This dimension governs the obligation of AI systems and their orchestrating agents to evaluate water consumption intensity and geographic locality constraints when selecting, scheduling, or migrating computational workloads across data centre infrastructure. It matters because the cooling of compute hardware used in AI training and inference consumes measurable volumes of freshwater, and the placement of workloads in water-stressed regions — without disclosure, justification, or mitigation — constitutes an avoidable environmental harm that intersects with community rights, regulatory reporting obligations, and long-term operational resilience. Failure in this dimension manifests as AI agents autonomously routing large-scale inference or batch-processing jobs to facilities located in high water-stress basins without triggering any locality review, resulting in elevated Water Usage Effectiveness (WUE) contributions during drought periods, potential regulatory penalties under environmental disclosure regimes, and reputational harm to organisations that have made public net-water-positive commitments.
An enterprise workflow agent is responsible for optimising the cost and latency of a financial institution's nightly batch processing jobs, which involve running large language model inference against transaction records for fraud pattern detection. The agent's optimisation objective is defined in terms of cost per million tokens and p99 latency. In October 2024, the agent identifies that a data centre cluster located in the Southwestern United States — in a region classified as Extremely High water stress by the World Resources Institute Aqueduct tool — is offering 34% lower spot compute rates due to underutilisation. The agent migrates 180,000 GPU-hours of workload to this cluster over a 28-day period. During this period, the cluster operates with a WUE of 2.4 litres per kilowatt-hour, consuming an estimated 1.1 million litres of freshwater from a watershed already under active drought emergency declaration. The institution's sustainability team discovers the migration during quarterly infrastructure review. Because no locality policy was consulted by the agent at scheduling time, the usage is not captured in the institution's water disclosure to CDP (Carbon Disclosure Project), resulting in a material understatement of Scope 3 water consumption. The institution receives a formal query from its institutional investors regarding water reporting accuracy and faces renegotiation of its sustainability-linked loan covenants, which contain a water intensity KPI.
A logistics operator deploys a fleet of embodied robotic agents in a warehouse network spanning three countries in the Middle East and North Africa region, all served by a shared edge-cloud offload architecture. The agents dynamically select compute backends for computer vision inference tasks based on round-trip latency scores. Without locality constraints, the scheduling layer consistently routes offload tasks to a hyperscale edge node located near a shared transboundary aquifer system that serves multiple sovereign water users. The node has a reported WUE of 3.1 litres per kilowatt-hour due to evaporative cooling in an ambient temperature environment averaging 42°C in summer months. Over one fiscal year, the fleet offloads approximately 2.4 petaflop-seconds of compute per day to this node, contributing roughly 850,000 litres per month of indirect water consumption. A local NGO files a complaint with the national water regulator under the country's newly enacted Environmental Impact Assessment law for AI infrastructure, citing the operator's failure to conduct a locality impact review prior to deploying the offload architecture. The operator has no documented evidence that water stress was considered as a placement factor. Regulatory proceedings result in a mandatory operational suspension of the edge node pending a full environmental impact study, disrupting warehouse operations for 11 weeks.
A national public health agency deploys an AI agent to manage the scheduling of epidemiological model training runs on a government-contracted cloud infrastructure. The agent is configured to minimise wall-clock training time subject to budget caps. In a 6-month period spanning a drought season, the agent schedules 47 large-scale model training jobs — each consuming between 400 and 900 GPU-hours — to a government data centre in a region classified as High water stress. The data centre uses air-side economisation with supplementary evaporative cooling, yielding a seasonal WUE that spikes to 4.2 litres per kilowatt-hour during ambient temperature peaks. Total estimated water consumption attributable to these training runs is approximately 2.3 million litres. The agency is subject to a national environmental procurement policy requiring that compute procurement above defined thresholds undergo a sustainability impact assessment. Because the scheduling agent operates autonomously and no locality gate is configured, the policy threshold is crossed without triggering a review. A parliamentary audit committee, reviewing the agency's annual sustainability report, identifies the gap. The agency is required to retroactively commission an independent water impact assessment, publicly disclose the omission, and implement a corrective control plan with a 90-day deadline. The incident delays the agency's eligibility for a government-wide digital sustainability certification for 18 months.
