# How to Verify an Autonomous Microreactor Is Running Safely

> An autonomous microreactor runs with fewer people on site. See how independent verification confirms it is operating safely, without taking a vendor's word.

[Resources](https://rankshieldenergy.com/resources) / Verification & trust Verification & trust

# How to Verify an Autonomous Microreactor Is Operating Safely
Published July 23, 2026 · Updated July 24, 2026 · By [Jamie Kloncz](https://rankshieldenergy.com/authors/jamie-kloncz), Founder, RankShield Energy

HELIX microreactor, concept render. RankShield Energy is at the pre-application stage; this depicts a design under development, not an operating facility. You verify an autonomous microreactor the way you verify any critical system you cannot stand next to: an independent party, not the operator, continuously confirms what the reactor is doing and records that confirmation so someone else can check it later. Verification is a separate function from operation. For a reactor designed to run with fewer people on site, that function has to be continuous, independent, and hard to alter after the fact.
That sounds abstract until you look at what it replaces. Today the Nuclear Regulatory Commission keeps roughly 150 resident inspectors in the field, at least two at every plant, whose job is independently verifying that requirements are being met [[2]](#src-2), and federal regulation requires a licensed operator at the controls at all times [[5]](#src-5). A microreactor designed for reduced on-site staffing does not merely trim that. It removes the mechanism by which outsiders have historically known anything.
This guide walks through what oversight looks like now, what the national laboratories have found actually breaks under autonomy, why the verifying party cannot be the operating party, what has genuinely been demonstrated, and where the regulator is heading. RankShield Energy is a pre-applicant with the NRC, holding no license or approval [[29]](#src-29), and the last section applies every argument here to our own program.
Key takeaways

- Today's oversight rests on people being present: about 150 NRC resident inspectors, at least two per plant, plus a licensed operator required at the controls at all times.
- Autonomy does not remove the verification burden, it moves it from observing a plant to checking claims about a plant.
- A vendor cannot be its own verifier, which is why IAEA safeguards and the internet's attestation standards both put the checker outside the checked.
- Autonomous control has been demonstrated at national-lab scale; continuous independent verification of a fleet has not, because no commercial fleet exists.
- The NRC itself anticipates a smaller inspection footprint, while the GAO flags unresolved staffing gaps. That space is what verification has to fill.

## How the current reactor fleet is actually watched
Oversight of the operating US fleet rests on people being physically present. The Nuclear Regulatory Commission stations resident inspectors at every plant, describing their role as providing essential on-site verification of licensee activities through walkdowns, observing tests, and reviewing corrective action documents [[1]](#src-1). The agency employs roughly 150 of them, with at least two assigned to each plant, and their stated job is independently verifying that requirements are being met [[2]](#src-2).
That human layer sits inside a larger structure. The Reactor Oversight Process is risk-informed and tiered, built on safety cornerstones, NRC-developed inspection findings, licensee-reported performance indicators, a significance determination process, and an action matrix that escalates as performance degrades [[3]](#src-3). The Government Accountability Office has described the agency's safety assurance as resting on exactly this: monitoring and inspecting the activities with the greatest effect on safety [[4]](#src-4).
There is also a hard legal floor underneath all of it. Under 10 CFR 50.54(m), a licensed senior operator must be in the control room at all times, and a licensed operator or senior operator must be present at the controls at all times [[5]](#src-5). That is not a guideline or an industry practice. It is a condition of the license.
Read together, these establish what a microreactor fleet is actually proposing to change. Not just staffing economics, but the mechanism by which anyone outside the operating organization knows what a reactor is doing.

