The grid roadmap for AI integration: how utilities move models from reports into the control loop

Detached is not a failure state — it is where every utility correctly starts, and much genuinely useful work lives here permanently: load research, loss studies, hosting-capacity screening, post-event analysis. The problem is not that detached analytics exist. It is that programmes stay detached while believing they are integrating, because the models keep improving and improvement feels like progress. Integration depth, the thing this roadmap measures, has not moved at all: the model still cannot see the grid, and the grid still cannot hear the model.

The signature of the stage is the extract ritual. An engineer requests a historian export, someone in the metering team pulls AMI interval data for the study feeders, a GIS analyst produces a shapefile, and a week of every study is spent joining the three on asset identifiers that never quite reconcile. Each study repeats the ritual, because nothing was kept: no governed feed, no maintained mapping, no shared definition of which topology snapshot the join was made against. Ten studies cost ten times what one costs, and the eleventh will too.

What makes Detached worth leaving quickly is that its outputs age badly in a way the grid now punishes. A hosting-capacity study computed on last year's topology and last year's DER register was tolerable when connections arrived slowly. With distributed solar, storage and EV load growing at the pace the sector's own bodies document, a detached analysis is materially wrong within months — and decisions made on it inherit the error. The first integration investment is therefore not a model at all: it is one governed, refreshing feed from the historian and the AMI head-end, joined to a topology that updates.

Observing is the most crowded stage on the ladder and the easiest to mistake for the destination. The engineering achievement is real: live feeds, a maintained topology join, models that track the network hour by hour. Load forecasts update themselves, transformer thermal models follow the weather, an anomaly detector watches feeder currents. Everything works — and none of it is wired to a decision. The output renders on a screen beside the control room, or a portal the planning team can open, and whether anyone acts on it is a matter of individual habit.

The stage has a structural failure mode that the sector's own experience documents relentlessly: the side screen fails exactly when it matters. On a quiet Tuesday, a control engineer has attention to spare and may consult the forecast portal. During a storm restoration — the hours the model was built for — the engineer is managing switching, crews and an alarm flood inside the EMS and OMS, and a second application on a second screen receives no attention at all. The model's consultation rate is highest when its value is lowest, and this inversion is invisible unless someone measures it, which at stage 2 nobody does.

The honest accounting of Observing is that it produces evidence, not value. That is worth having: a model that has tracked the live network for two quarters, with its accuracy measured against what actually happened, is exactly the artefact that justifies the integration work of stage 3. The mistake is polishing the model instead of spending that evidence. A forecast that improves from good to very good on a side screen changes nothing; the same forecast landed inside the ADMS display the operator already reads changes decisions the first week. Accuracy is the stage-2 team's comfort zone, and the write path is the exit.

Advising is where AI first becomes part of how the grid is operated rather than commentary on it. The engineering that gets a programme here is mostly unglamorous: an interface into the EMS or ADMS that renders a model output as a field the operator already scans, a work-management integration that turns a condition score into a ranked inspection queue, an OMS hook that replaces a static restoration estimate with a predicted one. None of it is machine learning. All of it is what makes machine learning matter.

The discipline that distinguishes a real stage 3 from a cosmetic one is the accept/override log. Every recommendation shown, every one accepted, every one overridden, with enough context to reconstruct why — feeder, conditions, operator, what was done instead. This log is usually pitched as an adoption metric, and it is, but its deeper role is forward-looking: it is the calibration dataset for the operating envelope that stage 4 will need. When the time comes to let a model write setpoints, the bounds inside which it may do so are derived from thousands of logged human judgements about when its advice was safe to follow. A programme that skipped the logging has to set those bounds by committee guesswork, and committees guess conservatively enough to strangle the loop.

Advising is also where trust is actually built, and it is built asymmetrically. Operators extend trust slowly and withdraw it instantly: one visibly wrong recommendation during a major event can end consultation for a year. The mitigation is scope honesty. A restoration-time model trained on routine faults should say so on its face and widen its uncertainty during major storms — or be suppressed in those modes entirely. Teams that let a blue-sky model advise through a hurricane are spending trust they have not earned, and the sector's operational culture, correctly, does not refund it.

