Definition
A legally enforceable requirement that operators of critical infrastructure (such as energy, water, and transport systems) must formally assess the risks that AI introduces to their operations and include those risks in their official risk management programmes. Australia's 2026 CIRMP Rules are the first to name AI as an explicit mandatory category.
Why it matters
Regulators are moving beyond voluntary AI guidelines to hard legal obligations for sectors where AI failures can affect public safety — operators in scope face compliance deadlines, audit exposure, and potential liability if AI risks are not formally assessed.