A document copilot inside the plant, outside the protected levels.
Plants already run generative AI over their procedures and condition reports, on hardware at the site. Kernwall OS is built for that advisory job: it sits below the plant's one-way boundary, opens no connection, takes updates only as signed media, and refuses models whose licence forbids nuclear use.
Already in plants
Operators are buying this job already.
Two of them, in their own words. Neither is a Kernwall deployment.
PG&E, Diablo Canyon
The first on-site generative AI at a US nuclear plant: Atomic Canyon's document search runs on NVIDIA H100s installed at the plant, over millions of pages from four decades of operation.
EDF and Mistral
A five-year deal for AI over the fleet's technical memory, maintenance and EPR2 work, hosted on sovereign cloud or EDF's own data centres. EDF says it will not concern plant control systems.
Both are advisory and work over documents, away from control systems. That is the only job Kernwall OS is designed for in a plant: staff ask, the model answers from the plant's own records with citations, and a person decides. See the session.
Why now
The rules for AI at a plant are being written now.
In the US the regulator has started its gap analysis. In the EU, energy suppliers get a supply-chain clock of their own.
- Oct 2024NIS2 applies, nuclear electricity included.
- May 2026The NRC began mapping AI cyber risks against RG 5.71.
- Jan 2027EU electricity's cyber code proposes supply-chain controls.
- Sep 2027High- and critical-impact electricity entities get identified.
Reference architecture
Below the one-way boundary, and nowhere above it.
On the plant information network, or alone in an engineering enclave. Bundles arrive on media through the plant's own kiosk, and nothing leaves.
The appliance's two placements against a plant's defensive levels, and the one path a bundle takes in.
- OutsideVendor
- Vendor build
Builds and signs release bundles. Holds no key to the plant and no route into it.
Signed bundles on media, never a connection
- Vendor build
- Lower levelsCorporate and plant information
- Import station
After the plant's own media kiosk, verifies each bundle and re-signs it with the site key.
- Document systems
Procedures, condition reports, licensing basis, work orders and maintenance history.
- Placement A · plant information networkAppliance
Answers staff from documents they can already open, over an OpenAI-compatible API. Egress denied.
Site-signed bundles, on media, to the enclave
- Import station
- EnclaveIsolated engineering
- Placement B · isolated engineering enclaveAppliance in the enclave
Outage planning and design-basis lookup on its own copy of the documents. No route to the protected levels, or out.
- Placement B · isolated engineering enclaveAppliance in the enclave
- Levels 3–4Protected levels
- One-way boundary
A one-way deterministic device or an air gap. Nothing below opens a connection in.
- Critical digital assets
Safety, security and control systems. No appliance goes here; it advises people and sends nothing in.
- One-way boundary
Levels 3–4 and the one-way device follow RG 5.71 Rev. 1 as the NRC's 2026 technical letter report quotes it; your plant's cyber security plan sets the real levels and zones.
Model licences
Licences that rule you out.
Open weights are not open for every use. The Llama 4 licence names nuclear outright, and a second clause reaches the grid. The window opens the catalog on Nuclear.
- Llama 4 Acceptable Use Policy §3.1
“Military, warfare, nuclear industries or applications, espionage”
Every civil nuclear operator, its engineering contractors and its suppliers.
- Llama 4 Acceptable Use Policy §3.4
“Operation of critical infrastructure, transportation technologies, or heavy machinery”
Grid and generation operators too, wherever the model touches operations.
Meta's waiver covers national-security use by the US and named allies, such as Germany and France, not civil operators. The clauses also bind models fine-tuned from Llama, so the catalog blocks them by lineage, and each block names the rule behind it.
| Model, origin, licence and lineage | In Nuclear |
|---|---|
| gpt-oss-120bUS · Apache-2.0 · base model | Allowed⚑ inherited |
| Mistral Small 3.2 24BFR · EU · Apache-2.0 · fine-tune of Mistral Small 3.1 24B Base | Allowed⚑ inherited |
| Llama 3.3 70B InstructUS · llama3.3 · base model | Blocked⚑ inherited |
| Qwen3-32BPRC · Apache-2.0 · base model | Review⚑ inherited |
| plant-sop-70bUS · Apache-2.0 (as claimed) · fine-tune of DeepSeek-R1-Distill-Llama-70B | Blocked⚑ inherited |
Nuclear · Blocked: Non-commercial, Llama AUP · Review: PRC origin, Custom licence
RG 5.71 · IAEA NSS 17-T · NIS2
What a plant's cyber team will ask of the box.
Each row maps a requirement to the control designed for it and the evidence it leaves for your cyber security plan.
- RG 5.71 · Defensive levels
Communication from lower levels into the protected levels passes a one-way device, or the assets are air-gapped.
The appliance opens no connection at all. It sits below the boundary, needs nothing from above it, and has no remote-access service.
Evidence you take awayEgress audit report; listening-services manifest per release (planned)
- Plant media process
Every file that arrives on media passes the plant's own scanning and approval.
An update is one signed bundle that passes the kiosk as a file. The import station then verifies it and re-signs it with the site key.
Evidence you take awayBundle digests to match against the kiosk log; signature verification transcript
- IAEA NSS 17-T · Levels and zones
Systems are protected in a graded way, by computer security level and zone.
One appliance per zone, holding only the documents cleared for it. Two zones means two boxes, never a bridge between them.
Evidence you take awayZone record and trust-store listing per appliance
- Model licence
The model's licence permits nuclear use, and so does the licence of every model it was trained from.
The catalog blocks models whose licence forbids nuclear use, along their fine-tune lineage, before a bundle is built.
Evidence you take awayLicence and lineage record per model in the AI-BOM
- NIS2 Art. 21 · Supply chain
Supply-chain security, and vulnerability handling in acquisition and maintenance.
SBOM and AI-BOM per release, signed provenance, published CVE scans and an emergency channel for actively exploited flaws.
Evidence you take awaySBOM, AI-BOM and provenance per release; release ledger
Defensive-level, media, zoning, licence and supply-chain requirements mapped to appliance controls.
The NRC has not drafted AI-specific guidance, and the EU network code's supply-chain controls are still to be proposed. We will map both when they are published, and until then we make no claim about what they will require.
Test it
Bring your cyber security plan to a pilot.
Tell us which level and zone you would put the box in, and what your media process checks. The pilot runs on your hardware, inside your wall, against that list.