Example 2: Furnace digital twin with embedded AI
An AI system impact assessment and an AI risk assessment for a vendor-supplied digital twin of the annealing furnaces, used for maintenance, quality and performance. The twin mostly advises, so the central question is not what it may do but how far anyone should trust what it says. Impacts and risks sit in separate sections and link by ID.
Approval decision
Approved with conditions Advisory use only. The twin may monitor, alert, estimate, recommend maintenance and run bounded what-if scenarios for people who decide. It may bring maintenance forward but never defer it, and it may flag where a hold looks longer than needed but never shorten a qualified cycle. It may not create work orders on its own, update itself unreviewed, feed other AI systems yet, or act on the furnace.
Decision recorded per permission, with conditions, owners and reassessment triggers, on the Decision tab.
Needs attention
Open points that shape the decision.
How this differs from Example 1
| Example 1: annealing control and routing | Example 2: furnace digital twin | |
|---|---|---|
| Central question | What may the AI change or release? | How far should anyone trust what the twin says? |
| Typical authority | Recommend. Control and release excluded. | Observe, diagnose, predict, prescribe maintenance to people, simulate. Closed loop excluded. |
| Dominant risks | Unsafe action, unverified release. | Fidelity drift, stale data, overreliance, authority creep, margin traded for energy. |
| Role of the plant | Provider and deployer (in-house build). | Deployer of a vendor platform. |
Open Example 1. The same method, severity scales and rating rules apply to both.
Assessment record
- System
- Furnace Digital Twin Platform with embedded AI components (vendor-supplied, illustrative)
- Vendor
- ThermaTwin Systems (fictional)
- Organization and role
- Northfield Aluminum, Rolling Plant 2 (fictional). The plant is the deployer. The vendor is the provider. Substantially modifying the vendor’s AI components could change that.
- Intended purpose
- Help maintenance, quality and operations staff understand furnace condition and behavior, plan maintenance, estimate thermal state where no sensor reaches, test changes virtually before trying them on product, and find where energy or cycle time might be reduced without losing metallurgical margin. These are objectives, not demonstrated results.
- Level of twin in scope
- Predictive, and prescriptive for maintenance: it estimates condition from how the ovens perform and recommends the maintenance it thinks is needed, for people to decide. Bounded what-if exploration and hold-time analysis for performance and energy, as findings for people. Nothing is sent to the furnace, and it does not create or schedule work on its own.
- Out-of-scope uses
- Replacing preventive maintenance or statutory inspections. Creating or scheduling maintenance work without a person’s approval. Any safety function. Sending commands or setpoints to the furnace. Product release. Operation outside the validated range.
- Scope of the assessment
- The AI components are assessed as AI systems. Physics-based parts of the twin are treated as context, because they may fall outside the definition of an AI system. See “Is it AI?” on the System tab.
- Lifecycle stage
- Pre-deployment evaluation: vendor selection and validation
- Affected parties
- Maintenance technicians and operators. Metallurgy and quality staff. Production planners. Downstream customers, through quality decisions. The environment. The business and its vendor relationship.
- Assessed on
- Oct 19, 2026. Review due by Jan 19, 2027, or earlier on a change trigger.
Real versus fictional: the plant, vendor, system, people and ratings are invented for this sample. Process and maintenance details are deliberately generic, and no operating parameters appear. Standards and regulations are named to show alignment, not to claim conformity. Verify every reference against its current official text before relying on it.
System and integration
A digital twin is a virtual model of one specific furnace, kept in step with it by live data and used to support decisions. If the data link or the upkeep stops, it quietly becomes a simulation. The assessment depends on where AI sits in the twin and which way information flows.
Why the plant wants a twin
Maintenance
Asks: Is a component degrading, what maintenance does it need, and when?
Could go wrong: A missed failure can injure people and damage equipment. False alarms waste downtime.
AI: anomaly detection, remaining-useful-life estimation, maintenance prescription.