## What autonomy actually removes, according to the labs studying it
Oak Ridge National Laboratory examined this directly and enumerated what autonomous control disturbs: staffing, manipulation of controls, licensed operator requirements, technical specifications, cybersecurity, and event notifications, noting that a control room may not even be co-located with the plant [[6]](#src-6). As one ORNL researcher put it, current regulatory guidance was written when remote operation of nuclear reactors was not possible, so this is a new frontier [[7]](#src-7).
Sandia National Laboratories, working for the NRC, reached the operational version of the same conclusion: human operators may not be located on site and may instead monitor the facility from a remote location, and some designs contemplate one control room supervising multiple microreactors [[8]](#src-8).
The most useful framing comes from Brookhaven National Laboratory, in work performed for the NRC's Office of Nuclear Regulatory Research on facilities without main control rooms. Their point is precise: the safety question is not so much justifying why a design has no main control room, but rather verifying that important human actions can be accurately and reliably performed [[9]](#src-9).
That sentence is the whole problem restated by the regulator's own research arm. The burden does not disappear when the people leave. It moves, from observing a plant to verifying claims about a plant. And verifying a claim requires something the claim itself cannot supply.

## Why the verifier cannot be the vendor
A party that both operates a reactor and certifies its own status carries a conflict that no amount of engineering removes. The report may be perfectly accurate. But an outside party has no independent basis to know that, because the same organization produces the report and is judged by it.
This is not a novel observation, and nuclear already contains the precedent. The IAEA safeguards system exists precisely so that an outside body applies technical measures through which it can independently verify that facilities are not misused, rather than relying on an operator's assertion [[10]](#src-10). Safeguards address non-proliferation rather than operational safety, so the subject matter differs. The structure does not.
Computing settled the same question formally. The internet's remote attestation architecture, standardized as RFC 9334, splits the roles into an Attester that produces evidence, a Verifier that appraises it against policy, and a Relying Party that acts on the result, built on the premise that one end of a communication needs to know whether the other end is in an intended operating state [[11]](#src-11). The design assumption is that the thing being checked does not get to be its own checker.
Which is why [self-attestation and independent verification](https://rankshieldenergy.com/resources/self-attestation-vs-independent-verification-reactors) are different products, not different words for the same product. A vendor dashboard shows what the operator's software chooses to display at the moment it chooses to display it. That is useful for running a plant. It is not evidence to anyone else.
The uncomfortable version, stated plainly: "trust us, the reactor is fine" may well be true, but truth an outsider cannot check is not the same as truth an outsider can rely on. For something with a reactor's consequences, that difference is the entire point.

## What replaces the inspector, function by function
It helps to stop treating this as one problem and break the resident inspector's job into what it actually delivered, then ask what has to supply each piece when the person is not there. The table below is our own mapping rather than a regulatory framework, offered as a way to structure the question.

What on-site presence provided, and what has to replace each function

Function of on-site presence
What must supply it without a person there
Why the operator alone cannot

Direct observation of plant condition
Continuous instrumented measurement of reactor state
Sensors report through the operator's own systems

Independent judgment about what was seen
Appraisal of measured state against design limits by a separate party
Self-appraisal is the conflict being solved

A witness who can be asked afterwards
A tamper-evident record a third party can examine later
Logs the operator can alter prove little

Escalation when something looks wrong
Divergence surfaced automatically and recorded either way
Undocumented judgment calls are unreviewable

The middle column is not speculative. ORNL's work on autonomous microreactor operation identifies the same requirements from the engineering side: sensor and instrumentation technologies capable of long-term unattended operation, complete system state awareness, and cybersecurity appropriate to remote monitoring [[12]](#src-12). Those are the preconditions for anyone, operator or verifier, to know anything at all.
The right-hand column is where [independent verification](https://rankshieldenergy.com/resources/verify-autonomous-microreactor-operating-safely) earns its place. Every function in the left column that depended on the inspector being a party with no stake in the answer needs a replacement with the same property.

