The Known Safe State

Adoption is broad, evidence of benefit is absent, transparency is a policy promise, and the cyber assurance framework that covers critical infrastructure has nothing in it about AI at all. Government has adopted artificial intelligence at scale ahead of any evidence that it works, and the transparency machinery that is supposed to supply public legitimacy is a policy commitment rather than a legal duty, with 152 published records across a state that runs thousands of services. Critical infrastructure adds a harder problem, because a service that cannot go offline needs a defined condition to fall back to and a workforce that has practised operating in it. This paper argues that the safe state is the deliverable. Write down what the service does when the model is withdrawn, rehearse it, measure how long it takes, and the rest of the assurance apparatus has something real to attach to. Skip it, and every other control is a document.