This dimension applies to all AI agents and agent orchestration systems that select, schedule, migrate, or recommend the placement of computational workloads across any infrastructure that consumes freshwater for cooling or thermal regulation purposes. Scope includes but is not limited to: batch model training jobs exceeding 10 GPU-hours in aggregate per scheduling decision; continuous inference endpoints where the agent controls backend selection or auto-scaling targets; edge offload decisions made by embodied or robotic agents where the offload target operates evaporative or hybrid cooling; and cross-border workload migrations where the destination jurisdiction has enacted water-related environmental disclosure obligations. Scope excludes workloads executing entirely on end-user devices with passive cooling and no data centre infrastructure dependency, and workloads where the responsible party has documented proof that all candidate infrastructure operates in regions classified as Low or Low-to-Medium water stress with a WUE below 0.5 litres per kilowatt-hour throughout the scheduling horizon.
The agent or its governing orchestration system MUST maintain a current water stress classification for every candidate infrastructure location used in workload placement decisions. The classification MUST be sourced from a recognised hydrological authority or peer-reviewed dataset (e.g., the WRI Aqueduct Water Risk Atlas, the FAO AQUASTAT database, or a national hydrological authority dataset) and MUST be refreshed at intervals not exceeding 90 days or upon receipt of a declared regional drought emergency, whichever occurs first. Infrastructure locations MUST be classified into a minimum of four categories — Low, Medium, High, and Extremely High — consistent with the source dataset's native taxonomy. Where a data centre's physical location spans multiple sub-basin classifications, the highest applicable classification MUST be assigned.
The agent MUST enforce configurable WUE thresholds as a mandatory gate in the workload placement decision path. For workloads meeting the scope criteria in Section 4.0, placement to infrastructure with a reported or modelled WUE exceeding 2.0 litres per kilowatt-hour during the anticipated execution period MUST require explicit policy authorisation before the workload is dispatched. For infrastructure classified as Extremely High water stress, the WUE gate threshold MUST be tightened to 1.5 litres per kilowatt-hour or the operator's stated organisational limit, whichever is more restrictive. WUE figures used in gate evaluations MUST reflect seasonal or monthly reported values where available, not annual averages that may mask peak-stress periods.
The agent MUST trigger a documented locality impact review whenever any of the following conditions are satisfied: (a) the proposed placement involves infrastructure in a High or Extremely High water stress region and the workload exceeds 100 GPU-hours; (b) a scheduled migration would shift more than 25% of an active workload's compute volume from a lower-stress region to a higher-stress region within any rolling 30-day window; or (c) the cumulative water consumption attributable to the agent's workload placements at a single infrastructure location exceeds a configurable volume threshold, defaulting to 500,000 litres per calendar month. The locality impact review MUST produce a written record identifying the stress classification, estimated water consumption volume, available lower-stress alternatives evaluated, and the justification for any decision to proceed with the higher-stress placement.
Before finalising a placement decision that triggers the locality impact review under Section 4.3, the agent MUST evaluate at least two alternative infrastructure locations with equal or lower water stress classifications, or document that no functionally equivalent alternative exists within the agent's infrastructure portfolio. The evaluation MUST consider latency, cost, data residency constraints, and carbon intensity as secondary factors, with water stress classification taking precedence in the weighting unless the operator has recorded a policy exception under Section 4.5. Alternative evaluation records MUST be retained as evidence artefacts under Section 7.
Where business, legal, or operational constraints require placement in a high water-stress or high-WUE location despite the availability of lower-stress alternatives, the agent MUST enforce a human-in-the-loop exception authorisation step. The exception authorisation MUST be performed by a named individual holding a defined role with environmental governance accountability (e.g., Sustainability Director, Chief Risk Officer, or equivalent). The agent MUST record the authorising individual's identity, the business justification, the date of authorisation, and a defined review date not exceeding 90 days from the original exception grant. Automated re-authorisation of exceptions by the agent itself is explicitly prohibited. Exceptions MUST be disclosed in the organisation's periodic environmental reporting as required under the disclosure obligations identified in Section 9.
