United States law applies in MichiganMichigan is a state of the United States, whose 134 researched instruments are listed on the United States page, not here. The law of Michigan, described on this page below, applies here too.
32 of 35 named instruments researched to a stage, across six of the ten areas of law we track: 24 in force and 8 proposed. As of .
When each starts22 of 32 carry a date, 10 do not. Earlier is before 2014.
in forcenot yet in forceblocked by a courtproposedno longer in force
Michigan enacted two artificial-intelligence-specific election transparency statutes in 2023 and a criminal ban on nonconsensual intimate deepfakes in 2025. Public Act 263 of 2023 requires a disclosure when a qualified political advertisement, or a prerecorded campaign telephone message, is generated in whole or substantially by artificial intelligence (MCL 169.247, 169.259).
Public Act 265 of 2023 prohibits distributing media the Act itself defines as artificial-intelligence-produced and materially deceptive within 90 days of an election, unless the media carries a prescribed manipulation disclaimer (MCL 168.932f). The Protection from Intimate Deep Fakes Act (Public Act 11 of 2025) criminalizes the nonconsensual creation or dissemination of a sexually explicit deep fake of an identifiable person and creates a parallel civil cause of action (MCL 752.381 to 752.390).
Several further AI bills were pending in the Legislature as of : HB 4668 (AI Safety and Security Transparency Act, foundation-model risk assessments), HB 5579 (employer AI and electronic-monitoring notice duties), HB 5899 (a state-agency AI governing board and pilot program, which would reach only government AI use), and SB 760 (the LEAD for Kids Act, companion-chatbot safety duties), which passed the Senate on and was referred to the House Committee on Communications and Technology.
Michigan's child sexually abusive material statute (MCL 750.145c) has not been checked for whether its definitions reach a computer- or AI-generated depiction. The Elliott-Larsen Civil Rights Act (Act 453 of 1976) prohibits discrimination against an applicant for financial assistance or financing in connection with a real estate transaction (MCL 37.2504).
The Michigan Department of Insurance and Financial Services has also issued Bulletin 2026-03-BT/CF/CU, which states that all Financial Service Providers are expected to develop, implement, and maintain a written AI Systems Program for the responsible use of AI Systems.
Proposed.proposed Not law. It binds no one unless it is enacted.
Binds public and private bodies.
What this law does
This bill, as passed by the Senate, would regulate operators of certain chatbots and the offering of certain chatbots to minors. An advanced chatbot is a generative artificial intelligence system with a natural language interface that provides ongoing, adaptive responses to user inputs. A chatbot operator could not make certain advanced chatbot design features available to a user unless it has actual knowledge that the user is not a minor.
The restricted features include features that simulate companionship or an interpersonal relationship with a user. They also include outputs that endorse, promote, or facilitate suicide or self-harm. They also include outputs that encourage secrecy about an interaction with the chatbot, self-isolation, or not seeking help from a health professional or an appropriate adult. They also include outputs that are, describe, or facilitate sexually explicit conduct or child sexual abuse material.
A user's self-identification that the user is not a minor is not sufficient by itself to establish that knowledge. A chatbot operator could not train the underlying model of an advanced chatbot with a minor's inputs unless the minor's parent or guardian gives written consent for that specific purpose. A chatbot operator would have to delete the personal data it collects from a user immediately after using it to determine whether the user is a minor.
The attorney general could seek a civil fine of $25,000 per violation. A minor who suffers actual harm, or a parent or guardian acting for the minor, could bring a civil action against the chatbot operator. The design-feature and personal-data duties do not apply until the effective date of the attorney general's initial rules. Senate Bill 760 passed the Senate on . It was referred to the House Committee on Communications and Technology.
MCL 752.388official Michigan Compiled Laws text, Protection from Intimate Deep Fakes Act, Michigan Legislature
In force since .Binds public and private bodies.
What this law does
The Protection from Intimate Deep Fakes Act (Public Act 11 of 2025) makes it a crime for an individual to intentionally create or disseminate a deep fake that realistically depicts the intimate parts of, or a sexual act involving, an identifiable individual, where the individual knew or should have known the deep fake would cause the depicted individual physical, emotional, reputational, or economic harm.
A first violation is a misdemeanor punishable by up to one year's imprisonment or a $3,000 fine; the offense becomes a felony punishable by up to three years or a $5,000 fine where the depicted individual suffers financial loss, the creator intends to profit, the creator operates a website or app for the purpose, the creator posts the deep fake online, the creator intends to harass, extort, threaten, or harm, or the creator has a prior conviction under this section.
Consent to the deep fake's creation is not a defense unless given in a signed, plain-language agreement describing the depiction.
The Act also creates a civil cause of action for the depicted individual for economic and noneconomic damages, confidential filing, and injunctive relief to maintain that confidentiality, and exempts interactive computer services, telecommunications providers, and technology developers who prohibit the conduct in their terms of service and did not design or market the technology for it.
MCL 37.2101 to 37.2804Michigan Compiled Laws, Elliott-Larsen Civil Rights Act (Act 453 of 1976), Michigan Legislature
In force since .Binds public and private bodies.
What this law does
The Elliott-Larsen Civil Rights Act (Act 453 of 1976) declares it a civil right to have the full and equal utilization of public accommodations, public service, and educational facilities, and the opportunity to obtain employment, housing and other real estate, without discrimination because of religion, race, color, national origin, age, sex, sexual orientation, gender identity or expression, height, weight, familial status, or marital status as prohibited by the Act.
Section 302 provides that, except where permitted by law, a person shall not deny an individual the full and equal enjoyment of the goods, services, facilities, privileges, advantages, or accommodations of a place of public accommodation or public service because of religion, race, color, national origin, age, sex, sexual orientation, gender identity or expression, or marital status.
Section 302 also bars a person from printing, circulating, posting, mailing, or otherwise publishing a statement, advertisement, notice, or sign that indicates that this enjoyment will be refused, withheld, or denied on those grounds.
The Act defines a place of public accommodation as a business, or an educational, refreshment, entertainment, recreation, health, or transportation facility, or institution of any kind, whether licensed or not, whose goods, services, facilities, privileges, advantages, or accommodations are extended, offered, sold, or otherwise made available to the public.
Section 504 provides that a person to whom application is made for financial assistance or financing in connection with a real estate transaction, or in connection with the construction, rehabilitation, repair, maintenance, or improvement of real property, or a representative of that person, shall not discriminate against the applicant because of religion, race, color, national origin, age, sex, sexual orientation, gender identity or expression, familial status, or marital status of the applicant or an individual residing with the applicant.
Section 504 also bars that person from using a form of application for financial assistance or financing, or making or keeping a record or inquiry in connection with an application, that indicates, directly or indirectly, a preference, limitation, specification, or discrimination on those grounds.
The application form and record rule does not apply to a form of application for financial assistance prescribed for the use of a lender regulated as a mortgagee under the national housing act, or by a regulatory board or officer acting under the statutory authority of this state or the United States.
Section 504 also bars a person whose business includes engaging in real estate transactions from discriminating on those grounds in purchasing loans for acquiring, constructing, improving, repairing, or maintaining a dwelling, or in making or purchasing loans or providing other financial assistance secured by residential real estate.
