Security by design in artificial intelligence-enabled energy management systems: a sociotechnical framework

The global energy sector is undergoing a profound digital transformation driven by growing demands for sustainability, efficiency, and resilience. The shift from traditional power grids to smart, decentralized energy systems has accelerated the adoption of artificial intelligence (AI)-enabled Energy Management Systems (EMS). While these technologies offer significant benefits, they also introduce new data security and governance challenges that must be addressed to ensure trustworthy and resilient energy infrastructure. This study adopts a Design Science Research (DSR) approach to investigate security issues associated with the development and implementation of AI-enabled EMS. Through an analysis of academic and practice-oriented literature, a conceptual framework was developed that takes a lifecycle perspective, tracing data flows through interconnected phases of data generation, sensing, model development, and deployment. Based on the identified challenges, four design principles were formulated to address specific security vulnerabilities. The primary outcome is a conceptual artifact that categorizes data security challenges in AI-enabled EMS across different lifecycle phases. The analysis revealed that these challenges require coordinated action by multiple stakeholders across different system layers, supported by dedicated security tools and governance mechanisms. The study proposes the Prevent-Audit-Learn-Harden (PALH) framework as a practical approach for guiding the secure design, deployment, and operation of AI-enabled EMS. By linking identified security challenges to corresponding design principles and lifecycle stages, the framework helps strengthen data security and governance in smart energy systems. The findings highlight the importance of a holistic, lifecycle-oriented approach to security in supporting the ongoing transition toward decentralized smart grids.