An AI-Enabled Cyber-Resilience Index for Industrial Control Systems: Integrating Regulatory Compliance and Geopolitical Exposure on the NATO-EU Eastern Flank

Operational Technology (OT) and Industrial Control Systems (ICSs) along the NATO-EU eastern flank face escalating hybrid threats, yet existing cyber-resilience metrics remain IT-centric, lacking OT-specific constraints and geopolitical exposure dimensions. This paper presents a Design Science Research contribution: the development and simulation-based feasibility demonstration of two interconnected artefacts. The first is the AI-enabled Cyber-Resilience Index (ACRI)—a composite 0–100 metric operationalized through 16 indicators across four domains (detection performance, operational continuity, governance maturity, supply-chain risk), aggregated as a three-term convex combination of capability domains with a linear subtractive supply-chain exposure penalty, weighted via AHP-based illustrative sector-reference profiles. The second is the Unified Compliance Framework (UCF), a structured R → C → E → SLO mapping linking 47 atomic regulatory requirements (NIS2, DORA, CER, AI Act, CRA) to standards (IEC 62443, ISO/IEC 27001) and auditable evidence artifacts, with a Continuous Assurance Loop operationalizing continuous control monitoring. Feasibility is demonstrated through digital twin simulation under three OT-representative threat scenarios (energy SCADA APT, railway supply-chain compromise, manufacturing ransomware). Results in simulated environments show ACRI improvement from Moderate-Risk baselines (45–61) to Adequate-Resilience thresholds (65–73); the proposed federated autoencoder–LSTM detector attains a composite Dperf of 0.883 versus 0.510 for a static ±3σ threshold baseline (a 73% relative improvement at the domain level). Sensitivity analysis confirms classification robustness (±7.3% weight perturbation; coefficient of variation below 9.1% across 10,000 Monte Carlo iterations). Critical limitations are explicit: simulation-only evidence (n=12 scenario instances), illustrative (non-empirical) AHP weights, no operational field validation, and limited inferential statistical power. instances), illustrative (non-empirical) AHP weights, no operational field validation, and limited inferential statistical power. The contribution is positioned as a proof-of-concept design artifact establishing methodological foundations for OT-centric resilience assessment and compliance-to-engineering traceability, not as a field-validated operational system.