White House AI task force urges liability relief to encourage cyberattack reporting

Companies that voluntarily disclose cyber incidents should face less regulatory risk as AI changes the threat landscape, President Donald Trump’s AI task force said after its second meeting on November 12. The group urged federal agencies to limit liability for good-faith reporting, where lawful and practical—a recommendation, not a protection companies can already claim.

AI risk prompts a rethink of enforcement

The task force’s starting point was that organizations with recently adequate cyber defenses may now be more vulnerable. In a statement reported by Cybersecurity Dive, it argued that AI has changed the risk environment enough that earlier standards for regulatory action after an incident may be outdated.

Thursday’s meeting focused on the cybersecurity implications of advancing AI capabilities and the resilience of critical infrastructure. Officials emphasized coordination among federal, state and local governments and private companies. Commerce Secretary Howard Lutnick and National Cyber Director Sean Cairncross described ongoing efforts to identify and reduce security risks from new models.

Some technical work is already underway: the National Security Agency and the National Institute of Standards and Technology have been testing advanced AI models with major AI labs. The disclosure discussion addresses another part of that effort—getting information about vulnerabilities and incidents from companies into government hands, then sharing useful findings with other defenders.

A proposed reporting shield, with conditions

The recommendation asks agencies to limit regulatory liability for good-faith voluntary reports of both cybersecurity vulnerabilities and incidents. It is conditional: agencies should act only when doing so is lawful, practical and consistent with the public interest, including public health and safety. The task force proposed at least 12 months of flexibility, with possible extensions after continued assessment of the risks.

Its stated purpose is to prevent regulatory requirements from discouraging disclosure when rapid information sharing is especially valuable. The group also said critical infrastructure operators and industry partners should be able to identify, report and fix risks without fearing punitive regulatory or administrative action, or civil liability, from good-faith voluntary disclosures.

Critical infrastructure operators and industry partners should be encouraged to proactively identify, report, and remediate cybersecurity risks without fear that good-faith voluntary disclosures will expose them to punitive regulatory or administrative action or civil liability

White House AI task force, in its statement reported by Cybersecurity Dive

Turning disclosures into shared defenses

Cairncross and Emil Michael, the Pentagon’s top research official, discussed conversations with industry leaders about establishing a voluntary process for reporting AI-related incidents. Under that proposed framework, the government would analyze submissions and share information with private companies to help them defend against similar threats.

The group also reiterated support for long-term reauthorization of the 2015 Cybersecurity Information Sharing Act. That law gives companies liability protections for sharing cyber threat data. Separately, the administration is working with leading AI labs on defensive tools, early-warning systems and faster remediation. It also envisions using national laboratory experts to assist with incident response, though no operating details were provided.

The push for voluntary disclosures does not mean the task force opposes reporting requirements. It backed the Cybersecurity and Infrastructure Security Agency’s forthcoming incident-reporting rule, while calling for clear, practical requirements that minimize duplication. Businesses have repeatedly complained that overlapping cyber regulations divert resources from responding to incidents and improving defenses.

CISA’s role in the task force’s work remains unclear. The White House readout did not identify whether the agency participated, and the White House did not answer Cybersecurity Dive’s questions about its involvement or the status of the projects. For companies considering disclosure, the proposed regulatory relief remains a recommendation rather than an implemented safeguard.