Artificial intelligence is rapidly becoming an integral part of the energy and infrastructure economy. Algorithms are used to predict electricity generation from wind and solar power, optimize power grid operations, conduct preventive maintenance on industrial plants, manage energy storage systems, detect pipeline leaks, monitor emissions, and control traffic flow. In the field of natural resources, AI is applied to geological exploration, reserve estimation, mine management, satellite imagery processing, forest and water monitoring, as well as predicting floods, wildfires, and other environmental risks.<\/p>\n\n\n\n
The benefits are clear: reduced costs, better demand forecasting, higher energy efficiency, earlier fault detection, and more precise resource management. However, linking algorithmic decision-making to public infrastructure raises numerous legal questions. A system managing a power grid, dam, water supply network, waste processing plant, or railway infrastructure can cause supply disruptions, property damage, pollution, or endanger human lives.<\/p>\n\n\n\n
Therefore, the legal framework for the use of artificial intelligence in these sectors must be viewed as an interplay of rules on AI systems, energy law, environmental protection, construction, concessions, public procurement, cybersecurity, data protection, product safety, and contractual liability.<\/p>\n\n\n\n
AI Systems as Part of Critical Infrastructure<\/strong><\/p>\n\n\n\n One of the first questions is how to legally classify a specific AI system. The European AI Act is based on a risk-based approach. Particularly strict rules are prescribed for high-risk systems, including certain systems intended for the management and operation of critical digital infrastructure, road traffic, as well as the supply of water, gas, heating, or electricity, where their failure could seriously endanger human life, health, or safety. The AI Act also has a significant extraterritorial reach: it can apply to providers and deployers outside the EU if the output generated by their system is used within the European Union.<\/p>\n\n\n\n However, not every algorithm in an energy company is automatically high-risk. A system that forecasts monthly administrative costs is fundamentally different from a system that automatically balances grid load or determines when to shut down a facility. A legal assessment must take into account the system's intended purpose, its level of autonomy, the significance of its output data, and the potential consequences of an incorrect decision.<\/p>\n\n\n\n For high-risk systems, risk management, data quality, technical documentation, automatic event logging, transparency to users, human oversight, accuracy, robustness, and cybersecurity are particularly crucial. In practice, this means an energy or infrastructure company should not acquire an AI solution as a standard off-the-shelf software package. Prior to deployment, it must determine who the manufacturer or provider of the system is, the intended purpose for which it was developed, whether a proper conformity assessment has been conducted, and what obligations the company assumes if it modifies the system or changes its intended purpose.<\/p>\n\n\n\n A company that substantially modifies a system or uses it outside its originally intended purpose can shift from being a mere deployer to assuming the role of a provider, carrying significantly broader regulatory obligations. This is especially important when internal engineering teams fine-tune a purchased model and connect it to equipment that controls physical processes.<\/p>\n\n\n\n Liability for Algorithmic Decisions<\/strong><\/p>\n\n\n\n The most crucial legal question is: who is liable when an AI system makes a mistake? Potential participants include the model developer, the software vendor, the system integrator, the sensor manufacturer, the infrastructure operator, the maintenance contractor, and the employee who accepted or ignored the algorithm's recommendation.<\/p>\n\n\n\n The answer depends on the cause of the damage. If the problem lies in a defective model, liability may rest with the vendor. If sensor data were inaccurate due to poor maintenance, the operator or service technician may be liable. If the model was functioning correctly but used for an unintended purpose, liability shifts closer to the user. If the system issued a hazard warning and the person responsible ignored it, the distribution of liability shifts once again.<\/p>\n\n\n\n Proving liability presents a particular challenge. The damaged party often lacks access to the source code, training data, operational logs, and information regarding model modifications. Without such data, it is difficult to determine whether the damage resulted from a design flaw, erroneous input data, a cyberattack, or an operator decision. Consequently, technical records and audit trails are legally almost as significant as the algorithm itself.<\/p>\n\n\n\n Contracts must regulate the obligation to retain logs, access data post-incident, cooperate in expert evaluations, and prohibit the deletion of relevant records. A clause in which a vendor merely states that the system is provided “as is” is unacceptable when the solution is used in a vital facility. Specific guarantees regarding purpose, performance, accuracy, availability, integration, cybersecurity, and regulatory compliance are required.<\/p>\n\n\n\n Limitations of liability must also be tailored to the actual risk. A cap equal to the fee paid for a few months of software usage may be completely inadequate relative to the potential damage caused by a power plant outage, river pollution, or damage to infrastructure. As a rule, intentional misconduct, gross negligence, intellectual property infringement, breaches of confidentiality and data protection, as well as certain safety and environmental incidents, should be excluded from limitation clauses.