The Act defines a person to include an individual, a corporation, a partnership, a trust, this state, a political subdivision or agency of this state, and any other legal or commercial entity. A person alleging a violation of the Act may bring a civil action for appropriate injunctive relief or damages, or both. A court may award all or a portion of the costs of litigation, including reasonable attorney fees and witness fees, to the complainant if it determines that the award is appropriate.
Action the Civil Rights Commission orders after a hearing may include a civil fine for a violation of article 5, not to exceed $10,000 for the first violation, $25,000 for the second violation within a 5-year period, and $50,000 for 2 or more violations within a 7-year period. The Department of Civil Rights receives, initiates, investigates, conciliates, and issues charges on complaints alleging a violation of the Act.
Section 302 was most recently amended by 2023 Act 6, effective . The Act took effect on .
MCL 500.2403(1)(d)Michigan Compiled Laws, The Insurance Code of 1956 (Act 218 of 1956), section 500.2403, Michigan Legislature
In force since .Binds private bodies.
What this law does
Section 2403 of the Insurance Code of 1956 requires that all rates be made in accordance with the section and the standards it lists. Under subsection (1)(d), rates shall not be excessive, inadequate, or unfairly discriminatory.
A rate for a coverage is unfairly discriminatory in relation to another rate for the same coverage if the differential between the rates is not reasonably justified by differences in losses, expenses, or both, or by differences in the uncertainty of loss for the individuals or risks to which the rates apply.
A reasonable justification must be supported by a reasonable classification system, by sound actuarial principles when applicable, and by actual and credible loss and expense statistics or, for new coverages and classifications, by reasonably anticipated loss and expense experience. The section took effect on with the Insurance Code of 1956 and has been amended several times since.
MCL 169.259, added to the Michigan Campaign Finance Act by Public Act 263 of 2023, requires a person, committee, or entity that creates, originally publishes, or originally distributes a qualified political advertisement generated in whole or substantially by artificial intelligence to include a clear and conspicuous disclosure, with format and duration requirements that vary by medium.
A companion amendment to MCL 169.247 requires the same disclosure on a prerecorded campaign telephone message generated in whole or substantially by artificial intelligence. The disclosure duty does not apply to a bona fide news broadcast that discloses the manipulation, a paid broadcaster, a distribution platform with a stated compliance policy, satire or parody, or a business regulated by the Michigan Public Service Commission or the Federal Communications Commission.
A first violation is a state civil infraction with a fine of up to $250; a second or subsequent violation carries a fine of up to $1,000 per violation, with each distributed or aired advertisement a separate violation.
MCL 168.932f, added to the Michigan Election Law by Public Act 265 of 2023, prohibits a person from distributing, or agreeing to distribute, media the section defines as materially deceptive because it depicts speech or conduct that did not occur, would cause a reasonable viewer to believe it did, and was produced by artificial intelligence, where the person knows the media falsely represents a depicted individual, intends within 90 days of an election to harm a candidate's reputation or electoral prospects, and intends to deceive electors about the depicted individual's actual speech or conduct.
The prohibition does not apply where the media carries a disclaimer, in a form prescribed for video, audio, or image media, stating that it was manipulated and does not depict real speech or conduct, or where media made by editing an existing work cites its unedited source. A first violation is a misdemeanor punishable by up to 90 days' imprisonment or a $500 fine; a violation within five years of a prior conviction under this section is a felony punishable by up to five years or a $1,000 fine.
The Attorney General, the depicted individual, an injured candidate, or a voter-representing organization may also seek permanent injunctive relief.
Michigan has no comprehensive consumer personal-data statute. The Michigan Personal Data Privacy Act, SB 359, was reported favorably from committee in June 2025 but has seen no floor vote in either chamber and does not clear the marquee bar for a proposed instrument.
Michigan's sectoral law covers breach notification under the Identity Theft Protection Act (MCL 445.61 to 445.79d), whose breach-notice trigger turns on the narrower personal information term (MCL 445.63(r)), which excludes biometrics, while a separate, broader personal identifying information term in the same section (MCL 445.63(q)), used elsewhere in the Act for identity-theft and criminal provisions, does include biometrics; the two must not be conflated.
The Insurance Data Security Act (MCL 500.550 to 500.565), adopting the NAIC model law effective , names biometric records as a protected data element for insurance licensees but defines the term no further and expressly forecloses a private right of action, as does the Identity Theft Protection Act's own breach-notice enforcement provision.
A physician-ordered genetic test informed-consent requirement (MCL 333.17020) binds health care providers but is not a consumer-facing genetic-privacy or data-processing statute; no Michigan law regulates direct-to-consumer genetic-testing companies' privacy practices, and no biometric-privacy statute reaches a general private-sector actor outside the insurance sector.
The Identity Theft Protection Act (Act 452 of 2004) requires a person or agency to provide breach notice without unreasonable delay, unless the entity determines the breach has not caused and is not likely to cause substantial loss, injury, or identity theft.
The notice trigger turns on the narrower personal information term at MCL 445.63(r), which does not include biometric data; a breach exposing only biometric identifiers, with no accompanying Social Security number, driver's license, or financial account number, does not trigger this notice duty. The publicly-available carve-out for this notice duty is placed in MCL 445.72(17), not in the definitions section, MCL 445.63. This section applies to a breach discovered or noticed on or after .
MCL 445.63 defines two distinct terms that must not be conflated. "Personal information," MCL 445.63(r), is a name combined with a Social Security number, driver's license or state ID number, or financial account or card number with an access code; it does not include biometric data.
"Personal identifying information," MCL 445.63(q), is a broader term, used for the Act's identity-theft-prevention and criminal provisions elsewhere in the chapter, that does include biometrics among many other data elements such as address, employer, government passport number, and account passwords. Only the narrower "personal information" term is the breach-notice trigger at MCL 445.72. The provisions this entry describes came into force on different days.
A licensee must maintain records concerning all cybersecurity events for at least 5 years from the date of the cybersecurity event and must produce those records on demand of the director. Section 557 was added by 2018 Act 690, effective . A licensee is a licensed insurer or producer, or another person licensed or required to be licensed, authorized, or registered, or holding or required to hold a certificate of authority, under the Insurance Data Security Act.
Proposed.proposed Not law. It binds no one unless it is enacted.
Before the second chamber, dated , as of .Binds private bodies.
What this law does
House Bill 6098 of 2026 passed the House on , by a vote of 92 to 15. The Senate referred it to its Committee on Economic and Community Development on . As passed by the House, new section 3q of the Michigan consumer protection act bars a person engaged in trade or commerce from using surveillance pricing in the sale of goods and services.
Surveillance pricing is a pricing system that increases the price of a good or service based on an individual's personal identifiable data, such as device type, IP address, individual cookies, geolocation, search history or purchasing habits. Surveillance pricing does not include dynamic pricing, taxes, delivery fees or a retailer loyalty program. The bar does not apply to a person doing business under a law of Michigan, another state or the United States relating to financial institutions.
It does not apply where the person bases the price or terms of credit on a consumer report used in compliance with the federal Fair Credit Reporting Act. It does not apply where the person is pricing insurance or insurance-related products. Only the attorney general or a prosecuting attorney may enforce section 3q. The bill takes effect 30 days after it is enacted. It does not take effect unless House Bill 6099 is also enacted.
Proposed.proposed Not law. It binds no one unless it is enacted.
Before the second chamber, dated , as of .Binds private bodies.
