White House AI Task Force Backs 12-Month Liability Relief for Cyber Reporting

By Nathan Brooks

The White House AI task force on Thursday recommended that federal agencies give companies at least 12 months of regulatory liability relief when they voluntarily report cybersecurity vulnerabilities and incidents in good faith. The guidance carries no legal force — it's not a law, rule or executive order — and no agency has committed in writing to adopting it.

The recommendation came out of the task force's second meeting, which a White House readout dates to November 12, though some reports cite November 13 or 14. Agencies should "implement limitations on regulatory liability for good-faith voluntary reporting of cybersecurity vulnerabilities and incidents" where doing so is "lawful, practical, and consistent with the interests of the American people, including public health and safety," the task force said. The relief window runs at least 12 months, with a possible extension based on ongoing risk evaluation.

Why the task force says the rules are outdated

The group's core argument: the threat math has changed. "Prior standards for taking regulatory action against organizations in response to cyber incidents may be outdated," the task force said, because organizations that recently had reasonable protections "are now more vulnerable." Attackers are using AI tools against defenders, making previously adequate security insufficient, per the task force's reasoning as reported by critics and coverage alike.

The task force wants to remove requirements that could "have a chilling effect on reporting and information sharing at a time when reporting is critical to our broad risk mitigation efforts." In plain terms: companies stay quiet about breaches when disclosure invites enforcement action, and silence leaves everyone else exposed.

The statement covers only cybersecurity vulnerabilities and incidents. It says nothing about other AI failures — a chatbot giving bad medical advice or a model failing an internal safety test fall outside its scope.

Who's on the task force and what came before

The group — described in some coverage as the Super Intelligence Force — is chaired by Director of National Intelligence Jay Clayton, with Emil Michael as vice chair, and operates on a 120-day window. One source identifies Scott Kupor as "SI Force Vice Chair," a discrepancy the available reporting hasn't resolved. Michael appears as Pentagon Under Secretary in one source and as the Pentagon's top research official in another.

At its first meeting on October 16, the task force told AI companies to report rogue behavior by their products and fix it through a "notification and remediation process." But it never defined what counts as an incident, how fast companies must report, or what happens if they don't. The November recommendation tackles the incentive side of that gap — it still doesn't supply the definitions.

Thursday's meeting included Commerce Secretary Howard Lutnick, National Cyber Director Sean Cairncross, OPM Director Scott Kupor, FTC Chair Andrew Ferguson, and OSTP Director Michael Kratsios. Separately, the NSA and NIST have been testing frontier AI models in partnership with major AI labs.

A voluntary reporting channel is taking shape

Cairncross and Michael discussed talks with industry leaders about a voluntary process for companies to report AI-related incidents. Under the proposed framework, the government would analyze submissions and share defensive information back with the private sector. That's the whole public picture — no design details, reporting format, data-access rules or confidentiality provisions have been described.

The task force also backs long-term reauthorization of the 2015 Cybersecurity Information Sharing Act, which provides liability protections for sharing cyber threat data and is due to expire.

What does this change for security teams?

Right now, very little on paper. The liability relief is conditional, and agencies can follow it or ignore it. It's a recommendation, not an enforceable shield. The practical value depends entirely on whether agencies write it into actual guidance — until then, in-house counsel shouldn't treat it as a safe harbor.

The task force did endorse CISA's forthcoming incident-reporting rule, while urging it set "clear and practical reporting requirements that minimize duplication." Business groups have complained for some time that overlapping, contradictory cybersecurity regulations divert resources away from incident response and defensive improvements.

Critics raise two problems. A voluntary regime relies on the same companies whose silence it's trying to fix, and a grace period is only as good as the reporting that follows it. CISA's role in the task force's work also remains unclear — the White House readout didn't say whether the agency participated, and the White House didn't answer questions about its involvement.

What to watch next

• Whether any agency adopts the 12-month relief in written guidance.
• How CISA finalizes its incident-reporting rule.
• Whether Congress reauthorizes the Cybersecurity Information Sharing Act before it lapses.
• Whether the task force's 120-day review produces an actual definition of an AI incident.
• Whether major AI labs see the safe harbor as reason enough to disclose vulnerabilities that could expose them to reputational and competitive damage.

For practitioners, the near-term takeaway is simple: watch the agencies, not the readout. The task force has offered a carve-out on paper; nothing binds anyone to honor it until a regulator puts pen to guidance.