- Sen. Markey proposed the Cybersecurity and AI Board of Investigations Act
- The proposed board would have subpoena authority and investigate major cyber incidents
- The bill would require public reports containing factual findings and recommendations for improving cybersecurity resilience
Sen. Edward Markey, D-Mass., has introduced the Cybersecurity and AI Board of Investigations Act, a legislation designed to create an independent federal entity focused on investigating significant cybersecurity incidents and emerging cyber risks.
What Are the Key Provisions of the Proposed Cybersecurity Bill?
Markey’s office said Thursday the legislation would create the five-member Cybersecurity and AI Board of Investigations as a non-regulatory entity focused on strengthening the ability of public and private institutions to address cybersecurity risks associated with artificial intelligence and other emerging technologies.
The bill would give the board subpoena authority to obtain relevant information and evidence needed to conduct investigations. The proposed authority is intended to allow investigators to develop a more complete account of major incidents, including technical, organizational and systemic factors.
The legislation would require the board to report its findings and recommendations publicly after investigations.
“We need the Cybersecurity and AI Board of Investigations to get to the bottom of major incidents and give companies and the government the critical information necessary to build resilience and better secure our economy and our country,” said Markey.
How Would the Proposed Board Investigate Major Cyber Incidents?
The board would investigate major cybersecurity incidents involving federal civilian information systems and non-federal systems, particularly those supporting critical infrastructure.
The legislation also directs the board to examine cybersecurity near-misses, systemic vulnerabilities across sectors and technology categories, and breakdowns in regulatory oversight, coordination or incident response.
The bill would additionally establish a voluntary, anonymized near-miss reporting system. The system would allow organizations and individuals to report cybersecurity events that could have disrupted critical communications or commerce systems or exposed sensitive information, helping investigators identify vulnerabilities before they contribute to larger incidents.
What Cybersecurity Risks Are Emerging as Federal Agencies Adopt AI?
The proposed approach comes as federal agencies continue to identify cybersecurity and governance challenges associated with AI adoption. A USDA Office of Inspector General review, for example, found that 73 of the department’s 82 identified AI use cases lacked authorizations to operate and were not recorded in the agency’s cybersecurity tracking system. Auditors also identified gaps in security documentation and recommended stronger risk assessments and oversight of AI systems.
Separately, federal and industry officials have warned that increasingly capable AI systems could create cybersecurity risks alongside their defensive applications. In May, CIA and industry officials discussed the potential for advanced AI models to help identify software vulnerabilities, while also raising concerns about how malicious actors could also misuse similar frontier AI systems.