## Recording it so someone can check afterwards
Continuous appraisal solves the present tense. It does not by itself solve the past tense, which is what a regulator, insurer, lender, or grid operator actually asks about. Their question is rarely "what is the reactor doing right now." It is "what was it doing on the fourteenth, and how do I know."
That is a records problem with an established answer outside nuclear. RFC 9943 defines an append-only transparency service that registers signed statements and issues receipts, so that a third party can audit the record later [[13]](#src-13). RFC 9942 standardizes the receipts themselves as compact cryptographic proofs of inclusion and append-only consistency against a verifiable data structure [[14]](#src-14), which matters for remote sites where bandwidth is limited.
Signatures on records intended to outlive the equipment need to survive future cryptography as well. NIST approved three post-quantum standards in August 2024, including ML-DSA and SLH-DSA for digital signatures [[15]](#src-15), and the federal baseline for assuring integrity across acquired components sits in NIST SP 800-161r1 [[16]](#src-16).
None of this is exotic and none of it was invented for reactors. It is the ordinary machinery of making machine-generated claims checkable by someone who was not present, which is exactly what [turning reactor state into an attestation record](https://rankshieldenergy.com/resources/reactor-state-sensors-attestation-record) requires.
A distinction worth holding onto: tamper-evident is not tamper-proof. The property being sought is not that a record cannot be altered. It is that alteration cannot happen quietly.

## What has actually been demonstrated so far
The operating model is further along than most coverage suggests. In 2022 the Department of Energy reported that Idaho National Laboratory demonstrated a digital twin of a simulated microreactor that predicted future heat pipe temperatures and then autonomously controlled the heat pipe on the MAGNET testbed [[17]](#src-17). That is closed-loop autonomy, demonstrated, not theorized.
INL's MARVEL project is explicitly intended to test systems for remote monitoring, develop autonomous control technologies for microreactors, and help develop regulatory approval processes for them [[18]](#src-18). In July 2026, INL and university partners went further and demonstrated remote, real-time autonomous power control of a research reactor, with the reactor's safety systems retaining control throughout [[19]](#src-19).
Two cautions belong with those results, and we would rather state them than let a reader over-read the paragraph above. These are national-laboratory demonstrations, not commercial operation, and none of them belongs to any vendor including us. And demonstrating that a reactor can be controlled autonomously is a different achievement from demonstrating that an independent party can continuously confirm what it did.
The second half is the thinner half. The instrumentation and control security guidance exists internationally [[20]](#src-20), and the IAEA has an active research project on computer security for small modular and microreactors that names autonomous and remote operations, digital twins, and centralised fleet management with reduced staffing as the conditions to be addressed [[21]](#src-21). But there is no operating fleet under continuous independent verification today, because there is no operating microreactor fleet.

## Where the regulator is heading, and what is still unsettled
The NRC has been circling this since at least 2020, when SECY-20-0093 flagged autonomous operation, remote operation, staffing, and oversight as open policy questions for microreactors [[22]](#src-22). More recently the agency has been planning for standardized, fleet-scale deployment [[23]](#src-23), which is the regulatory shape of many units per unit of attention.
The concrete vehicle is proposed 10 CFR Part 57, published in the Federal Register on May 1, 2026, which contemplates remote operation and reduced on-site staffing [[24]](#src-24), with companion draft guidance in NUREG-2271 aimed at rapid licensing and high-volume deployment [[25]](#src-25). Both are proposals. The comment period closed in June 2026, no developer is licensed under Part 57, and the text can still change. Anyone describing it as settled law is describing something that does not exist yet, which is why we cover [what proposed Part 57 actually says](https://rankshieldenergy.com/resources/nrc-part-57-autonomous-operation-explained) separately.
The most telling signal is quieter. Under the ADVANCE Act, the NRC is directed to develop microreactor strategies across areas including staffing and operations, and oversight and inspections, and in December 2025 staff proposed operational-phase oversight built on innovative inspection methodologies and a scalable inspection footprint [[26]](#src-26). The regulator itself anticipates that the inspection footprint shrinks.
Meanwhile the GAO has repeatedly flagged that the NRC has not evaluated its efforts to address staffing gaps and lacks benchmarks for whether recruitment and retention are working [[27]](#src-27), and still lists licensing advanced reactors among its priority open recommendations [[28]](#src-28). Fewer inspectors per reactor is arriving whether or not the verification layer arrives with it. That gap is the thing worth designing against now.

