Subpoena power for the incident report

The pattern after an AI agent incident has been consistent: the company involved investigates itself, and the public learns the details in pieces, when and if the company chooses to share them. Senator Ed Markey's new bill names that directly. Introduced September 24, the Cybersecurity and AI Board of Investigations Act would set up an independent board on the model of the National Transportation Safety Board (the body that investigates plane crashes), with the power to subpoena witnesses and records from the companies and agencies involved in major cyber incidents. On the disclosure failures the log has tracked all year, that is the missing piece: a body that can compel the record out of the lab rather than another rule binding the agent.

The board would be non-regulatory (it would not assign legal fault or liability) and would be required to report its findings publicly, with recommendations for federal agencies and industry. It would have five members, appointed by the president and confirmed by the Senate for five-year terms, no more than three from one party, and it would coordinate with the Secretary of Commerce.

Markey's own statement cites this July's Hugging Face incident and, pointedly, the limits of OpenAI's cooperation with outside researchers: the company gave independent researchers access, but the restricted scope, data and time "prevented them from completing a full evaluation — including an assessment of OpenAI's own safeguards." The bill's stated purpose is to remove that dependence on company goodwill. Beyond full-size incidents, it would also look at AI supply-chain vulnerabilities, gaps in federal oversight, and "near misses" (agent-led hacks narrowly averted), and it would stand up a voluntary, anonymized near-miss reporting system.

S.5541 has been read twice and referred to the Senate Commerce, Science, and Transportation Committee, the standard first stop. It has cleared nothing. It is logged as the second piece of AI legislation on the log (after the Sanders–Casar proposal to name a risk threshold), and the first aimed at what the public is allowed to learn after an incident rather than at what agents may do. Whether it moves in this Congress is open; its existence is the fact worth recording.