Quality
Asks: What is the thermal history inside the load, where no sensor reaches, and what properties will it give?
Could go wrong: Estimates stop matching the load and unsuitable material is accepted.
AI: virtual sensing, thermal stress surrogates, property prediction.
Performance and energy
Asks: How long must the load really be held, and what would a different load pattern or schedule save?
Could go wrong: A shorter hold trades metallurgical margin for energy and time, or results beyond the validated range are treated as predictions.
AI: surrogate models, soak-time and ramp optimization.
Capabilities
| ID | Capability | Purpose | AI component and pattern | Requested | Approved |
|---|
Physics-only or AI-powered?
A twin can run on physics alone: thermodynamic equations, finite element analysis and computational fluid dynamics, fed by thermocouple and power readings. Adding machine learning, including physics-informed neural networks, turns it into an adaptive engine that learns from operating and metallurgical data. This assessment is about the AI-powered (hybrid) form. A physics-only twin is not AI, but it is not risk-free: it assumes ideal conditions and drifts if burner efficiency degrades, circulation fans wear or a coil is stacked differently.
| Physics-only twin | AI-powered (hybrid) twin | What the assessment must cover | |
|---|---|---|---|
| Heat model | Fixed CFD, FEA and thermodynamic calculations | Machine learning with physics constraints: surrogate models and physics-informed networks | Physics: verify the equations and inputs. Learned parts: validate across a range and monitor drift. |
| Annealing cycles | Pre-set time and temperature ramps | Holds and ramps optimized on estimated core temperature | Any change to a qualified cycle needs requalification. Not approved here (P-14). |
| Energy use | Static profile | Reduced by optimizing firing and hold times | Energy is never traded against metallurgical requirements (R-9). |
| Handling variances | Manual recalibration by operators | Adjusts for load layout, alloy batch variation or door leaks | Automatic adjustment is either recalibration (restricted, P-8) or closed loop (not approved, P-9). |
| How it fails | Drifts from reality as the furnace wears, in ways the physics can explain | Can be confidently wrong outside the conditions it learned from, with no bug to find | Fidelity checks run independently of the twin (R-1). |
| Needs an AI assessment | No, but it still needs validation | Yes | This assessment. |
The metallurgical stakes are the reason for the caution. Recovery, recrystallization, grain structure, temper and strain relief all depend on the heat the load actually receives, and the highest-specification products, such as aerospace and automotive alloys, leave the least room for error.
Is it AI?
What makes the maintenance capabilities AI is inference: the twin works out what maintenance it thinks is needed from how the ovens perform, instead of following a service schedule or threshold that people wrote. If the logic can be read and its output predicted from the design alone, it is automation. If its behavior comes from patterns in data, it is AI, and it needs testing and monitoring, not just verification. A virtual 3D simulation that mirrors temperature profiles using standard fluid dynamics and sensor feeds is a digital twin but not AI. Training it on operating data so it can shorten cycle times, predict mechanical properties or detect furnace degradation is AI.
The determinations below are provisional for this illustrative sample. Confirm each with the vendor. EU AI Act Art. 3(1) and recital 12 separate inference from rules defined solely by people, and the Commission published guidelines on the definition in 2025. Verify current wording.
