MITRE ATLAS is the recognized taxonomy for adversarial AI threats. It was not designed for industrial control systems. This paper demonstrates that gap empirically using 111 controls from the Adaptive AI Governance Framework for the Electric Sector (AAIGF-E), 52 of which are not directly representable within current ATLAS technique abstractions, and acts on it by proposing a formally structured ICS specific adversarial AI technique taxonomy. Three tactics and eight techniques are defined, each with verified control mappings to AAIGF-E and explicit differentiation from existing ATLAS entries. The taxonomy uses the namespace ICS-AI.TXXXX to signal ATLAS lineage without claiming MITRE registration. The core finding: ATLAS models how AI systems are attacked. In industrial control systems, the most consequential attacks do not target the model they target the boundaries that govern what the model is allowed to do. That layer is not explicitly represented in current ATLAS abstractions.

MITRE ATLAS provides the most widely used adversarial AI threat taxonomy available to practitioners, cataloguing attack vectors (model poisoning, backdooring, adversarial input crafting, and inference API exploitation) that MITRE ATT&CK does not address [1]. For any practitioner governing AI adversarial risk, ATLAS is a necessary reference. This paper does not argue otherwise. The finding of this paper is more specific: ATLAS does not explicitly model the adversarial conditions governing AI deployment in electric sector Operational Technology (OT) environments. Drawing on the Adaptive AI Governance and Integrity Framework for Electric Sector (AAIGF-E), a 111-control, sector-specific AI governance framework integrating NERC CIP [2], NIST AI RMF [3], ISA/IEC 62443 [4], and ISO/IEC 42001 [5], this paper applies a structured three-way classification to all 111 controls: ATLAS-mapped (58 controls), outside ATLAS scope by design (32 controls), and true taxonomy gaps (20 controls). The 20 gap controls govern adversarially relevant operational conditions in ICS/OT environments not directly representable within current ATLAS technique abstractions, concentrating in the Operational Control, Testing and Evaluation, Incident Response, Model Integrity, and System Integrity domains. Six gap categories are identified and structured as either new attack surfaces (OT Operational Boundary Manipulation, Fail-Safe and Fallback Subversion, AI-toOT Command Pathway Exploitation, Recovery and Re-enablement Exploitation) or ICSspecific extensions of existing ATLAS concepts (Human Override Interference, Operational Context Poisoning). Proposed technique labels and representative controls are documented for each. The findings establish that AI governance in electric sector OT environments requires purpose-built control frameworks that extend beyond what any existing adversarial taxonomy currently provides.

NERC CIP is the binding cybersecurity regulatory framework for the Bulk Electric System (BES) in North America. It is rigorously maintained, operationally mature, and consequentially enforced. It is also structurally silent on artificial intelligence. The root cause is CIP-002: AI systems influencing BES operations are not classified as BES Cyber System components. When the asset is not classified, none of the downstream protections, CIP-007 systems security, CIP-008 incident response, CIP-009 recovery planning, are required to apply to it. This paper presents a control-level gap analysis demonstrating that NERC CIP compliance, achieved fully and in good faith, does not satisfy AI governance requirements for electric sector organizations deploying AI systems that influence grid operations. Using the Adaptive AI Governance Framework for the Electric Sector (AAIGF-E) as the analytical baseline, the analysis maps 111 AI governance controls against all applicable NERC CIP standards and identifies 41 controls (37%) that address AI-specific risks for which no current NERC CIP requirement exists. A subset of 23 controls (21%) carries dual gap status: no CIP requirement and no MITRE ATLAS adversarial technique. These 23 controls represent zones of zero governance visibility, risks that are ungoverned by regulation and unrepresented in adversarial threat taxonomy simultaneously. The 41 gap controls govern AI model lifecycle integrity, training and evaluation assurance, behavioral drift monitoring, human oversight authority, and AI-specific incident response. None of these areas is governed under any current CIP standard. A failure scenario anchored in Winter Storm Uri, conditions present at any utility deploying AI in grid operations under NERC CIP alone, demonstrates that CIP-only governance for AI-influenced grid operations creates unmanaged operational risk. Compliance and governance are not the same thing when the regulation predates the technology. This paper is the regulatory companion to a prior MITRE ATLAS gap analysis. Together they establish that neither the adversarial AI threat taxonomy nor the electric sector's primary regulatory framework currently governs the full AI risk surface in BES environments.

