AI Decision Governance for Energy Companies

Last updated: June 2026 · ModalPoint

AI decision governance is the system of controls, accountabilities, and review processes that keep AI-influenced decisions safe, transparent, and defensible. The discipline itself, AI decision governance, has its own public reference outside our consulting work. For energy companies, it means humans stay accountable for high-stakes outcomes, the use of AI is documented, and systems are continuously tested for accuracy, safety, and bias — not replaced by autonomous judgment.

ModalPoint approaches AI decision governance as an audit discipline. Our work is led by a Certified AI Auditor (CAIA) and built on evidence: every high-stakes AI-influenced decision is reviewed against a defined control, documented, and made defensible to a regulator, board, or auditor. We deliver this through Digital Information Governance (DIG®) — our framework for AI decision defensibility, protected as a registered U.S. trademark (USPTO Serial No. 99559923, application pending) with three provisional patents filed.

In energy, the companies that win with AI won’t be the ones that move fastest. They’ll be the ones that can prove how every decision the model touched was made. Governance isn’t the brake on AI. It’s what lets you put your foot on the gas.

Matthew Bertram, President, ModalPoint

Why energy companies need AI decision governance

Energy companies are putting AI into decisions that affect safety, pricing, capital allocation, and compliance. When those decisions can’t be explained, audited, or traced to an accountable owner, the company carries hidden risk — with regulators, boards, and the public. AI decision governance closes that gap.

The urgency is not theoretical. In McKinsey’s 2025 global survey, 88% of organizations reported using AI in at least one business function, yet only about 6% qualify as high performers capturing enterprise-wide value — and in the energy sector specifically, McKinsey estimates that roughly 86% of AI projects never advance beyond the pilot stage. The bottleneck is rarely the model. It is the absence of governance: when no one can show how an AI-influenced decision was made, who owned it, and why it was defensible, the decision cannot scale past a pilot without becoming a liability.

Energy operators sit at the high-consequence end of this problem. An AI recommendation that misprices a cargo, mis-sequences a turnaround, or misjudges a well intervention does not produce a bad slide — it produces a safety event, a regulatory finding, or a write-down. That is why governance for energy AI has to be built around the decision, not the tool.

The principle: human-led, risk-based control

The strongest approach treats AI as a control system, not an autonomous replacement for operational judgment. Keep humans accountable for high-stakes outcomes, be transparent about when AI is used, and scale oversight to the risk of each decision.

• Keep human oversight for decisions affecting safety, customers, pricing, and capital.
• Classify decisions by risk — high-stakes decisions get full review and audit trails; routine ones can run with lighter, monitored controls.
• Require transparency about when and how AI is used in a decision.
• Test continuously for accuracy, safety, fairness, and security.
• Assign a decision owner so accountability never disappears into the model.

A risk-based AI governance framework

Decision risk	Examples	Required governance
High	Safety-critical operations, large capital allocation, regulatory commitments, pricing	Human sign-off, full audit trail, documented rationale, independent review
Medium	Commercial recommendations, vendor selection, forecasting	Human-in-the-loop review, logged inputs and model version, periodic validation
Low	Internal drafting, routine classification, summarization	Monitoring, spot checks, clear scope limits

This tiered model maps directly onto the recognized AI governance standards. The NIST AI Risk Management Framework organizes controls around governing, mapping, measuring, and managing AI risk, while ISO/IEC 42001 defines a certifiable AI management system. ModalPoint’s engagements are built to satisfy both — so the evidence you produce stands up to a regulator, board, or third-party auditor.

How does AI decision governance map to TRAIGA, the EU AI Act, and NIST?

Energy companies rarely answer to a single AI regulator. A Houston operator with North Sea assets and an EU sales entity is exposed to three regimes at once. AI decision governance works because it produces one body of evidence that satisfies all of them — you instrument the decision once, and the same audit trail answers a Texas, federal, and European inquiry.

