1. Regulatory and Compliance Framework
Nuclear operations sit inside the most prescriptive regulatory perimeter of any industrial sector, and the introduction of AI-enabled autonomous management adds a second perimeter that is still being constructed. The first regime is the U.S. Nuclear Regulatory Commission framework. 10 CFR Part 50 Appendix A (General Design Criteria for Nuclear Power Plants) imposes the protection-system independence requirement (Criterion 22), the protection-system reliability and testability requirement (Criterion 21), and the single-failure tolerance requirement that has historically been satisfied by hard-wired analog instrumentation. 10 CFR 50.55a(h) incorporates IEEE Std 603 ("Standard Criteria for Safety Systems for Nuclear Power Generating Stations") by reference, which governs the qualification of digital instrumentation and control systems. 10 CFR Part 73 governs physical security and cybersecurity, with NRC Regulatory Guide 5.71 providing the implementation guidance for cybersecurity programs at nuclear facilities.
Regulatory Guide 1.152 ("Criteria for Use of Computers in Safety Systems of Nuclear Power Plants") is the central regulatory document for digital safety systems and explicitly addresses the lifecycle, qualification, and cybersecurity requirements for digital protection systems. NUREG/CR-6303 ("Method for Performing Diversity and Defense-in-Depth Analyses of Reactor Protection Systems") and NUREG-0800 (Standard Review Plan) Chapter 7 govern the review of instrumentation and control systems. The NRC's emerging position on AI in nuclear applications, articulated in the 2023 "NRC Artificial Intelligence Strategic Plan" and the 2024 "Strategic Plan for Use of Artificial Intelligence", indicates that high-consequence AI applications will require the same defense-in-depth, diversity, and human-oversight properties as traditional digital I&C, and that machine-learning systems must demonstrate predictability and reproducibility under licensing.
The second regime is the IAEA framework. IAEA Safety Standard SSR-2/1 (Safety of Nuclear Power Plants: Design) and SSG-39 (Design of Instrumentation and Control Systems) impose the international floor for protection-system architecture. IAEA TECDOC-1762 addresses computer-based systems important to safety. The IAEA's 2024 work on AI in nuclear applications follows the same architectural pattern as the NRC: AI is permissible in defense-in-depth layers when it does not undermine the qualified protection system, and human oversight must remain structurally enforceable.
The third regime is NIST. NIST SP 800-82 Revision 3 (Guide to Operational Technology Security) governs OT cybersecurity in industrial sectors including nuclear; NIST SP 800-53 controls map into the cybersecurity-program requirements of 10 CFR 73.54. The NIST AI Risk Management Framework (AI RMF 1.0) and the Generative AI Profile provide the federal baseline for AI risk management that NRC guidance increasingly references for AI-in-safety contexts. The fourth regime is the EU AI Act. Annex III point 2 classifies AI systems used in the management and operation of critical infrastructure (including nuclear) as high-risk, triggering Article 9 risk-management, Article 10 data-governance, Article 13 transparency, Article 14 human-oversight, Article 15 accuracy and robustness, and Article 17 quality-management obligations. Article 14 specifically requires that human-oversight measures enable natural persons to intervene in or interrupt operation, which is the architectural property the graduated state described below supplies between normal operations and trip.
ISO/IEC 27001:2022 applies to nuclear-operator information-security management systems, and IEC 61513 (Nuclear power plants, Instrumentation and control important to safety) and IEC 62645 (Nuclear power plants, Instrumentation, control and electrical power systems, Cybersecurity requirements) provide the international technical floor.
2. Architectural Shape
The architectural shape described here, situated against the cumulative regulatory floor between normal automated operations and emergency protection, has six properties. First, the described system computes a continuous confidence state from multiple independent inputs, consistent with IEEE 603 single-failure tolerance and NUREG/CR-6303 diversity analysis, under which no single sensor, model, or input class determines the operational posture. Second, the confidence-driven pause is structurally distinguishable from the qualified protection-system trip, so that under NRC Regulatory Guide 1.152 and IEEE 603 the protection system retains its independence and qualification.
