But it only applies to AI controlling critical infrastructure, you think this is an issue in practice?

I would think if a power plant deploys some AI model to optimize something or other, it would be on the plant operator to perform the reviews, regardless of who they get the AI from.