| Component | Technique (assumed) | Infers from data? | Determination | Confirm with the vendor |
|---|---|---|---|---|
| Physics-based twin core (CFD, FEA, thermodynamic equations) | Equations written by people, tuned to the furnace | No | Probably not AI | That no learned components sit inside the core. |
| Condition estimation from oven performance (T1) | Statistical or machine-learning model of normal and abnormal behavior | Yes: learns what normal looks like from data | Likely AI | Model type, training data and validated range. |
| Remaining useful life (T2) | Learned prognostic model | Yes | Likely AI | As above, plus the failure data behind it. |
| Maintenance prescription (T6) | Prediction plus an action layer: learned ranking or human-written rules | Partly: the prediction is learned, the mapping to action may be rules | Likely AI | Whether the recommended action is learned or rule-based. A rule table on top of an AI prediction inherits the prediction’s risk. |
| Virtual sensing (T3) | Surrogate or virtual sensor | Yes | Likely AI | Model type and validated range. |
| What-if surrogate and optimizer (T4) | Learned surrogate with an optimizer | Yes for the surrogate. A classical optimizer alone is not | Likely AI | Which parts are learned. |
| Physics-informed neural networks and surrogate models | Learned models constrained by physical equations | Yes: they learn from data, within physical limits | Likely AI | Which parts are learned, and how strictly the physics constraint is enforced. |
| Soak-time and ramp optimization (T7) | An optimizer on a learned surrogate, using estimated core temperature | Yes for the surrogate and the estimate. A classical optimizer alone is not | Likely AI | The objective and its constraints, and whether quality is a hard limit. |
| Property outcome prediction (T8) | A model linking heat and airflow history to past test results | Yes | Likely AI | Training data, test-result coverage and validated range. |
| Calibration and updating (T5) | Parameter fitting or retraining | Depends | To be determined | Classical parameter fitting is not AI. Retraining a model is. |
| Freshness checks, thresholds and interlocks | Fixed rules and deterministic logic | No | Not AI, still governed | IEC 61508 and IEC 62443 still apply. |
Integration patterns
Where AI sits relative to the twin decides the risk. Integration patterns are a Zeno framing, not a standard.
| Pattern | What it means here | Status | Governance need |
|---|
Data flow
One-way flow. In the approved configuration data move from the furnace to the twin. There is no write path from the twin to the furnace or to any protective function.
Authority levels
The same scale as Example 1, with wording extended for twins. A Zeno term, not taken from a standard. Chips show where each capability is approved.
Dependency on Example 1
The twin can supply thermal-state estimates (T3) to the annealing assistant’s property prediction in Example 1. If it did, Example 1’s R-2 (temperature data do not represent the product) and R-6 (changes without review) would extend into the twin, and any twin change would be a change trigger for Example 1.
Both systems can also predict mechanical properties: the twin from heat and airflow history (T8), the assistant from recorded thermal history (C3). If they disagree, neither is authoritative. Verification testing is, and the disagreement is logged and referred to Quality.
This assessment restricts that link (P-6) until both assessments are updated together.
What the plant asks the vendor
Because the plant is a deployer, it relies on the vendor for much of the evidence. These are the minimum asks before use, tied to third-party AI due diligence.
- Documentation of each AI component: purpose, training data summary, known limits and validated range.
- Validation evidence for furnaces and conditions like the plant’s, including missed-detection and false-alarm rates, and evidence for any claimed warning lead time.
- Evidence for any claimed energy or cycle-time savings, with the metallurgical results shown alongside.
- Which components are physics-based, hybrid or purely data-driven.
- Advance notice of model, data and platform changes, with release notes.
- Access to the data and logs the plant needs to verify outputs on its own.
- Security evidence for the platform and any remote access, aligned with IEC 62443.
- Incident notification terms and a support lifecycle that covers the furnaces’ expected life.
- Confirmation that closed-loop and self-updating features are disabled or can be disabled.
Regulatory classification
To be determined EU AI Act risk category and the scope of the AI components.
The physics-based parts of a twin may not meet the definition of an AI system. The machine-learning components, such as anomaly detection, remaining-useful-life models, maintenance prescription and surrogates, likely do. See “Is it AI?” above. No Annex III use obviously applies. Whether any component is a safety component of machinery (Art. 6(1) and Annex I) needs legal and conformity-assessment review.
As deployer, the plant has duties for use, human oversight and monitoring (Art. 26). If it substantially modifies the vendor’s AI components or changes their intended purpose, it may take on provider obligations (Art. 25). Standards this assessment points to, without claiming conformity: ISO 23247 and ISO/IEC 30173 (digital twins), ISO 13381-1 and ISO 17359 (prognostics and condition monitoring), IEC 61508 and ISO/IEC TR 5469, IEC 62443, and ISO/IEC 42001 Annex A.10 (third-party relationships).