What this law does
House Bill 6099 of 2026 passed the House on , by a vote of 92 to 15. The Senate referred it to its Committee on Economic and Community Development on . As passed by the House, new section 7(3) of the Shopping Reform and Modernization Act bars a person from using surveillance pricing in the display of the total price of a consumer item offered for sale at retail.
Surveillance pricing is a pricing system that increases the price of a consumer item based on an individual's personal identifiable data, such as device type, IP address, individual cookies, geolocation, search history or purchasing habits. Surveillance pricing does not include dynamic pricing, taxes, delivery fees or a retailer loyalty program. The private actions in section 12 of the act do not apply to a violation of section 7(3). The bill takes effect 30 days after it is enacted. It does not take effect unless House Bill 6098 is also enacted.
A person that knowingly fails to give required breach notice may be ordered to pay a civil fine of up to $250 per failure to notify, with aggregate liability for multiple violations arising from the same breach capped at $750,000; the Attorney General or a prosecuting attorney may bring the action.
The Act preserves, but does not itself create, any other civil remedy available under state or federal law; no provision ties a violation to the Michigan Consumer Protection Act or any other statute carrying a private right of action.
The Insurance Data Security Act expressly does not create or imply a private cause of action for its violation, and does not curtail a private cause of action that would otherwise exist independent of the chapter. The chapter establishes the exclusive Michigan standards for a licensee's data security, cybersecurity-event investigation, and notification to the Director of the Department of Insurance and Financial Services, who enforces it.
MCL 333.17020official Michigan Compiled Laws text, Public Health Code, Michigan Legislature
In force.Binds public and private bodies.
What this law does
A physician, or an individual to whom the physician has delegated authority to perform a selected act, task, or function, may not order a presymptomatic or predictive genetic test without first obtaining the test subject's written, informed consent.
This is a health-care informed-consent requirement binding a physician's ordering conduct, not a consumer-facing data-privacy or data-processing statute, and it does not reach a direct-to-consumer genetic-testing company; no Michigan statute regulates such a company's privacy practices. The act that added this section, Act 29 of 2000, took immediate effect on , and the consent requirement begins upon the expiration of 6 months after that date; no source states the resulting day.
Michigan adopted the NAIC Insurance Data Security Model Law as Chapter 5A of the Insurance Code (MCL 500.550 to 500.565), effective . Nonpublic information (MCL 500.553(i)) includes electronic information that is not publicly available and that, combined with an identifying element such as a name or number, includes a Social Security number, driver's license or state ID number, financial account or card number, a financial-account access code, or biometric records.
Biometric records appears as a bare, undefined term with no elaboration anywhere in the chapter's definitions and no photograph, video, or audio-recording exclusion or clawback clause of any kind, so whether it excludes a recording-derived identifier cannot be tested against this text. This chapter binds insurance licensees only, not a general private-sector actor.
Michigan's principal scraping-adjacent statute is the Fraudulent Access to Computers, Computer Systems, and Computer Networks Act (Act 53 of 1979, MCL 752.791 to 752.797), a computer-misuse statute that criminalizes intentional access without authorization or by exceeding authorization, independent of any privacy, copyright, or terms-of-service theory.
Michigan has no separate terms-of-service enforceability statute, text-and-data-mining exception, sui generis database right, or robots.txt-specific rule; a service's copyright and terms-of-service exposure for scraping rests on federal law and general common-law doctrine that Michigan has not separately codified. The Michigan Consumer Protection Act (MCL 445.903) was checked and contains no subsection naming automated access or data collection.
Act 53 of 1979 prohibits intentionally accessing or causing access to a computer, computer system, or computer network to devise or execute a fraud scheme, or to obtain money, property, or a service by false pretense (MCL 752.794).
Separately, MCL 752.795 prohibits intentionally accessing, or causing access to, a computer, computer system, or computer network without authorization or by exceeding valid authorization, to acquire, alter, damage, delete, or destroy property or to use its services, and prohibits planting instructions or a program intended to do the same.
Michigan Act 53 also creates a rebuttable presumption that access was unauthorized, which is rebutted by showing written or oral permission was granted, that the accessed system displayed a pre-programmed message a reasonable person would believe identified it as within the public domain, or that access did not require bypassing an access-control procedure.
MCL 752.796 separately prohibits using a computer, computer system, or computer network to commit, attempt, conspire to commit, or solicit another to commit a crime.
Penalties escalate with the aggregate value involved or the severity of the underlying crime: a violation of the fraud-scheme prohibition ranges from a misdemeanor (93 days, $500, or 3 times the aggregate amount) to a felony (10 years, or 3 times the aggregate amount) as the aggregate loss or prior-conviction count rises; a violation of the unauthorized-access prohibition is a felony punishable by up to 5 years or a $10,000 fine, rising to 10 years or $50,000 with a prior conviction; and a violation of the commit-a-crime prohibition is tiered to the maximum term of the underlying offense, from a 1-year misdemeanor up to a 20-year felony.
Cybersecurity law8 instruments, 7 in force, 1 proposed
Research summary (1,164 words)
Michigan has no single cross-sector product-security or cyber-resilience statute.
Its only enacted baseline-security duty is narrow: MCL 445.72a (Sec. 12a of the Identity Theft Protection Act, Act 452 of 2004, added by 2006 PA 566 and effective ) requires a person or agency that maintains a database including personal information about multiple Michigan residents to destroy, or arrange for the destruction of, any data containing an individual's personal information once it is removed from the database and not retained elsewhere for a purpose state or federal law does not prohibit, with retention for an investigation, audit, or internal review expressly permitted; a knowing violation is a misdemeanor punishable by a fine of up to $250 per violation, and the section neither creates a private right of action nor displaces whatever other civil remedy state or federal law might otherwise provide.
This is a disposal-only duty split out of the Act's breach-notification section, MCL 445.72, already this jurisdiction's privacy-topic row; it does not by its own text impose the broader administrative, technical, and physical safeguards program that New York's SHIELD Act (General Business Law 899-bb) or Utah's Protection of Personal Information Act (Utah Code 13-44-201) require, and no other enacted Michigan statute does either.
A broader, comprehensive reasonable-security-procedures duty is proposed in a bill that has passed the Senate.
Senate Bill 360 of the 2025-2026 Regular Session, as passed by the Senate on (Roll Call No. 212, 19-15) and referred to the House Committee on Government Operations the same day, would add a new Section 11a to the Identity Theft Protection Act requiring a person or agency that owns, possesses, collects, or accesses personal information to implement and maintain reasonable security procedures: designate a coordinator, identify internal and external risks, include safeguards addressing those risks, assess the safeguards' effectiveness, contractually require every service provider to maintain safeguards conforming to the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 or another industry-standard framework, and evaluate and adjust the procedures over time; reasonableness would turn on the entity's size, the amount and type of personal information involved, and the cost of the procedures relative to the entity's resources, and an entity that reasonably conforms to NIST CSF 2.0, or is already regulated under and conforms to Health Insurance Portability and Accountability Act (HIPAA), Gramm-Leach-Bliley Title V, the Federal Information Security Modernization Act of 2014, or HITECH, would be deemed compliant.
The bill would also add a duty to investigate a suspected breach (proposed Section 11b) and would arm only the Attorney General, through a new civil-investigative-demand and assurance-of-discontinuance framework, with a civil fine of up to $2,000 for a knowing failure to implement or maintain reasonable security procedures and a further $2,000 for a knowing failure to investigate a breach.
