Why ISO/IEC 27001:2022 Matters for Nuclear AI… and What It Means for Nuclearn Customers

Nuclear is not a place for shortcuts. Every procedure, every control, every record exists for a reason. The same standard applies to the AI systems that support nuclear operations. In March 2026, Nuclearn achieved ISO/IEC 27001:2022 certification, the internationally recognized standard for information security management. This is not a press release moment. It is a signal about how we build, how we operate, and what we owe our customers.

What ISO/IEC 27001:2022 Actually Is
ISO/IEC 27001:2022 is a global standard published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). It defines the requirements for establishing, implementing, maintaining, and continuously improving an Information Security Management System, or ISMS.

Unlike a one-time audit or a checklist, an ISMS is a living framework. It covers the people, processes, and technology involved in protecting information. It requires documented risk assessments, defined security roles, measurable objectives, and annual management reviews. And it requires an independent third party to verify that all of it actually works.

Our certification was conducted by A-LIGN Compliance and Security, Inc., a firm accredited by both the ANSI National Accreditation Board (ANAB) and the United Kingdom Accreditation Service (UKAS). The audit covered two stages across several months, beginning with a Stage 1 review in October 2025 and concluding with a Stage 2 audit between January 12 and January 20, 2026. Certification was issued on March 17, 2026.

Why This Matters for Nuclear
Nuclear operators trust Nuclearn with data that matters: workforce records, training completions, corrective action programs, engineering documentation, and more. These are not generic enterprise files. In a regulated industry, this information touches safety, compliance, and operational continuity.

Our customers include utilities operating in the United States, Canada, and the United Kingdom. Many of them have their own information security requirements. Procurement teams ask about our controls. Legal teams review our policies. Security teams want to know how we handle access, incidents, and third parties.

ISO/IEC 27001:2022 certification gives everyone a common reference point. Instead of answering the same security questionnaire in ten different formats, we can point to an independently verified ISMS that meets a globally recognized standard. That is useful to procurement. It is useful to compliance. And it is honest.

What Our ISMS Covers
The certified scope covers the design, development, deployment, and support of AI solutions for the nuclear and regulated utility industries. Every product in our portfolio is included: CAP AI, AtomAssist, Engineering AI, Work AI, Observation Program, Capitalizer, and Project Genius. The scope applies across on-premises, hosted, and GovCloud deployments.

That breadth matters. A certification that covers only part of your product line or only one deployment type offers limited assurance to customers. Ours covers the full picture.

The ISMS includes formal risk assessments conducted annually, with risks classified by likelihood and impact. Our most recent assessment identified one high-level risk, four medium-level risks, and four low-level risks, each with defined treatment plans and ownership. Security controls are monitored daily through Wazuh across our networks, systems, and applications. Access is governed by least privilege, multi-factor authentication on critical systems, and role-based access control.

Security Built Into How We Work
One thing the certification process reinforced is that security cannot live only in a policy document. It has to live in how people do their jobs every day.

At Nuclearn, every new hire completes security and privacy awareness training within 30 days of onboarding, managed through our Fortinet LMS. Vendor and supplier relationships are governed by a formal Third Party Information Security Risk Management Policy. Incident response procedures are tiered and documented, from critical data loss events to management-level escalations. Business continuity and disaster recovery plans are tested annually.

Our development practices follow secure coding principles with baseline requirements and developer checklists. Environments for development, testing, and production are separated. Change management is controlled. This is not how most software companies build. It is how nuclear-grade software should be built.

Continuous, Not One-Time
ISO/IEC 27001:2022 certification is not a trophy you earn and display. It carries a three-year validity period with surveillance audits in between. Our current certificate runs through March 17, 2029. Between now and then, we will undergo regular reviews, maintain our controls, update our risk assessments, and continue improving.

That ongoing requirement is the point. Nuclear operators do not do annual safety reviews and then walk away until the next one. Neither do we.

What This Means If You Are a Nuclearn Customer
If you are already using Nuclearn products, this certification validates what we have been telling you about how we handle your data. The controls are real, documented, and verified.

If you are evaluating Nuclearn, you can request our security documentation directly. We are prepared to support procurement due diligence and answer specific questions about our ISMS scope, controls, and audit results.
Either way, the certification number is ISMS-NU-031726. It is publicly verifiable through A-LIGN.Nuclear AI has to be held to a higher standard. We agree with that. ISO/IEC 27001:2022 is one way we demonstrate it.
To learn more about Nuclearn’s security posture or to request documentation, contact us at [email protected].