Third, the described system produces graduated authorization states rather than a single permit-or-trip decision, resolving into an authorized state, a suspended state that pauses execution while cognition continues, and a locked state reserved for governance-mandated halts, which is the form in which EU AI Act Article 14 human-oversight obligations become operable and the form of graduated authority allocation between AI and human operators that the NRC AI Strategic Plan contemplates. Fourth, recovery from the paused state proceeds by hysteretic re-establishment of confidence above a higher threshold than the pause threshold, since oscillation at a single threshold is itself a hazard category under SSG-39 and NUREG-0800 Chapter 7.
Fifth, each confidence-state transition is recorded as a credentialed observation in an audit-grade lineage chain, aligning with NRC license-condition reporting, IAEA SSR-2/1 documentation, and EU AI Act Article 12 logging obligations, all of which call for reconstructable provenance. Sixth, the described system composes hierarchically across unit, station, and operator-fleet scopes, matching the authority taxonomies of operator coalitions, multi-unit sites, and small-modular-reactor fleets. What the disclosed substrate contributes is the layer that ties these six properties together as structural conditions.
3. The Degraded-Confidence Region
Nuclear safety systems are designed around binary logic: if a measured parameter exceeds a limit, the protection system activates. This approach is essential and will remain the foundation of nuclear safety. But between normal operations and emergency shutdown lies a region of degraded confidence where the autonomous management system is uncertain about conditions but no single parameter has breached a safety limit.
In this region, a binary trip architecture continues normal operations because no trip condition has been met, and the determination passes to the operator, who may notice the accumulating anomalies and intervene. The ambiguous region between clearly safe and clearly unsafe is where the most consequential operational decisions are made, because the system is operating with reduced confidence but full authority. The historical accident record, Three Mile Island, Davis-Besse, Forsmark, repeatedly shows that the failure mode is not a missed trip but a continuation of operations through a degraded-confidence window carried by procedure rather than by a first-class architectural state.
Procedural compensation for this gap takes the form of operator procedures, technical specifications, and limiting conditions for operation. Operators are trained to pause discretionary maneuvers when instrumentation is suspect; technical specifications require entry into limiting conditions when surveillance requirements cannot be met; abnormal-operating procedures cover named degraded-instrumentation scenarios. These procedural overlays place the determination with the operator: they proceed from the operator perceiving the confidence degradation in the first place, and the human-factors literature documents that mode confusion, automation complacency, and alarm flooding bear on that perception in exactly the conditions where the procedures are invoked.
Confidence governance addresses this region by computing a continuous confidence state from multiple inputs: sensor agreement, model prediction accuracy, equipment health indicators, environmental conditions, and historical anomaly patterns. When the composite confidence drops below a safety threshold, the autonomous system enters non-executing mode, pausing discretionary operations without triggering emergency shutdown.
Machine-learning governance approaches are organized along a different axis. Confidence-thresholded inference (refuse when softmax probability is below a threshold) operates per decision, yielding an abstention at the point of inference rather than a system-level posture distinct from a refusal. Anomaly-detection overlays are organized around alerts routed to human operators for triage, which returns the determination to operator perception. EU AI Act Article 14 human-oversight obligations are framed around the ability to interrupt operation, which presupposes a structural state to interrupt to.
4. What the Confidence-Governance Primitive Provides
Confidence Governance, disclosed in United States Patent Application 19/647,395 as the confidence governor of Chapter 5, specifies confidence as a first-class computed state variable produced by a composite evaluation function over agent-state and task-state inputs. Applied to a nuclear management context, those inputs are credentialed observations drawn from sensor agreement, model-prediction accuracy, equipment-health indicators, environmental signals, and historical anomaly patterns, each carried within a published authority taxonomy. The confidence state is not advisory: it is a first-class architectural variable that the system, the operator, and the regulator can reason about, and the disclosed governor enforces it as a hard gate that, in the described embodiments, is not overridden by the system's own self-assessment or by operational pressure.