It is a reintroduction of Senate Bills 888 through 892 of the 2023-2024 Regular Session, which likewise passed the Senate on (Roll Call No. 540, 20-15) and were referred to the same House committee but received no further action before that session ended; as of the reintroduced bill remains in the House Committee on Government Operations, with no further recorded action since its Senate passage.
No enacted Michigan statute provides a Utah, Ohio, or Iowa-shaped cybersecurity affirmative-defense safe harbor conditioned on a framework-conforming program.
Senate Bill 672 of the 2021-2022 Regular Session would have added exactly that, an affirmative defense to a tort claim for a person that maintained a written cybersecurity program reasonably conforming to a named framework; it passed the Senate on (Roll Call No. 65, 20-17) and was referred to the House Committee on Financial Services the same day, but received no further action before the session ended, and no successor safe-harbor bill has been introduced since.
Senate Bill 360 does not include an affirmative-defense provision; it imposes a mandatory duty rather than offering a shield.
Michigan's sector-specific cyber regimes are the Public Service Commission's electric and gas technical standards (each filed as rows of their own) and the Insurance Data Security Act, MCL 500.550 to 500.565 (Chapter 5A of the Insurance Code of 1956, added by 2018 PA 690 and effective ), adopting the NAIC Insurance Data Security Model Law.
Its core duty, MCL 500.555, requires a licensee (a licensed insurer, producer, or other person licensed, authorized, or registered under the Insurance Code) to develop, implement, and maintain a comprehensive written information security program with administrative, technical, and physical safeguards, board-level oversight, a written incident-response plan, and an annual compliance certification to the Director of the Department of Insurance and Financial Services; MCL 500.559 separately requires a licensee to notify the Director within ten business days of determining that a qualifying cybersecurity event occurred.
MCL 500.550 forecloses a private cause of action for the chapter's violation and states that the chapter sets the exclusive Michigan standards for a licensee's data security, and MCL 500.553's definition of nonpublic information, which names biometric records among other elements, is already this jurisdiction's privacy-topic row rather than repeated here.
No enacted Michigan statute sets security requirements a connected device or software product must meet to be placed on the market, comparable to California's or Oregon's connected-device statutes or the Cyber Resilience Act, and no enacted Michigan statute imposes a general private-sector duty to report an exploited vulnerability or a security incident to a state authority; the federal Cyber Incident Reporting for Critical Infrastructure Act's reporting duty, which applies from the dates a final rule prescribes, is this jurisdiction's national-layer row rather than a Michigan-specific one.
Michigan's computer-misuse statute, the Fraudulent Access to Computers, Computer Systems, and Computer Networks Act (1979 PA 53), binds a person who accesses a computer system without authorization; it belongs to this jurisdiction's scraping-topic computer-misuse family because it binds the intruder rather than the operator or manufacturer this profile researches.
Michigan's Insurance Data Security Act requires each insurance licensee to develop, implement, and maintain a comprehensive written information security program based on its risk assessment. The same Act requires an insurance licensee to notify the director not later than 10 business days after determining that a qualifying cybersecurity event involving nonpublic information has occurred.
Michigan Administrative Code rule R 460.3205 requires an electric utility or cooperative to provide a written or oral annual report to designated members of the commission staff regarding its cybersecurity program and related risk planning.
As soon as reasonably practicable and before public notification, an electric utility or cooperative must orally report the confirmation of a cybersecurity incident to a designated member of the commission staff and to the Michigan intelligence operations center. Michigan Administrative Code rule R 460.2324 requires a gas utility to provide a written or oral annual report to designated members of the commission staff regarding its cybersecurity program and related risk planning.
As soon as reasonably practicable and prior to any public notification, a gas utility must orally report the confirmation of a cybersecurity incident to a designated member of the commission staff and to the Michigan fusion center.
Section 555 of the Insurance Code requires each licensee to develop, implement, and maintain a comprehensive written information security program, based on its risk assessment, that contains administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee's information system.
A licensee is a licensed insurer or producer, and other persons licensed or required to be licensed, authorized, or registered, or holding or required to hold a certificate of authority under the Insurance Code. A licensee must exercise due diligence in selecting its third-party service provider and must require the provider to implement appropriate administrative, technical, and physical measures to protect the information systems and nonpublic information it can reach.
Each licensee must establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information in its possession, its information systems, or the continuing functionality of any aspect of its business or operations.
By February 15 of each year, each insurer domiciled in Michigan must submit to the director a written statement certifying that the insurer is in compliance with section 555. A licensee that has fewer than 25 employees, including any independent contractors, is exempt from section 555.
A licensee subject to and in compliance with the federal health insurance portability and accountability act of 1996 is not required to comply with the chapter except for the requirements under sections 559 and 561. The chapter took effect on , a licensee had to implement section 555 by , and a licensee had until to implement section 555(6). The chapter does not create or imply a private cause of action for violation of its provisions.
Rule 205 of the Technical Standards for Electric Service requires an electric utility or cooperative to provide a written or oral annual report to designated members of the commission staff regarding its cybersecurity program and related risk planning. The annual report must contain an overview of the program describing the electric utility's or cooperative's approach to cybersecurity awareness and protection.
The annual report must contain a redacted summary of any unauthorized actions that resulted in loss of service, financial harm, or breach of sensitive business or customer data, including the parties notified and any remedial actions undertaken. The annual report must contain general information about current emergency response plans regarding cybersecurity incidents and domestic preparedness strategies.
An electric utility must also include in its annual report to the commission an overview of major investments in cybersecurity during the previous calendar year. The Technical Standards for Electric Service apply to electric utilities and cooperative electric utilities that are subject to the jurisdiction of the public service commission. Rule 205 carries a 2023 amendment effective . Rule 205 of the Technical Standards for Electric Service first took effect on .
The Michigan Public Service Commission adopted the Technical Standards for Electric Service under authority that includes section 5 of 1919 PA 419. A corporation, joint stock company, association or individual that owns, manages or operates a public utility and refuses or neglects to obey the commission's rules and regulations is liable to a penalty of not less than 100 dollars nor more than 1,000 dollars.
The officer or individual in default is also guilty of a misdemeanor and, on conviction, is subject to a fine of not less than 10 dollars nor more than 1,000 dollars, imprisonment in the county jail for not more than 6 months, or both.
Rule 24 of the Technical Standards for Gas Service requires a utility to provide a written or oral annual report to designated members of the commission staff regarding its cybersecurity program and related risk planning. The annual report must contain an overview of the program describing the utility's approach to cybersecurity awareness and protection.
The annual report must contain a redacted summary of any unauthorized actions that resulted in material loss of service, financial harm, or breach of sensitive business or customer data, including the parties notified and any remedial actions undertaken. The annual report must contain general information about current emergency response plans regarding cybersecurity incidents and domestic preparedness strategies.
An investor-owned public utility must also include in its annual report to the Michigan public service commission an overview of major investments in cybersecurity during the previous calendar year. The Technical Standards for Gas Service apply to a gas utility that operates within the state of Michigan and that is subject to the jurisdiction of the commission. Rule 24 took effect on .