Impact analysis
What could happen to whom. Severity is the worst credible outcome before controls and is rated without regard to likelihood. Likelihood and controls are handled only on the Risk tab.
Impact categories and severity scales
Severity is rated per category. The highest category rating drives an impact and ratings are never averaged across categories.
| Impact category | Harm type (NIST AI RMF) | 1 Minor | 2 Moderate | 3 Major | 4 Severe |
|---|
Intended benefits
Benefits are part of an impact assessment, but they are objectives here, not results: more consistent treatment, less avoidable scrap, better matching of product to suitable applications. None is claimed as established.
Impact register
Risk analysis
How likely each failure is and what changes that. Each risk links to the impacts it threatens and takes its severity from the most severe linked impact. Inherent risk is before controls and residual risk is after them.
Risk matrix
Scales and acceptance rules are on the Method tab.
Risk register
Worked scenario: a repair changes the furnace, and the twin is not told
A heating element is replaced in a simulated furnace. The real furnace now behaves slightly differently from the model. The same six steps are shown under the current approval and under a hypothetical where the twin could update itself and act on the furnace. The point is the evidence question and the authority boundary at each step.
What would have to be true before self-updating or closed-loop use is considered
- A separate assessment for each permission, not an extension of this one.
- Drift detection that is independent of the twin’s own calibration, so adaptation cannot hide divergence.
- Model updates gated by named approvers, versioned and reversible.
- Independent protection confirmed by controls engineering, with a tested way to revert.
- Concurrence from the Site EHS Manager, Maintenance, Controls Engineering and Quality, with the accountable executive.
- Example 1 reassessed at the same time, because it depends on the twin.
Decision and conditions
A staged decision. Each permission is decided separately, because approving the twin to advise is not approval to defer maintenance, update itself, feed other systems or act.
Permissions
| ID | Permission | Level | Decision | Conditions and evidence required | Risks | Approver |
|---|
Residual risk acceptance
| Risk | Residual | Treatment decision | Accepted by |
|---|
Conditions of approval
- Every output shows data freshness, twin and component version, validation status and uncertainty.
- Silence is not safety: the absence of an alert never changes an inspection or maintenance interval.
- A person approves every maintenance recommendation before any work order exists, and the twin never creates or schedules work on its own.
- Quality and metallurgical requirements are hard constraints in any optimization. No qualified cycle is shortened or changed on twin outputs.
- The twin has no write path to the furnace or to any protective function, and data flow stays one way.
- Calibration and model updates are versioned, reviewed and approved by named people before use.
- The vendor gives advance notice of model, data, platform and security changes, and the plant records each as a change trigger.
- Every system or decision that uses twin outputs is registered as a dependency, including Example 1.
- Post-deployment monitoring compares twin outputs with inspection findings and verified results and reports to the AI Governance Lead.
Reassessment triggers
- Any hardware repair, replacement or reconfiguration of a furnace, or any change to sensors or their placement.
- A vendor model, data or platform update, or any recalibration or retraining.
- Drift beyond tolerance, a missed failure, a surge in false alarms, or a near miss traced to a twin output.
- A new consumer of twin outputs, or a new interface, remote-access path or feature enablement.
- A request for any restricted, not-approved or excluded permission.
- A security incident at the vendor or on the connection.
- A change in regulation, or a conclusion on the EU AI Act classification question.
