AI threats create ‘urgent’ need to renew cybersecurity information-sharing law, businesses tell Congress

Three dozen business groups, including organizations representing critical infrastructure sectors, are pressing Congress to renew a major cybersecurity information sharing law before its expiration next month.

The 2015 Cybersecurity Information Sharing Act "has become a foundational component of the nation's cybersecurity," the groups wrote on Sunday to the chairs and ranking members of the congressional armed-services committees.

CISA 2015, as the law is often called, provides liability protections for companies sharing cyber threat indicators amongst themselves and with federal agencies. Those sharing alliances underpin the vast constellation of public-private collaboration groups that have sprung up over the past decade as the federal government has streamlined its approach to cyber defense.

After the law's initial 10-year operating period expired in 2025, lawmakers passed several short-term extensions, with the latest one set to lapse on Dec. 11. Cybersecurity experts and industry leaders have repeatedly urged lawmakers to renew the law, calling it a critical tool for fighting hackers. Businesses now want Congress to include a new 10-year extension in the National Defense Authorization Act (NDAA) for fiscal year 2027.

"These authorities support the timely exchange of actionable threat intelligence and are central to the collective defense of public- and private-sector networks, particularly across critical infrastructure sectors," the industry coalition wrote to lawmakers.

The signers include major trade associations representing almost every sector of critical infrastructure, including the Aerospace Industries Association, American Bankers Association, American Chemistry Council, American Petroleum Institute, Healthcare Leadership Council, National Association of Manufacturers, National Retail Federation, National Rural Water Association, U.S. Chamber of Commerce and USTelecom.

Cybersecurity-focused groups, including the Alliance for Critical Infrastructure and the Cybersecurity Coalition, also signed the letter.

Cybersecurity experts say the need for machine-speed information sharing has only grown as AI has sped up the pace of vulnerability discovery and cyberattack orchestration. In their letter, the business groups pointed to recent vulnerability crises that have led to global patching scrambles.

"In this environment, the speed and breadth with which defenders share information determines whether they keep pace with adversaries," the industry coalition wrote. "That speed depends on the legal certainty CISA 2015 provides."

The House's draft version of the 2027 NDAA includes a provision reauthorizing and renaming the cybersecurity information sharing law. That provision would add AI to the list of topics about which companies can share information. The Senate's draft NDAA does not include a CISA 2015 reauthorization.

Lawmakers will begin working to reconcile the two draft bills after they return to Washington on Nov. 9, following the midterm elections.