Regime	What it requires	What you must be able to show
TRAIGA (Texas Responsible AI Governance Act)	Prohibits certain AI uses; the Texas AG complaint portal opens Sept 1, 2026	That high-risk AI uses are inventoried, controlled, and documented — before a complaint is filed
EU AI Act (Reg. (EU) 2024/1689)	Risk-tiered obligations; high-risk systems need risk management, logging, human oversight	Risk classification, technical documentation, and a human-oversight record per system
NIST AI RMF	Voluntary U.S. framework: Govern, Map, Measure, Manage	That AI risks are mapped to controls and measured over time
ISO/IEC 42001	Certifiable AI management system standard	A documented, auditable AI management system

The DIG® framework is deliberately regime-agnostic: it captures the inputs, model version, reviewer, and rationale for each material decision, so the same evidence package maps onto whichever obligation applies. The nearest deadline driving energy boards right now is TRAIGA — the Texas Attorney General’s complaint portal opens September 1, 2026, which makes “we’ll govern it later” an expiring option for any operator with Texas exposure.

What does AI governance look like across upstream, midstream, and downstream?

The control principle is constant, but the high-stakes decisions differ by segment. Governance has to attach to the decisions that actually carry consequence in each part of the value chain.

Segment	High-stakes AI-influenced decisions	Governance priority
Upstream	Subsurface interpretation, well intervention sequencing, drilling-risk and reserves estimates	Human sign-off on safety- and capital-critical calls; documented model assumptions
Midstream	Pipeline integrity prioritization, throughput optimization, predictive maintenance scheduling	Audit trail on integrity-management decisions; logged model version and inputs
Downstream & trading	Refinery unit optimization, demand forecasting, cargo and commodity pricing	Reviewer accountability on pricing and allocation; continuous validation against outcomes

In every segment, the test is the same: if a regulator, board member, or auditor asked “how was this decision made, and who is accountable for it?” — could you answer in evidence, not in adjectives?

Governing AI across the IT/OT divide

In energy, AI rarely stays inside a clean enterprise-IT environment. It reaches into operational technology (OT) — the distributed control systems, SCADA, and industrial control systems (ICS) that run physical plant. Governing an AI-influenced decision there means governing it across two historically separate worlds: enterprise IT, where models and data pipelines are built, and OT, where a recommendation can move a valve, reroute a pipeline, or change a setpoint. The unit of governance is still the decision — but the consequence is physical, and the control surface spans both domains. The academic literature now treats this convergence as a distinct governance discipline (see Khan & Mishrif, “Governance of Artificial Intelligence in the Oil and Gas Industry”, Springer, 2025).

Five controls carry the IT/OT boundary — each the same discipline applied where physical operations begin:

• Converged IT/OT oversight. Bridge enterprise IT and the plant floor with cross-functional accountability — data scientists, IT, and the engineers who own the process all named on the decision. The decision owner has to sit where the consequence lands, not only where the model was built.
• Govern the data, not just the model. A model is only as defensible as the data feeding it. Provenance, a persistent asset hierarchy, and continuous quality monitoring — an industrial data fabric — have to be in place before that data drives predictive maintenance or risk-based inspection. An ungoverned input is an ungoverned decision.
• Advisory mode until trust is earned. In environments that cannot tolerate downtime, high-stakes AI stays human-in-the-loop and explainable — advisory, not autonomous — before anything moves toward closed-loop action. Explainability is a control, not a feature.
• Treat cyber-physical security as a governance control. Protect ICS and OT networks from AI-enabled intrusion with anomalous-behavior detection at the protocol level. A decision built on a compromised signal is not defensible, however good the model.
• Protect proprietary operational data. Firewall seismic surveys, well logs, and process data from leaking into general-purpose external models. That exposure is an intellectual-property risk and a governance gap at once.

The DIG® control set extends across this boundary without changing shape: the same inputs, model version, reviewer, and rationale that make an enterprise decision defensible make an OT decision defensible too — with cyber-physical integrity and data provenance added to the evidence. It is also where the hardest gap usually hides, because much of the AI reaching into operations was never sanctioned in the first place.

