Manufacturing Sector Guidance

Methodology Note

ODA3 Institute is an applied research and advisory firm founded in March 2026. It does not maintain a historical proprietary client incident dataset covering manufacturing AI events. Sector interpretations and threat scenarios are derived from authoritative standards, public disclosures, regulatory and official materials, peer-reviewed or academic research, controlled technical demonstrations and explicitly labelled analytical scenarios. Absence of proprietary telemetry limits frequency estimation and must not be interpreted as evidence that an event has or has not occurred.

Normative, Legal and Safety Boundaries

• GAISSF control identifiers, official titles and authoritative requirements remain unchanged. All manufacturing interpretation is informative.
• GAISSF tier classification and SEC-045 assessment do not constitute an EU Artificial Intelligence Act legal classification or conformity assessment. They do not replace technical documentation, quality-management, risk-management, human-oversight, registration, post-market monitoring, fundamental-rights impact assessment or other obligations where those requirements apply.
• GAISSF security controls do not calculate, demonstrate or satisfy probability of failure on demand, probability of dangerous failure per hour, safety integrity level, performance level or equivalent functional-safety metrics. Security approval does not replace machinery- or process-safety lifecycle approval.
• An AI system must not be treated as the sole safety protection layer unless it has been engineered, assessed and approved under the applicable functional-safety and machinery-safety regime.

Evidence Classification

Assurance Artifact Strength

Inline [T1]–[T4] tags classify externally verifiable analytical claims and threat scenarios. They are not applied mechanically to procedural guidance or authoritative GAISSF requirements.

Executive Summary

Manufacturing AI spans enterprise assistance, production advice, quality decisions, control-influencing systems and autonomous physical operation. Assurance depth must follow authority and consequence, not marketing labels.

• Operate two implementation tracks: enterprise/advisory AI and OT/edge/physical AI.
• Preserve independent safety functions, engineering change control, quality release authority and deterministic fallback.
• Use human-in-the-loop approval where process timing permits; use human-on-the-loop supervision or independent protection where real-time intervention is infeasible.
• Estimate financial exposure with traceable formulas, low/base/high ranges and explicit assumptions.
• Record what was not established, including the absence of proprietary ODA3 telemetry and verified public frequency data.

1. Purpose and Scope

This guide translates the 59-control GAISSF baseline into manufacturing implementation, assessment and evidence guidance across enterprise IT, operational technology, industrial control, connected machinery, robotics, industrial Internet of Things, digital twins, quality, safety and supply chains.

2. Two-Track Implementation Model

3. Manufacturing AI Classification

4. Human Factors Implementation Pattern

• Calibrate operator trust by presenting limits, uncertainty and required action rather than unsupported confidence.
• Design alerts for actionability, priority and rate; monitor alert fatigue and override behaviour.
• Run periodic manual or degraded-mode drills to preserve competence where safe and operationally feasible.
• Measure whether the operator has sufficient information and intervention time; nominal presence is not meaningful oversight.
• Review task de-skilling, workarounds, unsafe reliance and loss of situational awareness.

This pattern is informative and does not create a new GAISSF control.

5. Conditional Applicability Trigger Matrix

6. Functional Safety and Machinery Safety Integration

GAISSF security controls do not calculate, demonstrate or satisfy probability of failure on demand, probability of dangerous failure per hour, safety integrity level, performance level or equivalent functional-safety metrics. Security approval does not replace machinery- or process-safety lifecycle approval.

7. Financial Exposure Estimation

Use plant-specific low, base and high estimates. Fixed confidence percentages must not be used unless supported by observed variance or explicit expert judgement.

8. Tier 4 Operational Metrics

9. Reference Architecture Examples

• Data and model provenance for a computer numerical control machine may include sensor identity, calibration records, toolpath metadata, maintenance state, model hash, training dataset version and deployment approval.
• Behavioural drift detection should segment performance by plant, line, machine, product family, tooling condition, shift and environmental regime rather than rely only on an enterprise-wide average.
• An OT/edge deployment should use signed artifacts, secure boot where available, hardened management, local monitoring, validated rollback and compensating controls for constrained legacy devices.
• An enterprise assistant should prevent confidential design or process data from being used for provider training unless explicitly authorised.

10. GAISSF Control Implementation Records

Each record preserves the authoritative identifier and official title. Source requirements remain normative only through GAISSF-NOR-001. Manufacturing content below is informative.

D1-CTL-01 — DATASET PROVENANCE & POISONING PREVENTION

Authoritative Requirement

Hash verification + source allowlist + poisoning detection.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply dataset provenance & poisoning prevention in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Maintain model and dataset provenance, integrity checks, approved sources, version control, plant-specific validation, and documented acceptance criteria before production use.
• Use signed artifacts, automated integrity verification, adversarial testing, drift detection by plant and operating regime, independent review, and tested rollback.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; dataset/model provenance; hash or signature verification; drift and rollback records

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• enterprise-only validation
• no plant-specific baseline
• unsigned model updates
• unmonitored drift
• weak dataset lineage

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D1-CTL-02 — MODEL EXTRACTION RESISTANCE

Authoritative Requirement

Rate limiting + diversity detection + extraction monitoring.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply model extraction resistance in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Maintain model and dataset provenance, integrity checks, approved sources, version control, plant-specific validation, and documented acceptance criteria before production use.
• Use signed artifacts, automated integrity verification, adversarial testing, drift detection by plant and operating regime, independent review, and tested rollback.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; dataset/model provenance; hash or signature verification; drift and rollback records

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• enterprise-only validation
• no plant-specific baseline
• unsigned model updates
• unmonitored drift
• weak dataset lineage

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D1-CTL-03 — BEHAVIORAL DRIFT DETECTION

Authoritative Requirement

Baseline profiling + KL divergence monitoring + accuracy tracking.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply behavioral drift detection in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Maintain model and dataset provenance, integrity checks, approved sources, version control, plant-specific validation, and documented acceptance criteria before production use.
• Use signed artifacts, automated integrity verification, adversarial testing, drift detection by plant and operating regime, independent review, and tested rollback.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; dataset/model provenance; hash or signature verification; drift and rollback records

