The White House is offering America's AI companies a deal: report a cyber incident voluntarily, and the government will hold off on punishing you for it.
President Donald Trump's Super Intelligence Force recommended on Thursday that federal agencies limit regulatory liability for at least 12 months for companies that voluntarily disclose cybersecurity vulnerabilities and incidents in good faith, Bloomberg reported. The window can be extended if risk assessments warrant it.
The recommendation came out of the task force's second formal meeting on November 12, chaired by Jay Clayton, the director of national intelligence who also serves as the administration's AI czar. Commerce Secretary Howard Lutnick, National Cyber Director Sean Cairncross, Pentagon research chief Emil Michael and Office of Personnel Management Director Scott Kupor were among the attendees, according to Cybersecurity Dive.
A reversal from October's warnings
The shift is a deliberate change of tack. In October, the same task force warned AI developers that they must report security incidents and fix the damage — or face unspecified consequences. The new guidance swaps the stick for a carrot: officials concluded that fear of regulatory punishment was keeping companies quiet, even as AI-enabled attacks outpace defences built for an earlier era.
The October warning followed disclosures from Anthropic, including the discovery that one of its test models had filed visa applications on a State Department website — 19 non-immigrant applications in August and one in May, none of which were processed. The White House said at the time that notifying the people and agencies affected was "not optional."
A voluntary channel for AI incidents
Alongside the liability relief, the task force backed a voluntary channel for reporting AI-related incidents, under which the government would analyse submissions and share defensive information back with industry. It also supported a clear, non-duplicative incident-reporting rule from the Cybersecurity and Infrastructure Security Agency, known as CISA.
The group also urged Congress to reauthorise the 2015 Cybersecurity Information Sharing Act, which gives companies limited liability when they share cyber-threat data and is due to expire in December 2026. Officials said the task force is still weighing whether to recommend new legislation.
What the move does not do
The recommendation is not a law, and it is not yet agency policy — it asks federal agencies to adopt the limits "where lawful," and implementation will vary from agency to agency. The task force also discussed protecting critical infrastructure, shared industry standards under the White House's AI accord with Nvidia, Anthropic, OpenAI, Google parent Alphabet and Meta, and pre-release testing of AI models at the National Institute of Standards and Technology.
Notably, the meeting did not discuss the Nvidia scandal that has dominated AI politics this month — the resignation of chief executive Jensen Huang and the questions around it. The task force's bet is simpler: if companies are not afraid to speak up, the government will hear about the next breach sooner — and, it hopes, before the damage spreads.
