The Federal Chief Information Security Officer (CISO) Council has established a working group on AI security governance to help federal agencies manage emerging AI-related risks, according to a MeriTalk report. 

Acting Federal CISO Michael Duffy announced the initiative on October 14 at the ACT-IAC Cybersecurity Summit in Reston, Virginia.

Duffy said the federal government cannot wait for major incidents before adapting its approach to AI and cybersecurity. He said agencies need to assess the current threat environment and technological changes while taking a longer-term view of where AI is heading.

The group will develop frameworks to help agency CISOs make faster, more informed decisions using AI. It will also examine how agencies can govern AI systems as they prepare for a gradual shift toward machine-to-machine decision-making.

Governing AI and Human Workforces

According to the report, Duffy said the working group has two focuses. One is future decision-making involving what the administration calls “super intelligence.” The other is creating the frameworks needed to govern AI systems and understand how human workforces and AI capabilities can work together.

“We have spun up a working group on AI security governance for two things,” Duffy said, according to MeriTalk. “One is to think about decision-making with super intelligence in the future.”

Part of a Broader Cyber Agenda

According to MeriTalk, the initiative is part of four broader priorities Duffy outlined for the CISO Council: reducing exposure to cyber threats, strengthening operational resilience, integrating AI into cybersecurity tools and securing a modernized federal government.

On exposure management, the council is working to accelerate the replacement of outdated edge devices across agencies. On resilience, Duffy said the council is preparing for its second governmentwide CISO-level tabletop exercise to improve coordinated incident response.

Setting Clearer Boundaries Around AI Access

For chief data officers (CDOs) and data leaders, the new group signals a shift from treating AI deployment as an individual technology decision toward establishing common controls for how AI operates across government.

Such AI governance frameworks could help agencies set clearer boundaries around AI access, decision-making and accountability as AI becomes more deeply embedded in federal systems and cybersecurity operations.