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• enterprise-only validation
• no plant-specific baseline
• unsigned model updates
• unmonitored drift
• weak dataset lineage

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D1-CTL-04 — FEDERATED LEARNING POISONING PREVENTION

Authoritative Requirement

Gradient anomaly detection + robust aggregation.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply federated learning poisoning prevention in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Maintain model and dataset provenance, integrity checks, approved sources, version control, plant-specific validation, and documented acceptance criteria before production use.
• Use signed artifacts, automated integrity verification, adversarial testing, drift detection by plant and operating regime, independent review, and tested rollback.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; dataset/model provenance; hash or signature verification; drift and rollback records

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Document participating nodes, aggregation trust, poisoning resistance, privacy assumptions and rollback.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• enterprise-only validation
• no plant-specific baseline
• unsigned model updates
• unmonitored drift
• weak dataset lineage

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D1-CTL-05 — EMBEDDING SPACE ROBUSTNESS

Authoritative Requirement

Adversarial training + certified robustness measurement.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply embedding space robustness in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Maintain model and dataset provenance, integrity checks, approved sources, version control, plant-specific validation, and documented acceptance criteria before production use.
• Use signed artifacts, automated integrity verification, adversarial testing, drift detection by plant and operating regime, independent review, and tested rollback.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; dataset/model provenance; hash or signature verification; drift and rollback records

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• enterprise-only validation
• no plant-specific baseline
• unsigned model updates
• unmonitored drift
• weak dataset lineage

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D1-CTL-06 — POST-QUANTUM MODEL SIGNING & CRYPTO HARDENING

Authoritative Requirement

PQC signing (ML-DSA/SLH-DSA) + PQC key exchange (ML-KEM).

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply post-quantum model signing & crypto hardening in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Maintain model and dataset provenance, integrity checks, approved sources, version control, plant-specific validation, and documented acceptance criteria before production use.
• Use signed artifacts, automated integrity verification, adversarial testing, drift detection by plant and operating regime, independent review, and tested rollback.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; dataset/model provenance; hash or signature verification; drift and rollback records

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Perform a cryptographic-agility and migration assessment; do not use a fixed ten-year trigger without context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• enterprise-only validation
• no plant-specific baseline
• unsigned model updates
• unmonitored drift
• weak dataset lineage

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D1-CTL-07 — LORA/ADAPTER INTEGRITY VERIFICATION

Authoritative Requirement

Adapter scanning + provenance verification + registry allowlist.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply lora/adapter integrity verification in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Maintain model and dataset provenance, integrity checks, approved sources, version control, plant-specific validation, and documented acceptance criteria before production use.
• Use signed artifacts, automated integrity verification, adversarial testing, drift detection by plant and operating regime, independent review, and tested rollback.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; dataset/model provenance; hash or signature verification; drift and rollback records

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Verify provenance, compatibility, signatures, privilege and rollback for each adapter.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• enterprise-only validation
• no plant-specific baseline
• unsigned model updates
• unmonitored drift
• weak dataset lineage

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D1-CTL-08 — MODEL MERGE ATTACK DETECTION

Authoritative Requirement

Pre-registration behavioural evaluation + regression testing.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply model merge attack detection in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Maintain model and dataset provenance, integrity checks, approved sources, version control, plant-specific validation, and documented acceptance criteria before production use.
• Use signed artifacts, automated integrity verification, adversarial testing, drift detection by plant and operating regime, independent review, and tested rollback.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; dataset/model provenance; hash or signature verification; drift and rollback records

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• enterprise-only validation
• no plant-specific baseline
• unsigned model updates
• unmonitored drift
• weak dataset lineage

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D1-CTL-09 — QUANTIZATION BACKDOOR SCREENING

Authoritative Requirement

Cross-precision behavioural comparison + delta threshold monitoring.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply quantization backdoor screening in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Maintain model and dataset provenance, integrity checks, approved sources, version control, plant-specific validation, and documented acceptance criteria before production use.
• Use signed artifacts, automated integrity verification, adversarial testing, drift detection by plant and operating regime, independent review, and tested rollback.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; dataset/model provenance; hash or signature verification; drift and rollback records

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• enterprise-only validation
• no plant-specific baseline
• unsigned model updates
• unmonitored drift
• weak dataset lineage

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D2-CTL-01 — DIRECT PROMPT INJECTION PREVENTION

Authoritative Requirement

Input validation + adversarial pattern matching + system prompt isolation + guardrail sidecar.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply direct prompt injection prevention in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Validate and constrain inputs, isolate untrusted content, enforce tool permissions, log security-relevant interactions, and require human approval for production-affecting actions.
• Deploy context separation, deterministic policy enforcement, adversarial testing, runtime anomaly detection, content provenance checks, and automatic containment.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; input/output filtering tests; tool permission logs; adversarial test results

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• treating all plant data as trusted
• unrestricted tool calls
• missing context separation
• no production-action approval gate

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D2-CTL-02 — INDIRECT PROMPT INJECTION PREVENTION

Authoritative Requirement

Contextual separation + source allowlisting + output validation + RAG sanitization pipeline.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply indirect prompt injection prevention in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Validate and constrain inputs, isolate untrusted content, enforce tool permissions, log security-relevant interactions, and require human approval for production-affecting actions.
• Deploy context separation, deterministic policy enforcement, adversarial testing, runtime anomaly detection, content provenance checks, and automatic containment.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; input/output filtering tests; tool permission logs; adversarial test results

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• treating all plant data as trusted
• unrestricted tool calls
• missing context separation
• no production-action approval gate

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D2-CTL-03 — JAILBREAK RESISTANCE TESTING

Authoritative Requirement

Quarterly red-team prompt library + adversarial training + automated refusal monitoring.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply jailbreak resistance testing in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Validate and constrain inputs, isolate untrusted content, enforce tool permissions, log security-relevant interactions, and require human approval for production-affecting actions.
• Deploy context separation, deterministic policy enforcement, adversarial testing, runtime anomaly detection, content provenance checks, and automatic containment.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; input/output filtering tests; tool permission logs; adversarial test results

