White House AI Task Force Recommends 12-Month Liability Relief for Voluntary Cyber Incident Reporting

The White House AI task force on Thursday urged federal agencies to limit regulatory liability for companies that voluntarily report cybersecurity vulnerabilities and incidents in good faith, a recommendation aimed at encouraging disclosure as AI capabilities change the threat landscape. The guidance is not a law, rule or executive order, and agencies are not required to adopt it.

What the task force recommended

At its second meeting on November 12 (per a White House readout summarized in source [1]; some reports cite November 13 or 14), the task force said agencies should “implement limitations on regulatory liability for good-faith voluntary reporting of cybersecurity vulnerabilities and incidents” where doing so is “lawful, practical, and consistent with the interests of the American people, including public health and safety.” The flexibility would last at least 12 months, with possible extension based on ongoing risk evaluation [1][2].

The task force argued that “prior standards for taking regulatory action against organizations in response to cyber incidents may be outdated” because organizations that recently had reasonable protections “are now more vulnerable” [2]. It said the goal was to ease requirements that could “have a chilling effect on reporting and information sharing at a time when reporting is critical to our broad risk mitigation efforts” [2].

The task force statement addresses only cybersecurity vulnerabilities and incidents; it does not mention other AI failures such as a chatbot giving bad medical advice or a model failing an internal safety test [4]. The task force also backs long-term reauthorization of the 2015 Cybersecurity Information Sharing Act, which provides liability protections for sharing cyber threat data and is due to expire [1][2].

Task force structure and prior steps

The group—described in some coverage as the Super Intelligence Force—is chaired by Director of National Intelligence Jay Clayton, with Emil Michael as vice chair, and operates on a 120-day window [1]. Source [3] identifies Scott Kupor as “SI Force Vice Chair,” a discrepancy not resolved in the available reporting. Michael is identified as Pentagon Under Secretary in source [3] and as the Pentagon’s top research official in source [2] [2][3]. At its first meeting on October 16, it told AI companies to report rogue behavior by their products and fix it through a “notification and remediation process,” but had not defined what counts as an incident, how quickly companies must report, or what happens if they do not [1]. The November recommendation addresses the incentive side of that gap; it does not supply the definitions.

Thursday’s meeting included Commerce Secretary Howard Lutnick, National Cyber Director Sean Cairncross, OPM Director Scott Kupor, FTC Chair Andrew Ferguson, and OSTP Director Michael Kratsios [2][3]. The NSA and NIST have been testing frontier models in partnership with major AI labs [2].

A voluntary reporting channel under discussion

Cairncross and Michael discussed conversations with industry leaders about establishing a voluntary process for companies to report AI-related incidents. Under the proposed framework, the government would analyze submissions and share defensive information with the private sector [2][3]. No design details, reporting format, data-access rules, or confidentiality provisions were described in the coverage [1][2].

Conditions and limits

The liability relief is conditional: agencies should act only when lawful, practical, and consistent with the public interest, including public health and safety [1][2]. It is a recommendation, not an enforceable shield. Agencies can follow it or ignore it, and none has yet promised to adopt it in writing [4]. The task force also supports CISA’s forthcoming incident-reporting rule while urging that it set “clear and practical reporting requirements that minimize duplication” [2].

Industry context and open questions

Business groups have complained that overlapping and contradictory cybersecurity regulations divert resources from incident response and defensive improvements [2]. The task force’s argument for acting now is that attackers are using AI tools against defenders, making previously adequate protections insufficient [4].

Critics note that a voluntary regime relies on the same companies whose silence it tries to fix, and that a grace period is only as good as the reporting that follows [4]. CISA’s role in the task force’s work remains unclear; the White House readout did not say whether the agency participated, and the White House did not answer questions about its involvement [2].

What to watch

• Whether agencies adopt the 12-month relief in written guidance.
• How CISA’s incident-reporting rule is finalized.
• Whether Congress reauthorizes the Cybersecurity Information Sharing Act before it expires.
• Whether the task force’s 120-day review produces a definition of an AI incident.
• Whether major AI labs view the safe harbor as sufficient motivation to disclose vulnerabilities that could expose them to reputational and competitive risks [3][4].