New cyber watchdog gets subpoena power but shields companies from liability

What it does

This bill establishes an independent Cybersecurity and AI Board of Investigations to investigate major cyber incidents affecting federal and critical infrastructure systems, identify systemic vulnerabilities, and issue public reports with recommendations. The Board will operate independently from regulatory enforcement, maintain a voluntary near-miss reporting system to collect confidential incident data, and have subpoena power to compel testimony and documents—protecting voluntary submissions from liability and public disclosure while allowing federal agencies to use the information for cybersecurity purposes.

Why we flagged it

The bill's core mechanism is establishing an independent investigative board with subpoena power to investigate cyber incidents and issue public reports. While it creates transparency mechanisms, it simultaneously shields private-sector voluntary submissions from liability and public disclosure, creating a dual-track system.

What the text implies

• Voluntary submissions to the Board are protected from FOIA, state open-records laws, and discovery in civil litigation—creating a confidential reporting channel that may reduce public visibility into how private companies respond to incidents, even as the Board publishes aggregate findings.
• The Board's exemption from the Sunshine Act (open-meetings law) and Federal Advisory Committee Act means internal deliberations, party participation, and decision-making processes are not subject to public transparency requirements that normally apply to federal bodies.
• Subpoena authority is limited to private entities and individuals; government entities are explicitly excluded—creating asymmetric investigative power where federal agencies cannot be compelled to provide information, potentially limiting the Board's ability to investigate federal failures.
• The Board may contract with private-sector experts as investigators and may enter agreements with federally funded research centers, creating potential conflicts of interest if those contractors have commercial interests in the sectors being investigated.
• Information voluntarily provided to the Board may be shared with any federal agency for cybersecurity purposes without the submitting entity's consent, potentially enabling surveillance or enforcement actions by agencies other than the Board itself.

Section numbers refer to the bill text the analysis read — linked under Primary records below.

Who it affects

Citizens benefit from independent incident investigation, public transparency on cyber threats, and systemic vulnerability identification that may improve national cybersecurity resilience. However, the broad liability protection for voluntary submissions and exemption from Sunshine Act and FOIA-like disclosure rules create a private-sector safe harbor that may reduce accountability and public visibility into how companies respond to incidents.

Who stands to gain

• technology companies and critical infrastructure operators (liability shield for voluntary incident
• cybersecurity consulting and forensic firms (potential contracts for investigation support)
• federally funded research and development centers (potential agreements for investigative support)

Named in the bill

Cybersecurity and AI Board of Investigations, Department of Commerce, National Institute of Standards and Technology (NIST), Senate Committee on Commerce, Science, and Transportation, Senate Committee on Homeland Security and Governmental Affairs, House Committee on Energy and Commerce, House Committee on Homeland Security, Federal agencies (civilian executive branch), Critical infrastructure sectors, Artificial intelligence systems

Where it stands

• Sep 24, 2026 — Introduced · Congress.gov: “Introduced in Senate”
• Sep 24, 2026 — Referred to Senate Committee on Commerce, Science, and Transportation · Congress.gov: “Read twice and referred to the Committee on Commerce, Science, and Transportation”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.