Industrial AI systems are making autonomous decisions. Many lose their governance when they lose their connection.

In 2023, an excavator operator at BHP’s Goonyella Riverside coal mine in Queensland, Australia, was working on the autonomous haulage circuit when the autonomous trucks lost communication with their centralized systems. He grounded his bucket and exited the cab during the outage. While he was moving back to reenter the cab, the link restored. The autonomous haul truck resumed movement, reversed toward the excavator, and struck it. No one was injured, but the Queensland Mines Inspectorate investigated.

For every professional engineer who specifies, reviews, or stamps a system design that includes autonomous artificial intelligence (AI), the questions that matter are these: What authority governed that truck’s transition back to autonomous operation? Could anyone reconstruct the decision sequence with verifiable evidence?

Deployments like this are accelerating. According to Deloitte’s 2026 research on physical AI, only 5% of firms say physical AI is transforming their operations today, but 41% expect it will within three years. Most environments where these systems deploy routinely experience network outages. Yet most AI governance architectures assume reliable connectivity. NSPE’s Fundamental Canon #1, hold paramount the safety, health, and welfare of the public, now extends to a novel class of failure that didn’t exist when most of us took the PE exam.

Here, governance does not mean the organizational layer, who approves AI projects, AI ethics, or which corporate policies apply. It means the operational system that constrains what an AI is allowed to decide, enforces those constraints whether or not a human is watching, logs what it decided and why, and provides verifiable evidence after the fact. For professional engineers, this governance must survive network failures and coverage outages intact.

The Architectural Regression

For decades, industrial process control solved governance locally. A PLC (Programmable Logic Controller) governing a chemical reactor doesn’t check with a centralized authority before closing a valve. The control logic, the safety interlocks, and the governance rules all reside on the PLC at the point of action. A network connection to SCADA (Supervisory Control and Data Acquisition) or DCS (Distributed Control System) may provide monitoring, optimization, or coordination, but not authority. If the network fails, the PLC keeps governing the process safely and deterministically, by design.

As industry expanded autonomous decision-making beyond what PLCs govern, adding AI-driven optimization, predictive control, and autonomous operational decisions, it reversed this architecture. Model training, governance enforcement, compliance logging, and model distribution all run through cloud platforms. AI inference moved to the point of action, but the authority over that intelligence stayed in the cloud. The network went from being an enhancement to being a structural dependency.

These governance systems were built for enterprise IT, where connectivity is reliable, not for the industrial and remote environments where they now run. The industry took authority that was local and correct by design and made it remote; then connected it with an imperfect link that is prone to failure; then made the decision-making system non-deterministic, meaning the AI’s behavior evolves as models and system state change, rather than remaining static like PLC ladder logic.

Where AI optimizes within parameters bounded by PLC safety interlocks, the governance architecture holds. But autonomous AI increasingly makes operational decisions that exceed what those interlocks were designed to govern, even where decades of safety architecture exist. Physical AI is scaling rapidly into agriculture, construction, mining, emergency response, and other domains where there is no equivalent safety architecture. Combined, these changes don’t just add risk; they multiply it. Unlike a PLC, whose fail-state is deterministic and governed locally, a non-deterministic AI system whose governance depends on connectivity operates ungoverned during any connectivity gap, making the duration and frequency of connectivity loss a novel risk multiplier.

What This Means in Practice

In practice, commercial edge AI platforms assume reliable connectivity and offer local caching or degraded operation when the link drops. The AI system continues making decisions, potentially safety-critical ones, while the governance system that should be constraining, logging, and attesting those decisions is disconnected. Running AI models locally does not mean governing them locally. If policy enforcement, decision attestation, and compliance logging depend on a cloud connection, governance remains cloud-dependent regardless of where inference runs.

The industry is beginning to recognize the connectivity challenge, but not the governance problem it creates. The LF Edge Foundation’s 2026 State of the Edge report devotes an entire chapter to DDIL (Denied, Disrupted, Intermittent, and Limited) environments, conditions that also describe many industrial sites during normal operations. Deloitte’s 2026 Physical AI whitepaper identifies governance as an emerging dimension of physical AI maturity, but defines it as corporate policy, not operational governance. Neither asks the harder question: what governs the autonomous system when the network is not there?

