ClariantixClariantix
Intelligence Center™OverviewFeatured ResearchRegulatoryExecutive BriefingsIndustriesCustomer SuccessLibraryTrust IndexEventsAcademy
Industry Intelligence
Critical Infrastructure / Third-Party AI Risk
Estimated reading time: 5 minutes

You May Not Operate Critical Infrastructure—but Does Your AI Interact With the Organizations That Do?

Published October 14, 2026 · Clariantix Research

Many organizations assume critical-infrastructure concerns belong only to utilities, telecommunications companies, transportation operators, hospitals, banks or governments.

That view overlooks how essential services actually operate. Critical infrastructure depends on engineering firms, architects, consultants, software providers, cloud services, equipment vendors, system integrators, maintenance contractors, laboratories, insurers and many other organizations that may not consider themselves infrastructure operators.

If AI is used inside those relationships, an organization may influence critical functions without owning the infrastructure itself.

Exposure follows function and access

The relevant question is not only whether the organization appears on a critical-infrastructure list. It is whether its AI-enabled activity can affect the confidentiality, integrity, availability, safety or recovery of an essential service.

Examples include AI used to:

  • summarize inspection findings for a utility or transportation client;
  • draft maintenance instructions for operational equipment;
  • analyze drawings, specifications or asset-condition data;
  • prioritize safety observations or incident reports;
  • access building, network or industrial-control information;
  • communicate with vendors or field personnel;
  • generate code or configurations used in connected systems;
  • support procurement of critical components;
  • review emergency, continuity or recovery documentation;
  • operate through a service provider with remote access to client systems.

An error, unauthorized disclosure or uncontrolled agent action may therefore propagate beyond the immediate organization.

Map the dependency, not just the customer category

Organizations should map AI relationships through five lenses:

  • 1. Client criticality: Does the client operate or support an essential service?
  • 2. Workflow criticality: Could the AI-influenced deliverable affect safety, availability, security, regulatory compliance or emergency response?
  • 3. Access criticality: Can the AI or an associated user reach sensitive data, credentials, networks, operational technology or remote-maintenance functions?
  • 4. Dependency criticality: Would failure, delay or corruption in the organization’s service affect the client’s ability to maintain critical operations?
  • 5. Propagation potential: Could one error or compromised integration affect multiple clients, sites or sectors?

This analysis should be recorded at the use-case level. A firm may have many low-risk administrative uses and one narrow AI-enabled workflow with significant infrastructure implications.

Ask what the client assumes about your AI

Contracts and security questionnaires do not always expose AI use clearly. A client may believe work is completed through established human-controlled processes while a supplier uses AI to draft, analyze, classify or communicate.

Organizations should determine:

  • whether AI use must be disclosed;
  • whether client data may be submitted to external models;
  • whether subcontractors or AI providers are permitted;
  • which decisions require qualified professional review;
  • what records must be retained;
  • whether incidents must be reported within a defined period;
  • whether the client can audit controls or request evidence;
  • what happens when a provider or model changes;
  • whether the client can require suspension of an AI-enabled workflow.

The absence of an explicit contractual prohibition should not be treated as approval.

Include AI in third-party and remote-access governance

The Canadian Centre for Cyber Security has emphasized the risks created when system integrators or third-party service providers have remote access to operational technology. Agentic AI can add another layer to that exposure if an agent can use credentials, issue commands, retrieve configuration information or communicate through connected services.

Controls should address:

  • named organizational and client owners;
  • agent-specific identities and least-privilege access;
  • approved systems, data, environments and actions;
  • separation between analysis and execution;
  • human approval for consequential changes;
  • logging across multi-step activity;
  • credential revocation and technical isolation;
  • notification and external coordination;
  • continuity arrangements if the AI service is unavailable or suspended;
  • evidence required before resuming affected work.

Test the downstream scenario

Risk exercises should ask more than “what if the AI is wrong?” They should examine how an error or unauthorized action travels.

For example:

  • What if an AI-generated engineering summary omits a condition that affects safe operation?
  • What if an agent sends sensitive asset information to an unapproved external service?
  • What if a maintenance contractor’s agent reuses remote-access credentials outside the approved window?
  • What if a provider change alters the model’s ability to use tools or follow restrictions?
  • What if several critical-infrastructure clients rely on the same AI-enabled workflow?

The exercise should identify who detects the issue, who can pause the workflow, which clients must be informed, what evidence is preserved and how safe manual operations continue.

The Clariantix view

The relevant question is not only whether you operate critical infrastructure, but whether your AI can influence an organization that does.

AI governance should make interdependence visible. Organizations need to connect AI systems and agents to clients, services, data, access, contracts, critical functions, accountable owners, incidents and continuity arrangements. That is how indirect exposure becomes governable rather than invisible.

Know Your AI. Prove Your Trust.

Clariantix Perspective

Does your AI inventory show which systems and agents touch critical clients, services or supply chains?

Clariantix helps organizations map AI use, third-party relationships, accountable ownership, controls and evidence across connected operations.

Series

Assurance, Enforcement and Interdependence in Agentic AI

Sources and Notes
  1. Canadian Centre for Cyber Security, Careful adoption of agentic AI, September 10, 2026.
  2. Canadian Centre for Cyber Security, Critical Infrastructure Resilience and Escalated Threat Navigation initiative, September 18, 2026.
  3. Innovation, Science and Economic Development Canada, Improving the Reliability and Resilience of Canada's Digital Infrastructure, March 24, 2026.
  4. Canadian Centre for Cyber Security, Cyber threat actors use artificial intelligence in an active global campaign to disrupt internet-exposed programmable logic controllers, September 14, 2026.
  5. Canadian Centre for Cyber Security, Recommended cyber security contract clauses for cloud services, December 31, 2024.
  6. Canadian Centre for Cyber Security, Frontier artificial intelligence (ITSAP.10.050), May 29, 2026.

Accuracy note: Whether an organization is legally or contractually treated as part of a critical-infrastructure ecosystem depends on jurisdiction, sector, role and agreement. This article uses “indirect exposure” as a governance concept and does not assign a legal critical-infrastructure designation.

Previous Publication
Your AI Provider Signed a Safety Pledge. What Assurance Does That Actually Give Your Organization?