Artificial intelligence is being deployed across the electric sector at a pace that existing governance frameworks were not designed to address. Utilities, grid operators, and power generators are integrating AI into load forecasting, grid optimization, contingency assessment, predictive maintenance, and anomaly detection in OT and ICS environments. These are not low-stakes applications. AI systems influencing operational decisions on the Bulk Electric System carry direct consequences for grid reliability, operational safety, and national security. This paper introduces AAIGF-E, a structured governance and assurance framework comprising domain-specific controls, audit-ready requirements, and a concurrent lifecycle model designed for AI systems in electric sector environments.

AI systems are making consequential operational decisions in bulk electric systems, water treatment facilities, and industrial process environments. When those systems degrade, through concept drift, deployment-context mismatch, or data integrity failure, existing frameworks do not model how that degradation propagates through operational decision layers into physical consequence. This paper presents the AI Consequence Propagation (ACP) Model: a five-stage sociotechnical propagation model for AI-enabled industrial systems. Unlike static hazard causality frameworks, ACP models adaptive AI-mediated dependency propagation, where the propagation mechanism is not a fixed system property but an emergent behavioral condition that develops after deployment. The model introduces operational authority drift: a condition in which operational dependency on AI outputs exceeds formally authorized decision boundaries without any explicit system reconfiguration. ACP treats this drift as a central propagation mechanism linking AI reliability degradation to physical consequence. A detailed scenario applies the model to predictive maintenance AI concept drift at a transmission substation, demonstrating all five propagation stages under non-adversarial conditions using existing SCADA telemetry and work order data. Three governance interception points are identified where active controls would have broken the propagation chain. None required new technology. The model draws on sociotechnical safety theory, human factors research, and concept drift detection, and is presented as an open analytical contribution for validation and extension.

AI is being deployed in smart-grid and smart-city energy infrastructure faster than governance frameworks can validate it. Existing instruments—NERC CIP, NIST AI RMF 1.0, and ISA/IEC 62443—address cybersecurity compliance and AI trustworthiness principles but do not provide operational control architecture for AI systems influencing grid stability, distributed energy resource (DER) dispatch, or real-time reliability decisions. Compliance with these instruments is not equivalent to operational assurance: their requirements do not by themselves establish validated input integrity controls, adversarial robustness testing, or bounded autonomy architecture for every AI-enabled operational use case. This paper presents the AI and Agentic Intelligence Governance Framework, Electric Sector (AAIGF-E): 111 controls across seven lifecycle phases (Govern, Design, Implement, Assure, Monitor, Respond, Recover), mapped to existing electric-sector compliance obligations. A defining structural feature of AAIGF-E is its dual-narrative control architecture, in which each control carries both an AI governance rationale and a parallel electric-sector operational translation, enabling the framework to serve AI governance stakeholders and operational technology (OT) engineering teams within the same control set without requiring cross-discipline translation. Scenario-driven validation tests the framework against three operationally relevant failure modes: adversarial manipulation of DER dispatch AI, unauthorized autonomous action execution by an agentic AI system in an OT environment, and silent model drift in grid stability forecasting. Validation confirms structural coverage across prevention, detection, and response phases and identifies residual implementation and assurance gaps while identifying a residual prompt-injection pathway in which technically valid operational content may manipulate agent task scope or apparent authority before downstream actuation controls activate. The 111-control register is further characterized through quantitative analysis of standards coverage, lifecycle and governance-domain distribution, cross-framework convergence, and sector-specific translation. A separate independent coding reproducibility check samples 35 controls across five reference frameworks, producing 175 binary mapping decisions; 155 decisions agree with the internal coding key (88.6% raw agreement; Cohen’s $\kappa =0.742$). To reduce reliance on author-led validation, a representative operational scenario is also evaluated by independent AI governance, cybersecurity, and ICS/OT experts who derive their judgments before reviewing the AAIGF-E reference assessment. Their domain selections and governance recommendations show strong overall convergence with the framework assessment. AAIGF-E is designed for electric utilities and smart-city operators within North American regulatory frameworks who need governance architecture that connects AI lifecycle risk management to existing compliance cycles rather than replacing them.