For more than two decades, Basia Sall, chief data officer (CDO) at the Nuclear Regulatory Commission (NRC), has watched federal agencies pursue successive waves of technology modernization – from cloud adoption and digitization to stronger cybersecurity and data-driven decision-making.
What has changed, she said, is technology’s role in the mission. It is no longer viewed simply as a supporting function, but as an integral part of how agencies accomplish their work.
Sall emphasized that, in line with NRC Chairman Ho K. Nieh’s priorities, every technology modernization – including artificial intelligence (AI) adoption – is evaluated first and foremost through the lens of protecting public health and safety.
AI is accelerating that shift.
Previous modernization efforts largely focused on making established processes more efficient, said Sall. AI is forcing agencies to reconsider the processes themselves.
“We’re talking about how we fundamentally change how we do the work,” she said.
That shift is both exciting and difficult. Agencies can surround a longstanding process with new technology, but unless they challenge how the work is structured, they will not capture AI’s full value.
A recent NRC reorganization may help the agency do exactly that. Sall said her division previously centered on AI, data, and records management. Its portfolio now also includes application development and agency systems.
Bringing those functions together gives the NRC an opportunity to connect its data, AI, and software strategies – and rethink how technology supports the agency’s regulatory mission.
“For me, it’s really a benefit to have this all combined under one umbrella,” Sall said. “Now we can really start to think about how we make some significant gains in the way we approach technology and the work we do.”
Data comes first
Asked to rank the NRC’s fiscal year 2027 (FY27) technology priorities, Sall placed data management and analytics first, followed closely by AI and machine learning and workforce transformation.
The three priorities are deeply connected, she said. AI systems cannot deliver reliable results without accurate, organized, and accessible data – and employees must understand how to use the technology effectively.
“I can’t be the CDO and not have data as the top driver,” Sall joked.
But the emphasis extends beyond her office. Sall said leveraging AI and advanced data tools are leading priorities for Chairman Nieh, with the ultimate goal of enhancing regulatory effectiveness and efficiency.
“Any of our analytics, our AI tools, they’re not going to give us the results that are expected, and we won’t realize the value, if we don’t have the right data to be able to feed into it,” she said.
The NRC has been addressing gaps in metadata and data cataloging, including within its public Agencywide Documents Access and Management System, known as ADAMS, which contains records of past regulatory and licensing decisions.
Those records are increasingly valuable as technology companies explore advanced nuclear power, including small modular reactors, to support AI data centers. Better metadata would help applicants find relevant precedents while reducing manual curation by NRC data scientists, Sall said.
That creates an unusual link between AI and the NRC’s mission. “There’s growing pressure to process license applications faster, driven in part by the surge in electricity demand from AI data centers,” Sall said. “Using AI ourselves is one way we can meet that demand without sacrificing rigor,” Sall said.
Balancing capacity, risk, and readiness
Sall identified resources, cybersecurity, and workforce readiness as three potential obstacles to the NRC’s FY27 technology plans. Together, they shape how quickly the agency can modernize while managing the risks that come with it.
Funding and staffing will always affect how quickly an agency can scale its work, Sall said, but the NRC is looking for ways to continue advancing within its current resources. Cybersecurity presents a more complex constraint as the agency evaluates new tools and works to protect its data.
“Our CISO is working overtime trying to balance the risks,” Sall said. “We talk all of the time, trying to figure out what our next steps are and ensure that we have the risks mitigated.”
Workforce readiness adds another layer. The challenge is not simply getting employees through basic AI training, but ensuring they can apply what they learn as the technology continues to change. That requires the agency to monitor its approach and adjust rather than commit too rigidly to one path.
“It’s important for us to be monitoring that and not be too complacent in any one path forward,” she said. “We need to reprioritize and reassess on a pretty regular basis.”
Finding the middle lane on AI risk
The NRC has taken a measured approach to deploying generative AI.
Its internally developed SimplifAI tool uses Azure OpenAI for regulatory text retrieval and content generation within the agency’s environment, allowing employees to work with pre-decisional and non-public information.
The NRC also has Microsoft 365 Copilot licenses and is evaluating additional tools as it plans for FY27.
While the NRC permits employees to use public generative AI systems under rules that prohibit entering non-public information, it is also exploring browser and data-loss-prevention capabilities to reduce the risk of sensitive data leaving the agency.
That approach reflects the tension the NRC faces as both a regulator and technology user. Move too cautiously, Sall said, and stakeholders may question why a federal regulator is falling behind on AI. Move too quickly, and the agency risks criticism for adopting the technology without sufficient safeguards.
The agency’s goal is to find the middle ground. Drawing on language used by NRC’s CIO Scott Flanders, Sall said the commission does not want to operate in either the fast lane or the slow lane.
“This balanced approach reflects the NRC’s commitment to harnessing innovation to improve its work, but never at the expense of cybersecurity, data integrity, or public trust. We’ve found our footing at this point,” she said.
Document the process before choosing the tool
One of Sall’s biggest priorities is rethinking how the NRC develops and delivers software.
AI-assisted development could eventually make it easier to create modern interfaces for older systems, but Sall said technology teams must first understand the underlying business processes in detail.
“Before we even start conversations about any tool or any future thinking of any technology: What is your business process?” Sall said. “Details, details.”
Without that documentation, agencies risk using new technology to replicate outdated systems and workflows. Sall noted that strengthening the NRC’s data foundations and business processes is essential to realizing the true benefits of AI, ensuring that regulatory decisions remain reliable, traceable and consistent with the agency’s Principles of Good Regulation.
Sall envisions a different employee experience. An employee might receive a concise overview of daily priorities, key emails, emerging trends, and projects requiring intervention – without hunting through multiple systems to find them.
“I would like to just get rid of dashboards altogether,” Sall said.
Achieving that vision will require more than modernizing systems individually. Sall said agencies need to look across their technology environments and reconsider how employees experience work as a whole.
“I don’t think you can just reimagine it system by system by system,” she said. “You have to do a wholesale overhaul.”
Plan for the next six months
Sall’s planning window has narrowed as modern capabilities have evolved.
“If someone gives me a new roadmap for 24 months, I’m like, forget about it,” Sall said. “Six really is where I’m comfortable; I’ll go as far as nine – because we have to meet where the technology is going.”
As a result, one of the first things Sall asks technology vendors is where their product is headed over the next six to nine months. A company may have a stable product today, but she wants to know whether it has a credible near-term roadmap and the flexibility to keep pace with rapid change.
Agencies need partners that can help them navigate the coming twists and turns, she said, rather than simply sell them a tool designed for the current environment.
That near-term mindset does not mean abandoning long-term strategy. It means recognizing that agencies must revisit how they execute that strategy far more frequently.
For FY27, Sall’s direction is clear: Strengthen the data, document and redesign the work, maintain strong oversight, and stop spending limited resources on efforts that no longer provide enough value.
Asked whether agencies need to begin more initiatives or end more low-value work, Sall did not hesitate.
“This ongoing reassessment reflects the NRC’s commitment to prioritizing technology efforts that deliver the greatest value to its mission and to stopping work that no longer serves the public interest.”