19473_Authority_Oct-opt

1 6 dŚĞ ƵƚŚŽƌŝƚLJ │ October Y our staff are already using AI. The only question is whether you can see it. The PagerDuty Shadow AI Survey, published in June 2026, asked 1,250 office professionals about AI at work. Among those who use it, 66% had done so believing it was against company policy. [www. pagerduty.com/newsroom/shadow-ai- workplace-survey-2026/] Read that the other way around before reaching for a ban. People do not risk their standing at work for something that does not help them. Two-thirds of them breaking a policy is not a discipline problem, it is evidence that this technology is doing real work and your people have already found where. Banning technology has never worked. It did not work with personal email or cloud storage, and it will not work here. A ban does not produce zero AI use. It produces AI use you cannot see, cannot train, cannot audit, and will not hear about until something has already gone wrong. Governance is not a brake on adoption. It is the only mechanism that brings what is already happening into the daylight, where you can do something about it. You already govern automated decisions You already have a governance framework for automated decision making. It is written into the regulations you work under every day. 25 Pa. Code Chapter 302 says an available operator makes all process control decisions, and that those decisions may be made on site, remotely, through standard operating procedures approved by the operator in responsible charge, or by using a PLC system under Section 302.1208. That section sets your terms. The available operator monitors the system. The operator keeps the ability to adjust it, or direct its adjustment, to stay in compliance. And there is a backup plan for making process control decisions if it stops working. [www.law.cornell.edu/ regulations/pennsylvania/25-Pa-Code- SS-302-1208] That is a human-in-the-loop rule, and you have been operating under it for years. Many industries approaching AI governance are starting from a blank page. You are not. You already run automated systems under a standard that names a responsible human, requires them to monitor, and demands a fallback. The same three questions work for any AI system you bring in. Who is watching it? Can they override it? What happens when it is wrong? If you can answer those for a chemical feed loop, you can answer them for a tool drafting your public notices. The job is not inventing a new discipline. It is extending one you already practice, out beyond SCADA and PLCs, to the rest of the organization. The rules that do not bend So what does that look like in practice? A workable framework has two halves. A short list of rules that do not bend, and a longer set of guidelines telling people what they are actively encouraged to try. The first protects the authority. The second is what gets AI adopted well. Take the rules first, and keep them short enough that people remember them without looking. Begin with data. Be specific about what never goes into an AI tool. Personal and financial information at any level of detail is a clean starting line. So is anything describing your systems. Network details, site information, and SCADA setpoints in particular give staff a boundary they can apply without stopping to ask. Name your tools. Say which are approved and which are not. Staff cannot follow a rule that asks them to guess, and a short list kept current will do more good than a long policy nobody finishes. Set the rule for what leaves. Say how AI-assisted work is identified internally, and be explicit about anything going to a board, a regulator, a solicitor, or the public. All of it