## How we apply this to ourselves
RankShield Energy is a pre-applicant with the NRC. We hold no license, permit, or design approval, and nothing about our design has been demonstrated to or accepted by the NRC [[29]](#src-29). We have never operated a reactor, so nothing above is offered as operating experience.
What we do claim is narrower and, we think, more useful. Our working domain is the verification layer itself: independent appraisal, signing, and transparency logging of machine-generated claims. That is where our judgment comes from, and it is why we treat separation between the verifier and the operator as an architectural requirement rather than a feature. The tradeoff is real and worth naming, because a separate verifier costs more and adds a party to coordinate with. We think that cost is the point rather than an inefficiency to engineer away.
Our reactor safety characteristics are design intent, subject to analysis, testing, and regulatory review. Our verification approach is an architecture we apply, not a deployed or certified capability. If you are weighing developers, the same questions we have set out here apply to us, which is the premise of our [guide to evaluating a microreactor vendor](https://rankshieldenergy.com/resources/how-to-evaluate-a-microreactor-vendor), and they should be applied to us as unsentimentally as to anyone else.
One last framing that may be useful when you read any developer's material, including this site. Ask whether a claim is about engineering or about evidence. Engineering claims describe what a machine is built to do, and they are settled by analysis, testing, and regulatory review over years. Evidence claims describe how anyone outside the operating organization would know the machine did it, and they are settled by who is positioned to check. Most of this industry, ourselves included, is further along on the first than the second. Noticing which kind of claim you are being offered is most of the work.

## Frequently asked questions

### Who verifies an autonomous microreactor if no one is on site?
An independent verifier: a party structurally separate from the operator that continuously appraises the reactor's reported state against what the design permits, and records the result so it can be checked later. This is different from the operator's own monitoring software. Today the equivalent function is largely carried by NRC resident inspectors, roughly 150 of them with at least two at each plant, whose stated role is independently verifying that requirements are being met [[2]](#src-2). Regulatory oversight remains with the NRC. Independent verification is a technical function that supports it rather than replacing it.

### Does the law currently require an operator to be physically present?
Yes. Under 10 CFR 50.54(m), a licensed senior operator must be in the control room at all times and a licensed operator or senior operator must be present at the controls at all times [[5]](#src-5). That is a condition of the license for the current fleet. Proposed Part 57 contemplates remote operation and reduced on-site staffing for microreactors [[24]](#src-24), but it is a proposal published in May 2026 whose comment period has closed, it is not final, and no developer is licensed under it today.

### Has autonomous reactor control actually been demonstrated?
Yes, at national-laboratory scale. DOE reported in 2022 that INL demonstrated a digital twin of a simulated microreactor that predicted heat pipe temperatures and then autonomously controlled the heat pipe [[17]](#src-17), and in July 2026 INL and university partners demonstrated remote, real-time autonomous power control of a research reactor with safety systems retaining control [[19]](#src-19). Both are demonstrations of the operating model. Neither is a demonstration of continuous independent verification of a commercial fleet, and neither belongs to a vendor.

### Is independent verification the same as NRC approval?
No. Independent verification is a technical function performed by a party separate from the operator. NRC approval is a regulatory determination made by the federal regulator. A developer can build a verification layer and still be, as RankShield Energy is, a pre-applicant holding no license or approval [[29]](#src-29). The two support each other but are not interchangeable, and no verification architecture substitutes for regulatory review.

### Why not just rely on the vendor's monitoring dashboard?
Because a dashboard answers a different question. It shows what the operator's software chooses to display, at the moment it chooses to display it, to the operator. That is genuinely useful for running a plant. It does not help an insurer, lender, regulator, or grid operator establish what happened last month, because the party producing the record is the party being evaluated by it. The distinction is not about vendor honesty. It is structural, and it is the same reason companies do not audit their own books.

