US Energy Dept Flags AI, Cyber Gaps as Top Risks for 2026

The U.S. Department of Energy is heading into 2026 facing a growing disconnect between how quickly it deploys emerging technologies and how unevenly it is governing them, according to a new inspector general report that describes artificial intelligence and cybersecurity as two of the agency’s most significant management challenges.

See Also: New Trend in Federal Cybersecurity: Streamlining Efficiency with a Holistic IT Approach

In an annual assessment of management risks, auditors highlighted AI and cybersecurity governance as enterprisewide gaps cutting across DOE’s centralized structure, contractor-heavy operating model and national security responsibilities. The report warns that without stronger coordination and oversight, the department’s growing reliance on advanced digital systems could expose critical infrastructure to unnecessary operational and security risks.

Auditors called cybersecurity a top ongoing departmental risk – particularly as threats increasingly originate from state-sponsored intelligence services, criminal organizations and hostile actors targeting critical infrastructure and high-value assets nationwide (see: Utilities Warn US Grid at Risk as Federal Cyber Funds Dry Up).

At the center of the cybersecurity concern is DOE’s highly decentralized security model. Program offices, sites and national laboratories operate under a department order that gives local leadership broad discretion to tailor controls based on mission needs and risk tolerance.

The report warns that this flexibility has come at the cost of centralized oversight, limiting the Office of the Chief Information Officer’s ability to manage risk at the enterprise level. The report also warns that the DOE lacks a unified structure to collect, correlate and analyze real-time cybersecurity data across the department.

The report says leadership may struggle to identify systemic weaknesses or emerging threats that span multiple programs or sites – particularly in an environment where critical systems are operated by a mix of federal staff and contractors. The review also says that some contractors and DOE-owned facilities continue to assess their environments against outdated federal cybersecurity requirements, even when newer guidance is in effect.

Officials told the inspector general’s office that updated requirements are often underfunded or not funded at all, creating uneven compliance across the enterprise. Some sites prioritize direction from local oversight offices over guidance from DOE headquarter’s CIO, while others resist enterprise initiatives as unfunded mandates, the report says.

The department is expanding its use of AI across operations, national security missions, energy systems and scientific research, often using capabilities developed at national laboratories. But the report warns that the pace of adoption has outstripped the development of a comprehensive governance framework to guide deployment and manage risk.

DOE’s AI strategy, published in October, outlines several ambitious use cases, including automating permitting processes, modeling energy systems, improving grid stability and enhancing the security of critical infrastructure. The department is exploring placing AI data centers on DOE land alongside high-performance computing assets, a move that could deepen its dependence on AI-enabled infrastructure.

The report acknowledges steps DOE has taken, including the launch of an enterprise cybersecurity collaboration office and the development of the AI strategy and compliance plan, but the report says that tools and dashboards alone will not resolve structural weaknesses.