NDAA Update Nov 3, 2026: AI threats create urgent need to renew cybersecurity information-sharing law, businesses tell Congress

AI threats create urgent need to renew cybersecurity information-sharing law, businesses tell Congress

Cybersecurity Dive · Nov 3, 2026

Eric Geller reports that three dozen business groups, including organizations representing critical infrastructure sectors, are pressing Congress to renew a major cybersecurity information sharing law before its expiration next month. The 2015 Cybersecurity Information Sharing Act "has become a foundational component of the nation's cybersecurity," the groups wrote on Sunday to the chairs and ranking members of the congressional armed-services committees. CISA 2015, as the law is often called, provides liability protections for companies sharing cyber threat indicators amongst themselves and with federal agencies. After the law's initial 10-year operating period expired in 2025, lawmakers passed several short-term extensions, with the latest one set to lapse on Dec. 11. Businesses now want Congress to include a new 10-year extension in the National Defense Authorization Act (NDAA) for fiscal year 2027. The industry coalition wrote: "These authorities support the timely exchange of actionable threat intelligence and are central to the collective defense of public- and private-sector networks, particularly across critical infrastructure sectors." Signers include the Aerospace Industries Association, American Bankers Association, American Chemistry Council, American Petroleum Institute, Healthcare Leadership Council, National Association of Manufacturers, National Retail Federation, National Rural Water Association, U.S. Chamber of Commerce and USTelecom; cybersecurity-focused groups including the Alliance for Critical Infrastructure and the Cybersecurity Coalition also signed. The groups pointed to recent vulnerability crises that have led to global patching scrambles, writing: "In this environment, the speed and breadth with which defenders share information determines whether they keep pace with adversaries." "That speed depends on the legal certainty CISA 2015 provides." The House's draft version of the 2027 NDAA includes a provision reauthorizing and renaming the cybersecurity information sharing law that would add AI to the list of topics about which companies can share information. The Senate's draft NDAA does not include a CISA 2015 reauthorization. Lawmakers will begin working to reconcile the two draft bills after they return to Washington on Nov. 9, following the midterm elections.