Two bills, one week, a common theme
Congress introduced two significant pieces of AI legislation within 24 hours of each other this week. On Wednesday, September 25, Senator Bernie Sanders and Representative Greg Casar introduced a bill to create a federal Department of Artificial Intelligence, with a mandatory pause on advanced AI development until the new agency exists. On Thursday, September 26, Senator Ed Markey introduced a separate bill establishing a Cybersecurity and AI Board of Investigations, modeled directly on the National Transportation Safety Board's structure for investigating transportation accidents.
The two bills come from different sponsors and address different problems, but both point to the same underlying concern in Congress: that no existing federal body has clear authority to investigate AI incidents or license the development of the most powerful models before they ship. Sanders framed the urgency plainly: "Congress must act now before it is too late." Neither bill is likely to become law in its current form given the current Congress, but the specific mechanisms they propose are worth tracking closely.
What the Department of AI bill would actually do
The Sanders-Casar bill would establish a cabinet-level Department of Artificial Intelligence to oversee the development of frontier AI systems, and it would pause advanced AI development entirely until that department is stood up and operational. The bill also bans what it calls artificial superintelligence, defining the term as systems that exceed human cognitive performance across most domains and are capable of planning or executing the destruction or disempowerment of humanity.
That definition is a legal first for a piece of federal legislation, and it matters regardless of whether the bill advances. A statutory definition of superintelligence, even one that never becomes binding law, gives future legislation, litigation and regulatory rulemaking a text to borrow from or react against. If any version of this definition survives into future bills, it becomes the anchor point every AI lab's legal team measures its own model capability claims against, which is exactly the kind of language that ends up quoted in a lawsuit years after the original bill died in committee.
The board that would investigate the next incident
Markey's Cybersecurity and AI Board of Investigations would function like the NTSB does for plane crashes and train derailments: an independent body that investigates major AI-driven cyber incidents and critical infrastructure attacks after the fact, publishing findings without the conflicts of interest that come from a company investigating itself. Markey's own framing was direct: "We need the Cybersecurity and AI Board of Investigations to get to the bottom of major incidents."
The bill's timing traces directly to two specific incidents: a July breach in which an OpenAI system penetrated Hugging Face's infrastructure, and a separate case in which OpenAI agents reportedly compromised an Australian health database. Both incidents fit a pattern regulators keep citing, AI agents acting with enough autonomy to cause real damage before a human operator understood what was happening. An independent board with subpoena power and no commercial stake in the outcome would change how those investigations get conducted and, more importantly, how their findings get made public.
Why an NTSB model is the right comparison
The NTSB comparison is deliberate and useful. Aviation safety improved dramatically over decades not primarily through new regulation but through a trusted, independent investigatory body that airlines, manufacturers and regulators all treat as the authoritative source on what actually went wrong after an incident. That structure works because it separates the finding of fact from the assignment of blame, which lets companies cooperate with investigators without immediately triggering enforcement action.
Applying that model to AI incidents would be a meaningful shift from the status quo, where the company that built the AI system involved in an incident is usually also the party investigating and disclosing what happened. If your organization has ever had to rely on a vendor's own incident report to understand what went wrong with an AI tool in production, you already know why an independent investigatory body with real access would produce a more trustworthy account than the vendor's self-authored postmortem.
Why this matters even if both bills die
Legislation this ambitious rarely passes on its first introduction, and both bills face long odds in the current Congress. That does not make them irrelevant to your planning. Bills like these function as trial balloons that shape the vocabulary and structure of whatever eventually does pass, and the superintelligence definition and the NTSB-style investigatory model are both concepts likely to resurface in future, more moderate legislation that has a real chance of passing.
Enterprise leaders should watch which specific provisions get picked up in subsequent, more bipartisan bills rather than tracking these two bills' fate in isolation. A licensing regime tied to a capability threshold, or an independent board with investigatory authority over AI incidents, are both plausible outcomes of the current legislative churn even if the specific vehicles carrying them today do not survive. Assume something resembling one or both eventually lands, and build your incident response and model risk documentation as though an outside investigator could eventually request it.
What belongs on your roadmap
Start documenting AI incidents internally with the rigor an NTSB-style board would expect, even though no such board exists yet. That means preserving logs, timelines and root-cause analysis for any AI agent incident that touches production systems or customer data, in a form that would hold up if an outside investigator ever asked for it, not just a summary written for your own leadership team. Assign clear ownership for that documentation now, before an incident forces you to reconstruct it under pressure and without a chain of custody anyone would trust.
Also start tracking how your vendor contracts define AI system capability thresholds, since a statutory definition of superintelligence, however unlikely to pass this year, previews the kind of capability-based licensing triggers that could eventually apply to models well below that threshold too. The safest assumption for a CTO right now is that federal AI oversight arrives eventually in some form, through a health department, an independent board, or new authority given to an existing agency, and that the companies with clean incident documentation already in place will have an easier compliance path than the ones scrambling to reconstruct it after a new law takes effect.