Nuclear’s Quiet AI Revolution: How Nuclearn Is Powering 70 Reactors and Counting

Nuclear power is having a moment. Data centers are hungry for reliable, carbon-free baseload energy. Aging fleets are being asked to do more with leaner teams. And a workforce that took decades to build is approaching retirement. Our co-founders, CEO Bradley Fox and CFO Jerrold Vincent, recently sat down with Chris Wedding on the Climate CEO podcast from Entrepreneurs for Impact to talk about how we built an AI company quietly serving more than 70 nuclear reactors before most of the industry even knew AI was coming.

The conversation covered strategy, culture, workforce, and the realities of selling software inside one of the most regulated industries on the planet. Here is what stood out.

Starting Where It Hurts: The Corrective Action Program

Every nuclear power plant in the United States operates under a Corrective Action Program, or CAP. It is a regulatory requirement. Any employee at any level can and should report any issue they observe, from a crack in the parking lot to a malfunctioning pump to, yes, a complaint about the cafeteria. The result is that a single reactor can generate 5,000 to 10,000 documented issues per year, every one of which must be reviewed by experienced, cross-functional staff.

That review process requires people to categorize each issue, determine whether it represents a condition adverse to safety, assign it appropriately, assess whether it is a repeat occurrence, and decide how much effort to invest in resolving it. For decades, that has meant rooms full of highly trained personnel doing largely manual triage work.

“One reactor might have 5,000 to 10,000 of these issues identified every single year. And every one of those has to be looked at by a staff of cross-functional, highly experienced personnel.” — Jerrold Vincent, CFO and Co-Founder, Nuclearn

We recognized that this problem was universal across the fleet, painful enough to justify real investment, and tractable with natural language processing. Our CapAI product began automating a significant portion of CAP triage as early as 2021, freeing experienced engineers to spend their time on higher-value work rather than reviewing low-level administrative entries.

It was narrow. It was unsexy. And it was exactly the right place to start.

Land and Expand, Done Right

Our go-to-market strategy has been deliberate and patient. Rather than pursuing a small number of large contracts, we chose to land with a focused, high-value solution at as many sites as possible, prove ROI quickly, and expand from there.

This approach works particularly well in nuclear for a few reasons. Procurement at a nuclear plant is a multi-layered process with long budget cycles, extensive compliance reviews, and a deep institutional preference for proven vendors. Getting in the door with a smaller, clearly scoped product at a reasonable cost is far easier than asking a plant to adopt a broad platform it has never seen in action.

Once inside, the dynamic shifts. As Jerrold explained on the podcast, customers that see real results want to do more. We have since expanded into outage scheduling optimization (coordinating 13,000 to 15,000 discrete activities across a 20 to 30-day refueling window), and AtomAssist, an AI agent platform that functions as an intelligence hub for plant engineers, giving them fast access to documentation, precedent, and AI-assisted drafting for the extensive technical writing nuclear roles require.

“Start with smaller, more targeted use cases. Get as many folks on board as possible. Then help them out with deeper and more complex problems.” — Jerrold Vincent, CFO and Co-Founder, Nuclearn

The key constraint with this model, as Brad noted, is that the solution has to work really, really well. And customers have to like you. In a market as concentrated as nuclear, reputation travels fast in both directions.

A Workforce Problem That AI Alone Cannot Solve

One of the more striking threads in the conversation was the workforce challenge facing nuclear energy. The U.S. nuclear industry employs roughly 100,000 people, a significant portion of whom are approaching retirement age. The skills required to operate, maintain, and expand nuclear plants are deep and time-intensive to develop. New employees can take 5 to 10 years to grow into critical roles.

The data center boom has added pressure from an unexpected direction. Tech companies, recognizing that nuclear workers are excellent engineers and rigorous operators, have been actively recruiting from the industry. Plants are competing for talent in a way they never had to before.

Meanwhile, national goals for nuclear expansion would require doubling or tripling the current workforce over the next 10 to 15 years. The math does not work without AI augmentation.

But Brad and Jerrold were clear that AI is not a replacement strategy here. Nuclear is safety-critical infrastructure. The NRC requires human oversight on consequential decisions. The goal of our tools is to reduce the administrative and research burden on experienced people, help them transfer knowledge to newer colleagues, and make it possible for a somewhat smaller team to maintain the same standard of operational excellence.

