Governing Data and Cybersecurity in Industrial AI Across OT and IT

This Policy Brief examines how Europe should govern data and cybersecurity in industrial artificial intelligence across operational technology and information technology environments. It addresses the growing importance of machine-, sensor- and process-generated data for AI-enabled manufacturing, energy, logistics and critical infrastructure, and analyses the specific risks arising when AI systems interact with physical production processes. The Brief assesses the interaction between the EU AI Act, NIS2 Directive, Cyber Resilience Act, Data Act and relevant international standards, including IEC 62443, ISO/IEC 27001, ISO/IEC 42001 and the ISO/IEC 5259 series. It argues that Europe does not require another isolated regulatory layer, but an integrated, consequence-based assurance framework connecting industrial data quality, OT cybersecurity, AI lifecycle governance, interoperability, functional safety and supply-chain accountability. The publication proposes a European Industrial AI Security and Data Assurance Profile, differentiated assurance tiers and actionable recommendations for policymakers, regulators, industrial operators and technology providers.