Senator Introduced Cybersecurity AI Investigation Bill

The proposed board would investigate major cybersecurity incidents while establishing a near-miss reporting system.

Updated on Sept. 25, 2026 in Cybersecurity

Bold flat-color editorial illustration of an industrial network junction box, navy and cream palette, evoking systemic cybersecurity infrastructure and oversight. — Senator Edward Markey introduced legislation to establish a non-regulatory board tasked with investigating systemic cybersecurity vulnerabilities in federal and critical infrastructure. AI Illustration. Upload story photo >

Live Poll

Should the federal government create an independent board to investigate major cybersecurity incidents?

Senator Edward Markey introduced the Cybersecurity and AI Board of Investigations Act, a bill seeking to create a five-member non-regulatory body to examine systemic vulnerabilities. This proposed board would hold subpoena authority to investigate cybersecurity incidents within federal systems and critical infrastructure.

Why it matters

The legislation aims to strengthen institutional capacity for addressing risks introduced by artificial intelligence and emerging technologies. By creating a voluntary, anonymized reporting system for near-miss events, the proposal seeks to build broader cybersecurity resilience across sectors.

The proposed board would include 5 members and exercise subpoena authority to compel the production of evidence for investigations. This non-regulatory structure follows an USDA Office of Inspector General audit that found 73 out of 82 identified AI use cases lacked required operational authorization.

The players

Senator Edward Markey

A U.S. Senator who focuses on technology policy, telecommunications, and climate change legislation.

USDA Office of Inspector General

An independent oversight body responsible for auditing and investigating the programs and operations of the U.S. Department of Agriculture.

The details

The board is tasked with producing formal reports that detail factual findings and security recommendations following major incidents in federal civilian information systems or critical infrastructure. To identify systemic risks before they result in a compromise, the legislation establishes a voluntary, anonymized reporting mechanism for near-miss events. The process utilizes subpoena authority to ensure investigators can access the necessary evidence and technical logs to reconstruct how these incidents occurred.

September 24, 2026: Senator Markey's office announced the legislation.
May 2026: CIA and industry officials discussed AI cybersecurity risks.

The Tech Race

The legislation mirrors the National Transportation Safety Board's incident investigation model by creating a non-regulatory body focused on fact-finding rather than enforcement. This marks a departure from traditional regulatory compliance by prioritizing the development of systemic knowledge over direct penalties.

Federal agencies and private entities managing critical infrastructure may face new subpoena requirements if this legislation moves forward. The establishment of a voluntary near-miss reporting system is intended to lower the threshold for information sharing without the threat of immediate regulation.

The takeaway

The bill signals a federal shift toward creating specialized, fact-finding entities that investigate how emerging AI technology creates new attack vectors. Stakeholders should monitor committee hearing dates to see if this model gains legislative support.