Acting is narrower than the word 'autonomy' suggests, and the narrowness is the design. No serious utility lets a learned model command breakers or write to protection. What stage 4 actually looks like is a model proposing setpoints or schedules to a control scheme that was already engineered to act — a Volt/VAR optimisation adjusting regulator and capacitor settings, a DERMS issuing dispatch and curtailment within registered limits, a battery schedule optimiser. The scheme retains its own interlocks and its deterministic behaviour; the model adjusts what the scheme aims for, inside bounds a human wrote down. The grid has run closed loops for a century — protection, automatic generation control (AGC), and more recently FLISR self-healing — and it accepts them precisely because they are bounded, deterministic where it matters, and reversible. AI joins the loop on the same terms or not at all.

The central artefact is the operating envelope, and it deserves more engineering respect than it usually gets. A real envelope is not a min/max pair in a configuration screen. It is a versioned document and its enforcement code: hard bounds validated against power-flow studies of the actual network, rate limits so the loop cannot thrash equipment through excessive tap and switching operations, validity conditions that state when the model may act at all — topology as expected, telemetry fresh, no active switching in the area — and auto-revert triggers that return control to the previous scheme the moment any condition fails. Every element traces to evidence: the bounds to network studies, the validity conditions to the failure modes observed in the advisory year, the escalation thresholds to the override log.

The operational job changes accordingly. Supervising a closed loop is not watching its every action — that would just be stage 3 with worse ergonomics — it is watching its envelope statistics. The escalation rate (how often proposals fall outside bounds) is the leading indicator: rising escalations mean the network has moved away from the envelope's assumptions, through DER growth, reconfiguration or seasonal change, and the envelope needs review before an incident forces one. This is also where the security obligations bite hardest: a component that writes into a control scheme sits inside the OT boundary, and in North America the NERC CIP standards govern how it is built, patched, accessed and monitored. That is not an obstacle erected against AI — it is the same regime every control component lives under, and the roadmap's earlier stages exist partly so the assured path is built once, properly, before the loop needs it.

Coordinating is the stage vendor slides call the self-driving grid, and the honest version is smaller and more valuable than that. What actually exists at stage 5 is a portfolio: a handful of supervised closed loops in the contained, high-tempo corners of the network, a wider ring of advisory services, and — the part that earns the stage its name — shared machinery underneath them. One governed feed layer, one envelope-validation service, one action audit log, one reversion pattern, one assured OT path that every new component reuses. The marginal cost of the next loop collapses, which is the economic point, and every loop behaves identically under failure, which is the operational one.

The genuinely new engineering problem at this stage is interaction. Two loops that are each safe alone are not automatically safe together: a Volt/VAR loop and a DER dispatch loop both influence feeder voltage, and their envelopes must be validated jointly, not merely side by side — the same discipline protection engineers have always applied to interacting schemes, extended to learned controllers. This is also the honest boundary of the stage. System-level questions — can learned models one day assist constraint management across a whole transmission network? — are live research at bodies like EPRI, whose Open Power AI Consortium exists precisely because no single operator can validate such systems alone. A credible roadmap treats those as research to track, not line items to schedule.

What keeps a utility at stage 5 is governance rhythm rather than technology. Envelopes are reviewed on a calendar and re-validated when the network changes, because the network now changes constantly: every DER connection wave shifts the assumptions a bound was set under. Model risk management runs as a standing discipline with the shape that frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 formalise — inventory, ownership, review cadence, evidence retention — applied with control-engineering seriousness. And the reporting closes the loop institutionally: AI-driven actions appear in reliability and regulatory reporting with the same reconstructability as any switching operation, which is what makes the capability durable across leadership changes, audits and control periods rather than dependent on the team that built it.