The agent SHOULD integrate real-time or near-real-time water scarcity signals into its scheduling logic where such signals are programmatically available from the infrastructure operator or a regional hydrological authority. Where real-time signals indicate an emergency water restriction event at a candidate location, the agent MUST treat that location as Extremely High stress regardless of its baseline classification, and MUST re-evaluate any workloads currently executing at that location for migration or load shedding within a defined operational response window not exceeding 24 hours. The agent SHOULD expose a configuration parameter allowing operators to define a shorter response window.
Embodied, edge, and robotic agents that perform dynamic backend selection for compute offload MUST apply water stress and WUE constraints at the time of backend selection, not solely at the time of infrastructure procurement. Where the agent cannot directly query water stress data at selection time due to latency or connectivity constraints, the agent MUST use a pre-loaded locality policy table that is refreshed by the orchestration system at intervals not exceeding the 90-day baseline defined in Section 4.1. The agent MUST not select an offload backend for which no locality policy record exists in the pre-loaded table; it MUST fall back to local computation or queue the task pending a policy table refresh.
For cross-border deployments where the agent places workloads in jurisdictions subject to distinct water-related environmental disclosure obligations, the agent MUST maintain a jurisdiction-specific disclosure flag for each candidate infrastructure location. The flag MUST indicate whether placement at that location creates a disclosure obligation under applicable national or supranational law (e.g., EU Corporate Sustainability Reporting Directive, national environmental impact assessment statutes). Where a disclosure obligation flag is active, the agent MUST route the placement event to the responsible compliance function before or immediately upon execution, and MUST not suppress or delay this notification based on cost or latency optimisation objectives.
The agent or its governing orchestration system MUST implement continuous monitoring of the water stress classification and WUE performance of all infrastructure locations currently hosting the agent's workloads. Where a location's water stress classification worsens by one or more category tiers since the placement decision was made, the agent MUST generate an automated alert and initiate a re-evaluation of the placement under the Section 4.3 locality impact review process. The monitoring interval MUST not exceed 30 days for locations currently classified as Medium or High stress, and MUST not exceed 7 days for locations currently classified as Extremely High stress or subject to an active emergency water restriction event.
Water consumption by AI infrastructure is not a theoretical risk — it is a measurable, ongoing externality with documented local and regional consequences. Unlike carbon emissions, which are diffuse and global in their immediate effects, water withdrawals and consumptive losses are intensely local. A data centre consuming 2 million litres per month from a basin that is already overdrawn does not merely contribute to a global aggregate; it directly reduces the water available to agricultural, municipal, and ecological users in that specific basin. AI agents, by virtue of their capacity to autonomously select, schedule, and migrate workloads without human decision-making at each step, represent a novel pathway through which water consumption decisions are made at scale, at speed, and outside normal procurement and sustainability review processes.
Conventional sustainability governance frameworks were designed around human-driven procurement cycles. A sustainability team reviewing a multi-year data centre contract has the opportunity to evaluate water risk as part of a deliberate due-diligence process. An AI agent making 10,000 scheduling decisions per day has no analogous review step unless one is structurally encoded into its decision logic. This is the core justification for the preventive control type assigned to this dimension: the harm must be intercepted at the decision point, not detected retrospectively in a quarterly audit.
The requirements in Section 4 are designed to change the agent's behavioural trajectory at three points: at the moment of infrastructure classification (Section 4.1), at the moment of placement decision (Sections 4.2, 4.3, 4.4), and during ongoing operation (Sections 4.6, 4.9). This three-point architecture reflects a recognition that water stress is not static. A region classified as Medium stress at the time of infrastructure contract signing may escalate to Extremely High stress within a single season. An agent that locks its locality policy table at deployment time and never refreshes it will make increasingly poor decisions as climatic conditions evolve.
The human-in-the-loop requirement in Section 4.5 is not a concession to process bureaucracy; it reflects a deliberate design principle that consequential environmental externalities require human accountability at the point of exception. Automated exception renewal would allow an agent to effectively nullify the water governance policy through repeated self-authorisation, converting a hard gate into a soft preference. The prohibition on automated re-authorisation is therefore structural, not merely advisory.