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• treating all plant data as trusted
• unrestricted tool calls
• missing context separation
• no production-action approval gate

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D2-CTL-04 — MULTI-MODAL INJECTION DEFENSE

Authoritative Requirement

Multi-modal content scanning + steganography detection + modality-specific guardrails.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply multi-modal injection defense in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Validate and constrain inputs, isolate untrusted content, enforce tool permissions, log security-relevant interactions, and require human approval for production-affecting actions.
• Deploy context separation, deterministic policy enforcement, adversarial testing, runtime anomaly detection, content provenance checks, and automatic containment.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; input/output filtering tests; tool permission logs; adversarial test results

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• treating all plant data as trusted
• unrestricted tool calls
• missing context separation
• no production-action approval gate

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D2-CTL-05 — FUNCTION CALL/TOOL CALL INJECTION PREVENTION

Authoritative Requirement

Parameter schema validation + allowlist enforcement + sandboxed execution.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply function call/tool call injection prevention in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Validate and constrain inputs, isolate untrusted content, enforce tool permissions, log security-relevant interactions, and require human approval for production-affecting actions.
• Deploy context separation, deterministic policy enforcement, adversarial testing, runtime anomaly detection, content provenance checks, and automatic containment.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; input/output filtering tests; tool permission logs; adversarial test results

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• treating all plant data as trusted
• unrestricted tool calls
• missing context separation
• no production-action approval gate

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D2-CTL-06 — CROSS-CONTEXT HIJACKING MITIGATION

Authoritative Requirement

Context window segmentation + prompt anchoring + attention boundary enforcement.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply cross-context hijacking mitigation in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Validate and constrain inputs, isolate untrusted content, enforce tool permissions, log security-relevant interactions, and require human approval for production-affecting actions.
• Deploy context separation, deterministic policy enforcement, adversarial testing, runtime anomaly detection, content provenance checks, and automatic containment.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; input/output filtering tests; tool permission logs; adversarial test results

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• treating all plant data as trusted
• unrestricted tool calls
• missing context separation
• no production-action approval gate

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D3-CTL-01 — LEAST AGENCY ENFORCEMENT

Authoritative Requirement

Role-based tool scoping + policy-as-code + dynamic permission revocation.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply least agency enforcement in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Define authority boundaries, approved actions, human override, fail-safe behavior, segregation of duties, and explicit approval for control-affecting operations.
• Use independent safety interlocks, formal policy constraints, simulation and boundary testing, command mediation, real-time authority monitoring, and tested emergency fallback.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; authority matrix; simulation results; override and fail-safe test

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• unclear action authority
• ineffective human oversight
• AI path bypasses engineering change control
• no tested fallback

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D3-CTL-02 — INTER-AGENT COMMUNICATION SECURITY

Authoritative Requirement

mTLS for agent mesh + message signing + payload validation.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply inter-agent communication security in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Define authority boundaries, approved actions, human override, fail-safe behavior, segregation of duties, and explicit approval for control-affecting operations.
• Use independent safety interlocks, formal policy constraints, simulation and boundary testing, command mediation, real-time authority monitoring, and tested emergency fallback.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; authority matrix; simulation results; override and fail-safe test

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• unclear action authority
• ineffective human oversight
• AI path bypasses engineering change control
• no tested fallback

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D3-CTL-03 — AGENTIC PROMPT CHAINING DETECTION

Authoritative Requirement

Cross-session behavioural correlation + chain pattern detection + anomaly scoring.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply agentic prompt chaining detection in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Define authority boundaries, approved actions, human override, fail-safe behavior, segregation of duties, and explicit approval for control-affecting operations.
• Use independent safety interlocks, formal policy constraints, simulation and boundary testing, command mediation, real-time authority monitoring, and tested emergency fallback.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; authority matrix; simulation results; override and fail-safe test

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• unclear action authority
• ineffective human oversight
• AI path bypasses engineering change control
• no tested fallback

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D3-CTL-04 — EMBODIED AI SAFETY CONTROLS

Authoritative Requirement

Sensor integrity verification + safety interlocks + fail-safe state enforcement.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply embodied ai safety controls in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Define authority boundaries, approved actions, human override, fail-safe behavior, segregation of duties, and explicit approval for control-affecting operations.
• Use independent safety interlocks, formal policy constraints, simulation and boundary testing, command mediation, real-time authority monitoring, and tested emergency fallback.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; authority matrix; simulation results; override and fail-safe test

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• unclear action authority
• ineffective human oversight
• AI path bypasses engineering change control
• no tested fallback

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D3-CTL-05 — MULTI-AGENT TRUST CHAIN ATTESTATION

Authoritative Requirement

SPIFFE/SPIRE workload identity + short-lived certificates + continuous attestation.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply multi-agent trust chain attestation in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Define authority boundaries, approved actions, human override, fail-safe behavior, segregation of duties, and explicit approval for control-affecting operations.
• Use independent safety interlocks, formal policy constraints, simulation and boundary testing, command mediation, real-time authority monitoring, and tested emergency fallback.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; authority matrix; simulation results; override and fail-safe test

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• unclear action authority
• ineffective human oversight
• AI path bypasses engineering change control
• no tested fallback

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D3-CTL-06 — PERSISTENT MEMORY EXFILTRATION PREVENTION

Authoritative Requirement

User-scoped memory isolation + encryption at rest + query-level access controls.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply persistent memory exfiltration prevention in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Define authority boundaries, approved actions, human override, fail-safe behavior, segregation of duties, and explicit approval for control-affecting operations.
• Use independent safety interlocks, formal policy constraints, simulation and boundary testing, command mediation, real-time authority monitoring, and tested emergency fallback.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; authority matrix; simulation results; override and fail-safe test

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• unclear action authority
• ineffective human oversight
• AI path bypasses engineering change control
• no tested fallback

