Sen. Mark Warner (D-Va.) has introduced legislation that would compel the Cybersecurity and Infrastructure Security Agency (CISA) — the Department of Homeland Security unit responsible for defending U.S. critical infrastructure — to update its critical infrastructure cybersecurity plans to account for threats driven by artificial intelligence, according to a June 12, 2026 report by Industrial Cyber.

Executive Summary

The core of the proposal, as reported, is procedural rather than technical: it would use statute to force a planning refresh. CISA maintains national-level plans and guidance that federal agencies and the operators of the 16 designated critical infrastructure sectors — power, water, communications, financial services, and the data centers and networks that underpin them — use to organize their cyber defenses. Warner’s bill would require those plans to be updated with AI-driven threats explicitly in scope.

That matters because planning documents in this space have historically aged badly. The foundational National Infrastructure Protection Plan dated to 2013 and stood for over a decade before the federal government began modernizing the underlying policy framework in 2024. Meanwhile, the threat landscape has shifted quickly: AI tooling can accelerate phishing, vulnerability discovery, and social engineering at a pace that decade-old planning assumptions never contemplated. A statutory mandate converts “we should update this” into “the agency must update this” — with the congressional oversight hook that implies.

Why a Planning Mandate Is Bigger Than It Sounds

National cyber plans can read as bureaucratic paperwork, but they do real work: they set the shared assumptions that sector risk management agencies, regulators, and private operators build their own security programs around. When the top-level plan is stale, everything keyed to it inherits the staleness. By forcing an update through legislation rather than leaving timing to agency discretion, the bill — if enacted — would create an enforceable deadline and a paper trail Congress can audit. The trade-off is familiar from other compliance regimes: mandates guarantee that a document gets refreshed, not that the refresh is good. The substance will depend on CISA’s execution and resourcing, neither of which is described in the source report.

What “AI-Driven Threats” Could Mean for Operators

The report does not detail how the bill defines AI-driven threats, so operators should watch the bill text closely. In practice the term usually spans two categories. The first is AI as an attacker’s tool: machine-generated phishing and deepfake-enabled fraud, faster reconnaissance and vulnerability discovery, and malware that adapts to defenses. The second is AI as an attack surface: as utilities, hospitals, and industrial operators embed AI into operations, the models, data pipelines, and inference infrastructure themselves become targets. A credible planning update would need to address both — and clarify which agency guidance applies to each.

There is also a third dimension of particular interest to infrastructure providers: the facilities running AI are increasingly critical infrastructure in their own right. Data centers, high-capacity fiber routes, and the power systems feeding them now sit underneath much of the AI economy. Whether an updated national plan treats AI infrastructure as a protected asset class, and not just a threat vector, is one of the more consequential open questions.

The Business Signal for Infrastructure Providers

For operators of data centers, networks, and cloud platforms, legislation like this is a leading indicator even before it passes. Updated federal plans tend to cascade: sector-specific guidance follows, procurement language follows that, and customers in regulated sectors begin asking vendors to demonstrate alignment. Providers who can already document AI-aware threat modeling, incident response, and supply chain controls will be positioned ahead of any cascade. The cost side is real too — planning refreshes often precede new reporting or assessment expectations — but the source report identifies no specific obligations on private operators, so any compliance impact remains speculative until bill text and subsequent rulemaking are public.

The Path From Bill to Law Is the Real Test

A proposal is not a statute. The report available to us covers the introduction of the bill, not co-sponsorship, committee prospects, or companion legislation in the House — and the majority of introduced bills never reach a floor vote. Warner’s long tenure on cybersecurity issues and his seat on the Senate Intelligence Committee give the proposal a credible sponsor, but timing, amendments, and whether the measure moves standalone or gets folded into a larger vehicle such as an annual defense authorization bill will determine whether this becomes binding policy or a marker of congressional intent. Both outcomes carry signal; only one carries force of law.

Background

CISA was created by Congress in 2018 to serve as the federal government’s lead civilian agency for cybersecurity and critical infrastructure protection, working with the private owners and operators who control most U.S. infrastructure. The planning framework it inherited was showing its age: the National Infrastructure Protection Plan dated to 2013, and the underlying presidential policy directive from that same year was only replaced by a new national security memorandum in April 2024. Congress has been layering statute onto this space in recent years — most notably the 2022 law requiring critical infrastructure operators to report significant cyber incidents — and Warner, a former telecommunications executive and senior member of the Senate Intelligence Committee, has been a consistent voice in those debates. The rapid mainstreaming of generative AI since 2023 has given both attackers and defenders new tooling, which is the gap this bill reportedly aims to close at the planning level.

Source: Warner proposes bill to force CISA updates to critical infrastructure cybersecurity plans amid AI-driven threats — Industrial Cyber’s June 12, 2026 report on the senator’s proposed legislation.