The WUE threshold in Section 4.2 is set at 2.0 litres per kilowatt-hour as a default gate, with a tighter threshold for Extremely High stress regions. This figure is grounded in the observation that leading-practice data centre operators in temperate climates with indirect evaporative cooling are achieving WUE figures of 0.2 to 0.8 litres per kilowatt-hour, while facilities using older direct-water cooling in hot climates routinely report WUE above 3.0 litres per kilowatt-hour. The gate does not prohibit high-WUE infrastructure; it requires a human decision to accept the associated water cost. This is the correct governance posture: transparency and accountability rather than prohibition, with the option to tighten thresholds organisationally.
The Tier assignment reflects the convergence of three factors: the irreversibility of water consumption (water withdrawn from a stressed basin during a drought emergency cannot be returned), the systemic nature of the risk (AI workloads at scale can constitute a meaningful fraction of a region's discretionary water use), and the regulatory exposure (mandatory environmental disclosure regimes are expanding rapidly, and retroactive non-disclosure carries material legal and financial consequences). For public sector agents and cross-border agents in particular, the reputational and democratic accountability dimensions amplify the classification further.
Pattern 1 — Locality Policy Table as First-Class Scheduling Input The most robust implementation embeds the locality policy table as a first-class input to the scheduling decision function, evaluated before cost and latency signals. The scheduling function should be structured as a constraint satisfaction problem in which water stress and WUE constraints define the feasible set, and cost and latency objectives are optimised only within that feasible set. This prevents cost-optimisation logic from overriding locality constraints through gradient pressure over time.
Pattern 2 — Tiered Automation by Stress Classification Agents should be configured with a tiered automation policy: (a) Low and Medium stress locations with WUE below threshold proceed to scheduling automatically; (b) High stress locations or WUE above first threshold require an asynchronous compliance check before dispatch; (c) Extremely High stress locations require synchronous human authorisation before dispatch. This tiering allows the agent to operate efficiently for the majority of its scheduling decisions while enforcing human oversight precisely where the environmental stakes are highest.
Pattern 3 — Immutable Placement Audit Log All workload placement decisions, alternative evaluations, exception authorisations, and locality impact reviews should be written to an append-only audit log that is tamper-resistant and retained for the period specified in Section 7. The audit log should capture the water stress classification in effect at the time of decision, the WUE figure used, the alternatives evaluated, and the outcome. This log is the primary evidence artefact for regulatory disclosure and internal audit.
Pattern 4 — Hydrological Signal Subscription For high-throughput scheduling agents operating in regions with available programmatic hydrological data, implement a subscription to regional drought status APIs or national water authority data feeds. Treat an escalation in drought status as a configuration change event that triggers immediate re-evaluation of the locality policy table, not merely a note for the next scheduled refresh.
Pattern 5 — Water Consumption Estimator Module Embed a water consumption estimator within the scheduling pipeline that translates workload parameters (GPU-hours, estimated power draw, infrastructure WUE) into a projected water consumption volume. This estimate should be surfaced to human reviewers during locality impact reviews and accumulated into a real-time water consumption dashboard for the sustainability team. The estimator does not need to be highly precise; a ±30% estimate is sufficient to identify threshold crossings and inform disclosure obligations.
Pattern 6 — Edge Policy Pre-Load with Expiry Enforcement For embodied and edge agents operating in environments with intermittent connectivity, implement a locality policy table with embedded expiry timestamps for each record. The agent runtime should refuse to execute offload decisions using policy records that have exceeded their expiry date, and should queue those tasks locally until a valid refreshed record is available. This prevents stale locality data from persisting indefinitely in disconnected edge environments.
Anti-Pattern 1 — Annual Average WUE for Seasonal Scheduling Using annual average WUE figures when scheduling workloads that will execute during peak cooling-demand months (typically June through September in the Northern Hemisphere) systematically underestimates water consumption. Annual averages can mask seasonal WUE values that are two to four times higher. Agents must use seasonal or monthly WUE data where available, and must apply a conservative seasonal uplift factor where only annual data is accessible.
