What happened
Thirty five business groups sent a letter on Sunday to the leaders of the House and Senate Armed Services committees, asking them to include a 10 year extension of the Cybersecurity Information Sharing Act of 2015 in the final negotiations for the fiscal year 2027 National Defense Authorization Act.
CISA 2015 provides legal protections for threat data exchanges between the government and the private sector, and between companies. Congress has mixed a series of short term renewals with lapses since the law's previous 10 year sunset came and went last year, and it is now set to expire again on 11 December.
"The case for a long-term reauthorization has only grown more urgent," the groups wrote. They pointed to artificial intelligence: "Recent incidents have demonstrated that advanced AI systems can identify and exploit software vulnerabilities at machine speed, collapsing the window between the discovery of a weakness and its use in an attack." They added that AI tools are making sophisticated cyber capabilities cheaper, faster and easier to use, and that "the speed and breadth with which defenders share information determines whether they keep pace with adversaries. That speed depends on the legal certainty CISA 2015 provides."
Signatories include the Chamber of Commerce and the Business Roundtable, which led the letter, along with groups representing critical infrastructure sectors including aviation, telecommunications and technology. The House version of the fiscal 2027 defense bill carries a 10 year extension. The Senate version does not, and past attempts to attach a long term extension to the defense bill have run into objections from Senate Homeland Security and Governmental Affairs Chairman Rand Paul of Kentucky, who has tied his support to provisions curtailing past practices at the Cybersecurity and Infrastructure Security Agency that he says threaten free speech.
The defense policy bill usually passes at the end of the calendar year or the start of the next one. A possible congressional committee leadership shuffle could change the arithmetic in 2027, but the December deadline falls in 2026.
Why this is a GRC story
Legal certainty is a control input. Liability protection is what lets a general counsel approve sharing indicators at speed. When the authorisation lapses, the safe answer inside a legal review becomes no, and the resulting delay is invisible until an incident tests it.
Short term renewals carry a cost that never shows on a risk register. Each cycle forces legal and security teams to rejustify the same participation, and some organisations quietly stop contributing rather than manage the uncertainty. The loss is measured in relationships, not in filings.
The AI argument reframes the policy question. If exploitation now moves faster than internal detection cycles, shared early warning stops looking like a courtesy and starts looking like a compensating control. That is a defensible line for a board paper on systemic risk.
What to watch
Watch the conference committee text for the defense authorisation bill, because that is where a 10 year extension either survives or becomes another short term patch. Watch what happens to information sharing activity in the weeks after the December date if Congress lets it lapse. And watch whether industry groups escalate from letters to a public campaign if the Senate position holds into the new year.
Attribution: Analysis based on CyberScoop and related public reporting. This article is original commentary, not a repost of the source material.