The U.S. government is working with critical infrastructure operators to integrate AI into vital systems and strengthen cybersecurity, National Cyber Director Sean Cairncross said September 29 at a USTelecom event. 

According to a CyberScoop report, Cairncross said organizations need visibility into the AI agents running on those systems and across their supply chains, including how they are authorized, what they can access and where they operate. 

Cairncross said the government also identified replacing aging and unsupported systems as an important part of improving cybersecurity.

Jonathan Spalter, CEO of USTelecom, said the effectiveness of AI models embedded in critical infrastructure has increased significantly in recent months. As these models become more capable, organizations need to understand how they interact with operational systems and the data those systems hold.

AI Agents Bring Data Access Into the Governance Model

For chief data officers (CDOs), Cairncross’s comments underscore the need to extend existing AI governance practices to agentic AI. Organizations need to define what data agents can access, how they are authorized and who is accountable for their activity.

CDOs can work with security, technology and business teams to establish access requirements, review permissions and monitor how agents use data across workflows. These controls become particularly important when agents operate across multiple systems or connect to third-party services.

Cairncross’s reference to AI agents in the supply chain also raises questions about third-party access to organizational data and systems. CDOs need visibility into those connections to understand where data is being accessed and how responsibility is shared between the organization and its providers.

As AI adoption expands into critical infrastructure, data access, agent oversight and accountability will need to be addressed together. AI governance can help organizations define those responsibilities as AI becomes part of operational systems.