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D3-CTL-07 — SECURE MEMORY LIFECYCLE MANAGEMENT

Authoritative Requirement

Cryptographic deletion + lifecycle policy enforcement + retention auditing.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply secure memory lifecycle management in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Define authority boundaries, approved actions, human override, fail-safe behavior, segregation of duties, and explicit approval for control-affecting operations.
• Use independent safety interlocks, formal policy constraints, simulation and boundary testing, command mediation, real-time authority monitoring, and tested emergency fallback.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; authority matrix; simulation results; override and fail-safe test

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• unclear action authority
• ineffective human oversight
• AI path bypasses engineering change control
• no tested fallback

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D4-CTL-01 — AI BILL OF MATERIALS (AI BOM) MAINTENANCE

Authoritative Requirement

Automated BOM generation + version tracking + registry synchronization.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply ai bill of materials (ai bom) maintenance in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Inventory suppliers and dependencies, define security requirements, obtain provenance and update commitments, restrict access, and maintain exit and continuity plans.
• Require signed releases, independent assurance, SBOM/AI-BOM evidence, continuous supplier monitoring, escrow or fallback arrangements, and tested replacement procedures.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; contract clauses; supplier evidence; AI-BOM/SBOM; remote-access review

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• accepting marketing claims as evidence
• persistent vendor access
• no model provenance
• no cloud outage contingency

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D4-CTL-02 — MODEL FILE & ARTIFACT SCANNING

Authoritative Requirement

Static analysis + deserialization sandboxing + signature verification.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply model file & artifact scanning in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Inventory suppliers and dependencies, define security requirements, obtain provenance and update commitments, restrict access, and maintain exit and continuity plans.
• Require signed releases, independent assurance, SBOM/AI-BOM evidence, continuous supplier monitoring, escrow or fallback arrangements, and tested replacement procedures.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; contract clauses; supplier evidence; AI-BOM/SBOM; remote-access review

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• accepting marketing claims as evidence
• persistent vendor access
• no model provenance
• no cloud outage contingency

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D4-CTL-03 — MODEL HUB & REGISTRY VETTING

Authoritative Requirement

Provenance verification + license compliance + security scorecard.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply model hub & registry vetting in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Inventory suppliers and dependencies, define security requirements, obtain provenance and update commitments, restrict access, and maintain exit and continuity plans.
• Require signed releases, independent assurance, SBOM/AI-BOM evidence, continuous supplier monitoring, escrow or fallback arrangements, and tested replacement procedures.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; contract clauses; supplier evidence; AI-BOM/SBOM; remote-access review

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• accepting marketing claims as evidence
• persistent vendor access
• no model provenance
• no cloud outage contingency

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D4-CTL-04 — MCP SERVER BEHAVIORAL MONITORING

Authoritative Requirement

Tool-call logging + anomaly detection + access control enforcement.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply mcp server behavioral monitoring in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Inventory suppliers and dependencies, define security requirements, obtain provenance and update commitments, restrict access, and maintain exit and continuity plans.
• Require signed releases, independent assurance, SBOM/AI-BOM evidence, continuous supplier monitoring, escrow or fallback arrangements, and tested replacement procedures.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; contract clauses; supplier evidence; AI-BOM/SBOM; remote-access review

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• accepting marketing claims as evidence
• persistent vendor access
• no model provenance
• no cloud outage contingency

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D4-CTL-05 — THIRD-PARTY AI API SECURITY ASSESSMENT

Authoritative Requirement

Contractual security requirements + penetration testing + data flow mapping.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply third-party ai api security assessment in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Inventory suppliers and dependencies, define security requirements, obtain provenance and update commitments, restrict access, and maintain exit and continuity plans.
• Require signed releases, independent assurance, SBOM/AI-BOM evidence, continuous supplier monitoring, escrow or fallback arrangements, and tested replacement procedures.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; contract clauses; supplier evidence; AI-BOM/SBOM; remote-access review

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• accepting marketing claims as evidence
• persistent vendor access
• no model provenance
• no cloud outage contingency

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D4-CTL-06 — SHADOW AI DISCOVERY & GOVERNANCE

Authoritative Requirement

Network traffic analysis + SaaS discovery + policy enforcement.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply shadow ai discovery & governance in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Inventory suppliers and dependencies, define security requirements, obtain provenance and update commitments, restrict access, and maintain exit and continuity plans.
• Require signed releases, independent assurance, SBOM/AI-BOM evidence, continuous supplier monitoring, escrow or fallback arrangements, and tested replacement procedures.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; contract clauses; supplier evidence; AI-BOM/SBOM; remote-access review

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• accepting marketing claims as evidence
• persistent vendor access
• no model provenance
• no cloud outage contingency

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D4-CTL-07 — AI SOFTWARE COMPOSITION ANALYSIS (SCA)

Authoritative Requirement

Dependency scanning + CVE matching + automated patching.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply ai software composition analysis (sca) in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Inventory suppliers and dependencies, define security requirements, obtain provenance and update commitments, restrict access, and maintain exit and continuity plans.
• Require signed releases, independent assurance, SBOM/AI-BOM evidence, continuous supplier monitoring, escrow or fallback arrangements, and tested replacement procedures.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; contract clauses; supplier evidence; AI-BOM/SBOM; remote-access review

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• accepting marketing claims as evidence
• persistent vendor access
• no model provenance
• no cloud outage contingency

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D5-CTL-01 — HARMFUL CONTENT BLOCKING

Authoritative Requirement

Content safety classifier + refusal engine.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply harmful content blocking in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Define acceptable outputs, validate critical results, communicate uncertainty, maintain human review, and prevent unsafe or prohibited content from entering production workflows.
• Use independent verification, output policy enforcement, confidence calibration, structured validation, traceable citations, and automatic quarantine of suspect outputs.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; output acceptance criteria; quality verification; exception and quarantine records

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• confidence treated as correctness
• no independent verification
• generated instructions used without engineering approval

