From the Utility Management edition of November 6, 2026
NARUC 2026 Annual Meeting draft resolutions: WC-1 water cybersecurity WRRO and EX-1 EPRI SAFERai.power AI governance
National Association of Regulatory Utility Commissioners (NARUC) · State utility regulation / water and electric utilities · United States
- Publisher
- NARUC
- Original publication
- 2026-11-03
- Source retrieved
- 2026-11-07
- Event date
- 2026-11-08
What happened
Draft resolutions for the 8-11 Nov 2026 NARUC Annual Meeting include WC-1, urging Congress to reauthorize and restaff CISA (citing roughly one-third workforce loss since 2025 and September 2026 cuts to six free cyber assessments for water utilities), strengthen WaterISAC sharing with FOIA protections, and authorize EPA to create an independent non-governmental Water Risk and Resilience Organization (WRRO) for minimum drinking water and wastewater cybersecurity requirements. The draft cites attacks on water utilities in at least 12 states in July-August 2026 and notes only about 11% of community water systems fall under commission jurisdiction. EX-1 separately commends EPRI SAFERai.power for an operational risk framework and open-source tools assessing electric-utility AI by context, consequence, autonomy and risk, and supports state regulator engagement. Adoption date blanks remain open.
Why it matters
U.S. SLED water cyber posture and electric AI governance: a WRRO would push minimum requirements under EPA oversight, while SAFERai.power gives commissions shared language for AI scrutiny. Why now: vote window opens 8 Nov 2026; this PDF is the primary draft previously only summarized in press.
Evidence and measured results
Opened the official NARUC pubs PDF. WC-1 and EX-1 appear in full; TOC lists WC-1 dated 10/23/2026 (sponsor Commissioner Bange); NARUC list page marks a 3 Nov 2026 version. No final board adoption dates filled in.
Limitations and uncertainty
Draft only; Congress must still act for WRRO/CISA changes. SAFERai tools are under development. Incident and staffing claims are as stated in the draft.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-06; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Fragmented water cyber maturity and unclear AI governance expectations ahead of possible federal minimums.
- Stakeholders
- State utility commissioners
- Water utility GM/IT/OT leads
- Electric utility AI/risk owners
- CISO
- Discovery questions
- Which former CISA free assessments did you rely on?
- What share of OT assets have MFA-protected remote access?
- Do you inventory AI use cases by autonomy/consequence?
- Value hypothesis
- Pre-vote readiness reduces scramble if WRRO or SAFERai-aligned expectations land.
- Potential engagement
- Two-week WRRO/SAFERai readiness assessment with gap memo.
- Unsupported claims
- Guaranteed WRRO enactment
- Restored CISA funding timeline
- SAFERai certification
Pre-sales engineering
Role takeaway
- Fit
- Policy and risk-framework alignment for water OT cyber and electric AI—not a software install.
- Architecture and integration
- Inventory remote-access paths, logging and AI touchpoints to SCADA/OMS/AMI.
- Prerequisites
- Current OT asset inventory
- Remote-access and MFA status
- List of AI pilots touching operations
- Constraints
- Draft resolution only
- Most small water systems outside commission jurisdiction
- SAFERai tools still maturing
- Security
- Preserve least-privilege remote access; do not expose SCADA logs to unverified AI vendors pending sharing rules.
- Proof of value
- Documented gap list vs basic hygiene
- AI use-case register with approval gates
- Post-11 Nov adopted-vs-draft diff
Delivery
Role takeaway
- Work
- Facilitate inventory workshops, draft gap memo, define human-approval gates for OT-adjacent AI.
- Dependencies
- Utility OT/IT participation
- Prior assessment reports
- Legal review of information-sharing
- Ownership
- Utility CISO or compliance lead owns posture; advisory owns memo.
- Skills and adoption
- Brief operators and commissioners on WRRO concepts and SAFERai dimensions.
- Governance checkpoints
- Kickoff scope lock
- Draft memo counsel review
- Post-meeting adopted-text update
- Acceptance criteria
- Written gap memo
- AI use-case list with owners
- No production OT changes without change control
- Risks
- Policy changes after vote
- Over-interpreting draft as law
- Resource strain on small systems
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Inventory OT remote access, MFA and segmentation now; classify electric AI use cases by consequence/autonomy before SCADA/OMS agent integration.
Governance
Who approves, reviews and stays accountable for outcomes?
Commissions may soon have NARUC policy backing water cyber minimums and structured AI risk assessment; most small water systems remain outside commission jurisdiction.
Security and privacy
What data, permissions and controls need testing?
WC-1 seeks non-FOIA cyber-incident sharing and restored CISA free assessments; EX-1 frames AI around reliability, security and transparency rather than unconstrained autonomy.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Small water systems lacking cyber staff are stated beneficiaries of restored CISA assessments; WRRO minimums could strain them without funding.
Procurement
What should contracts, pricing and exit terms secure?
Expect RFPs referencing minimum water cyber controls and AI risk frameworks with human-oversight evidence.
Operating model
Which teams own the service once it runs?
Water utilities may move from discretionary cyber spend to compliance programs; electric utilities may need formal AI use-case risk reviews.
Publication history
- 2026-11-06Utility Management · Issue 097 resources
Stable resource ID: naruc-2026-annual-draft-wc1-wrro-ex1-saferai