<\/p>\n\n\n\n Data as a Strategic Asset<\/strong><\/p>\n\n\n\n AI systems depend on data, and in the energy and infrastructure sectors, such data holds immense technical and commercial value. Smart meters, wind turbines, substations, industrial control systems, mining equipment, and traffic sensors continuously generate data regarding operations, faults, consumption, and user behavior.<\/p>\n\n\n\n The legal question is not merely who “owns” the data, as the traditional concept of ownership is often insufficient. It is necessary to contractually determine who collects the data, who has access rights, for what purposes the data may be used, whether it may be used to train other models, and whether it can be shared with affiliates or subcontractors. The EU Data Act specifically regulates fairer access to data generated by connected products and industrial equipment, including the right of users of such products to access data generated by their usage.<\/p>\n\n\n\n If a turbine or industrial equipment vendor retains exclusive access to operational data, the facility owner may become technologically dependent on that vendor. Such vendor lock-in complicates changing service providers, developing proprietary analytical solutions, and proving the causes of failures. Therefore, the contract must ensure data access in a usable format, interoperability, portability to another vendor, and the obligation to export data upon contract termination.<\/p>\n\n\n\n Some data may simultaneously constitute personal data. Smart meter data can reveal household habits, while worker monitoring systems may contain data on employee location, performance, and behavior. In such cases, data protection rules will be applied such as lawful basis for processing, purpose limitation, data minimization, retention periods, security, and data subject rights. Automated decision-making that produces significant effects on a consumer or employee requires heightened legal scrutiny and genuine human oversight.<\/p>\n\n\n\n Cybersecurity and Operational Resilience<\/strong><\/p>\n\n\n\n AI increases system efficiency while simultaneously expanding the potential attack surface. An attacker can manipulate input data, compromise the model, alter sensor readings, or induce the system to make an erroneous decision. In the energy sector, such an incident can cause physical consequences, not merely data loss.<\/p>\n\n\n\n The NIS2 framework covers entities in energy, transport, digital infrastructure, water supply, and wastewater management, requiring cybersecurity risk management measures and the reporting of significant incidents. Therefore, an AI system cannot be viewed separately from the operator's overall security architecture.<\/p>\n\n\n\n Contracts with vendors should establish minimum security standards, vulnerability management, timelines for installing security patches, penetration testing, access controls, backups, and business continuity. In particular, incident reporting deadlines and the vendor's obligation to immediately provide information required for reporting to the regulator must be defined.<\/p>\n\n\n\n The energy company must retain the capability to safely operate critical functions manually. “Human-in-the-loop” must not be merely a formal designation. The person responsible must understand the system output, have sufficient time and authority to intervene, and have alternative procedures available if the system becomes unavailable.<\/p>\n\n\n\n Artificial Intelligence and Environmental Protection<\/strong><\/p>\n\n\n\n AI can significantly enhance environmental protection by detecting illegal logging, monitoring air and water quality, predicting the spread of wildfires, optimizing energy consumption, and identifying methane leaks. Nevertheless, the use of algorithms does not release the investor or the competent authority from statutory obligations.<\/p>\n\n\n\n Environmental impact assessments must remain transparent and verifiable procedures. If AI is used to model noise, emissions, flood risks, or biodiversity impacts, it must be possible to explain the methodology, data sources, assumptions, and limits of reliability. Documentation cannot be replaced by the conclusion that the result was “generated by an algorithm.”<\/p>\n\n\n\n This is also vital for the public's right to participation. Citizens, local communities, and environmental organizations must be able to understand the data underlying project decisions. If the model and key assumptions are protected as trade secrets, a balance must be struck between intellectual property protection and the procedural rights of the public.<\/p>\n\n\n\n An AI result should not serve as the sole basis for issuing environmental, construction, or other administrative permits. The competent authority must independently establish the facts, evaluate evidence, and provide a reasoned decision. Uncritical reliance on an opaque model may lead to the annulment of an administrative act due to incompletely established facts or a lack of proper reasoning.<\/p>\n\n\n\n At the same time, the infrastructure required for AI carries an environmental footprint. Data centers consume electricity and cooling water, require grid connections, and can increase local infrastructure strain. Therefore, the legal analysis of an AI project should encompass energy origin, energy efficiency, water usage, e-waste management, and potential emission reporting obligations.<\/p>\n\n\n\n Natural Resources, Mines, and Concessions<\/strong><\/p>\n\n\n\n In mining, AI is used for geological modeling, excavation optimization, fleet management, and predictive maintenance. The question arises whether algorithmic reserve estimation can suffice for investment decisions or regulatory reports. The answer must depend on professional standards and the requirements of competent authorities. AI can assist a geologist or mining engineer, but it should not automatically replace the responsibility of an authorized expert.<\/p>\n\n\n\n In the case of concessions, it is necessary to determine whether data collected during extraction belongs to the concessionaire, the grantor, or constitutes documentation that must be handed over to a public authority. The contract should also regulate the right to use models developed on the basis of such data after the concession expires.