Congress mandates AI-era security plans for power grids, hospitals, banks
S. 4728 — Combat Emerging Threats to Critical Infrastructure Act of 2026 · Filed by Mark Warner (D-VA) · Introduced Jun 10, 2026 · Referred to committee
Your members of Congress
Enter a ZIP to see where your representative and both senators stood on this bill.
Looked up on this device — your ZIP is never stored on our servers.
What it does
This bill requires the federal government's cybersecurity agency (CISA) to update and maintain detailed security plans for 16 critical infrastructure sectors—from energy and finance to healthcare and water systems—with specific focus on emerging threats from artificial intelligence, quantum computing, cloud systems, and social engineering. The agency must report these plans to Congress every two years and coordinate with relevant federal agencies and industry partners to address technology-driven vulnerabilities.
Why we flagged it
The bill's core function is to mandate systematic updating and biennial reassessment of federal sector-specific cybersecurity plans, with explicit focus on emerging technology threats (AI, quantum, cloud). It is a governance and planning instrument, not a regulatory carve-out or appropriation.
What the text implies
- The bill does not appropriate funds or specify enforcement mechanisms; agencies must absorb planning costs within existing budgets, potentially diverting resources from other cybersecurity work.
- Sector-specific plans are not made public by statute—only reported to Congress—meaning the public has limited visibility into what vulnerabilities are identified or how they are being addressed.
- The bill references NSM-22 (a 2024 executive memorandum) as the authoritative definition of critical sectors, tying statutory obligations to executive policy that could change without congressional action.
- Biennial reassessment creates a rolling compliance cycle with no sunset or performance metrics; agencies could produce plans that satisfy the letter of the law without substantive security improvements.
- The quantum computing / digital asset vulnerability language (Financial Services Sector) is vague and may require coordination with Treasury on cryptographic standards that do not yet exist.
Who it affects
Ordinary citizens depend on critical infrastructure (power grids, hospitals, water systems, financial networks) functioning safely. This bill mandates systematic, updated threat assessment and cross-sector coordination to protect those systems from AI-enabled attacks and quantum computing risks—threats that could otherwise go unaddressed. The requirement for congressional reporting adds transparency and accountability.
Who stands to gain
- cybersecurity software and services vendors
- cloud infrastructure providers
- AI/ML security tool developers
- consulting firms specializing in critical infrastructure
- defense contractors (Defense Industrial Base Sector)
Named in the bill
CISA (Cybersecurity and Infrastructure Security Agency), NSM-22 (National Security Memorandum on Critical Infrastructure and Resilience), National Artificial Intelligence Initiative Act of 2020, GENIUS Act, Homeland Security Act of 2002, NIST Special Publication 800-207, Senate Committee on Homeland Security and Governmental Affairs, Senate Select Committee on Intelligence, House Committee on Homeland Security, House Permanent Select Committee on Intelligence, 16 critical infrastructure sectors (Chemical, Communications, Energy, Financial Services, Healthcare
Where it stands
- Jun 10, 2026 — Introduced · Congress.gov: “Introduced in Senate”
- Jun 10, 2026 — Referred to Senate Committee on Homeland Security and Governmental Affairs · Congress.gov: “Read twice and referred to the Committee on Homeland Security and Governmental Affairs”
Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.
Money around this bill
4 lobbying clients named this bill on 4 disclosure filings across 1 quarter, Jun 2026 to Jun 2026. Those filings disclosed $9,090,000 in lobbying spend. A filing names 16 bills on average, so that figure is what each filing reported, not a share belonging to this bill.
More lobbying clients named this bill than 72% of bills with at least one filing.
Mark Warner, the sponsor, reported $2,246,650 in PAC receipts in the 2026 cycle.
- Ctia-the Wireless Association — $3,640,000 on 1 filing
- Ncta - the Internet & Television Association — $3,190,000 on 1 filing
- Anthropic — $1,970,000 on 1 filing
- Edison International — $290,000 on 1 filing
Lobbying Disclosure Act filings through Jul 20, 2026. A filing shows who paid to lobby on a bill it names, not what changed.
How this was measured
Analysis — Quorum's AI read the full bill text on Jul 9, 2026; transparency and hidden-provision scores are compared against the median of 16,222 analysed bills.
Status and sponsors — Congress.gov's bill record — actions, committee referrals and cosponsors — loaded nightly. The timeline shows status changes, not every procedural action.
Money — Senate Lobbying Disclosure Act filings whose specific-issue field names this bill for quarters ending Jun 2026 to Jun 2026. A filing's amount is reported whole beside the median number of bills a filing names; it is never divided across them. PAC receipts are FEC-reported contributions to the sponsor's candidate committee in the 2026 cycle.
As of — lobbying records through Jul 20, 2026 · page rendered 2026-10-20.
“Congress mandates AI-era security plans for power grids, hospitals, banks” QuorumCivic. https://share.quorumcivic.app/bill/119/s4728 Report an error
The week in bills
One email, Sunday: what Congress passed, what it changed, and who paid.
One link arrives to confirm the address. It is used for this email and nothing else, and every issue carries an unsubscribe link.