Cybersecurity Policy Report, Anniversary of 9/11 Prompts Call to Address the Modern Threat of AI, (Sep 11, 2026)
Congress should establish “a clear, risk-based cybersecurity framework” for AI (artificial intelligence) systems used by critical infrastructure operators, according to House Homeland Security Committee Republicans.
“Artificial intelligence capabilities are advancing faster than the policies, governance structures, and security practices needed to manage their use,” the lawmakers noted in a report that commemorates today’s 25th anniversary of the Sept. 11, 2001, terrorist attacks on the U.S. and identifies gaps in the nation’s homeland security.
“This report reflects on the ‘failure of imagination’ that culminated in the attacks of September 11, 2001, in the context of a twenty-first century threat environment,” the report says. It offers recommendations to update the nation’s homeland security posture to address threats that weren’t imagined 25 years ago, including AI-enabled cyber attacks.
“Organizations are adopting AI across software development, cybersecurity, data analysis, customer service, internal operations, and other functions, often without a complete understanding of where the systems are deployed, what information they can access, or what actions they are authorized to take,” the report observes.
“The lack of visibility creates several risks. An organization may not know that an employee has connected an external model to sensitive data. A coding agent may introduce insecure dependencies or make changes that are not adequately reviewed. An autonomous system may exceed its intended permissions, interact with external infrastructure, or take actions that the organization cannot reconstruct after the fact,” it says.
“Where AI is connected to critical infrastructure or operational technology, failures could affect physical processes and essential services,” it warns.
The report calls for a cybersecurity framework for AI systems “that are deployed on, integrated into, or granted meaningful access to critical infrastructure systems and whose compromise or misuse could reasonably produce material consequences.”
The Cybersecurity and Infrastructure Security Agency and sector risk management agencies (SRMAs) “should work with sector-specific regulators, owners and operators, AI developers and providers, cybersecurity companies, independent evaluators, standards bodies, and other technical experts so that common expectations reflect both cross-sector risk and the operational realities of individual sectors,” it recommends.
“Standards should build on existing cybersecurity and AI risk management frameworks, recognize materially equivalent federal or sector specific requirements, and account for legacy operational technology, maintenance windows, safety and reliability obligations, procurement cycles, and other constraints that make critical infrastructure different from ordinary enterprise computing,” it says.
“For systems capable of producing the most serious consequences, Congress should require appropriate assurance before production deployment or material changes. Assessments should be designed around the actual risk presented and should permit qualified internal testing, independent evaluation, or recognition of equivalent federal and sector-specific assessments,” the report adds.
“The federal government should also establish a consistent methodology for evaluating model provenance and AI supply chain risk in sensitive critical infrastructure environments,” the report advises.
“CISA, working with the National Institute of Standards and Technology (NIST) and other technically capable agencies, should also develop the capacity to evaluate advanced AI cyber capabilities that are relevant to critical infrastructure protection. Evaluations should examine not only benchmark performance, but whether models can reliably perform consequential cyber tasks when combined with tools, scaffolding, additional inference time, or modified safeguards,” it says.
“The Committee’s objective is to reduce material cybersecurity risk without creating a general federal licensing regime for artificial intelligence or dictating which models, vendors, architectures, or technologies private entities must use,” the report adds. “Effective requirements should be adaptable as capabilities change, focused on measurable security outcomes, and developed with sustained participation from critical infrastructure operators, AI developers, cybersecurity practitioners, researchers, standards organizations, and other experts.”
MainStory: TopStory FederalLegislation DataSecurity AINews