<\/p>\n\n\n\n An algorithm can increase deposit recovery rates, but it may also encourage more intensive extraction with greater environmental consequences. Therefore, profit optimization must not be the sole objective of the system. The model must incorporate legal constraints, concession terms, remediation plans, worker safety, and inviolable environmental thresholds.<\/p>\n\n\n\n Public Procurement and Infrastructure Contracts<\/strong><\/p>\n\n\n\n A large number of infrastructure AI solutions will be procured by public enterprises and government bodies. Tender documentation must precisely define functional requirements, data quality, interoperability, security, ownership of results, and the possibility of changing vendors. Requesting a specific commercial platform without objective justification can violate the principles of competition and technological neutrality.<\/p>\n\n\n\n The lowest price can hardly be the sole criterion for a system managing critical infrastructure. Reliability, explainability, security, lifecycle costs, maintenance quality, and exit strategies must be evaluated.<\/p>\n\n\n\n In EPC and other infrastructure contracts, it must be determined whether the AI component constitutes part of the works, equipment, software, or services. Testing, commissioning, warranties, and legal remedies depend on this classification. Special acceptance tests for normal, boundary, and emergency scenarios are required. The fact that a system technically functions are insufficient if it fails to achieve the agreed level of accuracy or does not enable safe manual takeover.<\/p>\n\n\n\n Modifications to models following commissioning require special regulation. A model that continues to learn can change its behavior without a classic software upgrade. Therefore, the contract should define permitted modifications, re-testing, notification obligations, and the procuring entity's right to reject a version that increases risk.<\/p>\n\n\n\n The Position of Bosnia and Herzegovina<\/strong><\/p>\n\n\n\n Bosnia and Herzegovina does not yet have a single, comprehensive regulation governing the development and use of artificial intelligence in the manner of the EU AI Act. However, this does not mean AI is used in a legal vacuum. Existing rules on obligations, liability for damages, personal data protection, consumer protection, energy, environmental protection, construction, public procurement, concessions, labor, and criminal liability apply.<\/p>\n\n\n\n For domestic companies, European regulations are significant for three reasons. First, the AI Act may directly cover providers from BiH when system outputs are used in the EU. Second, international investors, banks, and buyers contractually pass European requirements down to suppliers and project companies. Third, domestic regulations will gradually align with the EU Acquis Communautaire<\/em> through the European integration process.<\/p>\n\n\n\n Therefore, companies from BiH should not wait for separate domestic “AI law.” A more rational approach involves establishing an AI system registry, designating responsible persons, classifying risks, reviewing vendor contracts, and introducing procedures for human oversight, incident reporting, and the retention of technical records.<\/p>\n\n\n\n Conclusion<\/strong><\/p>\n\n\n\n The greatest legal risk of artificial intelligence in energy, infrastructure, and natural resource management is not the technology itself, but the unclear liability for its use. An organization that does not know which AI systems it uses, what data they process, who controls their outputs, and what happens in the event of a failure cannot reliably manage either legal or operational risk.<\/p>\n\n\n\n Responsible implementation requires determining the actual purpose of the system prior to procurement, performing risk classification, and contractually regulating data, intellectual property, security, testing, liability, and the termination of cooperation. During use, continuous monitoring of model performance, recording of decisions, maintenance of human oversight, and verification that the system is operating within approved boundaries are necessary.<\/p>\n\n\n\n In sectors where algorithmic decisions can impact energy supply, facility safety, the environment, or the use of public goods, efficiency cannot be the sole criterion. Legally sustainable artificial intelligence must be safe, verifiable, explainable, and under the actual control of humans who assume responsibility for its use.<\/p>\n\n\n\n Author: Aleksandar Sajic<\/p>\n","protected":false},"excerpt":{"rendered":" Artificial intelligence is rapidly becoming an integral part of the energy and infrastructure economy. Algorithms are used to predict electricity generation from wind and…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[91,82],"tags":[],"class_list":["post-1743","post","type-post","status-publish","format-standard","hentry","category-articles","category-newsletter-en"],"_links":{"self":[{"href":"https:\/\/advokatskafirmasajic.com\/blog\/wp-json\/wp\/v2\/posts\/1743","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/advokatskafirmasajic.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/advokatskafirmasajic.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/advokatskafirmasajic.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/advokatskafirmasajic.com\/blog\/wp-json\/wp\/v2\/comments?post=1743"}],"version-history":[{"count":1,"href":"https:\/\/advokatskafirmasajic.com\/blog\/wp-json\/wp\/v2\/posts\/1743\/revisions"}],"predecessor-version":[{"id":1744,"href":"https:\/\/advokatskafirmasajic.com\/blog\/wp-json\/wp\/v2\/posts\/1743\/revisions\/1744"}],"wp:attachment":[{"href":"https:\/\/advokatskafirmasajic.com\/blog\/wp-json\/wp\/v2\/media?parent=1743"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/advokatskafirmasajic.com\/blog\/wp-json\/wp\/v2\/categories?post=1743"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/advokatskafirmasajic.com\/blog\/wp-json\/wp\/v2\/tags?post=1743"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}