## Sources

- [U.S. Nuclear Regulatory Commission. Resident Inspector Program. Accessed July 2026](https://www.nrc.gov/reactors/operating/oversight/rop-description/resident-insp-program)
- [U.S. Nuclear Regulatory Commission. Backgrounder on NRC Resident Inspectors Program. Accessed July 2026](https://www.nrc.gov/reading-rm/doc-collections/fact-sheets/resident-inspectors-bg)
- [U.S. Nuclear Regulatory Commission. Reactor Oversight Process Framework. Accessed July 2026](https://www.nrc.gov/reactors/operating/oversight/rop-description)
- [U.S. Government Accountability Office. Nuclear Power: NRC Relies on Information From its Reactor Oversight Process to Ensure Safety (GAO-25-107807). September 2025](https://www.gao.gov/products/gao-25-107807)
- [U.S. Government Publishing Office. 10 CFR 50.54(m), Conditions of licenses. 2024 CFR edition](https://www.govinfo.gov/content/pkg/CFR-2024-title10-vol1/xml/CFR-2024-title10-vol1-sec50-54.xml)
- [Oak Ridge National Laboratory. Licensing Challenges Associated with Autonomous Control (ORNL/SPR-2018/1071). December 2018](https://www.osti.gov/biblio/1492160)
- [Oak Ridge National Laboratory. Nuclear: Remote-controlled reactors. April 2019](https://www.ornl.gov/news/nuclear-remote-controlled-reactors)
- [Sandia National Laboratories. Human Factors Considerations for Automating Microreactors (SAND-2020-5635). June 2020](https://www.osti.gov/biblio/1763526)
- [Brookhaven National Laboratory for the U.S. NRC. Review of Reactor Facilities without Main Control Rooms (BNL-227637-2025-INRE). February 2025](https://www.osti.gov/biblio/2529385)
- [International Atomic Energy Agency. Basics of IAEA Safeguards. Accessed July 2026](https://www.iaea.org/topics/basics-of-iaea-safeguards)
- [Internet Engineering Task Force. RFC 9334: Remote ATtestation procedureS (RATS) Architecture. January 2023](https://www.rfc-editor.org/info/rfc9334/)
- [Oak Ridge National Laboratory. Concepts for Autonomous Operation of Microreactors (ORNL/TM-2019/1305). September 2019](https://www.osti.gov/biblio/1615811)
- [Internet Engineering Task Force. RFC 9943: An Architecture for Trustworthy and Transparent Digital Supply Chains (SCITT). June 2026](https://www.rfc-editor.org/info/rfc9943)
- [Internet Engineering Task Force. RFC 9942: CBOR Object Signing and Encryption (COSE) Receipts. 2026](https://www.rfc-editor.org/info/rfc9942)
- [National Institute of Standards and Technology. Announcing Approval of Three FIPS for Post-Quantum Cryptography. August 2024](https://www.nist.gov/news-events/news/2024/08/announcing-approval-three-federal-information-processing-standards-fips)
- [National Institute of Standards and Technology. SP 800-161r1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations. Updated November 2024](https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final)
- [U.S. Department of Energy, Office of Nuclear Energy. Idaho National Laboratory Demonstrates First Digital Twin of a Simulated Microreactor. July 2022](https://www.energy.gov/ne/articles/idaho-national-laboratory-demonstrates-first-digital-twin-simulated-microreactor)
- [Idaho National Laboratory. MARVEL Project. Accessed July 2026](https://inl.gov/marvel/)
- [Idaho National Laboratory. Researchers achieve remote, autonomous power control of a research reactor in real time. July 2026](https://inl.gov/news-release/researchers-achieve-remote-autonomous-power-control-of-a-research-reactor-in-real-time/)
- [International Atomic Energy Agency. Computer Security of Instrumentation and Control Systems at Nuclear Facilities (Nuclear Security Series No. 33-T). 2018](https://www.iaea.org/publications/11184/computer-security-of-instrumentation-and-control-systems-at-nuclear-facilities)
- [International Atomic Energy Agency. Enhancing Computer Security of Small Modular Reactors and Microreactors (CRP J02021). Accessed July 2026](https://www.iaea.org/projects/crp/j02021)
- [U.S. Nuclear Regulatory Commission. SECY-20-0093: Policy and Licensing Considerations Related to Micro-Reactors. October 2020](https://www.nrc.gov/docs/ML2025/ML20254A363.html)
- [U.S. Nuclear Regulatory Commission. SECY-25-0052: Nth-of-a-Kind Microreactor Licensing and Deployment Considerations. June 2025](https://www.nrc.gov/docs/ML2430/ML24309A266.html)
- [U.S. Nuclear Regulatory Commission. Licensing Requirements for Microreactors and Other Reactors With Comparable Risk Profiles (proposed 10 CFR Part 57). Federal Register, May 1, 2026 (91 FR 23628)](https://www.federalregister.gov/documents/2026/05/01/2026-08550/licensing-requirements-for-microreactors-and-other-reactors-with-comparable-risk-profiles)
- [U.S. Nuclear Regulatory Commission. Guidelines for Preparing and Reviewing Applications Under 10 CFR Part 57 (NUREG-2271, Draft for Comment). April 2026](https://www.nrc.gov/reading-rm/doc-collections/nuregs/staff/sr2271/index.html)
- [U.S. Nuclear Regulatory Commission. Microreactors: Regulatory Activities. Updated May 2026](https://www.nrc.gov/reactors/new-reactors/advanced/modernizing/microreactors/reg-activities)
- [U.S. Government Accountability Office. Nuclear Power: NRC Needs to Take Additional Actions to Prepare to License Advanced Reactors (GAO-23-105997). July 2023](https://www.gao.gov/products/gao-23-105997)
- [U.S. Government Accountability Office. Priority Open Recommendations: Nuclear Regulatory Commission (GAO-26-109004). June 2026](https://www.gao.gov/products/gao-26-109004)
- [U.S. Nuclear Regulatory Commission. Pre-Application Activities for Advanced Reactors. Accessed July 2026](https://www.nrc.gov/reactors/new-reactors/advanced/who-were-working-with/pre-application-activities)