Why This Matters Now

Major industry initiatives are building AI infrastructure into network and cloud management planes, increasingly positioned for industrial Internet of Things (IoT) and physical AI deployments where connectivity interruptions are routine and the consequences of ungoverned decisions are physical. When governance depends on the network, every network interruption becomes a governance interruption.

The First Warning Signals

Incidents where autonomous AI caused harm under inadequate governance are few so far, but instructive. In October 2023, a Cruise autonomous robotaxi in San Francisco ran over a pedestrian who had previously been struck by a separate human-driven vehicle and thrown into the robotaxi’s path. The robotaxi stopped after the initial impact, but its detection system failed to identify the woman trapped beneath. The system made an autonomous decision to pull over to the curb, dragging her more than 20 feet across the pavement. Cruise omitted the dragging from its mandatory National Highway Traffic Safety Administration crash report, leading to a US Department of Justice criminal charge and a $500,000 fine. Two governance failures converged: an autonomous decision made without detecting the hazard it created, and a regulatory report that omitted what the system’s own records showed.

The Cruise vehicle was connected, not operating under network partition. That makes the governance failure more concerning, not less: if an autonomous AI system can cause this level of harm while fully connected, professional engineers must consider what happens when similar systems lose that connection entirely.

An Emerging Regulatory Response

The European Union AI Act’s highrisk system requirements take effect in August 2026. Articles 9 through 15 mandate continuous risk management, automatic event logging, human oversight throughout use, and system robustness. Notably, none of these provisions contain exceptions for connectivity interruptions. The National Institute of Standards and Technology’s AI Risk Management Framework similarly addresses risks across the system lifecycle. But the engineering guidance for meeting these requirements under realworld operational constraints, where connectivity is intermittent, does not exist yet.

Connectivity Assumptions Versus Operational Reality

Consider the connectivity service level agreements (SLAs) that industrial sites depend on. A 99.9% uptime SLA, common among satellite providers, permits about 8 hours and 46 minutes of downtime per year. Many exclude outages under 60 seconds, and none anticipate every failure. In July 2025, a LEO satellite provider’s software failure dropped its global connectivity to 16% for 2.5 hours. In February 2024, a Tier 1 carrier’s single misconfigured network element caused a 12-hour nationwide wireless outage affecting 125 million devices and taking FirstNet, the first responder network, offline for over two hours. The Federal Communications Commission called it a "sunny day outage."

These were infrastructure failures, not AI governance incidents. But they establish that the connectivity industrial AI governance relies on will fail under conditions that are entirely foreseeable. When autonomous AI that can cause real harm is governed by architectures dependent on connectivity that cannot be guaranteed, we have an obligation to protect the public and our clients against this emergent risk class.

Closing the Gap

Current functional safety standards (IEC 61508, IEC 61511, ISA 84) were designed for deterministic control systems and were not designed to address AI model drift, governance partition, decision attestation, or state reconciliation. No published International Electrotechnical Commission (IEC) or Institute of Electrical and Electronics Engineers (IEEE) standard yet addresses AI governance under network partition. PEs don’t need to become AI specialists, but we need frameworks for asking the right questions when AI appears in our designs. The sidebar offers five questions to start.

Practically, this means adding AI governance to design review checklists alongside cybersecurity and functional safety. It means requesting partition operating specifications, and if there are none, documenting that gap as a finding. It means requiring decision attestation and a secure, auditable evidence chain through connectivity interruptions. It means asking what happens to model lifecycle governance during a partition: what if a model is updated or recalled while the system is disconnected? And it means documenting the governance risk assessment in the project record. If an incident triggers a regulatory inquiry or litigation, that record is the evidence that the engineering analysis was performed.

The engineering principle is clear: governance policy enforcement, decision logging, and attestation must execute locally at the point of action, with state reconciliation when connectivity restores; the same pattern that made PLCs reliable for decades, now applied to a non-deterministic decision-maker. The system must be able to prove what it decided, under what constraints, with what data, using what model, under what authority, whether or not it was connected at the time. That is the architectural standard the industry has not yet met.

Physical AI systems are entering industrial operations now, and most are being deployed without governance that survives the loss of a network connection. Whether that changes is an engineering judgment, and it is ours to make. The engineers who designed PLCs understood something the AI industry is now learning: authority must reside where consequences occur.