White House task force urges 12-month liability relief for AI cyber reports

The White House's artificial intelligence task force has recommended that federal agencies grant at least a 12-month reprieve from regulatory liability to companies that disclose cybersecurity vulnerabilities and incidents in good faith, Bloomberg reported after the group's Thursday meeting.

Officials said agencies should "implement limitations on regulatory liability for good-faith voluntary reporting of cybersecurity vulnerabilities and incidents" where doing so is "lawful, practical, and consistent with the interests of the American people, including public health and safety." The framework would also set up a voluntary channel for AI-related incident reports, with the government analyzing submissions and sharing defensive information back to industry.

"It is clear that the cybersecurity risk environment has changed and organizations that only a short time ago had reasonable protections in place are now more vulnerable," the task force said, adding that prior enforcement standards "may be outdated." The twelve-month window can be extended based on continuing risk assessment.

Commerce Secretary Howard Lutnick, National Cyber Director Sean Cairncross, Pentagon research head Emil Michael and Office of Personnel Management Director Scott Kupor were among the attendees, Cybersecurity Dive reported. The group also urged long-term reauthorization of the 2015 Cybersecurity Information Sharing Act, the soon-to-expire law that gives companies liability cover for sharing cyber threat data. CISA's level of participation in the task force was unclear.