That category covers energy, transport, defence, food, health and finance, including facilities such as power stations, airports and hospitals.
The warning appears in the agency's annual review, which also says Russia and China will start using AI "routinely" in cyber-attacks.
It is a staple of criminal hacking gangs, typically based in former Soviet states, and has already hit Royal Mail, outsourcing firm Capita and various public bodies, including councils.
The NCSC says AI will make the threat worse by helping attackers scout targets, find weaknesses in IT networks and write malicious code.
NCSC chief executive Richard Horne is due to say in a speech that the UK faces a "real prospect of an unprecedented rise" in cyber incidents in the coming months. He attributes this to AI's ability to expose weaknesses that have been "tolerated for far too long." As an example, AI recently helped uncover a critical flaw in PHP, a programming language used by almost 70% of websites. Horne says AI can help defenders find and patch flaws, but attackers will get there first if defenders lack access. OpenAI and Anthropic have so far given some companies advanced access to their most powerful models to help identify serious IT flaws.
Horne is also expected to say that British military communications networks face daily, "persistent" and "sustained" attacks. He will name Russia as one of the perpetrators, saying its campaigns deliberately stay below the threshold of armed conflict. He will cite recent attacks on supermarket fridges in Europe, where hackers raised temperatures above 50C, as a warning to invest in cyber resilience.