Washington — November 14, 2026. The White House’s AI task force is urging federal agencies to hold off on punishing companies that voluntarily report cybersecurity vulnerabilities and incidents, recommending at least 12 months of limited regulatory liability for good-faith disclosures. Why it matters: it is a clear shift from October, when the same task force told AI companies that incident disclosure was mandatory and warned of consequences for staying quiet — now the pitch is a carrot instead of a stick.
What happened
The recommendation came out of the task force’s second meeting, held Thursday, November 12, which focused on the cybersecurity implications of advancing AI capabilities, according to a White House readout reported by Cybersecurity Dive and Bloomberg. In its statement, the group said the cyber risk environment has changed, that organizations which recently had reasonable protections in place are now more vulnerable, and that prior standards for taking regulatory action after cyber incidents may be outdated.
Specifically, the task force said agencies should “implement limitations on regulatory liability for good-faith voluntary reporting of cybersecurity vulnerabilities and incidents” where doing so is lawful, practical, and consistent with the interests of the American people, including public health and safety. The flexibility should last at least 12 months, with the possibility of extension based on an ongoing evaluation of the risk landscape.
The details
The stated goal is to remove a chilling effect: officials argued that fear of enforcement discourages the reporting and information sharing that defenders need most right now. Commerce Secretary Howard Lutnick and National Cyber Director Sean Cairncross were among the officials describing work to identify and mitigate risks from new AI models, and Cairncross and Pentagon research chief Emil Michael discussed a voluntary process for companies to report AI-related incidents, with the government analyzing reports and sharing defensive information back to industry.
The group also backed a long-term reauthorization of the 2015 Cybersecurity Information Sharing Act, the soon-to-expire law that gives companies liability protections for sharing cyber threat data, and said it supports the Cybersecurity and Infrastructure Security Agency’s forthcoming incident-reporting rule — while hoping CISA sets clear, practical requirements that minimize duplication. The readout did not say whether CISA itself participated in the meeting, and the White House did not respond to Cybersecurity Dive’s request for comment on that point.
Why it matters
This is a recommendation, not an executive order or a law — no agency has yet promised relief, and none has said which regulators would offer it or when. But the direction is unmistakable, and it reverses the tone of October’s mandatory-disclosure push. For AI companies and the critical-infrastructure operators the task force is courting, the practical test is whether agencies turn this into written safe-harbor guidance; until they do, reporting a breach to a regulator still carries the old risks. Everything AI, tested — we will be watching whether any agency actually puts the 12-month shield in writing.
Frequently asked questions
Is the liability relief already in effect?
No. It is a task force recommendation to federal agencies, not a binding rule. Agencies would have to adopt it themselves, and none has yet specified how or when.
What kind of reports does it cover?
Good-faith voluntary reports of cybersecurity vulnerabilities and incidents. The coverage reviewed for this story does not extend it to every kind of AI failure, such as a chatbot giving bad advice or a model failing an internal safety test.
How long would the relief last?
At least 12 months, with the possibility of extension based on an ongoing evaluation of the risk landscape.
What else did the task force back?
A long-term reauthorization of the 2015 Cybersecurity Information Sharing Act and CISA’s forthcoming incident-reporting rule, provided its requirements are clear and do not duplicate other reporting duties.
Sources: Cybersecurity Dive, Bloomberg (via Startup Fortune and AI Weekly reporting of the same meeting)