The U.S. Congress returns this week with expiring cybersecurity authorities and unfinished artificial intelligence (AI) safety bills competing for a shrinking legislative window, after last week’s midterm elections reshaped both chambers.
Democrats will take control of the House and Senate in January, leaving Republican majorities only a few weeks to shape legislation before losing control of the congressional agenda. Government funding and the annual defense policy bill will compete for attention with proposals addressing cyber threat sharing, federal technology and advanced AI oversight, Nextgov/FCW reported.
The most immediate deadline is Dec. 11, when the Cybersecurity Information Sharing Act of 2015 expires again. Known as CISA 2015, the law provides legal protections to companies that share qualifying cyber threat information with the government.
The protections lapsed during last year’s government shutdown but have continued through temporary renewals. Industry groups warn that uncertainty over those safeguards can discourage companies from sharing information about intrusions that could include sensitive personal data, potentially weakening the flow of intelligence used to identify and counter attacks.
Two other authorities also expire Dec. 11 under a recent stopgap extension. The Federal Cybersecurity Enhancement Act of 2015, which supports intrusion detection and prevention on federal networks, and the Technology Modernization Fund, which helps agencies replace aging systems and improve security, are both set to expire without congressional action.
The National Defense Authorization Act offers a potential vehicle for a longer renewal, per NextGov. A coalition of 35 industry groups has urged negotiators to extend CISA 2015 through 2035.
That route remains uncertain, however. The House narrowly passed its defense bill July 22, but the Senate failed a July 14 procedural vote needed to begin debating its version. Lawmakers must resolve the impasse and reconcile differences before sending a unified bill to the president.
The House package would require the Pentagon to explain its use of commercial cyber capabilities, including tools supporting offensive operations. It also addresses cyberdefense strategies involving Taiwan.
An amendment from Democratic Reps. Delia Ramirez, Ill., and George Whitesides, Calif., to formally authorize the Common Vulnerabilities and Exposures (CVE) program within the Cybersecurity and Infrastructure Security Agency, failed to make it into the House package. CVE supplies common identifiers for publicly known security flaws. An April 2025 contracting scare exposed concerns about its dependence on U.S. government support. The authorization effort is likely to become a priority for the next Congress, according to reporting cited by Nextgov/FCW.
On AI, several pending proposals would impose different forms of oversight.
The bipartisan FRONTIER Act, introduced by Reps. Jay Obernolte, R-Calif., and Lori Trahan, D-Ill., would require disclosures about advanced models’ risks and safeguards, plus government reports of serious safety incidents.
The AI Kill Switch Act, from Reps. Ted Lieu, D-Calif., and Nathaniel Moran, R-Texas, would require covered developers to retain the ability to restrict or shut down their systems. It would also empower the Department of Homeland Security to order emergency action after a qualifying incident, in consultation with the Commerce Department and the Director of National Intelligence.
Sen. Bernie Sanders, I-Vt., and Rep. Greg Casar, D-Texas, have proposed banning artificial superintelligence altogether while pausing advanced AI development while a new federal regulator establishes safety rules.
Lawmakers may also revisit FISA Section 702 surveillance authority. Although it statutorily lapsed in June, existing court approvals permit collection into 2027. Privacy groups want a still-secret surveillance court opinion released before renewal.
Together, the unfinished measures leave Republican leaders facing a stark choice on a short timeline. They can either secure agreements before January, or hand consequential decisions on cybersecurity continuity and AI safeguards to a substantially changed Congress.
