Cybersecurity and AI Board of Investigations Act of 2026
- Sponsor
- Sen. Markey, Edward J. [D-MA]
- Committees
- Commerce, Science, and Transportation Committee (primary)
- Last action
- Sep 24, 2026
Bottom line
The bill creates a new independent federal board to investigate significant cyber incidents and near-misses, with a special focus on AI, aiming to enhance national cybersecurity through public reports and non-binding recommendations.
What it actually does
This bill establishes an independent Cybersecurity and AI Board of Investigations (CAIBI) to conduct impartial reviews and assessments of cyber incidents, near-misses, and systemic cybersecurity vulnerabilities, particularly those involving artificial intelligence and other emerging technologies. The Board is tasked with identifying contributing failures, issuing actionable recommendations, and maintaining a voluntary, anonymized near-miss reporting system to improve national cybersecurity resilience.
Proponents argue
Proponents argue that a dedicated, independent board, modeled after the National Transportation Safety Board, is essential to understand the rapidly evolving cyber threat landscape, especially with the increasing sophistication and prevalence of AI. They contend it would foster transparency, facilitate learning across public and private sectors, and provide crucial, unbiased insights to improve the nation's digital defenses without being constrained by regulatory or enforcement mandates.
Opponents contend
Opponents might raise concerns that the establishment of a new independent board could lead to duplication of efforts with existing federal agencies like CISA, NIST, and the FBI, potentially creating bureaucratic inefficiencies and jurisdictional confusion. Some may also express apprehension regarding the Board's subpoena authority, even with stated protections, fearing it could deter voluntary information sharing from private entities.
The bill is moderately detailed but clearly structured, allowing an informed reader to understand its core provisions and implications within a reasonable timeframe.
Section 3(b)(1)
Establishment of the Cybersecurity and AI Board of Investigations
This provision formally establishes the Cybersecurity and AI Board of Investigations (CAIBI) as an independent federal establishment. It mandates that the Board be operational 90 days after the bill's enactment, setting it up as a new, distinct entity within the federal government.
Supporters argue
Supporters argue that establishing an independent board is critical for ensuring unbiased and thorough investigations into cyber incidents, free from political or regulatory pressures that might influence existing agencies.
Critics contend
Critics may contend that creating a new independent agency adds another layer of bureaucracy to an already complex federal cybersecurity landscape, potentially leading to redundancy and inefficient resource allocation.
Tradeoffs
The tradeoff involves balancing the desire for independent oversight with the potential for increased bureaucratic complexity and overlap with existing federal cybersecurity mandates.
Section 3(b)(3)
Purposes and Scope of the Board's Investigations
This section outlines the core missions of the CAIBI, including advancing digital infrastructure safety, conducting independent reviews of incidents affecting federal and non-federal information systems (especially critical infrastructure), analyzing near-misses, identifying systemic vulnerabilities (including those related to AI), and assessing breakdowns in regulatory oversight. The Board is explicitly designed to operate independently from regulatory and enforcement actions, without assigning legal fault or liability.
Section 3(b)(4)
Organizational Structure of the Board
This provision mandates the establishment of three distinct offices within the Board: the Office of Investigations (for conducting incident inquiries), the Office of Trend Analysis and Learning (for managing the near-miss system and issuing trend reports, especially on AI risks), and the Office of Coordination (for liaising with federal agencies and private sector entities).
Section 3(b)(5)
Voluntary Near-Miss Reporting System
The bill requires the Board to establish a voluntary, anonymized system for individuals and organizations to report cybersecurity near-misses, particularly within critical infrastructure sectors. This system is designed to identify systemic vulnerabilities across technologies and sectors, support proactive risk management, and protect the identity of reporters from disclosure, without attributing fault or liability.
Section 3(c)
Board Membership and Leadership
The Board will consist of 5 members appointed by the President with Senate consent, based on their technical qualifications and cybersecurity expertise, serving 5-year terms. No more than 3 members can be from the same political party. The President also designates a Chair and Vice Chair, each serving 3-year terms, with the Chair acting as the chief executive and administrative officer.
Section 3(e)(3)
Requirements for Board Reports
Upon completing a review, the Board must prepare a report containing factual findings, actionable recommendations for improving cybersecurity, a timeline of events, an analysis of contributing factors, and a section on lessons learned. Reports must include technical indicators of compromise, detailed methodological information, and a plain language executive summary, all based on unclassified or declassified information suitable for public consumption.