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D5-CTL-02 — PII LEAKAGE PREVENTION

Authoritative Requirement

PII detection + masking + access controls.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply pii leakage prevention in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Define acceptable outputs, validate critical results, communicate uncertainty, maintain human review, and prevent unsafe or prohibited content from entering production workflows.
• Use independent verification, output policy enforcement, confidence calibration, structured validation, traceable citations, and automatic quarantine of suspect outputs.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; output acceptance criteria; quality verification; exception and quarantine records

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• confidence treated as correctness
• no independent verification
• generated instructions used without engineering approval

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D5-CTL-03 — COPYRIGHT DETECTION

Authoritative Requirement

n-gram overlap detection + refusal.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply copyright detection in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Define acceptable outputs, validate critical results, communicate uncertainty, maintain human review, and prevent unsafe or prohibited content from entering production workflows.
• Use independent verification, output policy enforcement, confidence calibration, structured validation, traceable citations, and automatic quarantine of suspect outputs.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; output acceptance criteria; quality verification; exception and quarantine records

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• confidence treated as correctness
• no independent verification
• generated instructions used without engineering approval

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D5-CTL-04 — AI WATERMARKING ROBUSTNESS

Authoritative Requirement

C2PA-compliant watermarking + tamper resistance testing.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply ai watermarking robustness in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Define acceptable outputs, validate critical results, communicate uncertainty, maintain human review, and prevent unsafe or prohibited content from entering production workflows.
• Use independent verification, output policy enforcement, confidence calibration, structured validation, traceable citations, and automatic quarantine of suspect outputs.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; output acceptance criteria; quality verification; exception and quarantine records

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Document why provenance or watermarking is required or not required for the scoped output channel.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• confidence treated as correctness
• no independent verification
• generated instructions used without engineering approval

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D5-CTL-05 — PRIVACY-BY-DESIGN VERIFICATION

Authoritative Requirement

Data minimization + purpose limitation + machine unlearning.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply privacy-by-design verification in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Define acceptable outputs, validate critical results, communicate uncertainty, maintain human review, and prevent unsafe or prohibited content from entering production workflows.
• Use independent verification, output policy enforcement, confidence calibration, structured validation, traceable citations, and automatic quarantine of suspect outputs.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; output acceptance criteria; quality verification; exception and quarantine records

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• confidence treated as correctness
• no independent verification
• generated instructions used without engineering approval

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D5-CTL-06 — PRIVACY-PRESERVING ML VALIDATION

Authoritative Requirement

Differential privacy + membership inference testing.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply privacy-preserving ml validation in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Define acceptable outputs, validate critical results, communicate uncertainty, maintain human review, and prevent unsafe or prohibited content from entering production workflows.
• Use independent verification, output policy enforcement, confidence calibration, structured validation, traceable citations, and automatic quarantine of suspect outputs.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; output acceptance criteria; quality verification; exception and quarantine records

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• confidence treated as correctness
• no independent verification
• generated instructions used without engineering approval

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D6-CTL-01 — HUMAN-IN-THE-LOOP FOR HIGH-RISK ACTIONS

Authoritative Requirement

Approval workflow + policy enforcement + audit log.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply human-in-the-loop for high-risk actions in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Maintain an AI inventory, assign accountable owners, classify criticality, approve risk, define policies, and retain evidence.
• Integrate plant-level assurance with enterprise governance, continuous control monitoring, independent challenge, board reporting, and multi-site conformance review.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; AI inventory; RACI; risk acceptance; governance minutes

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• central policy without plant implementation
• incomplete inventory
• unclear ownership
• undocumented exceptions

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D6-CTL-02 — AUDIT TRAIL COMPLETENESS

Authoritative Requirement

Structured logging + SIEM integration + retention enforcement.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply audit trail completeness in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Maintain an AI inventory, assign accountable owners, classify criticality, approve risk, define policies, and retain evidence.
• Integrate plant-level assurance with enterprise governance, continuous control monitoring, independent challenge, board reporting, and multi-site conformance review.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; AI inventory; RACI; risk acceptance; governance minutes

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• central policy without plant implementation
• incomplete inventory
• unclear ownership
• undocumented exceptions

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D6-CTL-03 — AI MODEL CARD COMPLETENESS

Authoritative Requirement

Standardized template + version control + public accessibility.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply ai model card completeness in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Maintain an AI inventory, assign accountable owners, classify criticality, approve risk, define policies, and retain evidence.
• Integrate plant-level assurance with enterprise governance, continuous control monitoring, independent challenge, board reporting, and multi-site conformance review.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; AI inventory; RACI; risk acceptance; governance minutes

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• central policy without plant implementation
• incomplete inventory
• unclear ownership
• undocumented exceptions

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D6-CTL-04 — AI INCIDENT RESPONSE READINESS

Authoritative Requirement

AI-IR runbook + tabletop exercises + containment automation.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply ai incident response readiness in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Maintain an AI inventory, assign accountable owners, classify criticality, approve risk, define policies, and retain evidence.
• Integrate plant-level assurance with enterprise governance, continuous control monitoring, independent challenge, board reporting, and multi-site conformance review.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; AI inventory; RACI; risk acceptance; governance minutes

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• central policy without plant implementation
• incomplete inventory
• unclear ownership
• undocumented exceptions

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D6-CTL-05 — MODEL DEPRECATION & DECOMMISSIONING

Authoritative Requirement

Access revocation + decommission audit + scheduled lifecycle.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply model deprecation & decommissioning in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Maintain an AI inventory, assign accountable owners, classify criticality, approve risk, define policies, and retain evidence.
• Integrate plant-level assurance with enterprise governance, continuous control monitoring, independent challenge, board reporting, and multi-site conformance review.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; AI inventory; RACI; risk acceptance; governance minutes

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• central policy without plant implementation
• incomplete inventory
• unclear ownership
• undocumented exceptions

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D6-CTL-06 — THIRD-PARTY AI VENDOR GOVERNANCE

