual and your counsel before you file it.

How this clears vigilance and the board

A P4 System Integrator in a PSU will meet CVC-shaped questions even when there is no special 'AI circular'. “OT Networks and Why AI Must Stay Out” has to survive a technical committee, a cost centre, and a union conversation if jobs appear threatened.

An agent on OT is not digital transformation. It is an unauthenticated intern with a wrench. Keep the model in IT. Copy one way if you must. OT networks stay off-limits. Navratna autonomy speeds buying; it does not waive DPDP or data classification. IREPS is not GeM. RBI-shaped rules still localise payment data.

• Classify data before the POC.
• Keep agents off OT.
• Write the board memo with residual risk.
• Engage unions on retrieval vs replacement.

Close this loop before the next CAB

Put “OT Networks and Why AI Must Stay Out” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P4 System Integrator, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “OT network AI security” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.

What must be true before you file this

If “OT Networks and Why AI Must Stay Out” is only a heading, it will not survive a file inspection. A P4 System Integrator should be able to attach one artefact that proves “OT network AI security”: a log export, a clause, a scored row, a dated notice, or a refusal rule.

Write three dated sentences: what was decided, who owns it, and when it will be re-checked. Unsigned sentences are souvenirs. Dated sentences are controls.

• Name the owner of “OT network AI security” inside the institution.
• Attach one artefact a stranger can open next year.
• Revisit when the model, the notice, or the SI changes.
• Do not treat a vendor slide as evidence.

What the next file must contain

“OT Networks and Why AI Must Stay Out” earns a line in the noting only if a P4 System Integrator can attach proof of “OT network AI security.” A heading is not proof. A vendor slide is not proof. A workshop photograph is not proof.

Write three dated sentences: what was decided, who owns it after the next posting order, and when it will be re-checked. If you cannot write the three sentences, you are not ready to buy, to sell, or to go live.

Leave unsourced percentages out of the note. DPDP is not a blanket localisation statute. The November 2025 AI governance text is guidance, not an Act. CERT-In’s 28 April 2022 directions still set specified incident and log clocks. A PAC, when lawful, lives in GFR Rule 166.

• Name the designation that owns “OT network AI security.”
• Attach one artefact a stranger can open next year.
• Record the instrument you are actually using.
• Revisit when the model, the SI, the notice or the posting changes.