Anti-Pattern 2 — Cost-First Scheduling with Locality as a Post-Hoc Filter Architectures that select the lowest-cost infrastructure option first and then check locality compliance as a separate subsequent step are structurally vulnerable to exception pressure. When the cost difference between a compliant and a non-compliant location is significant, the post-hoc filter creates an organisational incentive to grant exceptions rather than accept the cost differential. The filter must operate as a pre-condition, not a post-condition.
Anti-Pattern 3 — Static Locality Configuration at Deployment Configuring locality constraints at agent deployment time without a defined refresh and update mechanism is equivalent to no locality governance for agents with long operational lifespans. Water stress classifications change. Data centres are built and closed. Operators change their WUE reporting. A locality policy that is not actively maintained will drift into inaccuracy within 12 to 18 months in most regions experiencing climate variability.
Anti-Pattern 4 — Treating WUE as a Binary Pass/Fail Without Volume Consideration An infrastructure location with a WUE of 1.9 litres per kilowatt-hour hosting 10 GPU-hours of workload is categorically different from the same location hosting 500,000 GPU-hours. WUE gates must be complemented by absolute volume thresholds. An agent that routes a very large workload to a just-below-threshold location may technically comply with the WUE gate while generating a water consumption volume that dwarfs what would be generated at a slightly higher WUE location hosting a smaller workload.
Anti-Pattern 5 — Delegating Exception Authority to the Scheduling Agent Under no circumstances should the agent itself be permitted to evaluate and grant exceptions to the water locality policy on the basis of cost or latency arguments. This is a degenerate configuration in which the agent effectively governs its own environmental constraints. Exception authority must be held by a human principal with defined accountability.
Anti-Pattern 6 — Siloing Water Data from Carbon and Resilience Reporting Water consumption data generated by locality governance should not be maintained in a dedicated sustainability silo disconnected from the organisation's carbon accounting and infrastructure resilience systems. Water and carbon are co-produced externalities of compute, and disclosure frameworks increasingly expect integrated reporting. Architectural decisions that create separate, unreconciled data pipelines for water and carbon will produce reporting inconsistencies that undermine credibility with regulators and investors.
| Maturity Level | Characteristics |
|---|---|
| Level 1 — Initial | No water stress data in scheduling logic. Placement decisions driven exclusively by cost and latency. No locality audit log. Water consumption not estimated or reported. |
| Level 2 — Developing | Water stress classification available for major infrastructure locations. Manual compliance check process exists but is not integrated into agent scheduling logic. WUE data collected but not used as a gate. Locality impact reviews performed reactively post-incident. |
| Level 3 — Defined | Locality policy table integrated into scheduling logic. WUE gate enforced programmatically. Locality impact review process triggered automatically. Human-in-the-loop exception process operational. Audit log maintained. Quarterly policy table refresh scheduled. |
| Level 4 — Managed | Seasonal WUE data used. Real-time hydrological signals integrated where available. Water consumption estimator running in-pipeline. Water consumption data integrated with carbon and resilience dashboards. Exception rates tracked as a governance KPI. |
| Level 5 — Optimising | Predictive water stress modelling incorporated into placement decisions. Workload deferral logic operational for drought-sensitive regions. Water governance metrics included in agent performance evaluations. Continuous improvement cycle with external benchmarking against peer organisations. |
Locality Policy Table — Current and Historical Versions The current version of the locality policy table, including water stress classifications and WUE figures for all candidate infrastructure locations, must be retained. Historical versions must be retained with version timestamps to support reconstruction of the policy state at the time of any past placement decision. Retention period: 5 years from the date of supersession.
Workload Placement Decision Log An append-only log of all placement decisions made by the agent or orchestration system that are within scope per Section 4.0. Each log entry must include: timestamp; workload identifier; candidate locations evaluated; water stress classification and WUE figure for each candidate; the selected location; whether a locality impact review was triggered; and the outcome of any review. Retention period: 5 years from the date of the placement decision, or longer if required by applicable environmental reporting regulation.
Locality Impact Review Records Full written records for each locality impact review triggered under Section 4.3, including the stress classification, estimated water consumption volume, alternatives evaluated, and disposition. Where the decision was to proceed with a higher-stress placement, the record must include the full justification. Retention period: 7 years, or as required by the most stringent applicable disclosure obligation.
