Protecting Information by Local Leaders for Agency Resilience Act

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. federal laws
• Most recent activity: Proposed
• Most recent activity date: 2025-11-18

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• AI system security vulnerabilities
• Cyberattacks, weapon development or use
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has focused coverage of approximately 2-3 subdomains, primarily addressing AI system security vulnerabilities (2.2), cyberattacks and cyber weapons (4.2), and lack of capability/robustness (7.3). Coverage is concentrated in cybersecurity and system resilience domains, with the document establishing comprehensive governance measures for securing AI systems used in state and local government information infrastructure.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Public Administration (excl. National Security)

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• National Security

All other sectors had no coverage in this document.

Sectors Summary

The document primarily governs the Public Administration sector, specifically state and local government entities managing cybersecurity infrastructure. While it references critical infrastructure across multiple sectors, the governance applies to government entities responsible for that infrastructure, not the sectors themselves.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding Act of Congress that amends the Homeland Security Act of 2002, establishing mandatory legal obligations for federal agencies and grant recipients with specific enforcement mechanisms, compliance requirements, and penalties for non-compliance.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: This Act was proposed and passed by the United States Congress, specifically passed by the House of Representatives on November 17, 2025. Congress is the legislative body with authority to amend the Homeland Security Act of 2002.

Target

• Entity Types: AI_Governance_Actor, AI_Deployer
• Summary: The Act governs state and local governments and eligible entities that receive grants for cybersecurity programs. These entities maintain, own, or operate information systems and AI systems as part of their government operations and critical infrastructure management.

Enforcer

• Entity Types: AI_Governance_Actor
• Summary: The Secretary of Homeland Security, acting through the Director of CISA, has explicit enforcement authority including grant administration, outreach implementation, direct funding provisions, and oversight of compliance with cybersecurity frameworks and spending restrictions.

Monitor

• Entity Types: AI_Governance_Actor
• Summary: The Act establishes monitoring requirements for CISA and mandates GAO reviews every three years to assess the grant program, including AI adoption. The Comptroller General conducts comprehensive reviews of grant selection processes and implementation.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily addresses the Deploy and Operate and Monitor lifecycle stages, focusing on the implementation, operation, and ongoing monitoring of AI systems within state and local government cybersecurity infrastructure. It also touches on planning aspects through cybersecurity planning requirements but does not address model development, data collection, or training phases.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Systems

Technical Scope Summary

The document explicitly defines and mentions artificial intelligence and artificial intelligence systems throughout. It does not specifically address frontier AI, general purpose AI, foundation models, or other specialized AI categories. The focus is on AI systems as used in cybersecurity and operational technology contexts within government infrastructure.