AI Needs Security Laws. We Already Know How to Write Them.

Somewhere right now, an AI agent is moving money, changing a system configuration or accessing sensitive data on someone’s behalf.

In most places, no law requires that agent to be secure.

The question isn’t whether the agent is intelligent enough to do the task. It’s whether anyone has established what it is allowed to do, how it can be stopped and who is accountable when something goes wrong.

We would never knowingly accept uncontrolled access in a payment system, a power grid or a sensitive federal environment. Yet AI agents are rapidly gaining the ability to act across all three, and our regulatory frameworks haven’t caught up.

I’ve spent much of my career where cybersecurity, emerging technology and highly regulated environments meet, from national laboratories and federal cloud environments to financial services. One lesson has held throughout: innovation without appropriate security and accountability eventually becomes a business risk.

My view is straightforward: AI needs security laws. And we already have decades of experience regulating cybersecurity, interpreting statutory authority and balancing innovation against risk. We should use those lessons rather than start from scratch.

The Security Gap in AI Regulation

The United States still lacks a comprehensive federal AI statute. States have moved ahead with different approaches, while federal policymakers continue to debate national standards, agency authority and the proper role of state regulation. Europe’s AI Act includes cybersecurity requirements for certain high-risk systems, but most of those obligations are still years from taking effect.

The problem isn’t that security is entirely absent from AI regulation. It’s that security obligations remain fragmented, depending on the industry, the jurisdiction or the particular application.

Much of the public debate focuses on bias, transparency, consumer protection and the safety of frontier models. Those are legitimate concerns. But as AI moves from generating information to taking action, we need to ask a different set of questions:

What systems can an AI agent access?
Whose identity and authority does it use?
Can an attacker manipulate its instructions?
What prevents it from exceeding its permissions?
Can we reconstruct its decisions and actions?
Who is responsible when something goes wrong?

These are familiar questions to any security professional.

Consider an AI agent authorized to initiate supplier payments. The model may be extraordinarily capable. It may interpret invoices, reconcile accounts and execute transactions faster than any human operator.

But what happens when an attacker embeds malicious instructions inside an invoice? Can the agent be tricked into changing the destination account? Can it initiate a payment outside its approved limits? Is there an independent control that stops the transaction?

These aren’t hypothetical categories of risk. Prompt injection, excessive permissions, insecure tool integrations and insufficient monitoring are recognized challenges in agentic AI. The model’s intelligence does not determine the security of the system around it. As I wrote in The Harness Matters More Than the Horse, the surrounding controls ultimately decide what an AI system is permitted to do. That architecture deserves far more attention in AI policy.

What Regulatory Law Has Already Taught Us

One of the most valuable lessons from studying regulatory law is that identifying a serious public risk does not automatically justify any regulatory response. Good regulation requires clear legal authority, carefully written obligations, honest accounting of costs and benefits, and an understanding of how rules will work in practice.

Congress needs to establish the authority

In FDA v. Brown & Williamson Tobacco Corp. (2000), the Supreme Court rejected the FDA’s claim that it could regulate tobacco under its existing statute. The Court built on that reasoning in West Virginia v. EPA (2022), holding that agencies need clear congressional authorization before issuing rules of vast economic and political significance, the so-called major questions doctrine.

Few questions will carry more economic significance than how AI that acts on its own is governed. If agencies try to stretch existing statutes to cover autonomous AI, those rules will face exactly this challenge.

The Court reinforced the point in Loper Bright Enterprises v. Raimondo (2024), overturning Chevron deference and making clear that courts, not agencies, decide what federal statutes mean.

For businesses investing in AI, this isn’t an academic distinction. Organizations need to know which requirements apply, who can enforce them and whether those obligations will survive in court. Regulation built on uncertain authority creates uncertainty, and uncertainty makes long-term investment and security planning harder. The durable path is for Congress to set clear foundational security obligations for consequential AI deployments, including their scope and the authority delegated to regulators.

Write for the activity, not the technology

Courts apply statutes as written, including to circumstances lawmakers never anticipated. Carefully drafted language can remain useful for decades. Poorly drafted language becomes obsolete or produces results no one intended.

A law that defines security obligations around today’s model architectures, computing thresholds or technical implementations will age badly. Legislation should instead focus on the activity and authority involved. What can the system do? What can it access? What consequences can its actions create? What safeguards manage those risks? Those questions stay relevant no matter which model, vendor or architecture wins.

Disclosure is not security

The SEC’s 2023 cybersecurity disclosure rules require public companies to report material cybersecurity incidents and describe how they manage cyber risk. Those rules brought real transparency. But they also illustrate a distinction that matters for AI: requiring an organization to disclose risk is not the same as requiring it to manage that risk effectively.

An organization might disclose that it uses autonomous AI agents. That tells us very little about whether those agents have appropriate permissions, whether their actions are monitored or whether malicious instructions can steer them. Transparency has value. Transparency alone is not security.

Regulate the risk, not the label

Good intentions don’t eliminate the costs of regulation. An autonomous agent that can transfer millions of dollars or modify critical infrastructure should face meaningful security obligations. A productivity assistant that drafts meeting summaries should not automatically face the same ones. The distinction should rest on the authority exercised and the consequences of failure, not the fact that both use AI.