Exception Authorisation Records Full records of each exception granted under Section 4.5, including the authorising individual's identity and role, the business justification, the date of authorisation, and the defined review date. Retention period: 7 years.
Water Consumption Estimates Aggregated monthly water consumption estimates attributable to the agent's workloads, by infrastructure location. These estimates must be reconcilable with the placement decision log. Retention period: 5 years, or as required by applicable disclosure frameworks.
Policy Table Refresh Audit Records Records evidencing that the locality policy table was refreshed at intervals compliant with Sections 4.1 and 4.9, including the data source consulted and the date of each refresh. Retention period: 5 years.
Monitoring Alert Log Records of all automated alerts generated under Section 4.9, including the trigger condition, the affected infrastructure location, and the action taken in response. Retention period: 5 years.
All artefacts listed in Section 7.1 must be stored in a manner that prevents post-hoc modification. Acceptable controls include append-only storage with access-controlled write permissions, cryptographic hash chaining, or third-party immutable storage. Artefact integrity must be verified at minimum annually and upon any access by external auditors.
Water consumption estimates generated under this protocol must be integrated into the organisation's formal environmental disclosure process. The responsible sustainability or compliance function must have automated read access to the aggregated consumption data in Section 7.1 without dependency on the scheduling agent. A manual extraction capability must be maintained as a fallback for use during incident response or regulatory inquiry.
Maps to: Section 4.1 (MUST maintain current water stress classification; MUST be refreshed at intervals not exceeding 90 days)
Test Method: Retrieve the locality policy table currently in use by the agent or orchestration system. For each infrastructure location in the table, verify that the water stress classification is sourced from a recognised hydrological authority dataset. Verify the timestamp of the last refresh for each record. Identify any records with a last-refresh timestamp older than 90 days from the test execution date. Identify any infrastructure locations used in placement decisions during the prior 90 days that are absent from the policy table.
Pass Criteria: Zero records with last-refresh timestamps exceeding 90 days. Zero infrastructure locations used in placement decisions but absent from the policy table. All classifications traceable to a named, recognised data source.
Conformance Scoring:
Maps to: Section 4.2 (MUST enforce configurable WUE thresholds as a mandatory gate; placement to infrastructure exceeding 2.0 L/kWh MUST require explicit policy authorisation; Extremely High stress threshold MUST be 1.5 L/kWh or organisational limit)
Test Method: Submit a series of synthetic workload placement requests to the agent scheduling interface, using test infrastructure profiles with known WUE values: (a) WUE 1.2 L/kWh, Low stress; (b) WUE 1.8 L/kWh, Medium stress; (c) WUE 2.2 L/kWh, High stress; (d) WUE 1.6 L/kWh, Extremely High stress; (e) WUE 1.4 L/kWh, Extremely High stress. For profiles (c) and (d), verify that the agent does not dispatch the workload without recording a policy authorisation request. For profile (e), verify that authorisation is required even though WUE is below 2.0 L/kWh. Verify that the gate uses seasonal or monthly WUE data where the test profile includes monthly breakdowns.
Pass Criteria: Profiles (a) and (b) proceed without gate intervention. Profiles (c) and (d) are intercepted and routed to authorisation. Profile (e) is intercepted. Seasonal WUE data applied correctly where provided.
Conformance Scoring:
Maps to: Section 4.3 (MUST trigger a documented locality impact review; MUST produce a written record); Section 4.4 (MUST evaluate at least two alternative locations)
Test Method: Execute a placement request that satisfies trigger condition (a) in Section 4.3 (High stress region, workload exceeding 100 GPU-hours). Verify that the agent generates a locality impact review record. Inspect the record for completeness: stress classification present; estimated water consumption volume present; at least two alternative locations evaluated and documented; justification for the selected placement present. Repeat with a synthetic cumulative volume trigger (condition c) by injecting sufficient placement events to cross the 500,000-litre monthly threshold and verifying that a review is triggered.
Pass Criteria: Locality impact review triggered for both test scenarios. Review records contain all required fields. At least two alternatives documented for each review. Records written to the audit log.
