Summary

Revises federal cybersecurity law to add and clarify definitions (including “artificial intelligence” and “Sector Risk Management Agency”), expand voluntary federal cyber-threat information sharing and technical assistance for critical infrastructure, and require DHS outreach and annual briefings to better include small, rural, and non‑Federal infrastructure owners and operators. The bill also permits some uses of authorities where they were previously mandatory, adds SRMAs to rapid notification lists, prohibits certain uses of AI developed or deployed strictly for cybersecurity in specified activities, and updates the Homeland Security Act definition of SRMA to explicitly cover operational technology, edge devices, and IoT (including assets affected by ransomware). A 90-day deadline is set for DHS to develop an outreach plan, followed by annual briefings to two congressional committees.

Key Points

• Adds and clarifies statutory definitions for AI, critical infrastructure, and Sector Risk Management Agencies.
• Expands voluntary federal cyber-threat information sharing and technical-assistance options for critical infrastructure owners/operators.
• Requires DHS to produce an outreach plan within 90 days and to give annual briefings to Congress targeting small, rural, and non‑Federal infrastructure owners/operators.
• Adds SRMAs to the list of entities that may be rapidly notified about cyber threats and expressly covers OT, edge, and IoT devices.
• Converts some mandatory authorities into permissive ones, increasing agency discretion in how to use certain powers.
• Prohibits certain uses of AI developed or used strictly for cybersecurity in specified authorized activities.
• Implements multiple conforming and textual changes across existing cybersecurity statutes to reflect the new definitions and authorities.

Categories & Tags