Compliance costs also fall unevenly. Smaller companies need proportionate ways to demonstrate security without being exempt from the safeguards that serious risks require. Poorly designed rules create barriers to entry that favor incumbents without improving security.

We’ve Already Learned How to Secure Fast-Moving Technology

Earlier in my career, working in national laboratory environments, security was never simply about whether a technology worked. It was about what it could access, how it was authorized, what could go wrong and whether we could show that safeguards were operating. When we brought cloud capabilities into sensitive environments, identity, authorization, least privilege, monitoring and accountability were foundational.

Those same principles apply to AI agents today. The difference is that an agent may now initiate actions that used to require a human operator.

Frameworks such as the NIST Cybersecurity Framework, the NIST AI Risk Management Framework and federal cloud security programs provide useful foundations. They serve different purposes and don’t all carry the force of law, but they show how security can evolve alongside technology. AI security law should build on five principles.

1. Risk-based obligations. Requirements should scale with the authority granted to an AI system and the consequences of its actions. A system that provides information is fundamentally different from one that executes financial transactions, changes production infrastructure or makes consequential decisions about people.

2. Security outcomes, not prescribed technologies. Legislation should require outcomes such as least privilege, appropriate identity controls, transaction limits, monitoring and human oversight for defined high-impact actions. It should not mandate specific models, products or architectures. Technology will change. The responsibility to control access and prevent unauthorized actions will not.

3. Continuous, verifiable security. Compliance should rest on operational evidence, not annual attestations alone. This is the shift I’ve described as GRCops: automation and continuous assurance for governance, risk and compliance. But collecting evidence of compliance is not the same as proving a system is secure. The goal is to show that controls actually reduce risk, not to generate more documentation.

4. A reasonable duty of security. Organizations deploying AI with consequential authority should owe a duty to implement reasonable safeguards proportionate to the risk, judged against recognized practices, foreseeable threats and the effectiveness of the controls in place.

5. Clear accountability across the AI supply chain. AI systems are rarely built and run by one organization. Model developers, application providers, tool integrators and deployers each shape the security of the result, and responsibility should follow what each party controls. Deploying an agent should create accountability for its delegated authority and safeguards, without erasing a developer’s responsibility for defects within its control. “The AI did it” cannot become an excuse.

What I Would Actually Put in the Law

First, a baseline duty of reasonable security for consequential AI systems. Organizations deploying agents with authority over financial transactions, sensitive information, critical infrastructure or other high-impact activities should implement appropriate identity controls, authorization boundaries, monitoring and safeguards against unauthorized actions.

Second, traceability for consequential agent actions. Organizations should be able to show which system acted, under whose authority, what it did and whether it stayed within approved boundaries.

Third, AI security incidents folded into existing reporting frameworks. Rather than creating new, duplicative obligations, extend the reporting mechanisms organizations already follow to cover AI-related incidents.

Fourth, meaningful incentives for demonstrably effective security. Organizations that implement recognized risk management practices and maintain evidence that their controls work could receive a rebuttable presumption of reasonable care. Simply adopting a framework should not grant blanket immunity. Outcomes still matter.

Finally, a consistent national security baseline that respects the roles of both federal and state governments. A federal baseline can bring clarity to organizations operating across jurisdictions, but Congress should define preemption carefully rather than assume every state protection must disappear. The goal is consistency where it improves security, not uniformity for its own sake.

The Objections Deserve Serious Answers

Won’t regulation slow innovation? It can. Poorly written requirements, unnecessary reporting and rigid technical mandates discourage investment and favor established companies. But the absence of clear security expectations also discourages adoption. Boards need confidence that consequential AI can operate within understood boundaries, and clear, proportionate requirements help create it.

Doesn’t existing law already apply? Often, yes. Privacy, consumer protection, financial services and cybersecurity law already reach many AI-enabled activities, and we should use them where they’re sufficient. But agentic AI raises questions about delegated authority, identity, manipulation and attribution that existing law doesn’t address consistently. Those gaps deserve targeted solutions.

Can legislation keep pace with AI? Not if lawmakers try to regulate every technical detail. But laws built on reasonable care, authorization, accountability and risk can stay relevant through enormous technological change. Write durable obligations and let the technical implementation evolve.

Should Washington override state AI laws? A fragmented landscape creates real compliance challenges, especially for organizations operating nationally. At the same time, states have long played an important role in consumer protection and policy experimentation. Congress should identify which requirements need national consistency and where states keep legitimate authority. The goal is a workable framework, not simply moving regulatory power from one level of government to another.

The Bottom Line

AI is moving beyond answering questions. It is beginning to exercise authority. That changes the security conversation, and it should change the regulatory one too.

AI security legislation should be clear enough to enforce, flexible enough to survive technological change, proportionate enough to preserve innovation and grounded enough in evidence to actually improve security.

We don’t need laws that try to predict every future AI capability. We need laws that establish what organizations are responsible for when they give intelligent systems the authority to act.

Rules don’t slow innovation. Uncertainty does.

For the CISOs, legal leaders and policymakers reading this: If you could establish one security requirement for autonomous AI systems tomorrow, what would it be?