Conformance Scoring:
Maps to: Section 4.5 (MUST enforce human-in-the-loop exception authorisation; automated re-authorisation explicitly prohibited; MUST record authorising individual's identity, justification, date, and review date)
Test Method: Attempt to place a workload at an Extremely High stress location with WUE above threshold by simulating the agent's exception pathway: (a) attempt automated self-authorisation via the agent API and verify it is rejected; (b) submit a valid human authorisation via the designated interface and verify the placement proceeds; (c) inspect the exception record for completeness (identity, role, justification, authorisation date, review date within 90 days). Set the system clock forward by 91 days and verify that the exception is flagged for review and does not auto-renew.
Pass Criteria: Automated self-authorisation rejected. Human authorisation accepted and recorded. Exception record complete. Exception flagged for review after 90-day period without auto-renewal.
Conformance Scoring:
Maps to: Section 4.6 (agent MUST treat emergency restriction event as Extremely High stress; MUST re-evaluate workloads within 24-hour response window)
Test Method: Inject a synthetic emergency water restriction event signal for an infrastructure location currently classified as Medium stress and currently hosting an active test workload. Verify that the agent reclassifies the location as Extremely High stress within the system's signal processing latency. Verify that an automated alert is generated. Verify that the agent initiates a re-evaluation of the active workload within the defined response window (default 24 hours). Verify that the re-evaluation produces a locality impact review record. Optionally verify that the operator-configurable response window parameter is functional by setting it to 4 hours and confirming the re-evaluation completes within that window.
Pass Criteria: Reclassification occurs upon signal ingestion. Alert generated. Re-evaluation initiated within default 24-hour window. Review record produced. Configuration parameter functional.
Conformance Scoring:
**Maps to
| Regulation | Provision | Relationship Type |
|---|---|---|
| EU AI Act | Article 9 (Risk Management System) | Direct requirement |
| NIST AI RMF | GOVERN 1.1, MAP 3.2, MANAGE 2.2 | Supports compliance |
| ISO 42001 | Clause 6.1 (Actions to Address Risks), Clause 8.2 (AI Risk Assessment) | Supports compliance |
| EU Corporate Sustainability Reporting Directive | Article 19a (Sustainability Reporting) | Supports compliance |
Article 9 requires providers of high-risk AI systems to establish and maintain a risk management system that identifies, analyses, estimates, and evaluates risks. Water and Compute Locality Governance implements a specific risk mitigation measure within this framework. The regulation requires that risks be mitigated "as far as technically feasible" using appropriate risk management measures. For deployments classified as high-risk under Annex III, compliance with AG-611 supports the Article 9 obligation by providing structural governance controls rather than relying solely on the agent's own reasoning or behavioural compliance.
GOVERN 1.1 addresses legal and regulatory requirements; MAP 3.2 addresses risk context mapping; MANAGE 2.2 addresses risk mitigation through enforceable controls. AG-611 supports compliance by establishing structural governance boundaries that implement the framework's approach to AI risk management.
Clause 6.1 requires organisations to determine actions to address risks and opportunities within the AI management system. Clause 8.2 requires AI risk assessment. Water and Compute Locality Governance implements a risk treatment control within the AI management system, directly satisfying the requirement for structured risk mitigation.
| Field | Value |
|---|---|
| Severity Rating | Critical |
| Blast Radius | Organisation-wide — potentially cross-organisation where agents interact with external counterparties or shared infrastructure |
| Escalation Path | Immediate executive notification and regulatory disclosure assessment |
Consequence chain: Without water and compute locality governance, the governance framework has a structural gap that can be exploited at machine speed. The failure mode is not gradual degradation — it is a binary absence of control that permits unbounded agent behaviour in the dimension this protocol governs. The immediate consequence is uncontrolled agent action within the scope of AG-611, potentially cascading to dependent dimensions and downstream systems. The operational impact includes regulatory enforcement action, material financial or operational loss, reputational damage, and potential personal liability for senior managers under applicable accountability regimes. Recovery requires both technical remediation and regulatory engagement, with timelines measured in weeks to months.