AI in OT: Which Standards to Cite and How to Protect the IT/OT Boundary

On 23 October 2026, IIoT World published a Q&A titled "Standards and Controls for AI in Operational Technology". The answers come from Gary Tillery (CEO of Skkynet) and Matt Morris (VP Security and Resilience at EverLine), and grew out of audience questions from the session "It Can't Happen to Me – Until It Does" at the Industrial AI Summit 2026.

A note on the nature of the text: it is content sponsored by Skkynet (the publication states its editorial independence), based on the opinions of practitioners with commercial interests. It is neither a study nor a standard, and it introduces no new regulation or statistics. As a checklist, however, it is concrete. Note: our reading covered only the first part of the page, so the final section on the dedicated secure network is not commented on here.

There Is No Single Standard: You Need a Stack

Tillery's central point is that no single standard covers AI in production on its own. His list, which he himself describes as personal and not exhaustive, is organized by area:

• Interoperability and data: OPC UA (IEC 62541), Asset Administration Shell (IEC 63278) with ECLASS, ISA-95 (IEC 62264), ISO 23247 for digital twins, MQTT with Sparkplug B for telemetry. MQTT/Sparkplug B does not replace the semantics of OPC UA for control-relevant data.
• OT security: IEC 62443 (zones and conduits), IEC PAS 62443-1-6 for IIoT, NIST SP 800-82 Rev. 3. ISO/IEC 27001 addresses enterprise IT and does not replace 62443 on the factory network.
• Functional safety: IEC 61508, 61511, 62061 and ISO 13849, a hard boundary that no AI model or remote tool should write across.
• AI governance: ISO/IEC 42001:2023 (certifiable), ISO/IEC 23894, 5338, 5259 and 22989, plus the NIST AI RMF and its Generative AI Profile.

On the EU AI Act, the article notes that where it applies, safety components and certain industrial uses are high-risk. Alignment with ISO 42001 is possible, but it does not replace IEC 61508 or 62443. The biggest gap remains in agentic and generative systems: current standards assume a bounded model, not a planner that chooses its own tools.

AI as Advisor, Not Operator

The operational guidance is to treat AI as an advisor. The meaning of data comes from OPC UA or the asset shell; every action goes through a broker that sits outside the prompt; the model holds no standing credentials to PLCs or historians, only short-lived credentials tied to a single task, with an audit trail of who delegated the action.

The IT/OT Boundary According to Morris

If a single click can reach OT, you have an architecture problem.

Morris proposes designing on the assumption that IT is already compromised. The real bridges, he says, are shared Active Directory, reused credentials, dual-homed engineering workstations and always-on vendor remote access. The controls he lists:

• a separate OT identity, with no domain trust;
• an IT/OT DMZ where data is pushed outward and nothing initiates inbound connections into OT;
• jump hosts with phishing-resistant MFA, session recording and time-limited access;
• application allowlisting on HMIs and engineering workstations;
• OT-aware monitoring on conduits.

Morris cites the Colonial Pipeline case: OT was not compromised, but the company shut down because without IT it could neither bill nor track product. If OT cannot run without IT, the boundary is a fiction.

How to Verify It Holds

The suggested tests are:

• assume-breach testing starting from a compromised IT workstation, in a replica lab or during maintenance shutdowns;
• attack-path analysis on the as-built configuration, not on network diagrams;
• island-mode exercises, with IT and OT separated for a defined period;
• metrics: time to isolate, percentage of conduits validated during the year, number of undocumented dependencies found.

Key Takeaways

For those connecting MES, shop-floor data and AI tools, the value lies in three questions: which standards do I cite for each layer, where are the real bridges between IT and OT, and does the plant still produce if IT goes down? The same logic applies to food and poultry lines that depend on monitoring and traceability. A realistic first step is an island-mode exercise, which surfaces hidden dependencies before a real incident does.