An AICSA Opinion Piece by Lisa Ventura MBE FCIIS, Chief Executive and Founder, the AI and Cyber Security Association (AICSA)

Earlier this summer, after back-to-back heatwaves, my husband Russ and I had a proper air conditioning system installed at our home in Worcester using Worcester Bosch units. I am autistic and ADHD with extreme heat sensitivity, and I wrote about that installation and the difference it made.

A few weeks later one of the condenser units developed a noise, which for someone with sensory sensitivity is not a minor irritation. I wrote a follow up review about how our installer and Worcester Bosch put it right, and about meeting Jo Shepherd, the Chief Executive Officer of Worcester Bosch, who was out in the field with her engineers on the day of the repair.

What has stayed with me since is not the cooling. The same units that keep me sane in August will add warmth in February. One box on the wall, two jobs, and an app on my phone that knows more about my home than I do.

Heating Has Quietly Become a Software Industry

For most of living memory a domestic heating control was a thermostat that measured one temperature in one room and switched something on or off. The systems going into British homes now sit on the home network, talk to a cloud service, respond to electricity tariffs and in some cases to signals from the wider electricity system. They are connected computers that happen to move heat around, and once operational data flows off one continuously, machine learning stops being exotic and starts being obvious.

Systems That Learn How a Home Behaves

Traditional weather compensation adjusts how hot a heating system runs according to the temperature outside. It works, but an installer sets the curve once and it rarely gets revisited.

UK software companies such as Havenwise, Homely and Passiv UK have replaced that fixed curve with a model the system builds for itself. They take a local weather forecast, the shape of a time of use tariff, the thermal behaviour of the building and the occupants’ preferences, then work out when and how hard to run the heat pump. If prices are about to rise it can warm the house beforehand at the cheaper rate. Havenwise needs no extra hardware, connecting through the manufacturer’s own cloud service, which tells you where value in this industry is migrating.

Finding Faults Before Anyone Feels Them

The most convincing evidence sits here, and it comes from Bosch. Researchers at Bosch Thermotechnik, working with the Technical University of Applied Sciences Cologne, have published work on detecting water contamination inside residential heat pumps using physics informed machine learning. Fouling and scaling degrade heat exchangers slowly and invisibly, and there is little real world failure data to train a model on. Their answer was to generate healthy and faulty states in a climate chamber, then train a classifier on that data, ranking systems by risk so maintenance effort goes where it is needed.

That matters because a large field study in Nature Communications analysed real operating data from heat pumps across Central Europe and found a meaningful proportion running below existing efficiency standards, with others improperly sized for their homes. Nobody in those households necessarily knew, and machine learning applied to operating data is the only practical way to find such systems at scale.

Heating That Talks to the Grid

Electrifying heat means large, flexible electrical loads arriving on the distribution network in huge numbers. Machine learning is being used by energy suppliers and flexibility providers to shift heat pump cycles away from expensive peak periods into cheaper, lower carbon windows. The Department for Energy Security and Net Zero has funded work here through its Heat Pump Ready programme, covering smart home energy systems, remote monitoring and thermal storage. Much of it sits at pilot stage rather than wide deployment, but the direction of travel is not in doubt.

Where Worcester Bosch and Bosch Sit

Since a Worcester Bosch air conditioning installation started me down this road, I wanted to know what the company and its parent are doing. At Bosch Group level the commitment is clear. Bosch holds a substantial European patent portfolio in artificial intelligence, describes its approach as People First technology, and applies machine learning across its own manufacturing for predictive maintenance and fault detection. At CES this year it unveiled an agentic AI cooking assistant inside its Home Connect app.

Within heating, the Bosch Thermotechnik research above is the clearest evidence of applied work. The HomeCom Easy app provides status monitoring and anomaly notifications for Bosch heat pumps and air conditioners, the Climate 7000i includes presence detection that limits power draw when a room is empty, and Bosch Home Comfort Group has also launched SkyQ, a control platform for light commercial buildings with built in fault detection.

That said, Bosch describes SkyQ and its consumer controls as intelligent rather than as artificial intelligence, but what does exist is a parent group with deep AI capability, a research division publishing machine learning work on heat pump reliability, and a UK brand whose connected products sit closer to smart monitoring than to learned control. That gap is what I would like to ask Jo Shepherd about when we next speak.

Why the AICSA Is Watching This

Every capability described here rests on the same foundation: a heating appliance permanently connected to a network, sending operational data to a cloud service and accepting instructions back. That creates risk we should be discussing far more than we are. A compromised heat pump could leak occupancy data, because heating patterns reveal when a house is empty with uncomfortable precision, and it could leave a household without heat in winter. The concern that keeps me awake is aggregation: a vulnerability in one unit is almost certainly present in every unit that manufacturer has shipped, and a coordinated switching event across a large population of high draw appliances becomes a grid stability problem rather than a customer service one. Security researchers at Pen Test Partners have already raised this.

The people designing heat pump optimisers are mostly energy engineers rather than security specialists, and the people buying the systems are householders like me who are not thinking about attack surfaces. Bringing those groups into the same room is much of why the AICSA exists.

Final Thoughts

Heating is going through a transition much like the one the automotive industry went through, and the security profession was largely absent from that conversation until the vehicles were already on the road. We then spent a decade retrofitting security onto systems that were never designed to accommodate it, at real cost and with mixed results. Heating has a narrow window in which to avoid repeating that, because the units being designed now will still be bolted to the outside walls of British homes in fifteen or twenty years. Whatever decisions get made in the next couple of product cycles will be very difficult to unpick later.

