Including a shutdown mechanism and doing an annual risk management review favors large incumbents?
I would think if a power plant deploys some AI model to optimize something or other, it would be on the plant operator to perform the reviews, regardless of who they get the AI from.
E.g. HIPAA security rule updates