Governing AI on legacy site systems in construction and infrastructure: the retrofit playbook

Bolted-on is the natural first state, because it is the path of least resistance twice over. The AI vendor wants a demo running before the pilot review; the fastest route to data is whatever the legacy system will give up without a change request — a nightly CSV from the weighbridge terminal, a screen-scrape of the plant-hire portal, a USB pull from the DVR. Each extraction works, in the sense that bytes arrive. None of it is governed, in the sense that nobody can say what the bytes mean, when they were true, or whether tomorrow's bytes will mean the same thing.

The defining property of this stage is that the improvisations are invisible. The model's outputs look like outputs; the dashboard renders; the pilot review sees accuracy figures. What nothing surfaces is that the accuracy was computed against data whose provenance is a chain of undocumented habits — an operator keying tonnage into a 2008 terminal, an export template someone configured and left the company, a portal whose schema the vendor changes without notice. The governance question 'could you defend this decision?' has a simple answer at this stage: no, and you will not find out until someone asks.

This is also the stage where the OT exposure is created. In the rush to feed the model, laptops get plugged into engineering networks, historians get queried from the corporate side, and telemetry paths get opened that no one risk-assessed — precisely the pattern operational-technology security guidance exists to prevent. The cost of leaving Bolted-on is not a platform; it is a survey. Walking the estate and writing down what actually feeds the AI is a matter of weeks, and it converts an unknown risk surface into a known one before the next model is connected.

Surveyed is the stage where the estate stops being folklore. Someone has walked the site and the asset base and written down what is actually there: the DVR estate and its firmware versions, the historian and the tags it holds, the telematics portals and who has the logins, the BMS controllers and the point lists last updated a decade ago, the weighbridge, the turnstiles, the batch plant. Against each entry sits the thing governance actually needs: what extracts from it, how, on what schedule, into which model, owned by whom. The register is unglamorous and it changes the conversation permanently — risk can now be ranked instead of guessed.

What the survey almost always finds is worse and more useful than expected. A typical first pass on a mature estate turns up several systems nobody named in advance, at least one whose vendor no longer exists, documentation gaps that make interface behaviour a matter of experiment, and two or three extraction paths that would embarrass the firm in front of a client auditor. It also finds the good news: which feeds are already clean enough to mediate cheaply, and which AI use cases were quietly consuming data too unreliable to act on — knowledge that redirects investment before it is wasted.

The trap at this stage is treating the register as the deliverable. A survey with no controls behind it is a well-documented version of stage 1: the screen-scrapes are now beautifully catalogued and still silently wrong. The register's purpose is to sequence the wrapping work — which feeds get mediation gateways first, driven by the criticality of the decisions their AI informs, not by which system is oldest or which team shouts loudest. The move to Wrapped starts with the single feed whose failure would be most expensive to discover late.

Wrapped is where governance becomes an engineering fact instead of a documentation exercise. Between each critical legacy system and the AI that reads it now sits a mediation gateway — a deliberately boring piece of infrastructure that does four things the substrate cannot. It stamps provenance: which system, which interface, which extraction, when. It normalises time, converting the DVR's drifting clock and the historian's local time into one NTP-disciplined base so events can be honestly ordered. It enforces quality gates, holding back stuck values, impossible readings and schema changes instead of passing them to the model. And it logs, giving every downstream decision a trail the source system could never provide.

The OT boundary is settled at this stage, permanently. Models never query controllers, PLCs or historians directly; extraction happens through read-only taps — one-way replication, protocol converters, or a data diode where the asset warrants it — so the AI retrofit adds no write path and no attack path into systems that act on the physical world. This is not an AI-specific invention: it is the standard separation discipline of NIST SP 800-82 and NCSC operational-technology guidance applied to a new consumer. Treating the AI as just another untrusted connection to OT is the mindset that keeps the retrofit out of the incident report.

What changes operationally is failure. At stages 1 and 2, a dead or corrupted feed is discovered by a human noticing that decisions look odd — days or weeks late. At Wrapped, the gateway notices in minutes: a staleness alarm, a schema alarm, a quality-gate trip, each paging a named person. Just as important is what the AI does next: outputs that depend on the failed feed are withheld, not computed on stale data, and the operation falls back to its pre-AI procedure — which is still documented and still drilled. A wrapped estate fails loudly and safely; an unwrapped one fails silently and expensively, which is the entire difference.

Assured is the stage where the firm stops trusting its own wrapping and starts testing it. The mediation layer built at stage 3 is infrastructure, and infrastructure decays: a gateway config drifts, an alarm rota goes stale, a 'temporary' direct connection appears during a shutdown and stays. The assurance discipline is adversarial by design — sample an AI-informed decision from the last quarter and walk it backwards through the evidence, from the recommendation to the gateway log to the provenance stamp to the raw extraction, and see whether the chain actually holds. Then walk the other way: pick a live feed and check the register, the tap, the alarms and the estate decision all exist and match. The gaps found are the product.

The failure drill graduates from a good habit to a governed cadence. On a schedule, a feed is deliberately killed or corrupted on a quiet shift: does the alarm page the right person, does the model withhold, does the fallback procedure actually run with the people on that shift, how long until normal service. The drill report — what worked, what did not, what changed as a result — is the single most persuasive artefact the estate can produce, because it is evidence of behaviour rather than intention. It is what an assurance-minded client, an insurer or a regulator can be shown without interpretation.

Assured is also where the economics become honest. Every wrap has a running cost — the gateway, the alarms, the drills, the audit time — and for some systems that cost quietly exceeds what replacement would amortise to. The recorded wrap/replace/restrict/retire decision, reviewed on a date rather than on a whim, is what keeps the estate deliberate: the analogue camera estate whose wrapper costs more per year than an IP refresh, the historian whose vendor support ends next cycle, the portal whose schema changes have tripped the gates three times this year. These are renewal signals, and at Assured they are read as such instead of being absorbed as maintenance noise.

Renewed is not the estate becoming modern — no working construction or infrastructure estate ever fully is. It is the estate becoming deliberately managed, with AI dependency as a first-class input to renewal. The question 'which systems do we replace next year?' is answered partly from the dependency register: which substrates carry the most critical AI decisions, which wrappers cost the most to run and audit, which vendors are approaching end of life, which feeds trip their quality gates most often. Renewal money follows governance economics, which means the ugliest system in the yard is not necessarily next — the one whose wrapper is the most expensive lie to maintain is.

The second discipline of this stage is refusing to mint new legacy. Every procurement — the new access-control estate, the batch-plant replacement, the camera refresh, the historian upgrade — carries AI-readiness requirements in the specification: documented APIs, event logging, NTP time discipline, schema-change notification, data export in an open format, and contractual terms covering what the vendor may and may not do with the data. None of this is exotic, and all of it is nearly free at procurement time and painfully expensive to retrofit. The firms at this stage learned that the wrapping programme they just finished was the price of two decades of procurement that never asked.

Retirement gets the same rigour as acquisition. A legacy system leaving service is a governance event: its archives get a disposition decision — migrate, retain with an owner, or destroy on a schedule — its feeds are formally decommissioned in the register, and the models that consumed them are re-pointed or re-validated rather than left reading a ghost. The stage's quiet achievement is that the estate's story becomes tellable: an auditor, a client or an incoming engineering director can be shown what runs, what feeds what, what is wrapped, what is scheduled for replacement and why. That narrative, backed by evidence, is what estate governance was for all along.