Sign-off
| Role | Responsibility | Signature |
|---|---|---|
| Plant Manager (accountable executive) | Accepts High residual risk and the overall decision | Sample, unsigned |
| Site EHS Manager | Concurs on any risk linked to human safety | Sample, unsigned |
| Maintenance Manager | Owns maintenance risks and the preventive program the twin supplements | Sample, unsigned |
| Controls Engineering Manager and OT Security Lead | Confirm one-way data flow, segmentation and vendor access | Sample, unsigned |
| Quality Manager | Owns product-quality risks and any link to release decisions | Sample, unsigned |
| Vendor Risk Lead | Owns vendor terms, change notice and due diligence | Sample, unsigned |
| AI Governance Lead | Owns this assessment, the dependency register and monitoring | Sample, unsigned |
Terms and alignment
Where this assessment uses a term from a standard, framework or regulation, it says which. Where it uses its own term, it says so. This is a reading aid, not a substitute for the official texts. This sample is not affiliated with or endorsed by ISO, IEC, NIST, the EU institutions or IAPP.
| Term used here | Meaning in this assessment | Alignment |
|---|
Governance professional vocabulary
The structure follows the lifecycle language of AI governance practice: use case, impact assessment, risk tolerance, residual risk, go or no-go decision, human oversight, and post-deployment monitoring. Check these against the current IAPP AI Governance Professional body of knowledge, which this sample does not reproduce.
Method
The same method, scales and rating rules as Example 1, applied to a different system. How the steps line up with the main standards and frameworks. Govern, in the NIST AI RMF sense, runs through every step.
Steps and alignment
| Step | ISO 31000 and ISO/IEC 23894 | NIST AI RMF 1.0 | ISO/IEC 42001 and 42005 | EU AI Act |
|---|---|---|---|---|
| 1. Scope and context | Scope, context and criteria | MAP 1 | Context of the organization. Scope of the impact assessment | Intended purpose (Art. 3(12)) |
| 2. Impact analysis | Not a separate step. Feeds consequence | MAP 5 | 42005. Clause 6.1.4 and Annex A.5 | Art. 27 where it applies. Not applied here |
| 3. Risk analysis and evaluation | Risk identification, analysis, evaluation | MAP 5, MEASURE 1 to 2 | Clause 6.1.2 | Art. 9 risk management system |
| 4. Risk treatment and residual risk | Risk treatment | MANAGE 1 to 2 | Clause 6.1.3 and Annex A controls | Art. 9 to 15 requirements |
| 5. Approval decision | Risk acceptance by the risk owner | MANAGE 1.1, 1.3, 1.4 | Top-management accountability | Art. 26 deployer obligations |
| 6. Monitor and reassess | Monitoring and review | MANAGE 4, GOVERN | Performance evaluation and improvement | Art. 72 monitoring. Art. 73 serious incidents |
Likelihood scale
Qualitative and judged against the controls in place. No numeric probabilities are claimed.
| Level | Meaning |
|---|---|
| 1 Remote | Not expected during the life of the system, given the controls. |
| 2 Unlikely | Could occur, but only through a combination of failures. |
| 3 Possible | Could occur during the life of the system under realistic conditions. |
| 4 Likely | Expected to occur repeatedly unless something changes. |
Rating and acceptance rules
Rating is severity multiplied by likelihood: 1 to 3 Low, 4 to 6 Medium, 8 to 9 High, 12 to 16 Critical.
- Critical cannot be accepted at plant level. It needs further treatment or exclusion of the permission.
- High is accepted only by the Plant Manager, with documented conditions.
- Medium is accepted by the risk owner, with the Quality Manager or EHS concurring where their category is involved.
- Low is accepted by the risk owner.
- Any risk linked to a human-safety impact of severity 3 or 4 also needs the Site EHS Manager’s concurrence, whatever its rating.
Limitations
- Ratings are the assessor’s qualitative judgments on an invented system. They are not findings about a real one.
- The matrix is coarse. Multiplying ordinal scales hides differences, and a rating should never replace the reasoning shown beside it.
- Residual ratings assume the conditions of approval are met. They do not carry over if a restricted permission is enabled.
- OT security is treated as a source of risk, not a category of harm. Its consequences land in the impact categories above.
- Metallurgical, controls, maintenance and safety-engineering content is generic and needs review by qualified specialists before any real use.