The Michigan Public Service Commission adopted the Technical Standards for Gas Service under authority that includes section 5 of 1919 PA 419. A corporation, joint stock company, association or individual that owns, manages or operates a public utility and refuses or neglects to obey the commission's rules and regulations is liable to a penalty of not less than 100 dollars nor more than 1,000 dollars.
The officer or individual in default is also guilty of a misdemeanor and, on conviction, is subject to a fine of not less than 10 dollars nor more than 1,000 dollars, imprisonment in the county jail for not more than 6 months, or both.
MCL 445.72a requires a person (a private business or other legal entity) or agency (a Michigan state government department, board, commission, office, authority, or unit, including a public university, but not a court) that maintains a database including personal information about multiple Michigan residents to destroy, or arrange for the destruction of, any data containing an individual's personal information once that data is removed from the database and is not retained elsewhere for a purpose state or federal law does not prohibit.
Retaining data for an investigation, audit, or internal review is not itself a violation of this duty. "Destroy" means shredding, erasing, or otherwise modifying the data so it cannot be read, deciphered, or reconstructed through generally available means. An entity already subject to, and in compliance with, a federal law governing the disposal of records containing personal identifying information is considered compliant with this section too.
A knowing violation is a misdemeanor punishable by a fine of up to $250 for each violation, and the section neither creates a private right of action nor displaces whatever other civil remedy state or federal law might otherwise provide.
This is a narrower, disposal-only duty that does not, by its own text, impose the broader administrative, technical, and physical safeguards program that New York's SHIELD Act (General Business Law 899-bb) or Utah's Protection of Personal Information Act (Utah Code 13-44-201) require.
Proposed.proposed Not law. It binds no one unless it is enacted.
Binds public and private bodies.
What this law does
Senate Bill 360 of the 2025-2026 Regular Session, as passed by the Senate on , would add a new Section 11a to the Identity Theft Protection Act requiring a person or agency that owns, possesses, collects, or accesses personal information to implement and maintain reasonable security procedures.
Those procedures would have to designate a coordinator, identify internal and external risks, include safeguards addressing those risks, assess the safeguards' effectiveness, contractually require every service provider to maintain safeguards conforming to the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 or another industry-standard framework, and evaluate and adjust the procedures over time.
Reasonableness would turn on the entity's size, the amount and type of personal information involved, and the cost of the procedures relative to the entity's resources. An entity that reasonably conforms to the current NIST Cybersecurity Framework 2.0, or that is regulated by Michigan or the federal government and reasonably conforms to Health Insurance Portability and Accountability Act (HIPAA), Gramm-Leach-Bliley Title V, the Federal Information Security Modernization Act of 2014, or HITECH, would be deemed compliant.
The bill would also add a duty to investigate a suspected breach under proposed Section 11b. Only the Attorney General could enforce this duty, by a civil action seeking injunctive relief and a fine of up to $2,000 for a knowing failure to implement or maintain reasonable security procedures under proposed section 11a.
Section 559 of the Insurance Code requires each licensee to notify the director as promptly as possible, and not later than 10 business days, after a determination that a cybersecurity event involving nonpublic information in its possession has occurred, when either of two sets of criteria is met.
The first set of criteria is that Michigan is the licensee's state of domicile, for an insurer, or its home state, for an insurance producer, and that the event has a reasonable likelihood of materially harming a consumer residing in Michigan or any material part of a normal operation of the licensee.
The second set of criteria is that the licensee reasonably believes the nonpublic information involved is of 250 or more consumers residing in Michigan and that the event is one of two further kinds. A licensee is a licensed insurer or producer, and other persons licensed or required to be licensed, authorized, or registered, or holding or required to hold a certificate of authority under the Insurance Code.
A licensee that learns a cybersecurity event has or may have occurred must conduct a prompt investigation itself or through a designated outside vendor or service provider. A licensee must maintain records concerning all cybersecurity events for at least 5 years from the date of the event and produce them on demand of the director.
A licensee must provide the notice information in electronic form as the director directs and has a continuing obligation to update and supplement its notifications regarding material changes to previously provided information. An assuming insurer must notify its affected ceding insurers and the director of its state of domicile within 10 business days after making the determination that a cybersecurity event has occurred. Section 559 was added by Act 690 of 2018 and took effect on .
As soon as reasonably practicable and before public notification, an electric utility or cooperative must orally report the confirmation of a cybersecurity incident to a designated member of the commission staff and to the Michigan intelligence operations center. The oral report is not required where it is prohibited by law or court order or where official law enforcement personnel instruct otherwise.
The oral report is due if a person intentionally interrupted the production, transmission, or distribution of electricity. The oral report is due if a person extorted money or other thing of value from the electric utility or cooperative through a cybersecurity attack. The oral report is due if a person caused a denial of service in excess of 12 hours.
The oral report is due if a security breach, as defined in section 3 of the identity theft protection act, occurred before public and customer notification. The oral report is also due, at the electric utility's or cooperative's discretion, for any other cybersecurity incident, attack, or threat the utility or cooperative deems notable, unusual, or significant.
The Technical Standards for Electric Service apply to electric utilities and cooperative electric utilities that are subject to the jurisdiction of the public service commission. Rule 205 carries a 2023 amendment effective . Rule 205 of the Technical Standards for Electric Service first took effect on . The Michigan Public Service Commission adopted the Technical Standards for Electric Service under authority that includes section 5 of 1919 PA 419.
A corporation, joint stock company, association or individual that owns, manages or operates a public utility and refuses or neglects to obey the commission's rules and regulations is liable to a penalty of not less than 100 dollars nor more than 1,000 dollars. The officer or individual in default is also guilty of a misdemeanor and, on conviction, is subject to a fine of not less than 10 dollars nor more than 1,000 dollars, imprisonment in the county jail for not more than 6 months, or both.
As soon as reasonably practicable and prior to any public notification, a utility must orally report the confirmation of a cybersecurity incident to a designated member of the commission staff and to the Michigan fusion center. The oral report is not required where it is prohibited by law or court order or where official law enforcement personnel instruct otherwise. The oral report is due if a person intentionally interrupted the production, transmission, or distribution of natural gas.
The oral report is due if a person extorted money or other things of value from the utility through a cybersecurity attack. The oral report is due if a person caused a denial of service in excess of 12 hours. The oral report is due if a security breach, as defined in section 3(b) of the identity theft protection act, occurred before public and customer notification.
The oral report is also due, at the utility's discretion, for any other cybersecurity incident, attack, or threat the utility deems notable, unusual, or significant. The Technical Standards for Gas Service apply to a gas utility that operates within the state of Michigan and that is subject to the jurisdiction of the commission. Rule 24 took effect on .
The Michigan Public Service Commission adopted the Technical Standards for Gas Service under authority that includes section 5 of 1919 PA 419. A corporation, joint stock company, association or individual that owns, manages or operates a public utility and refuses or neglects to obey the commission's rules and regulations is liable to a penalty of not less than 100 dollars nor more than 1,000 dollars.
The officer or individual in default is also guilty of a misdemeanor and, on conviction, is subject to a fine of not less than 10 dollars nor more than 1,000 dollars, imprisonment in the county jail for not more than 6 months, or both.
Michigan's eavesdropping statute makes it a felony to use a device to eavesdrop on a private conversation without the consent of all parties, and defines eavesdropping as overhearing, recording, amplifying or transmitting the private discourse of others without the permission of all persons engaged in it; the text does not say whether a party who records their own conversation eavesdrops on it.