Non-executing mode is not a shutdown. It is a governed state where the autonomous management system continues to monitor, analyze, and recommend but stops executing discretionary operational changes. Power level adjustments, fuel management operations, maintenance scheduling, and load-following maneuvers are paused. The system continues to monitor safety-critical parameters and will activate emergency protection systems if hard limits are breached. The qualified protection system retains its independence and qualification under IEEE 603 and Regulatory Guide 1.152; the confidence-governance layer sits architecturally between normal operations and protection, supplying a graduated state between the two.
In non-executing mode, the system enters an inquiry posture. It actively investigates the source of confidence degradation: which sensor inputs are anomalous, which model predictions are diverging from observations, which equipment health indicators are declining. This investigation occurs structurally rather than depending on an operator to diagnose the source of the anomaly. Each diagnostic finding is recorded as a credentialed observation that re-enters the chain as evidence for the recovery decision.
Execution authorization gating resolves into three states. In the authorized state, the confidence value is above the authorization threshold and the trajectory triggers no alarm, and discretionary operations proceed. In the suspended state, the confidence value has fallen below the authorization threshold or the trajectory has triggered a pre-emptive suspension, and execution is structurally prohibited while cognition continues. In the locked state, reserved for a severe integrity violation, a catastrophic resource failure, or a governance-mandated halt, both execution and certain cognitive processes are restricted pending external review and the agent cannot self-recover. For a nuclear deployment these map respectively to normal autonomous management, a confidence-driven operational pause, and a governance hold that requires operator or regulator clearance to lift.
The withdrawal of execution authority is not implemented as a flag the control loop checks and optionally respects; it is a structural decoupling of the execution subsystem's output pathway, so the subsystem cannot commit discretionary changes regardless of its internal state or the urgency of intent. The transition to the suspended state is immediate when confidence drops below the threshold or when the trajectory alarm fires. There is no delay for confirmation and no override for convenience: in the described embodiments the threshold is a structural property of the governor and is not subject to override by operational pressure to maintain power output or meet production schedules. This is the EU AI Act Article 14 human-oversight property expressed structurally: the human can resume, but the system can pause, and the pause is not subject to commercial override.
A system that pauses at a confidence threshold and resumes at the same threshold will oscillate when confidence fluctuates near the boundary. Recovery of execution authorization addresses this by requiring the confidence value to exceed the authorization threshold by a configurable hysteresis margin before the agent transitions back from suspended to authorized. The resume threshold is therefore meaningfully higher than the pause threshold, and the system must demonstrate sustained confidence recovery before resuming autonomous operations. This asymmetry is deliberate. Entering non-executing mode should be easy: any confidence degradation below the threshold triggers the pause. Resuming operations should be harder: the system must not only resolve the condition that caused the confidence drop but demonstrate that confidence has been restored with margin.
The confidence trajectory is also projected, not only its instantaneous value. The governor characterizes confidence through opposing decay and recovery processes and analyzes the rate of change, so a rapid confidence decline can trigger a trajectory-based pre-emptive suspension earlier than a gradual decline even when both are approaching the same threshold. This forward projection detects situations where confidence is falling fast enough that waiting for the threshold breach may not leave sufficient margin for a safe transition. The governor is technology-neutral with respect to the underlying inference and signal-processing techniques, and through parent-to-child confidence propagation it composes hierarchically across unit, station, and fleet scopes.
5. Compliance Mapping
Against 10 CFR Part 50 Appendix A and IEEE Std 603, the confidence-governance layer is architecturally separate from the qualified protection system and does not undermine its independence, single-failure tolerance, or qualification. The protection system retains its trip authority; the confidence-governance layer adds a graduated state above protection rather than replacing it. Against NRC Regulatory Guide 1.152, the confidence-state computation, threshold logic, and lineage record are auditable as digital safety-system functions with reproducible behavior.
Against NUREG/CR-6303 diversity-and-defense-in-depth analysis, the multi-input confidence computation is itself a diversity-providing layer between normal operations and protection, with credentialed observations from heterogeneous sensor classes, prediction models, and equipment-health subsystems. Against the NRC AI Strategic Plan, the architecture provides the predictability, reproducibility, and human-oversight properties the Plan specifies as preconditions for AI deployment in safety-relevant contexts.
