{"resourceId":"naruc-2026-annual-draft-wc1-wrro-ex1-saferai","versions":[{"version":"external-9553543e4d00a50e96b75709344175a8067cf7eea82189a9b558f45c26062f6f","resource":{"id":"naruc-2026-annual-draft-wc1-wrro-ex1-saferai","title":"NARUC 2026 Annual Meeting draft resolutions: WC-1 water cybersecurity WRRO and EX-1 EPRI SAFERai.power AI governance","organization":"National Association of Regulatory Utility Commissioners (NARUC)","sector":"State utility regulation / water and electric utilities","geography":"United States","publishedAt":"2026-11-03","publicationDate":"2026-11-03","eventDate":"2026-11-08","sourceName":"NARUC","sourceLabel":"NARUC Resolutions Submitted for the 2026 NARUC Annual Meeting (PDF)","sourceUrl":"https://pubs.naruc.org/pub/912305B2-E106-77DC-5C31-D499BF47C855","evidenceClass":"public-sector-association","outcomeClass":"emerging","topics":["governance-procurement","data-security","operating-model"],"finding":"Draft resolutions for the 8-11 Nov 2026 NARUC Annual Meeting include WC-1, urging Congress to reauthorize and restaff CISA (citing roughly one-third workforce loss since 2025 and September 2026 cuts to six free cyber assessments for water utilities), strengthen WaterISAC sharing with FOIA protections, and authorize EPA to create an independent non-governmental Water Risk and Resilience Organization (WRRO) for minimum drinking water and wastewater cybersecurity requirements. The draft cites attacks on water utilities in at least 12 states in July-August 2026 and notes only about 11% of community water systems fall under commission jurisdiction. EX-1 separately commends EPRI SAFERai.power for an operational risk framework and open-source tools assessing electric-utility AI by context, consequence, autonomy and risk, and supports state regulator engagement. Adoption date blanks remain open.","sledRelevance":"U.S. SLED water cyber posture and electric AI governance: a WRRO would push minimum requirements under EPA oversight, while SAFERai.power gives commissions shared language for AI scrutiny. Why now: vote window opens 8 Nov 2026; this PDF is the primary draft previously only summarized in press.","evidence":"Opened the official NARUC pubs PDF. WC-1 and EX-1 appear in full; TOC lists WC-1 dated 10/23/2026 (sponsor Commissioner Bange); NARUC list page marks a 3 Nov 2026 version. No final board adoption dates filled in.","architectureImplications":"Inventory OT remote access, MFA and segmentation now; classify electric AI use cases by consequence/autonomy before SCADA/OMS agent integration.","governanceImplications":"Commissions may soon have NARUC policy backing water cyber minimums and structured AI risk assessment; most small water systems remain outside commission jurisdiction.","securityPrivacyImplications":"WC-1 seeks non-FOIA cyber-incident sharing and restored CISA free assessments; EX-1 frames AI around reliability, security and transparency rather than unconstrained autonomy.","caveats":"Draft only; Congress must still act for WRRO/CISA changes. SAFERai tools are under development. Incident and staffing claims are as stated in the draft.","streamIds":["utility-management"],"roles":{"sales":"Sales framing: NARUC draft WC-1 and EX-1 signal that water cyber minimums and electric AI governance are moving from voluntary practice toward association-backed policy. Position advisory work as CISA/WaterISAC readiness and SAFERai-style AI risk reviews, not autonomous OT control products. Emphasize that the 8-11 Nov vote is directional—Congress must still create a WRRO—so sell gap analysis and board briefings, never compliance guarantees or restored funding timelines.","engineering":"Engineering framing: treat WRRO and SAFERai as near-term design constraints even while drafts. Map internet-facing PLCs, remote-access MFA and segmentation against services CISA used to provide for free, and classify every AI use case by operational consequence and autonomy before any SCADA or OMS integration. Prefer recommendation-only agents on operational paths until inventory, logging and human approval gates are documented and tested.","delivery":"Delivery framing: deliver a bounded WRRO/SAFERai readiness workshop covering asset and remote-access inventory, a basic cyber hygiene gap list, and an AI use-case register with named human approvers. Include a calendar hold to diff adopted text after 11 Nov against this draft. Do not promise resolution passage, federal appropriations, or SAFERai certification; success is an actionable memo the utility can take to its board or commission."},"roleDetails":{"sales":{"customerProblem":"Fragmented water cyber maturity and unclear AI governance expectations ahead of possible federal minimums.","stakeholders":["State utility commissioners","Water utility GM/IT/OT leads","Electric utility AI/risk owners","CISO"],"discoveryQuestions":["Which former CISA free assessments did you rely on?","What share of OT assets have MFA-protected remote access?","Do you inventory AI use cases by autonomy/consequence?"],"valueHypothesis":"Pre-vote readiness reduces scramble if WRRO or SAFERai-aligned expectations land.","potentialEngagement":"Two-week WRRO/SAFERai readiness assessment with gap memo.","unsupportedClaims":["Guaranteed WRRO enactment","Restored CISA funding timeline","SAFERai certification"]},"engineering":{"fit":"Policy and risk-framework alignment for water OT cyber and electric AI—not a software install.","architectureIntegration":"Inventory remote-access paths, logging and AI touchpoints to SCADA/OMS/AMI.","prerequisites":["Current OT asset inventory","Remote-access and MFA status","List of AI pilots touching operations"],"constraints":["Draft resolution only","Most small water systems outside commission jurisdiction","SAFERai tools still maturing"],"security":"Preserve least-privilege remote access; do not expose SCADA logs to unverified AI vendors pending sharing rules.","proofOfValue":["Documented gap list vs basic hygiene","AI use-case register with approval gates","Post-11 Nov adopted-vs-draft diff"]},"delivery":{"work":"Facilitate inventory workshops, draft gap memo, define human-approval gates for OT-adjacent AI.","dependencies":["Utility OT/IT participation","Prior assessment reports","Legal review of information-sharing"],"ownership":"Utility CISO or compliance lead owns posture; advisory owns memo.","skillsAdoption":"Brief operators and commissioners on WRRO concepts and SAFERai dimensions.","governanceCheckpoints":["Kickoff scope lock","Draft memo counsel review","Post-meeting adopted-text update"],"acceptanceCriteria":["Written gap memo","AI use-case list with owners","No production OT changes without change control"],"risks":["Policy changes after vote","Over-interpreting draft as law","Resource strain on small systems"]}},"retrievedAt":"2026-11-06T22:05:53.081222-06:00","enrichedAt":"2026-11-06T22:12:10-06:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Small water systems lacking cyber staff are stated beneficiaries of restored CISA assessments; WRRO minimums could strain them without funding.","procurementImplications":"Expect RFPs referencing minimum water cyber controls and AI risk frameworks with human-oversight evidence.","operatingModelImplications":"Water utilities may move from discretionary cyber spend to compliance programs; electric utilities may need formal AI use-case risk reviews.","peerReview":"unknown","sourceVerification":{"openedUrl":"https://pubs.naruc.org/pub/912305B2-E106-77DC-5C31-D499BF47C855","referenceExcerpt":"CISA is underfunded and understaffed, having lost roughly one-third of its workforce since 2025.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}