Critical Infrastructure & Sovereign AI.

The association’s role

The National Cybersecurity Association of Ukraine is a collaboration platform and an association of experts and market participants. In this area it initiates cross-sector dialogue on AI-ready data centres, energy, data and cyber resilience.

The idea is public-private collaboration: officials, infrastructure operators, energy specialists, developers and security practitioners can sit at one table before projects are decided. There is no formal public-private partnership contract.

An expert council or working group for this area is only proposed. For now this is a page of reference sources and a list of topics for discussion.

Why AI infrastructure is a resilience question

AI-based services rest on a chain: computing capacity in data centres, stable power, communications networks and the data itself. The more public and business processes depend on such services, the more a failure in one link becomes a question of continuity rather than a technical nuisance. This is the association’s reasoning, not a research finding.

Ukrainian official documents already put resilience at the centre. The draft Cybersecurity Strategy 3.0, discussed on 13 June 2026, shifts the emphasis to proactive cyber defence, with a focus on resilience, AI-related threats and implementing European law such as NIS2 ¹. It was a draft at the time of that discussion. The EU4CyberUA project, launched in June 2026, aims to strengthen Ukraine’s cyber resilience ².

“Sovereign AI” is used here as a working frame: a country’s ability to develop and use artificial intelligence on infrastructure, data and rules that it can govern. No official Ukrainian definition was found, so this is the association’s position for discussion, not an established term.

What public sources say

NIST reports that a concept note for an AI RMF profile for critical infrastructure was published on 7 April 2026, and that AI RMF 1.0 is being revised ³. It is only an announcement of a future document, so no substantive recommendations should be drawn from it yet.

Joint guidance from several national agencies includes Deploying AI Systems Securely (15 April 2024) ⁴ and AI Data Security (22 May 2025), which concerns the data used to train and operate AI systems ⁵.

On threats: in ENISA’s Threat Landscape 2025, about 80% of incidents are hacktivism, and most are low-level DDoS attacks with very low impact ⁶. It is a reminder to read reports proportionately, not to treat every threat as sophisticated.

Topics for cross-sector dialogue

These are topics the association proposes for conversation. They are not conclusions and not recommendations about any particular project.

• What “AI-ready” means for a data centre in terms of cyber security and continuity.
• Energy for computing: reliability of supply, redundancy and dependence on outside suppliers.
• Data: who owns it, where it is stored, how it is classified and who has access.
• Cyber resilience of the whole chain: from the site and the network to model and platform suppliers.
• The division of roles between the state, critical-infrastructure operators and the private sector.
• The people and skills needed to operate such systems securely.

What the association does, and what it does not

The association brings market participants together, supports the exchange of experience and publishes explainers with sources. It does not design or build infrastructure, raise or allocate investment, certify or assess data centres or AI systems, or provide technical services.