Against IAEA SSR-2/1 and SSG-39, the confidence-governance layer is a defense-in-depth element with documented design basis, qualification, and surveillance. Against IEC 61513 and IEC 62645, the substrate provides the credentialed-observation chain that satisfies cybersecurity-relevant logging and integrity requirements.
Against the EU AI Act Annex III point 2 critical-infrastructure high-risk classification, the architecture provides the Article 9 risk-management documentation (the confidence-state design basis), the Article 10 data-governance trail (the credentialed-observation lineage), the Article 13 transparency property (the confidence state is exposed and explainable), the Article 14 human-oversight property (the operator can resume but cannot suppress the pause), the Article 15 accuracy-and-robustness property (the multi-input aggregation and hysteresis are robustness measures), and the Article 17 quality-management trail (the lineage chain).
Against NIST SP 800-82 R3 and SP 800-53, the architecture provides the OT-relevant logging, integrity, and access-control evidence in a credentialed structural form rather than as procedural overlay. Against ISO/IEC 27001:2022, the lineage chain satisfies Annex A logging and monitoring controls.
The confidence computation is auditable. Regulators can examine the inputs, weights, and thresholds that govern the confidence state. The transition to non-executing mode is logged with the confidence state and the specific inputs that drove the degradation. Recovery is logged with the evidence that supported resumption. The entire confidence governance lifecycle is available for regulatory review.
6. Adoption Pathway
For nuclear operators, confidence governance provides a governance layer between normal automated operations and emergency protection systems. It addresses the operational region where conditions are degraded but not yet dangerous, the region where human operators have historically made errors by continuing to operate with insufficient confidence. The deployment is a defense-in-depth addition rather than a protection-system change, which materially simplifies the licensing pathway: 10 CFR 50.59 evaluation, NRC topical-report submission, and inspection under the existing reactor oversight process.
For the nuclear industry moving toward greater automation of plant management, small modular reactors with reduced staffing, advanced reactors with longer fuel cycles, fleet operations centers, and load-following operations under deepening renewable penetration, confidence governance provides a structural safety primitive under which automation operates within declared confidence bounds rather than at full authority by default. The autonomous system operates with full authority only when its confidence is high. When confidence degrades, authority is revoked and must be re-earned through demonstrated recovery.
The adoption pathway is staged. First, deploy the confidence-governance substrate as a non-safety advisory layer producing graduated-outcome recommendations to the operator and to the existing automation, with the recommendations logged in a credentialed lineage chain that supports regulatory review. Second, integrate the substrate with discretionary-control loops (load-following, condensate-polishing, secondary-side optimization) under a license-amendment or 50.59 evaluation that authorizes the non-executing-mode pause as a structural property of those loops. Third, extend the substrate to advanced-reactor and SMR fleet-operations contexts where reduced staffing and load-following requirements make graduated authority allocation a licensing precondition rather than a feature.
Each stage produces compliance-relevant evidence, NRC inspection findings, INPO peer-review observations, IAEA OSART mission outputs, EU AI Act conformity-assessment artifacts, that supports the next. The endpoint is a nuclear automation architecture in which the qualified protection system retains its trip authority, the operator retains the resume authority, and the substrate provides the graduated state between them that satisfies NRC, IAEA, NIST, and EU AI Act obligations simultaneously because the architectural floor was raised by the substrate rather than papered over by procedure.
7. Disclosure Scope
The confidence-governance mechanisms described in this article (confidence as a first-class computed state variable, the composite evaluation function over agent-state and task-state inputs, trajectory projection and pre-emptive suspension into a non-executing cognitive mode, the three authorization states of authorized, suspended, and locked, structural decoupling of the execution pathway, and hysteretic recovery of execution authorization) are disclosed in United States Patent Application 19/647,395. The nuclear-operations problem framing, regulatory mapping, and staged adoption pathway are an enabling application of that disclosed technology to nuclear facility management; the regulatory frameworks cited are external to the application and are referenced only to situate the deployment. This article is published as a dated, enabling public disclosure of that application and its embodiments across single-unit, multi-unit, small-modular-reactor, and fleet-operations scopes.
