Congress Weighs Cybersecurity Renewals, AI Oversight and Section 702 Changes

Congress has a narrowing year-end window to address several federal cybersecurity and technology authorities before a change in political control. The most immediate deadline is December 11, 2026, when the Cybersecurity Information Sharing Act of 2015 (CISA 2015) is again set to expire. The law provides legal protections to companies that share qualifying cyber threat information with the government. Industry groups warn that uncertainty over those safeguards can discourage companies from reporting intrusions, including incidents that may involve sensitive personal data, potentially reducing information available to identify and counter attacks. The date is significant for contractors and other organizations that support threat sharing, incident response, and federal cyber operations, even though the current signals identify no new solicitation or contract award.

Two additional authorities are also scheduled to expire on December 11 following a stopgap extension: the Federal Cybersecurity Enhancement Act of 2015, which supports intrusion detection and prevention on federal networks, and the Technology Modernization Fund, which helps agencies replace aging systems and improve security. The potential lapse creates continuity and planning concerns for vendors working on network protection, modernization, and cybersecurity improvements. A coalition of 35 industry groups has urged negotiators to extend CISA 2015 through 2035. The National Defense Authorization Act (NDAA) could provide a vehicle for a longer renewal, but the defense bill faces unresolved House-Senate differences. The House passed its measure on July 22, while the Senate failed a July 14 procedural vote needed to begin debate on its version; lawmakers must still resolve the impasse and produce a unified bill.

The legislative agenda also includes federal AI-safety and oversight proposals, alongside government funding and the annual defense policy bill. The available reporting does not describe finalized AI requirements, so contractors should treat possible oversight changes as a developing policy issue rather than an established compliance mandate. For companies supporting federal AI programs, the practical near-term step is to track legislative text and agency implementation plans, and to identify where current governance, testing, documentation, or risk-management processes may need adjustment if proposals advance. The House defense package also includes provisions concerning the Pentagon’s use of commercial cyber capabilities, including tools supporting offensive operations, and cyberdefense strategies involving Taiwan. An amendment from Representatives Delia Ramirez and George Whitesides would formally authorize the Common Vulnerabilities and Exposures (CVE) program within the bill, according to the reporting.

Separately, lawmakers are debating whether to attach renewal of Section 702 of the Foreign Intelligence Surveillance Act (FISA) to the NDAA. The statute has lapsed, but a court has authorized covered searches through March. Section 702 concerns government use of Americans’ personal information when searching for communications with foreign targets, and its renewal has become a point of disagreement over intelligence capabilities, warrant requirements, civil liberties, and legislative process. A coalition of 27 civil liberties groups, in a letter led by Demand Progress, opposed adding a straightforward renewal to the NDAA without full debate and a warrant requirement for U.S.-person searches. House Intelligence Committee Democrat Jim Himes has argued for action during the lame-duck session, saying a reauthorization after Democrats take control of both chambers in January could look different. For GovCon firms supporting intelligence, surveillance, and related technology programs, changes in timing or statutory terms could affect program authorities and agency priorities; the sources do not establish a specific acquisition consequence.

• CISA 2015 is scheduled to expire on December 11, 2026; its information-sharing protections matter to companies reporting qualifying cyber threat data to government.
• The Federal Cybersecurity Enhancement Act of 2015 and Technology Modernization Fund are also due to expire on December 11, creating potential continuity concerns for federal network defense and modernization work.
• A coalition of 35 industry groups has urged Congress to extend CISA 2015 through 2035; the NDAA is a possible legislative vehicle, not a guaranteed outcome.
• The House passed its defense bill on July 22, while the Senate failed a July 14 procedural vote to begin debate; reconciliation remains necessary before a unified bill can go to the president.
• The House NDAA package would require the Department of Defense to explain its use of commercial cyber capabilities, including tools supporting offensive operations, and addresses cyberdefense strategies involving Taiwan.
• An amendment by Representatives Delia Ramirez and George Whitesides would formally authorize the CVE program within the defense bill, as reported by PYMNTS.
• AI-safety and federal oversight proposals remain under consideration; contractors should monitor legislative developments because final requirements are not specified in the available reporting.
• FISA Section 702 has lapsed, with court-authorized searches permitted through March; debate centers on renewal, warrant protections, and whether to attach it to the NDAA.
• 27 civil liberties groups, led by Demand Progress, warned against renewing Section 702 through the NDAA without full debate; Rep. Jim Himes has advocated for action during the lame-duck session.
• For vendors, monitor the December 11 deadline, NDAA negotiations, and any enacted language for changes to cyber-sharing protections, network security authorities, modernization funding, AI oversight, and intelligence program requirements.