The Home Solicitation Sales Act bars a telephone solicitation made in whole or in part by recorded message and a solicitation to a residential subscriber on the federal do-not-call list or to a consumer who has asked the caller's organization not to call, requires identification, disclosures before payment and a verifiable authorization before any charge, and bars blocking caller identification, with a civil action for actual damages or $250, whichever is greater.
A 1913 telephone statute, as amended effective 1999, separately bars delivering a recorded commercial-advertising message without the subscriber's consent and blocking caller identification on intrastate commercial advertising, each with a $1,000 civil action and a misdemeanor.
The Unsolicited Commercial E-mail Protection Act requires an unsolicited commercial e-mail sent through a Michigan provider or to a Michigan resident to carry an ADV: label, sender identification and an opt-out method, bars misrepresenting its origin or transmission path, and requires honoring an opt-out; its origin and path prohibitions are framed as rules against falsity or deception, the kind of state email rule the CAN-SPAM Act's preemption clause leaves in force, while its labeling, identification and opt-out duties are not framed that way.
Section 539l of the Michigan Penal Code, Act 328 of 1931, makes it a misdemeanor, punishable by imprisonment for not more than 1 year or a fine of not more than $1,000, or both, to install or place a tracking device in or on a motor vehicle without the knowledge and consent of the owner or, for a leased vehicle, the lessee, and to track the location of a motor vehicle with a tracking device without the knowledge and consent of either the owner or the authorized operator or, for a leased vehicle, either the lessee or the authorized operator.
Subsection (1) of section 539l does not apply to, among others, the installation or use of a device that provides vehicle tracking to give the operator mechanical, operational, directional, navigation, weather, or traffic information, or of a device or service that gives the lessee clear notice that the vehicle may be tracked.
A person who intentionally sends an unsolicited commercial e-mail through an e-mail service provider the sender knew or should have known is located in Michigan, or to an address the sender knew or should have known is held by a Michigan resident, must begin its subject line with "ADV:", conspicuously state the sender's legal name, correct street address, valid domain name and valid return e-mail address, and provide a toll-free number, return e-mail address or other easy electronic method to opt out, with a notice of it in print as large as most of the message.
Unsolicited means without the recipient's express permission, and an e-mail is not unsolicited if the sender has a preexisting business or personal relationship with the recipient or the recipient opted into a system to receive promotional material.
A sender of unsolicited commercial e-mail through a Michigan provider or to a Michigan resident's address must not use a third party's domain name or e-mail address to identify the message's point of origin or transmission path without consent, misrepresent that information, or omit the information needed to identify the point of origin.
Once a recipient tells the sender they do not want future unsolicited commercial e-mail, the sender must not send them any, directly or through a third party, and must keep policies and records, updated at least every 14 business days, so that the recipient receives none from the date of the notice.
The origin and transmission-path prohibitions are framed as rules against falsity or deception, the kind of state email rule the CAN-SPAM Act's preemption clause leaves in force; the labeling, identification and opt-out duties are not framed that way.
A person must not knowingly sell, give, distribute or possess with intent to distribute software primarily designed, of only limited other commercially significant use, or marketed to enable falsifying commercial e-mail transmission or routing information.
A violation is a misdemeanor, and a violation of section 4, which holds the origin and path prohibitions and the opt-out-honoring duty, or of the act in furtherance of another crime is a felony; each commercial e-mail sent in violation is a separate violation. It is a defense that the e-mail was transmitted accidentally or as a result of a preexisting business relationship, which the sender must prove.
A recipient, an e-mail service provider through whose facilities the e-mail passed, or the attorney general may recover actual damages or, in lieu of actual damages, the lesser of $500 for each unsolicited commercial e-mail or $250,000 for each day the violation occurs, and a prevailing recipient or e-mail service provider also recovers actual costs and reasonable attorney fees.
An e-mail service provider does not violate the act by acting as an intermediary in, or providing, the transmission of an unsolicited commercial e-mail that violates it. Person is defined to include a governmental entity as well as an individual, corporation, partnership or association.
A person who is present or not present during a private conversation and who wilfully uses a device to eavesdrop upon it without the consent of all parties, or who knowingly aids, employs or procures another to do so, is guilty of a felony. To eavesdrop is to overhear, record, amplify or transmit any part of the private discourse of others without the permission of all persons engaged in the discourse.
The text does not say whether a party who records their own conversation eavesdrops on it, and the chapter does not define private conversation. Using or divulging information a person knows or reasonably should know was obtained by eavesdropping in violation of the chapter is also a felony.
The chapter does not prohibit a communications common carrier's employee from hearing a communication in the course of employment, or a public utility from recording customer calls requesting service or registering a complaint where a record is required for legitimate business purposes and its employees know of the practice. The chapter does not modify or affect any law concerning the interception, divulgence or recording of messages transmitted by communications common carriers.
Person is defined for this chapter as an individual, partnership, corporation or association. Any party to a conversation on which eavesdropping is practiced contrary to the act may obtain an injunction against further eavesdropping and recover actual and punitive damages from the person who eavesdrops.
A telephone solicitation is a voice communication over a telephone made to encourage the recipient to purchase, rent or invest in goods or services during that call, and a telephone solicitor is any person doing business in Michigan who makes or causes one to be made, including by an automatic dialing and announcing device or a live person.
A telephone solicitation does not include a call the residential subscriber expressly invited or permitted in advance, a call to an existing customer (one who bought from the caller and paid within the preceding 12 months or has not yet paid under a prior agreement) unless that customer has asked not to be called, or a call that only requests a face-to-face meeting without urging a decision during the call.
A person must not make a telephone solicitation that consists in whole or in part of a recorded message, and a home solicitation sale may not be made by telephonic solicitation using one. A telephone solicitor must not call a residential telephone subscriber whose name and number are on the then-current federal do-not-call list, which the public service commission must designate as the state list while the federal list is maintained, and may use the list for no other purpose.
At the start of a solicitation to a residential subscriber, the caller must give their name and the full name of the organization or person on whose behalf the call is made, and provide on request a telephone number answered by a natural person who can describe that organization and the solicitation; the solicitor must not intentionally block the display of its number on the subscriber's caller ID. It is an unfair or deceptive act for a telephone solicitor to fail to disclose clearly, before payment, the total price, any restrictions or conditions, the material refund, cancellation or exchange terms, prize terms and odds, material investment risks and the quantity and characteristics of the goods or services, or to misrepresent the goods or make a false statement to induce payment.
It is also unfair or deceptive to charge a consumer before receiving an express verifiable authorization (a written authorization, a recorded oral authorization or an independent third party's confirmation), to offer a prize promotion requiring a purchase, to fail to comply with the recorded-message, do-not-call, identification or caller-identification rules, to call a consumer who has asked not to be called by or for that organization, or to leave a voicemail falsely claiming a current business matter or relationship and asking for a call back.
A person who suffers loss as a result of a violation of section 1c may recover actual damages or $250, whichever is greater, with reasonable attorney fees. A knowing or intentional violation of section 1c is a misdemeanor, except where it is a failure to comply with the recorded-message, do-not-call, identification or caller-identification rules.
Sections 1a to 1d do not apply to a person subject to the charitable organizations and solicitations act, the public safety solicitation act, or section 527 of the Internal Revenue Code. The recorded-message rule for home solicitation sales dates from 1978; the identification, caller-identification and section 1c rules were added by 2002 PA 612, effective .