Section 3(i)
Information Requests and Subpoena Authority
The Board is authorized to request and receive relevant documents and testimony from entities or individuals involved in or affected by an incident. If voluntary responses are deficient, the Chair, with a majority Board vote, can issue subpoenas to compel disclosure. Non-compliance can lead to civil action by the Attorney General. This subpoena authority does not apply to government entities, and information obtained via subpoena is not subject to the same protections as voluntarily provided information.
Section 3(j)
Protections for Voluntarily Provided Information
This section establishes strong protections for documents and testimony voluntarily provided to the Board. Such information is considered commercial/proprietary, exempt from FOIA and similar state/local laws, does not waive legal privileges, and cannot be used in trials or regulatory proceedings (with an exception for investigating the person/entity who committed the incident itself). Disclosure is limited to specific cybersecurity, national security, or serious harm prevention purposes.
The definitions of 'Federal civilian executive branch agency' and 'Federal civilian executive branch information system' explicitly exclude the Department of Defense, elements of the intelligence community, and national security systems from the Board's primary investigative scope.
Section 3(a)(6) and (7)
Why it matters:This is standard legislative practice to precisely define the scope and applicability of a new agency's jurisdiction, ensuring it does not conflict with existing national security mandates.
Case for: Supporters argue that this limitation is necessary to protect highly sensitive national security operations and intelligence gathering from potential compromise or interference by a civilian investigative body, ensuring appropriate jurisdictional boundaries.
Case against: Critics might contend that excluding these critical sectors means the Board will not have a complete picture of the most sophisticated cyber threats, potentially missing key insights from incidents involving state-sponsored actors or advanced persistent threats.
Estimated impact: Significantly limits the Board's direct investigative authority over military and intelligence cyber operations, focusing its efforts on civilian government and critical infrastructure.
The Board is mandated to operate independently from regulatory review and enforcement actions 'without assigning legal fault or liability' for any review and assessment conducted.
Section 3(b)(3)(H)
Why it matters:This phrasing is likely intended to reassure potential reporting entities that the Board's findings will not be used against them in legal or regulatory contexts, encouraging cooperation. It's a key feature of the NTSB model.
Case for: Proponents argue that this explicit limitation is fundamental to the Board's mission of fostering learning and transparency. By removing the threat of legal or regulatory repercussions, entities are more likely to provide candid and comprehensive information, leading to more effective cybersecurity improvements.
Case against: Critics might argue that by explicitly disclaiming legal fault or liability, the bill could be perceived as reducing accountability for severe cyber incidents, potentially undermining incentives for robust cybersecurity practices.
Estimated impact: Establishes the Board as a learning-focused entity rather than a punitive one, which is central to its operational model.
The Board is explicitly exempted from the Federal Advisory Committee Act (FACA) and the Government in the Sunshine Act.
Section 3(g)
Why it matters:Exempting the Board from these acts is likely intended to provide it with greater operational flexibility and to protect sensitive investigative discussions and proprietary information from premature public disclosure, which could hinder its work.
Case for: Supporters argue that these exemptions are necessary for the Board to conduct sensitive investigations effectively, allowing for candid discussions and the protection of proprietary or classified information without the constraints of public meeting requirements or extensive public records requests.
Case against: Critics might contend that these exemptions reduce transparency and public oversight of a new federal agency, potentially limiting public access to its deliberations and internal processes, which could raise accountability concerns.
Estimated impact: Grants the Board significant operational autonomy and discretion over its internal proceedings and information disclosure, compared to many other federal bodies.
Voluntarily provided submissions, and any records created solely for preparing them, cannot be used in evidence or discovery in any court or regulatory proceeding. However, there is an exception: this protection does not prevent the use of such information to investigate or prosecute a person or entity suspected of committing, conspiring to commit, or aiding the commission of the incident described in the submission, provided the submission itself is not disclosed.
Section 3(j)(4)(B)
Why it matters:This complex phrasing attempts to balance the need to encourage voluntary reporting with the imperative to allow for criminal prosecution of those responsible for cyber incidents, without directly using the voluntary submission as evidence.
Case for: Proponents argue that this exception is a necessary safeguard to ensure that serious criminal acts are not shielded by the voluntary reporting system, while still providing significant protections to encourage reporting. It aims to prevent the system from being exploited by malicious actors.
Case against: Critics might argue that even with the caveat that the submission itself isn't disclosed, the possibility of information from a voluntary report being used to investigate the reporting entity could still create a chilling effect, deterring some from sharing critical data.
Estimated impact: Creates a specific legal pathway for law enforcement to act on information derived from voluntary reports, while attempting to maintain the integrity of the voluntary reporting system.