1 Utility Filing Could Redefine Regulatory Data Security

For security practitioners, Evergy's filing is not about an external breach but about an insider-risk path: a staffer, intervenor, or attorney with legitimate access to a confidential docket could paste it into an open AI tool and lose control of the data. The utility wants protective orders to close that gap before customer, business, or infrastructure information leaks through model training or reuse.

Evergy filed a request with the Kansas Corporation Commission on July 30, 2026, asking utility regulators to amend the standard protective order used in contested dockets so confidential case information cannot be uploaded into open artificial intelligence tools. The filing, first reported by the Great Bend Post and Hays Post on August 13, would permit the use of secure, closed AI systems with appropriate safeguards while prohibiting open AI tools from ingesting protected material. It represents one of the earliest utility-sector efforts to preempt generative AI as a data-exposure risk in regulatory proceedings, not in response to a known breach but as a prospective governance measure.

“

The filing, first reported by the Great Bend Post and Hays Post on August 13, would permit the use of secure, closed AI systems with appropriate safeguards while prohibiting open AI tools from ingesting protected material.

Matt Lucht, Evergy spokesman, said confidential information is regularly given to regulators to help stakeholders in the decision-making process, but the company must also protect business, customer and infrastructure-related information from disclosure. He added that Evergy wants to ensure it can continue to openly share information with regulators and case intervenors while maintaining appropriate confidentiality. The filing is less about restricting access to regulators and more about controlling what happens to sensitive documents once authorized users possess them.

The concern reflects how quickly generative AI has entered professional workflows. Artificial intelligence tools now transcribe meeting notes, summarize emails and write letters for the general public. In business settings, the same tools are developing strategic plans, helping attorneys draft court documents and assessing competition. That shift creates a gap in legal instruments written before large language models became widely available. A standard protective order may bind human users to confidentiality, but it does not necessarily address the automated retention, reuse or training exposure that can occur when a user pastes protected text into a consumer AI platform.

Justin Grady, KCC director of utilities, described the risk in stark terms. He said "the sky's the limit" regarding how people could use confidential information with generative AI tools. Grady outlined a scenario in which an individual with access to a confidential regulatory document could "dump all of their files into some new large language model and say what were the weaknesses or the deficiencies that were in this filing." Generative AI creates new content by drawing from large datasets and learning as it goes, which means input data may not be reliably contained or forgotten. For a regulated utility, that could expose trade secrets, customer data or critical infrastructure details through an ordinary workflow action.

The filing draws a meaningful distinction between open and closed AI systems. Open tools are widely accessible and easy to use, but their data handling practices may be opaque or include training on user inputs. Closed systems, by contrast, can be controlled, audited and potentially isolated from external model training. Evergy's proposed amendment would allow the latter with safeguards while blocking the former. This distinction is likely to become a recurring theme in enterprise and regulatory data governance because it offers a practical compromise: confidentiality can be preserved without prohibiting AI-assisted analysis altogether.

From a cybersecurity perspective, the filing frames an insider-risk issue rather than a classic external intrusion. A staff member, attorney or intervenor with legitimate access to a confidential docket could bypass traditional data loss prevention controls simply by pasting content into an open AI tool. No network compromise is required for sensitive information to leave the controlled environment. That makes the protective order amendment a governance control designed to reduce an accidental or careless disclosure path that is difficult to detect after the fact.