MCL 484.125Act 206 of 1913, Telephone Companies as Common Carriers, official text (Michigan Legislature)
In force since .Binds private bodies.
What this law does
A caller, anyone who contacts or tries to contact a subscriber in Michigan by telephone, may not use a telephone line to deliver a recorded message presenting commercial advertising to a subscriber's residential, business or toll-free number unless the subscriber has knowingly and voluntarily requested, consented to, permitted or authorized the contact, or has knowingly and voluntarily given the caller the subscriber's telephone number.
That authorization may not be transferred, assigned or sold without the subscriber's written permission. A subscriber is a person with residential, business or toll-free service from a telephone company Michigan regulates, and others at the same legal residence. A caller may not deliver or attempt to deliver intrastate commercial advertising while blocking the display of caller identification information the subscriber would otherwise see.
Authorized recorded commercial advertising must end, or free the subscriber's line for incoming and outgoing calls, immediately when the subscriber hangs up.
Using automated dialing, push-button or tone-activated equipment that operates sequentially or otherwise cannot avoid contacting subscribers who have not authorized the contact is prima facie evidence of intent to violate the section, but the section does not prohibit using automatic dialing equipment to advise a customer about merchandise, goods or services the customer previously ordered.
A subscriber contacted in violation of the section may recover damages of $1,000 with reasonable attorney fees, and the caller commits a misdemeanor. The section dates from 1980 and was amended by two 1998 acts effective .
Michigan has not enacted an age-gating statute in any of the four families.
Four related Senate bills passed the Senate 20 to 17 on and are pending in the House Committee on Communications and Technology: Senate Bill 757 would restrict addictive social media feeds for minors, Senate Bill 758 would create a Michigan Kids Code age-appropriate design code, Senate Bill 759 is tie-barred to Senate Bill 758 and would amend the Michigan Consumer Protection Act to make a Kids Code violation an unfair trade practice, and Senate Bill 760 would restrict AI companion chatbots available to minors.
Separate bills on social media age verification and parental consent (House Bill 4388) and adult content age verification (Senate Bill 191) remain in committee and have not passed either chamber.
Proposed.proposed Not law. It binds no one unless it is enacted.
Before the second chamber, dated , as of .Binds private bodies.
What this law does
Would require a covered online service provider to give a parent tools to manage a covered minor's privacy and account settings, screen time, and purchases, to collect only the personal data a covered minor needs for the service, and to bar profiling, dark patterns, and personalized-feed recommendations directed at a covered minor absent the minor's own request.
Does not take effect unless Senate Bill 759 is also enacted; passed the Senate 20 to 17 on and is pending in the House Committee on Communications and Technology.
Proposed.proposed Not law. It binds no one unless it is enacted.
Before the second chamber, dated , as of .Binds private bodies.
What this law does
Would amend the Michigan Consumer Protection Act to add violating the Michigan Kids Code Act (Senate Bill 758) to the Act's list of unfair, unconscionable, or deceptive trade practices, arming the Consumer Protection Act's existing private right of action and the Attorney General's enforcement powers for a Kids Code violation.
Tie-barred to Senate Bill 758, which does not take effect unless this bill is also enacted; passed the Senate 20 to 17 on and is pending in the House Committee on Communications and Technology.
Proposed.proposed Not law. It binds no one unless it is enacted.
Before the second chamber, dated , as of .Binds private bodies.
What this law does
Would bar a chatbot operator from making an advanced chatbot, a generative AI system with a natural language interface that provides ongoing, adaptive responses, available to a minor if it could foreseeably undermine the minor's safety, wellbeing, or development, and would restrict data collection, companionship-simulating design features, and training the chatbot on a minor's inputs absent the minor's parent or guardian's written consent. Passed the Senate 20 to 17 on ; pending in the House Committee on Communications and Technology.
Proposed.proposed Not law. It binds no one unless it is enacted.
Before the second chamber, dated , as of .Binds private bodies.
What this law does
Would bar a covered operator of an addictive internet-based service or application from providing an addictive feed, a feed that recommends or prioritizes user-generated media based on the user or the user's device, to a minor unless the operator has determined the user is not a minor or has obtained verifiable parental consent, and bars sending addictive feed notifications to a minor overnight or during school hours.
Passed the Senate 20 to 17 on in its second substitute; pending in the House Committee on Communications and Technology.
These areas of law were researched here and no instrument was recorded. Each finding says what the research checked, as of the date under it. It describes our search, not a guarantee that no such law exists.
Reuse law
Michigan has no press-publisher neighbouring right, mandatory platform-to-publisher bargaining code, or codified hot-news misappropriation statute distinct from federal law.
The Michigan Penal Code's computer chapter, Act 53 of 1979 (MCL 752.791 to 752.797), reaches unauthorized computer access and fraud but contains no provision addressing reproduction of news headlines or snippets, framing, linking, or a text-and-data-mining opt-out; the Michigan Consumer Protection Act (MCL 445.903) was checked and contains no subsection naming automated content aggregation or a publisher payment scheme.
No Michigan bill proposing a journalism usage fee or a platform-to-publisher payment scheme, and no Michigan court decision addressing snippet reproduction, linking, framing, or hot-news misappropriation specifically, was located. Copyright over news content reproduced or aggregated by services operating in Michigan is governed by the federal Copyright Act and its fair-use doctrine, already addressed in the federal document for this topic.
As of .
Case law
No current case law for Michigan AI law
No current case law for Michigan privacy law
No current case law for Michigan scraping law
No current case law for Michigan cybersecurity law
No current case law for Michigan communications law
No current case law for Michigan content moderation law
No current case law for Michigan product and AI liability law
No current case law for Michigan digital accessibility law
No current case law for Michigan age gating law
No current case law for Michigan reuse law
Reporting clocks that run here20 instruments
The instruments whose obligation lines set a deadline for reporting an incident, a vulnerability or a personal-data breach, each deadline read from the sentence that carries it and listed shortest first. The law of Michigan comes first, then the law of the bodies above it that applies here.
Each flag is one law, and a link to it. Read down the scale: the clocks document's time axis, with the empty stretches shortened so the deadlines sit close. Flags on one line set the same duty at the same deadline, and the laws behind them are named to the right, with what each clock counts from.
The deadlines above on one time axis, shortest at the top. The axis keeps its order and, between neighbors, its proportion, but a stretch with no deadline on it is shortened, so the hour marks on the left are what say how far apart two stations really are. Beside each action, the laws that set it, what each counts from, and a status where the law is not yet in force. The List tab has the same data in full, with the sentences.
Notify the director as promptly as possible, and not later than 10 business days after you determine that a cybersecurity event involving nonpublic information in your possession has occurred, when Michigan is your state of domicile (insurer) or home state (insurance producer) and the event has a reasonable likelihood of materially harming a Michigan consumer or a material part of your normal operation (section 500.559(1)(a)).
Give the same notice within the same 10 business days when you reasonably believe the nonpublic information involved is of 250 or more Michigan consumers and the event is one you must report to a government body under other law or has a reasonable likelihood of materially harming a Michigan consumer or a material part of your normal operation (section 500.559(1)(b)).
If you are an assuming insurer, notify your affected ceding insurers and the director of your state of domicile within 10 business days after determining that a cybersecurity event has occurred (section 500.559(5)).