“AI can help patch in some of that knowledge where it may not exist, or help make it accessible to those new people.” — Bradley Fox, CEO and Co-Founder, Nuclearn

Our original mission, keeping plants economically viable when natural gas was cheap and wind was getting cheaper, has evolved into something broader: helping nuclear scale fast enough to meet the energy demands of a world that is electrifying everything.

A Culture Built for Transparency

One of the most revealing moments in the podcast came when Chris Wedding asked how nuclear plants manage to maintain such an open reporting culture. Brad and Jerrold practically laughed. In nuclear, the idea that you would not report a problem is not just unusual; it is inconceivable.

From the first day at a plant, every employee is taught that transparency is non-negotiable. People openly challenge executives at all-hands meetings. Problems are discussed at every level of the organization. This is not radical candor as a management philosophy. It is how plants stay safe.

For a software company trying to get plants to adopt AI tools that touch sensitive operational data and critical workflows, this culture is actually an asset. Nuclear customers are not going to quietly tolerate a product that underperforms. They will tell you exactly what is wrong. For us, that feedback loop is a feature, not a threat.

Built From Inside the Industry

Jerrold and Brad both came from the nuclear industry before founding Nuclearn in 2020. They spent years inside plants doing data science work, grappling with the reality that nuclear runs on massive volumes of unstructured text data, maintenance logs, corrective actions, engineering evaluations, and hundreds of required documents per project.

Getting good at natural language processing was not optional. It was the job. And when transformer-based language models began demonstrating their potential around 2018, our founders recognized the technology before most enterprise software vendors had even started paying attention.

The first year was nights and weekends. They ran conservative napkin math on the automation opportunity across the entire U.S. fleet. The numbers were large enough to justify the risk. They commercialized what they had been building, found early customers, and grew from there without outside capital until our seed and Series A rounds.

That grounding in the industry shows up in ways that matter. Our pricing model reflects a genuine understanding of how plants budget and measure value. Our product roadmap follows the actual pain points of the people running these facilities. When Brad and Jerrold talk about nuclear, they are not performing expertise. They lived it.

What Comes Next

We are well past proof of concept. With more than 70 reactors already in our customer base, a recent Series A from SJF Ventures and Blue Bear Capital, and a growing product suite, our near-term focus is on expanding within the existing fleet while building the relationships and capabilities that will matter as new reactor construction accelerates.

Small modular reactors and advanced reactor designs are getting significant investment. But the infrastructure for new builds, the engineering firms, the licensing processes, the operational staffing models, runs through the same companies already using Nuclearn. That means we are already participating in new nuclear without having to wait for the first SMR to come online.

Nuclear is moving faster than it has in decades. The workforce is under pressure. The technology to help is here. We built this company to be part of the solution, and that work is just getting started.

Listen to the full episode: Nuclear’s AI Revolution on Climate CEO (Entrepreneurs for Impact)

Learn more about Nuclearn at nuclearn.ai

Inside the Innovation Agora: What Bradley Fox Said at CERAWeek

There are moments at industry events where the conversation shifts from speculation to reality. At this year’s Innovation Agora at CERAWeek, Bradley Fox, CEO and Co-Founder of Nuclearn, delivered one of those moments.

His session, “Driving Efficiency Across the Nuclear Fleet: From Operating Plants to New Nuclear Deployment,” was not a forward-looking hypothesis. It was a clear, experience-driven view into what is already happening inside nuclear plants today and what must happen next.

This is the inside track on what he shared and why it matters.

The Core Challenge: More Demand, Less Experience

Fox opened with a reality that is already shaping decision-making across the industry.

Nuclear is facing a supply-demand imbalance that cannot be solved with hiring alone.

The data points are not subtle:

  • 95 reactors in the United States generating nearly one-fifth of domestic electricity
  • A national target of 400 GW of nuclear capacity by 2050
  • Data center demand expected to grow 165 percent by 2030
  • Nearly 40 percent of the nuclear workforce eligible to retire within a decade
  • 4 million new nuclear professionals needed globally by 2050

This is not a slow transition. It is a compression of demand, workforce change, and operational pressure all happening at once.

Fox summarized it directly:

The fleet must produce more with fewer experienced people.

That is the problem AI is being deployed to solve.

AI in Nuclear Is Already in Production

One of the most important clarifications from the session was this:

AI in nuclear is not in pilot mode. It is already in production.

