To direct the Secretary of Homeland Security, acting through the Director of the Cybersecurity and Infrastructure Security Agency, to establish a Critical Infrastructure AI Cyber Defense Pilot Program, and for other purposes.
- Sponsor
- Rep. Gottheimer, Josh [D-NJ-5]
- Committees
- Homeland Security Committee (primary)
- Last action
- Sep 21, 2026
Bottom line
The bill establishes a five-year pilot program to provide AI-powered cybersecurity tools and technical assistance to critical infrastructure, with a focus on smaller and underserved entities, authorizing $100 million in funding.
What it actually does
This bill directs the Secretary of Homeland Security, through the Cybersecurity and Infrastructure Security Agency (CISA), to establish a Critical Infrastructure AI Cyber Defense Pilot Program. This program will enable critical infrastructure owners and operators to securely use artificial intelligence (AI) procured by the Secretary and receive technical assistance to protect against, detect, test for, and remediate cybersecurity vulnerabilities. The program prioritizes not-for-profit, publicly owned, rural, and small-sized critical infrastructure entities.
Proponents argue
Proponents argue that this bill is a crucial step to bolster the cybersecurity defenses of the nation's critical infrastructure, especially for smaller entities that may lack the resources to acquire advanced AI tools. They contend that leveraging AI is essential to combat increasingly sophisticated cyber threats and proactively protect vital services. Supporters believe this program will enhance national security and economic stability by making essential infrastructure more resilient.
Opponents contend
Opponents might raise concerns about the efficacy and security of government-procured AI tools, questioning whether CISA has the expertise and capacity to effectively manage such a program and distribute cutting-edge technology. They may also argue that this initiative could lead to vendor lock-in, stifle private sector innovation, or create new, unforeseen vulnerabilities if the AI systems themselves are compromised or poorly implemented. Critics might also question the cost-effectiveness of the program given the authorized appropriations.
The bill is very short and clearly written, making it highly accessible for a reader to understand its core provisions within a few minutes.
Section 1(a)
Establishment of Critical Infrastructure AI Cyber Defense Pilot Program
This provision mandates the Secretary of Homeland Security, through CISA, to create a pilot program within 120 days of the bill's enactment. The program will allow critical infrastructure owners and operators to use AI tools, procured by the Secretary, and receive technical assistance from CISA to enhance their cybersecurity defenses against vulnerabilities, including protection, detection, testing, and remediation.
Supporters argue
Supporters argue that this provision directly addresses a critical national security need by empowering vital infrastructure sectors with advanced AI defenses, which are often out of reach for smaller entities. They believe it fosters a proactive approach to cybersecurity in an evolving threat landscape.
Critics contend
Critics might contend that the government procuring and distributing specific AI tools could lead to inefficiencies, stifle innovation from the private sector, or create a single point of failure if the chosen AI solutions prove inadequate or vulnerable. Concerns could also be raised about the government's capacity to effectively manage the procurement and deployment of rapidly evolving AI technologies.
Tradeoffs
The provision balances the need for enhanced cybersecurity with potential challenges related to government procurement of advanced technology, ensuring equitable access, and avoiding market distortion.
Section 1(c)
Prioritization for Program Participation
This section directs the Secretary to prioritize certain types of critical infrastructure owners and operators when selecting participants for the pilot program. Specifically, it gives preference to entities that are not-for-profit, publicly owned, rural, or small-sized. This ensures that the program's benefits are directed towards entities that may have fewer resources to invest in advanced cybersecurity.
Section 1(e)
Authorization of Appropriations and Administrative Cap
This provision authorizes the appropriation of $100,000,000 for fiscal years 2027 through 2031 to fund the Critical Infrastructure AI Cyber Defense Pilot Program. It also places a cap on administrative expenses, stipulating that no more than 5 percent of the authorized funds can be used by the Secretary for salaries, expenses, and other administrative costs related to procuring AI and providing technical assistance.
The bill defines 'artificial intelligence,' 'critical infrastructure,' and 'Sector Risk Management Agency' by referencing existing statutes: Section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401), Section 1016 of the USA PATRIOT Act (42 U.S.C. 5195c), and Section 2200 of the Homeland Security Act of 2002 (6 U.S.C. 650), respectively.
Section 1(g)
Why it matters:This is standard legislative practice to avoid reprinting lengthy definitions and ensure consistency with existing legal frameworks. It is not intended to be evasive.
Case for: Referencing existing definitions ensures legal consistency and avoids creating new, potentially conflicting definitions for established terms, streamlining the legislative process.
Case against: For a casual reader, requiring external lookups makes the bill less self-contained and harder to fully comprehend without additional research, potentially obscuring the precise scope of the program.
Estimated impact: Clarifies the legal scope and applicability of the program, affecting which technologies are considered AI, which entities qualify as critical infrastructure, and which agencies are involved in risk management.