The Trump administration’s AI task force is encouraging regulatory agencies not to take enforcement actions against companies that experience cyberattacks resulting from AI overwhelming their defenses.
“It is clear that the cybersecurity risk environment has changed and organizations that only a short time ago had reasonable protections in place are now more vulnerable,” the new task force said in a statement about its second meeting on Thursday. “As a result, prior standards for taking regulatory action against organizations in response to cyber incidents may be outdated.”
Instead, the task force said, federal agencies should “implement limitations on regulatory liability for good-faith voluntary reporting of cybersecurity vulnerabilities and incidents” when doing so is “lawful, practical, and consistent with the interests of the American people, including public health and safety.”
The regulatory flexibility should last for at least the next 12 months, the task force said, “with the possibility of extension based on an ongoing evaluation of the risk landscape.”
The task force said its goal was to ease regulatory requirements that could “have a chilling effect on reporting and information sharing at a time when reporting is critical to our broad risk mitigation efforts.”
The business community has repeatedly complained to the federal government that there are too many overlapping and contradictory cybersecurity regulations, with compliance forcing some companies to divert resources from incident response and defensive improvements. The Trump administration, like its predecessor, has been exploring ways to reduce regulatory complexity. The Cybersecurity and Infrastructure Security Agency (CISA)’s forthcoming incident-reporting rule could significantly increase that complexity, although the task force said it supports the rulemaking and hopes that CISA establishes “clear and practical reporting requirements that minimize duplication.”
The AI task force focused on the cybersecurity implications of advancing AI capabilities during its Thursday meeting, according to a readout from the White House.
The group “discussed the evolving cyber threat environment and its ongoing efforts to strengthen the security and resilience of America’s critical infrastructure,” with officials emphasizing “the shared and overlapping responsibilities and importance of continued close coordination among the federal, state, and local governments and the private sector.”
Officials, including Commerce Secretary Howard Lutnick and National Cyber Director Sean Cairncross, described ongoing work to identify and mitigate security risks associated with new AI models. The National Security Agency and the National Institute of Standards and Technology have been testing new frontier models in partnership with major AI labs.
Cairncross and Emil Michael, the Pentagon’s top research official, discussed their conversations with industry leaders about setting up a process for companies to voluntarily report AI-related incidents. As part of that framework, the government would analyze reported incidents and share information with the private sector to help them defend against similar threats.
Given the importance of rapid information sharing, the task force repeated the Trump administration’s support for a long-term reauthorization of the 2015 Cybersecurity Information Sharing Act, a soon-to-expire law that gives companies liability protections for sharing cyber threat data. “Critical infrastructure operators and industry partners should be encouraged to proactively identify, report, and remediate cybersecurity risks without fear that good-faith voluntary disclosures will expose them to punitive regulatory or administrative action or civil liability,” the group said.
The government is also working with frontier AI labs “to develop advanced tools to strengthen defenses, improve early detection and warning systems, and enable rapid remediation,” according to the statement. In addition, the Trump administration envisions tapping experts at the U.S. national laboratories to assist with incident response, although the statement did not provide details about how that would work.
The task force has also promised to work with critical infrastructure operators to harden their defenses against AI-fueled cyber threats, and Thursday’s meeting featured a discussion of how that work is going. Cairncross and Office of Personnel Management Director Scott Kupor said they were working to “identify actionable measures” that would boost infrastructure security the most, with a focus on small and medium-sized businesses. At the same time, the task force is also developing initiatives to secure federal networks.
The readout did not say whether CISA participated in the task force meeting or has been involved in the group’s work. Experts have said the cyber agency should be deeply involved in any activities related to AI security, critical infrastructure protection and information sharing. The White House did not respond to a request for comment about CISA’s involvement in the task force and the status of the group’s projects.