Authoritative Requirement

Contractual security requirements + annual assessment + audit rights.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply third-party ai vendor governance in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Maintain an AI inventory, assign accountable owners, classify criticality, approve risk, define policies, and retain evidence.
• Integrate plant-level assurance with enterprise governance, continuous control monitoring, independent challenge, board reporting, and multi-site conformance review.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; AI inventory; RACI; risk acceptance; governance minutes

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• central policy without plant implementation
• incomplete inventory
• unclear ownership
• undocumented exceptions

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D6-CTL-07 — AI RESILIENCE & BUSINESS CONTINUITY

Authoritative Requirement

Failover systems + degraded mode + RTO/RPO definition.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply ai resilience & business continuity in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Maintain an AI inventory, assign accountable owners, classify criticality, approve risk, define policies, and retain evidence.
• Integrate plant-level assurance with enterprise governance, continuous control monitoring, independent challenge, board reporting, and multi-site conformance review.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; AI inventory; RACI; risk acceptance; governance minutes

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• central policy without plant implementation
• incomplete inventory
• unclear ownership
• undocumented exceptions

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D7-CTL-H01 — AI-GENERATED PHISHING SIMULATION

Authoritative Requirement

Simulation campaigns + click tracking + remedial training.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply ai-generated phishing simulation in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Define human authority, train users, test usability, provide escalation and override, and monitor adverse human-factor effects.
• Conduct human-factors engineering, competence validation, fatigue and workload assessment, independent ethics review where relevant, and recurring operator drills.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; training records; human-factors test; override drill; complaint or adverse-impact review

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• nominal human-in-the-loop
• operators cannot realistically intervene
• training not role-specific
• alert fatigue

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D7-CTL-H02 — DEEPFAKE DETECTION TRAINING

Authoritative Requirement

Training modules + quiz + simulated attacks.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply deepfake detection training in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Define human authority, train users, test usability, provide escalation and override, and monitor adverse human-factor effects.
• Conduct human-factors engineering, competence validation, fatigue and workload assessment, independent ethics review where relevant, and recurring operator drills.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; training records; human-factors test; override drill; complaint or adverse-impact review

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• nominal human-in-the-loop
• operators cannot realistically intervene
• training not role-specific
• alert fatigue

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D7-CTL-H03 — OUT-OF-BAND AUTHENTICATION

Authoritative Requirement

Independent channel verification + policy enforcement.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply out-of-band authentication in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Define human authority, train users, test usability, provide escalation and override, and monitor adverse human-factor effects.
• Conduct human-factors engineering, competence validation, fatigue and workload assessment, independent ethics review where relevant, and recurring operator drills.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; training records; human-factors test; override drill; complaint or adverse-impact review

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• nominal human-in-the-loop
• operators cannot realistically intervene
• training not role-specific
• alert fatigue

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D7-CTL-H04 — AI SOCIAL ENGINEERING IR

Authoritative Requirement

Tabletop exercises + IR plan + verification triggers.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply ai social engineering ir in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Define human authority, train users, test usability, provide escalation and override, and monitor adverse human-factor effects.
• Conduct human-factors engineering, competence validation, fatigue and workload assessment, independent ethics review where relevant, and recurring operator drills.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; training records; human-factors test; override drill; complaint or adverse-impact review

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• nominal human-in-the-loop
• operators cannot realistically intervene
• training not role-specific
• alert fatigue

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D7-CTL-H05 — AI-ENHANCED EXTERNAL ATTACK DEFENSE

Authoritative Requirement

AI-generated phishing detection + SOC tuning + response automation.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply ai-enhanced external attack defense in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Define human authority, train users, test usability, provide escalation and override, and monitor adverse human-factor effects.
• Conduct human-factors engineering, competence validation, fatigue and workload assessment, independent ethics review where relevant, and recurring operator drills.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; training records; human-factors test; override drill; complaint or adverse-impact review

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• nominal human-in-the-loop
• operators cannot realistically intervene
• training not role-specific
• alert fatigue

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D8-CTL-01 — EU AI ACT RISK TIER MAPPING

Authoritative Requirement

Risk classification framework + conformity assessment.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply eu ai act risk tier mapping in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Log material events, define incident criteria, preserve evidence, test rollback and manual fallback, and conduct post-incident review.
• Correlate AI, OT, safety and quality telemetry; automate containment; test cross-plant recovery; and independently validate restart readiness.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; incident playbook; logs; exercise results; recovery and restart approval

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• monitoring only accuracy
• no production stop criteria
• untested fallback
• restart without quality and safety revalidation

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D8-CTL-02 — ISO 42001 GAP ANALYSIS

Authoritative Requirement

Gap analysis methodology + remediation tracking.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply iso 42001 gap analysis in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Log material events, define incident criteria, preserve evidence, test rollback and manual fallback, and conduct post-incident review.
• Correlate AI, OT, safety and quality telemetry; automate containment; test cross-plant recovery; and independently validate restart readiness.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; incident playbook; logs; exercise results; recovery and restart approval

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• monitoring only accuracy
• no production stop criteria
• untested fallback
• restart without quality and safety revalidation

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D8-CTL-03 — GPAI TECHNICAL DOCUMENTATION VERIFICATION

Authoritative Requirement

Technical documentation + training data summary + copyright attestation.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply gpai technical documentation verification in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Log material events, define incident criteria, preserve evidence, test rollback and manual fallback, and conduct post-incident review.
• Correlate AI, OT, safety and quality telemetry; automate containment; test cross-plant recovery; and independently validate restart readiness.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; incident playbook; logs; exercise results; recovery and restart approval

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• monitoring only accuracy
• no production stop criteria
• untested fallback
• restart without quality and safety revalidation

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D8-CTL-04 — DORA ICT INCIDENT REPORTING (FINANCIAL SECTOR)

Authoritative Requirement

Incident classification + notification workflow + SLA monitoring.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply dora ict incident reporting (financial sector) in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Log material events, define incident criteria, preserve evidence, test rollback and manual fallback, and conduct post-incident review.
• Correlate AI, OT, safety and quality telemetry; automate containment; test cross-plant recovery; and independently validate restart readiness.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; incident playbook; logs; exercise results; recovery and restart approval