Across operating plants, AI is actively supporting core workflows:

Corrective Action Program Automation

AI is reviewing thousands of condition reports, assigning significance, and routing issues. This reduces administrative burden and allows engineers to focus on higher-value decisions.

Outage Planning and Scheduling

Managing tens of thousands of tasks within a tight outage window is one of the most complex planning challenges in nuclear. AI is identifying gaps, predicting sequencing risks, and helping avoid costly delays.

Engineering Document Intelligence

AI is compressing days of document review into minutes by making millions of pages of procedures and regulatory content accessible and usable in real time.

Predictive Maintenance

Machine learning models are identifying early indicators of equipment issues, enabling teams to act before failures occur.

Robotics and Dose Reduction

Robotics platforms are already reducing radiation exposure and saving hundreds of person-hours annually across facilities.

These are not experimental use cases. They are active deployments inside operating plants today.

The Shift From Pilot to Operational Necessity

Fox highlighted that adoption is no longer driven by curiosity. It is driven by necessity.

Corrective Action Program automation, in particular, has moved rapidly into production because the volume of work and workforce constraints made it unavoidable.

This marks a broader shift.

AI is moving into the early majority phase within nuclear, not because the industry is chasing innovation, but because operational pressure demands it.

This distinction matters.

It signals that AI is becoming part of how work gets done, not an overlay on top of it.

New Nuclear Requires a Different Approach

While operating plants benefit from decades of historical data, new nuclear projects face a different reality.

They are building without that foundation.

Fox emphasized that AI for new builds is not simply an extension of existing applications. It is a different problem set entirely.

AI is being applied to:

  • Program management across multi-year, multi-discipline construction efforts
  • Workforce development through AI-assisted procedures and training materials
  • Design acceleration through faster modeling and simulation cycles
  • Licensing alignment by identifying gaps before submission

In this context, AI is not just improving efficiency. It is enabling progress.

Without it, scaling new nuclear becomes significantly more complex and time-intensive.

What Makes AI Work in Nuclear

Fox outlined a set of characteristics that consistently define successful AI deployments in nuclear environments.

These are not theoretical guidelines. They are practical requirements.

On-Premise Deployment

Nuclear data must remain secure and controlled. Public cloud models are not an option for plant operations.

Auditability

Every output must be traceable. If it cannot be explained to a regulator, it will not be used.

Human in the Loop

AI supports decisions. It does not replace them. The role of the engineer remains central.

Workflow Integration

AI must exist within existing systems and processes. If it requires a separate workflow, adoption will fail.

Domain-Specific Design

General-purpose AI does not understand nuclear processes or regulatory frameworks. Solutions must be built specifically for the industry.

These factors are what separate successful deployments from those that do not move beyond initial trials.

The Regulatory Environment Is Moving Forward

There is a common perception that regulation is slowing AI adoption in nuclear.

Fox addressed this directly.

The Nuclear Regulatory Commission is not blocking AI. It is actively working to define how it is used safely and effectively.

Recent progress includes:

  • An AI strategic plan
  • International collaboration on AI principles
  • Validation that existing frameworks support non-safety AI
  • Ongoing development of guidance for broader applications

The pathway is being built.

But it requires alignment, transparency, and discipline across the industry.

The Gaps That Still Need to Be Solved

While progress is real, Fox was clear that challenges remain.

The industry is still working through:

  • Data quality issues across legacy systems
  • Workforce readiness and change management
  • The absence of a defined pathway for safety-related AI
  • The pace of knowledge transfer as experienced workers retire
  • Lack of standardization across plants
  • Slower adoption compared to other industries

These are not technology problems alone.

They are operational and organizational challenges that require coordination across utilities, regulators, and partners.

The Bigger Takeaway

What stood out most in this session was the clarity around the role of AI in nuclear.

It is not positioned as a replacement for expertise.

It is positioned as a way to extend it.

At a time when nuclear is being asked to do more than ever before, powering data centers, supporting decarbonization, and enabling new builds, the industry cannot rely solely on traditional approaches.

AI is becoming part of the operating model.

Not as a future concept, but as a present capability.

Watch the Full Session

If you want to hear this perspective directly, the full session from the Innovation Agora at CERAWeek is available here.

This is one of the clearest, most practical discussions on how AI is being applied across the nuclear fleet today and what it will take to scale it moving forward.