I would ask the industry to use this window, and I would ask four things in particular:

Manufacturers should treat security as a design requirement rather than something to be evidenced after the fact. That means secure update mechanisms that will still work when a product is a decade old, a published route for security researchers to report vulnerabilities without fear, and honesty with customers about what data leaves the home, where it travels and who else can see it. Heating data is not neutral. It describes when a household sleeps, when it is empty and how many people live there.
Installers are part of the security chain now, whether they asked to be or not. Robert, who fitted our system, was superb at his job and took enormous care over the installation. Nobody has trained him on network security, because until recently nobody needed to. If commissioning a heat pump now involves connecting it to a home network and a cloud account, the training and certification frameworks need to catch up with that reality, and manufacturers are best placed to lead it.
Energy suppliers and flexibility providers are acquiring the ability to switch large numbers of appliances remotely. That capability deserves the same scrutiny, resilience testing and operational discipline we would expect of anyone else running critical national infrastructure, because at sufficient scale that is what it becomes.
Those of us in cyber security have work to do as well. It is not enough to stand outside an industry and point at its weaknesses. We need to turn up at heating conferences, learn how these systems are actually designed and installed, and make our advice practical for a sole trader in a van rather than a security team in a bank. If we make ourselves difficult to work with, we will be worked around.

My Worcester Bosch air conditioning is excellent. The engineering is quiet and well made, and the aftercare when something went wrong was the best I have had in years. Everything I have described here is a chance to extend that same standard of care into the software and the data, and the companies that get it right will have an argument no marketing department can manufacture, that their product can be trusted in someone’s home for as long as it is there.

If you are building AI into heating or cooling and you want to think through what that means for security, the AICSA would like to hear from you. Please get in touch with us via hello@aisec.org.uk.

Sources

Ventura, L. (2026), “Review: Surviving the UK Heatwaves, My Worcester Bosch Air Conditioning Installation”, Cyber Geek Girl. https://cybergeekgirl.co.uk/review-surviving-the-uk-heatwaves-my-worcester-bosch-air-conditioning-installation/

Ventura, L. (2026), “Follow Up Review: A Noisy Condenser, Two Engineers and an Unexpected Visit from the CEO of Worcester Bosch”, Cyber Geek Girl. https://cybergeekgirl.co.uk/follow-up-review-a-noisy-condenser-two-engineers-and-an-unexpected-visit-from-the-ceo-of-worcester-bosch/

Qarqour, A., Heisenberg, G., Arora, S. J., and Martinovic, D. (2026), “Hybrid Detection for Heat Pump Contamination Using Physics-Informed Machine Learning”, PHM Society European Conference. https://papers.phmsociety.org/index.php/phme/article/view/4979

Brudermueller, T., Potthoff, U., Fleisch, E., Wortmann, F., and Staake, T. (2025), “Estimation of energy efficiency of heat pumps in residential buildings using real operation data”, Nature Communications. https://www.nature.com/articles/s41467-025-58014-y

ETH Zurich (2025), “How efficient are heat pumps in reality?”. https://ethz.ch/en/news-and-events/eth-news/news/2025/05/how-efficient-are-heat-pumps-in-reality.html

Bosch Media Service (2026), “Bosch launches SkyQ intelligent control system to maximize HVAC performance”. https://us.bosch-press.com/pressportal/us/en/press-release-31232.html

Bosch Media Service (2026), “BSH Home Appliances North America Reports Strong 2025 Performance”. Source for the Bosch AI patent portfolio, People First technology and Bosch Cook AI. https://us.bosch-press.com/pressportal/us/en/press-release-30528.html

Bosch Media Service (2026), “BCW 2026: Bosch pushes ahead with technologies for automation and robotics”. https://us.bosch-press.com/pressportal/us/en/press-release-31104.html

Worcester Bosch. https://www.worcester-bosch.co.uk/

Worcester Bosch, “HomeCom Easy App” product page. https://www.worcester-bosch.co.uk/products/boiler-controls/Bosch-HomeCom-Easy-App

Bosch Home Comfort, “Bosch Climate 7000i” product facts page. https://www.bosch-homecomfort.com/global/en/facts-bosch-climate7000i/

Bosch Home Comfort Group. https://www.bosch-homecomfortgroup.com/

Bosch Group. https://www.bosch.com/

Cooling Post (2025), “Shepherd appointed Worcester Bosch CEO”. https://www.coolingpost.com/uk-news/shepherd-appointed-worcester-bosch-ceo/

Havenwise. https://www.havenwise.co.uk/

Homely Energy. https://www.homelyenergy.com/

Passiv UK. https://www.passivuk.com/

HVP Magazine, “New AI technology signals boom time for heat pump installers”. https://www.hvpmag.co.uk/New-AI-technology-signals-boom-time-for-heat-pump-installers-/18477

Department for Energy Security and Net Zero, “Heat Pump Ready Programme”, gov.uk. https://www.gov.uk/government/publications/heat-pump-ready-programme

Pen Test Partners, “New cybersecurity rules for smart heat pump manufacturers”. https://www.pentestpartners.com/security-blog/new-cybersecurity-rules-for-smart-heat-pump-manufacturers/