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• monitoring only accuracy
• no production stop criteria
• untested fallback
• restart without quality and safety revalidation

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D8-CTL-05 — NIST SP 800-218A COMPLIANCE CHECK

Authoritative Requirement

Secure development practices + attestation.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply nist sp 800-218a compliance check in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Log material events, define incident criteria, preserve evidence, test rollback and manual fallback, and conduct post-incident review.
• Correlate AI, OT, safety and quality telemetry; automate containment; test cross-plant recovery; and independently validate restart readiness.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; incident playbook; logs; exercise results; recovery and restart approval

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• monitoring only accuracy
• no production stop criteria
• untested fallback
• restart without quality and safety revalidation

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D9-CTL-01 — PHYSICAL HARM BOUNDARY ENFORCEMENT

Authoritative Requirement

Independent safety monitor (hardware or DO-178C Level A / IEC 61508 SIL 3 certified software) running in parallel with AI inference. Safety monitor enforces: maximum force/velocity/temperature/current limits; geofencing for autonomous systems; exclusion zones; rate-of-change limits for safety-critical parameters. AI output gated through safety monitor — monitor vetoes any out-of-boundary command without AI system awareness.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply physical harm boundary enforcement in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Maintain independent safety functions, constrained actuation, validated operating envelopes, emergency stop, physical access controls, and safe-state behavior.
• Apply defence-in-depth across perception, planning and actuation; independent monitoring; formal safety cases; adversarial physical testing; and validated degraded modes.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; safety case; operating envelope; interlock test; physical access and emergency-stop test

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• AI relied on as sole safety control
• unsafe operating envelope
• no physical adversarial testing
• safety and security reviews disconnected

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D9-CTL-02 — SAFE STATE AND GRACEFUL DEGRADATION

Authoritative Requirement

For each AI-controlled system, document: safe state definition (autonomous vehicle: controlled stop; surgical robot: tool withdrawal; industrial arm: immediate stop and hold); transition time to safe state (must be within stopping distance/reaction time for physical context); trigger conditions for safe state entry; recovery procedure. Implement degraded mode ladder: Full AI control → AI-assisted human control → Manual-only → Safe state.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply safe state and graceful degradation in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Maintain independent safety functions, constrained actuation, validated operating envelopes, emergency stop, physical access controls, and safe-state behavior.
• Apply defence-in-depth across perception, planning and actuation; independent monitoring; formal safety cases; adversarial physical testing; and validated degraded modes.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; safety case; operating envelope; interlock test; physical access and emergency-stop test

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• AI relied on as sole safety control
• unsafe operating envelope
• no physical adversarial testing
• safety and security reviews disconnected

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D9-CTL-03 — HUMAN OVERRIDE AND EMERGENCY STOP

Authoritative Requirement

Hardware emergency stop: physical E-stop accessible without any software mediation. AI system must not be able to disable, delay, or circumvent E-stop. Software override: human operator interface that immediately transfers control to safe state. Override must be possible when: AI communication is disrupted; AI system is under adversarial attack; AI model is producing anomalous outputs. Override authority must be unconditional — no AI reasoning, confidence scoring, or approval process may delay or prevent override activation.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply human override and emergency stop in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Maintain independent safety functions, constrained actuation, validated operating envelopes, emergency stop, physical access controls, and safe-state behavior.
• Apply defence-in-depth across perception, planning and actuation; independent monitoring; formal safety cases; adversarial physical testing; and validated degraded modes.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; safety case; operating envelope; interlock test; physical access and emergency-stop test

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• AI relied on as sole safety control
• unsafe operating envelope
• no physical adversarial testing
• safety and security reviews disconnected

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D9-CTL-04 — CYBER-PHYSICAL ATTACK DETECTION

Authoritative Requirement

Three-layer anomaly detection: (1) Sensor layer — statistical validation of sensor readings against physical models; flag readings deviating >3σ from model prediction; cross-validate against redundant sensor channels. (2) Actuator layer — monitor command streams for sequences inconsistent with operating context; flag commands outside physically feasible envelope. (3) AI inference layer — apply GAISSF™ D2-CTL-01 (Prompt Injection Detection) equivalent for physical AI inputs; monitor input feature distributions for adversarial perturbation signatures. All detections trigger immediate safe state entry (D9-CTL-02) and incident record with root_cause_category = Adversarial_Attack, root_cause_specific_type = Cyber_Physical_Attack.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply cyber-physical attack detection in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Maintain independent safety functions, constrained actuation, validated operating envelopes, emergency stop, physical access controls, and safe-state behavior.
• Apply defence-in-depth across perception, planning and actuation; independent monitoring; formal safety cases; adversarial physical testing; and validated degraded modes.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; safety case; operating envelope; interlock test; physical access and emergency-stop test

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• AI relied on as sole safety control
• unsafe operating envelope
• no physical adversarial testing
• safety and security reviews disconnected

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D9-CTL-05 — PHYSICAL ENVIRONMENT INTEGRITY MONITORING

Authoritative Requirement

Sensor integrity monitoring covering: (1) Hardware health — sensor self-test results, calibration drift indicators, environmental exposure limits. Alert when sensor confidence falls below threshold. (2) Data plausibility — real-time statistical validation against physical laws, historical baselines, and redundant sensor cross-validation. (3) Degraded sensor handling — explicit policy for each sensor failure mode: degrade gracefully (reduce AI authority, increase human oversight) or enter safe state. (4) Calibration management — automated alert when calibration certificates expire; block AI system from operational use with expired sensor calibration.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply physical environment integrity monitoring in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Maintain independent safety functions, constrained actuation, validated operating envelopes, emergency stop, physical access controls, and safe-state behavior.
• Apply defence-in-depth across perception, planning and actuation; independent monitoring; formal safety cases; adversarial physical testing; and validated degraded modes.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; safety case; operating envelope; interlock test; physical access and emergency-stop test