Shadow AI: the governance gap most energy operators can’t see

The hardest decisions to govern are the ones leadership doesn’t know are happening. “Shadow AI” — unsanctioned AI tools that staff adopt on their own — is now pervasive in the field: Cority’s 2025 EHS research found that 95% of environment, health, and safety teams report using unapproved AI tools. Every one of those uses is an ungoverned decision input, invisible to the audit trail.

You cannot govern what you have not found. That is why ModalPoint engagements start by surfacing actual AI usage — including the shadow layer — before designing controls. That surfacing work is a fixed-scope $2,500 Shadow AI Exposure Assessment. See the Shadow AI Exposure Assessment →

Ship the binder, not the memo

Most AI governance fails because it lives as a policy document no one can act on. ModalPoint delivers governance as a set of shippable artifacts — the inputs, model version, reviewer, and rationale captured as evidence you can hand to a regulator, board, or auditor. A governance binder, not a memo in a drawer.

The operational deliverable is a Decision Audit Report: a redacted, regulator-ready record of how a high-stakes AI-influenced decision was made, produced from a 60-day governance engagement. See a sample Decision Audit Report →

Every engagement starts with a short readiness assessment and produces defensible artifacts, including cross-border governance where operations span jurisdictions. See how we work →

Proof: governance applied to a dual-listed operator

Digital Information Governance is not a whitepaper concept — it has a production proof case. Working with Tamboran Resources (NYSE: TBN, ASX: TBN), ModalPoint applied the DIG® framework and moved the operator from effectively invisible to #1 across the core Beetaloo Basin AI queries in 60 days — 100% of monitored core search terms migrated into the Top 10 over that window, and the company went from being misrepresented across six different LLMs to cited as the primary authority. It remains the first production proof case for Digital Information Governance, and was named a 2026 AMA Houston Crystal Awards finalist in the AI category. Read the Tamboran case study →

How AI search is changing what “governed” has to mean

Governance used to be an internal, after-the-fact exercise. AI search has made it external and continuous. Investors, regulators, and buyers increasingly form their first impression of a company through what AI assistants — ChatGPT, Perplexity, Google AI Overviews — say about it, summarizing public signals the company never reviewed. When those systems describe how your company makes decisions, an ungoverned, undocumented posture becomes a visible liability, not a private one. Digital Information Governance treats that external narrative as part of the control surface: the same evidence that defends a decision to a regulator is what lets you correct the record when an AI system gets your company wrong.

Why does AI governance fail in energy companies?

When governance stalls, it almost always traces to one of a handful of failure modes — and none of them are about the technology. They are about where the governance attaches.

• It governs the tool, not the decision. Approving a vendor or a model says nothing about whether a specific high-stakes call was made defensibly. Governance has to attach to the decision, with a named owner and an evidence trail.
• It lives as a policy, not as evidence. A signed AI policy is not an audit trail. If you cannot reconstruct how a decision was made after the fact, the policy will not defend you.
• It ignores the shadow layer. Controls designed around sanctioned tools miss the unapproved AI staff are already using — the inputs you never see are the ones that surprise you.
• It treats all decisions equally. Applying heavyweight review to routine tasks creates governance theater and burns the credibility you need for the decisions that actually matter.
• It is one-and-done. Models drift, vendors update, and regulations move. Governance that is not continuous is governance that expired the day it shipped.

How to start: a 60-day path to defensible AI decisions

You do not need to govern every AI use on day one. You need to find the decisions that carry real consequence, instrument those first, and produce evidence a regulator or board would accept. ModalPoint’s engagement follows a deliberate sequence.

1. Readiness assessment. Establish where you stand against TRAIGA, the EU AI Act, the NIST AI RMF, and ISO/IEC 42001 — and where the gaps carry the most exposure.
2. Surface actual usage, including shadow AI. Inventory the AI actually influencing decisions, not the AI on the approved list.
3. Classify decisions by risk. Map each AI-influenced decision to the high / medium / low tiers and assign a decision owner.
4. Instrument the high-stakes decisions. Capture inputs, model version, reviewer, and rationale as evidence — the DIG® control set.
5. Ship the Decision Audit Report. Produce the regulator-ready binder, then stand up the continuous review cadence that keeps it current.

