White House AI Task Force Urges Liability Relief to Spur Reporting of AI Cyber Incidents

In a statement after its second meeting, held on Thursday, the task force said "prior standards for taking regulatory action against organizations in response to cyber incidents may be outdated." It called on agencies to "implement limitations on regulatory liability for good-faith voluntary reporting" where that is lawful, practical and consistent with the public interest, including public health and safety. The relief should last at least 12 months, "with the possibility of extension" as risks are reassessed, according to the statement as reported by Cybersecurity Dive.

The recommendation goes at a long-standing complaint from companies: disclosing a breach can invite enforcement action, which discourages them from sharing details that would help others defend themselves. The task force said it wanted to avoid rules that could "have a chilling effect on reporting and information sharing." Officials framed the change as a way to get AI companies to report critical incidents, Bloomberg reported, and the statement said critical infrastructure operators should also be able to act "without fear that good-faith voluntary disclosures will expose them to punitive regulatory" action.

The meeting focused on the security implications of advancing AI, according to the White House readout. Commerce Secretary Howard Lutnick and National Cyber Director Sean Cairncross described work under way. The National Security Agency and the National Institute of Standards and Technology are testing new frontier AI models with major AI labs, and the government is working with those labs on tools to strengthen defences, improve early detection and warning, and speed up remediation.

Cairncross and Emil Michael, the Pentagon's top research official, discussed with industry leaders a process for companies to report AI-related incidents voluntarily. Under that framework the government would analyse the reports and share what it learns with the private sector. The administration also wants experts at the US national laboratories to help with incident response, though the statement gave no detail on how that would work.

The task force backed a long-term reauthorisation of the Cybersecurity Information Sharing Act of 2015, which gives companies liability protection when they share cyber threat data and is due to expire soon. It also said it supports the Cybersecurity and Infrastructure Security Agency's forthcoming incident-reporting rule and hopes CISA sets "clear and practical reporting requirements that minimize duplication," a nod to business complaints about overlapping cyber rules.

The readout did not say whether CISA took part in the meeting or in the task force's work, and the White House did not respond to Cybersecurity Dive's questions on that point or on the status of its projects.

Cairncross and Office of Personnel Management Director Scott Kupor are working to "identify actionable measures" to improve infrastructure security, with a focus on small and medium-sized businesses. The bigger test for the liability proposal is whether independent regulators adopt it before the information-sharing law lapses.