## Related

- [Self-attestation vs independent verification →](https://rankshieldenergy.com/resources/self-attestation-vs-independent-verification-reactors)
- [NRC Part 57 and autonomous operation →](https://rankshieldenergy.com/resources/nrc-part-57-autonomous-operation-explained)
- [How to evaluate a microreactor vendor →](https://rankshieldenergy.com/resources/how-to-evaluate-a-microreactor-vendor)

Written by
Jamie Kloncz
Founder, RankShield Energy
Jamie leads the HELIX microreactor pre-application program and RankShield Energy's verification-first approach to advanced-reactor operations. [More about the author](https://rankshieldenergy.com/authors/jamie-kloncz)

*This guide reflects the state of microreactor verification and NRC rulemaking as of July 2026. Proposed rules such as 10 CFR Part 57 are not final and may change. This area is evolving rapidly; check back if the rule is finalized or if the NRC issues new guidance.*
**About this article.** RankShield Energy is a pre-applicant engaged in early regulatory interaction with the U.S. Nuclear Regulatory Commission (NRC). Nothing here should be read as a representation that any RankShield Energy design, product, or facility is NRC-approved, licensed, or certified, or that any safety, performance, or operational characteristic has been demonstrated or accepted by the NRC. Descriptions of reactor and system behavior reflect design intent and are subject to analysis, testing, and regulatory review. This article is for general educational purposes and is not engineering, legal, regulatory, or investment advice.

A note on how we write about our own reactor
HELIX is in pre-application development. Where this article touches our design, every figure is a design target and every physics result is unqualified screening, labeled as such. We cite authoritative sources (NRC, DOE, IAEA, national laboratories) and never invent statistics.
RankShield Energy · HELIX · pre-application