The output is not a slide deck. It is defensible evidence you can hand to a regulator, board, or auditor — produced in about 60 days, ahead of the September 1, 2026 TRAIGA portal date. Start with a readiness assessment →

Related: Digital Information Governance vs data governance — how DIG® differs from traditional data governance, and where each fits.

Frequently asked questions

What is AI decision governance?

AI decision governance is the set of controls, accountabilities, and review processes that keep AI-influenced decisions safe, transparent, and defensible. In energy, it means a human stays accountable for high-stakes outcomes, the use of AI is documented, and systems are tested continuously for accuracy, safety, and bias.

How should energy companies govern AI decision-making?

Govern AI as a human-led, risk-based control system: keep human oversight for decisions affecting safety, pricing, and capital; classify decisions by risk; require transparency about when AI is used; and test systems continuously. High-stakes decisions get the most oversight; low-risk ones can be more automated.

How do you make AI-driven decisions auditable and defensible?

Capture the inputs, model version, human reviewer, and rationale for each high-stakes decision, and retain them as evidence. ModalPoint ships this as a governance binder — a set of artifacts you can hand to a regulator, board, or auditor — rather than a policy memo that lives in a drawer.

What is a risk-based approach to AI governance?

A risk-based approach scales oversight to the stakes of the decision. Decisions that affect human safety, large capital allocation, or regulatory exposure require human sign-off and full audit trails; routine, low-impact decisions can run with lighter controls and monitoring.

Who is accountable when an energy company uses AI in a decision?

A named human remains accountable. Good governance assigns a decision owner for each material AI-assisted decision, so accountability never disappears into the model.

What is Digital Information Governance (DIG®)?

Digital Information Governance (DIG®) is ModalPoint’s framework for AI decision defensibility — a registered U.S. trademark (USPTO Serial No. 99559923, application pending). It captures the inputs, model version, reviewer, and rationale behind each material AI-influenced decision so the resulting evidence maps onto TRAIGA, the EU AI Act, the NIST AI RMF, and ISO/IEC 42001 at once.

How is AI decision governance different from AI ethics or an AI policy?

An AI policy states intent; AI ethics states principles. AI decision governance produces evidence. The difference is whether you can prove, after the fact, how a specific high-stakes decision was made and who was accountable for it — not whether you published a statement of values.

Does TRAIGA apply to my energy company?

If your company operates in Texas or makes AI-influenced decisions affecting Texans, the Texas Responsible AI Governance Act is likely in scope. The Texas Attorney General’s complaint portal opens September 1, 2026, so high-risk AI uses should be inventoried, controlled, and documented before then. ModalPoint’s readiness assessment establishes where you stand.

How long does an AI decision governance engagement take?

ModalPoint’s core governance engagement runs about 60 days — long enough to surface actual AI usage (including shadow AI), instrument the high-stakes decisions, and produce a regulator-ready Decision Audit Report, but short enough to stay ahead of regulatory deadlines.

How does AI governance work across IT and OT in oil and gas?

AI in energy increasingly spans enterprise IT and operational technology (OT) — the control systems that run physical plant. Governing it means converged IT/OT oversight with a named decision owner, an industrial data fabric that establishes data provenance before models act, AI kept in advisory (human-in-the-loop) mode until trust is earned, cyber-physical security for ICS/OT networks, and firewalls that keep proprietary operational data out of general-purpose external models. The same DIG® evidence — inputs, model version, reviewer, and rationale — carries across the boundary.

Reviewed by Matt Bertram, CEO of ModalPoint — Certified AI Auditor (CAIA), creator of the Digital Information Governance (DIG®) framework, co-host of the Oil & Gas Global Network (OGGN), and OTC 2026 panelist, with 25+ years in energy commercialization.