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• AI relied on as sole safety control
• unsafe operating envelope
• no physical adversarial testing
• safety and security reviews disconnected

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D9-CTL-06 — ACTUATOR COMMAND VERIFICATION

Authoritative Requirement

Pre-execution verification gate on every actuator command: (1) Physical bounds check — command value within safe operating envelope for current system state. (2) Sequence plausibility check — command consistent with prior sequence; flag implausible state transitions for human review. (3) Rate-of-change check — rate of change does not exceed safe limits (acceleration rate, force application rate, temperature change rate). (4) Dual-approval for irreversible actions — actuator commands causing irreversible physical changes (cutting, welding, demolition, high-energy discharge) require hardware interlock confirmation. Verification gate implemented in IEC 61508 SIL 3 certified software or hardware logic independent of AI model.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply actuator command verification in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Maintain independent safety functions, constrained actuation, validated operating envelopes, emergency stop, physical access controls, and safe-state behavior.
• Apply defence-in-depth across perception, planning and actuation; independent monitoring; formal safety cases; adversarial physical testing; and validated degraded modes.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; safety case; operating envelope; interlock test; physical access and emergency-stop test

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• AI relied on as sole safety control
• unsafe operating envelope
• no physical adversarial testing
• safety and security reviews disconnected

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

D9-CTL-07 — PHYSICAL INCIDENT EVIDENCE PRESERVATION

Authoritative Requirement

(1) Continuous ring-buffer recording — minimum 60-second rolling buffer of: all sensor inputs (raw and processed); all AI model inputs and outputs; all actuator commands; all safety monitor decisions; all human override activations; system health telemetry. Safety-critical systems retain 300 seconds minimum. (2) Incident freeze — on any safety-relevant event, automatically freeze buffer and begin extended logging. Frozen buffer write-protected. (3) Cryptographic integrity — all records SHA-256 hashed and ECDSA signed at point of creation. For Optimized tier: CRYSTALS-Dilithium signing (post-quantum). (4) Regulatory retention — ICAO Annex 13: 5 years minimum; EU AI Act Art. 19: 10 years; DORA Art. 12: 5 years. (5) UAIF® integration — automatically populate UAIF® incident record from evidence package.

Manufacturing Interpretation

In manufacturing, this control requires the organisation to apply physical incident evidence preservation in a way that accounts for long-lived assets, constrained maintenance windows, plant-specific conditions, product conformity, physical consequences and separation of safety functions from AI.

Minimum and Enhanced Implementation

• Maintain independent safety functions, constrained actuation, validated operating envelopes, emergency stop, physical access controls, and safe-state behavior.
• Apply defence-in-depth across perception, planning and actuation; independent monitoring; formal safety cases; adversarial physical testing; and validated degraded modes.

Evidence and Assessment

approved scope and owner; risk assessment; architecture or data-flow diagram; configuration and change records; test results; monitoring or review records; safety case; operating envelope; interlock test; physical access and emergency-stop test

Confirm the control operates at sampled plants and not only in corporate policy. Trace one deployed system from intake through validation, deployment, monitoring, change and recovery. Challenge supplier assertions and verify evidence quality.

Legacy OT and Compensating Controls

Apply proportionately to architecture, consequence and deployment context.

Use compensating monitoring, gateways, signed offline transfer, procedural approval or independent protection where direct implementation is technically infeasible.

Failure Modes, Residual Risk and Limits

• AI relied on as sole safety control
• unsafe operating envelope
• no physical adversarial testing
• safety and security reviews disconnected

Residual risk remains from unknown failure modes, incomplete data, supplier opacity, plant variation, human factors and correlated dependencies. Risk acceptance must be explicit for production- or safety-affecting systems.

Implementation of this control does not establish functional safety, product conformity, legal compliance or incident prevention by itself.

11. Manufacturing Threat Scenarios

The tags classify the evidentiary basis for the scenario description, not the severity of the scenario. No site-specific access path, occurrence or consequence is established without supporting evidence.

12. EU Artificial Intelligence Act Boundary

GAISSF tier classification and SEC-045 assessment do not constitute an EU Artificial Intelligence Act legal classification or conformity assessment. They do not replace technical documentation, quality-management, risk-management, human-oversight, registration, post-market monitoring, fundamental-rights impact assessment or other obligations where those requirements apply.

Manufacturing organisations must determine legal classification from intended purpose, role in the value chain, product integration, applicable annexes, sector legislation and jurisdiction. GAISSF tiers are an operational assurance model, not a legal classification.

13. Notably Absent

• Verified public disclosures establishing the frequency of AI-driven operational-technology disruption in manufacturing were not identified.
• Proprietary internal ODA3 telemetry confirming the frequency of AI-driven operational-technology disruption is absent because ODA3 Institute was founded in March 2026 and does not maintain a historical proprietary client incident dataset.
• Malicious AI-model manipulation, kinetic sabotage, cross-plant propagation or direct safety-system compromise is not treated as confirmed merely because it is technically plausible.
• Any assertion that GAISSF security controls replace or satisfy probability-of-failure metrics required for functional-safety certification is notably absent and expressly disclaimed.
• The review did not establish that reported manufacturing incidents are predominantly attributable to any single AI failure category.

14. Limitations

ODA3 Institute is an applied research and advisory firm founded in March 2026. It does not maintain a historical proprietary client incident dataset covering manufacturing AI events. Sector interpretations and threat scenarios are derived from authoritative standards, public disclosures, regulatory and official materials, peer-reviewed or academic research, controlled technical demonstrations and explicitly labelled analytical scenarios. Absence of proprietary telemetry limits frequency estimation and must not be interpreted as evidence that an event has or has not occurred.

Public disclosure is incomplete, architectures are often confidential, attribution is difficult, and controlled research does not establish field frequency. External standards, legal obligations and supplier products must be reverified at release and use.

15. Worked Example — Tier 2 Predictive Maintenance for a CNC Machine

A separately populated worked-example workbook is included in the package.

16. Final Validation and Publication Gates