AI-based cybersecurity anomaly detection for OT systems in the EU Resilience Framework, an illustrative simulation-based methodological study

Aim: To examine the possible role and constraints of Artificial Intelligence in anomaly detection for Operational Technology considering the EU critical entity resilience framework and concentrating on the European Commission’s 2026 guidance. Methodology: A focused reading of the Critical Entities Resilience Directive, CER guidance, NIS2 and the EU’s AI Act is combined with an illustrative synthetic experiment. Three established detectors and a fixed-weight combination are evaluated on 7,481 aligned test timestamps. Findings: The combined detector achieved an F1 score of 0.700 but missed many attack-labelled observations and incorrectly flagged some normal observations as anomalous. These outcomes illustrate detection limits and do not demonstrate improved service continuity, effective oversight by qualified personnel or regulatory compliance. Value: This study links an accessible technical example with practical questions about integrated resilience measures, alert handling, accountability of responsible personnel and documentation. Its contribution is a bounded applied interpretation, not a new detection algorithm.