If you own or license data in a database, give notice of a security breach to each affected Michigan resident without unreasonable delay after you discover the breach or receive notice of one, unless you determine the breach has not or is not likely to cause substantial loss or injury to, or result in identity theft with respect to, 1 or more residents of this state (MCL 445.72(1), (4)).
Orally report the confirmation of a cybersecurity incident to a designated member of the commission staff and to the Michigan intelligence operations center as soon as reasonably practicable and before public notification (R 460.3205(2)).
Orally report the confirmation of a cybersecurity incident to a designated member of the commission staff and to the Michigan fusion center as soon as reasonably practicable and prior to any public notification (R 460.2324(2)).
The law of the United States, which applies in Michigan
Notify the NRC Headquarters Operations Center via the Emergency Notification System within one hour after discovery of a cyberattack that adversely impacted safety-related or important-to-safety functions, security functions, or emergency preparedness functions (including offsite communications), or that compromised support systems and equipment resulting in adverse impacts to those functions.
Also notify within one hour after discovery of a cyberattack that adversely impacted the safety, security, and emergency preparedness functions performed by digital assets described in 10 CFR 73.77(a)(1)(ii).
Notify the NRC Headquarters Operations Center within four hours after discovery of a cyberattack that could have caused such an adverse impact, after discovery of a suspected or actual cyberattack initiated by personnel with physical or electronic access to the systems in scope, or after notifying a local, State, or other Federal agency of an event related to your cyber security program that does not otherwise require notification.
Notify the NRC Headquarters Operations Center within eight hours after receipt or collection of information regarding observed behavior, activities, or statements that may indicate intelligence gathering or pre-operational planning related to a cyberattack against the systems in scope.
Use the site corrective action program to record vulnerabilities, weaknesses, failures and deficiencies in your cyber security program, and the notifications you make, within twenty-four hours of their discovery.
Once the final rule takes effect, report a covered cyber incident to the Agency not later than 72 hours after your organization reasonably believes that the covered cyber incident has occurred.
Once the final rule takes effect, report a ransom payment to the Agency not later than 24 hours after your organization makes the payment, even where the underlying ransomware attack is not itself a covered cyber incident.
Once the final rule takes effect, promptly submit an update to a previously submitted covered cyber incident report whenever substantial new or different information becomes available or a ransom payment is later made, continuing until your organization notifies the Agency that the incident has concluded and been fully mitigated and resolved, and preserve data relevant to the incident or payment under the procedures the final rule establishes.
Upon any responsible SCI personnel having a reasonable basis to conclude that an SCI event has occurred, begin appropriate corrective action and notify the Commission of the SCI event immediately.
Within 24 hours of that conclusion, submit a written notification to the Commission, made on a good faith, best efforts basis, that describes the SCI event and the systems affected and, to the extent available, your assessment of the market participants potentially affected, the potential impact on the market, and the steps you have taken, are taking or plan to take.
If the SCI event is resolved and the investigation closed within 30 calendar days, submit a final written notification within five business days after resolution. If not, submit an interim written notification within 30 calendar days after the event, and a final one within five business days after resolution and closure.
If your organization is a banking organization, notify your primary federal banking regulator, the OCC, the Federal Reserve Board, or the FDIC, whichever supervises it, about a notification incident, as soon as possible and no later than 36 hours after your organization determines that a notification incident has occurred.
A notification incident is the subset of computer-security incidents that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, your ability to serve customers, a business line, or an operation whose failure would threaten the financial stability of the United States, so a computer-security incident that falls short of that threshold does not by itself start this clock.
If your organization is a bank service provider, notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible after your organization determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to that banking organization for a period of four hours or more.
This duty carries a standard, as soon as possible, rather than a fixed number of hours to notify by, and that disruption threshold is what engages the duty rather than a period to notify within.
If you are a developer or provider of a frontier AI model, or an operator of critical infrastructure that uses an AI model to manage industrial control systems or other operational technologies, report any confirmed AI safety incident or AI security incident within 30 days of confirmation, and within 72 hours if the incident poses an imminent threat to national security, critical infrastructure or public safety.
If your organization is a federally insured credit union, notify the NCUA-designated point of contact of a reportable cyber incident by email, telephone, or another method the NCUA prescribes, so that the NCUA receives the notification as soon as possible and no later than 72 hours after your organization reasonably believes it has experienced a reportable cyber incident.
Where the reportable cyber incident is a disruption of business operations or unauthorized access to sensitive data facilitated through, or caused by, a compromise of a credit union service organization, cloud service provider, or other third-party data hosting provider, or by a supply chain compromise, the NCUA must receive the notification within 72 hours of your organization being notified by the third party if that is sooner.
Send the notice as soon as practicable, but not later than 30 days, after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred, delaying it only for the period the United States Attorney General specifies where the Attorney General determines that notice poses a substantial risk to national security or public safety (17 CFR 248.30(a)(4)(iii)).
Maintain written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring, of service providers, including that a service provider notify you as soon as possible, and no later than 72 hours, after becoming aware of a breach in security resulting in unauthorized access to a customer information system it maintains (17 CFR 248.30(a)(5)(i)).
Rapidly report a cyber incident to the Department of Defense within 72 hours of discovering it, at the Department's DIBNet portal (dibnet.dod.mil), using a DoD-approved medium assurance certificate that you must obtain before you need to file a report.
Make those policies and procedures reasonably designed to ensure that each service provider takes appropriate measures to protect against unauthorized access to or use of customer information, and to notify you as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred resulting in unauthorized access to a customer information system the service provider maintains.
If your organization is an Securities and Exchange Commission (SEC) reporting company, determine, without unreasonable delay after you discover a cybersecurity incident, whether the incident is material, and if it is, file a Form 8-K under Item 1.05 within four business days after you make that determination.
If the information called for in Item 1.05 is not determined or is unavailable when you file, state that in the filing and file an amendment to the Form 8-K within four business days after you determine it or it becomes available.
After you reasonably determine that a breach of your customers' CPNI has occurred, electronically notify the United States Secret Service and the Federal Bureau of Investigation through the central reporting facility as soon as practicable, and in no event later than seven business days (47 CFR 64.2011(b)).
Do not notify customers or disclose the breach where the relevant investigating agency directs you in writing not to, for an initial period of up to 30 days that the agency may extend (47 CFR 64.2011(b)(3)).
If you are a vendor of personal health records (an entity that offers or maintains an electronic record of health information that can draw information from multiple sources and is managed, shared and controlled by or primarily for the individual) or a PHR related entity, notify each affected individual who is a citizen or resident of the United States, in plain language and without unreasonable delay, no later than 60 calendar days after you discover a breach of security of unsecured PHR identifiable health information.
Notify prominent media outlets serving a State or jurisdiction, without unreasonable delay and in no case later than 60 calendar days after you discover the breach, when the unsecured PHR identifiable health information of 500 or more of its residents is, or is reasonably believed to have been, acquired during the breach.
If you are a third party service provider, notify the official designated in a written contract by the vendor of personal health records or PHR related entity you serve (or else a senior official of that vendor or entity), without unreasonable delay and in no case later than 60 calendar days after you discover the breach; identify each customer of that vendor or entity whose unsecured PHR identifiable health information has been, or is reasonably believed to have been, acquired during the breach; and obtain acknowledgment that the notice was received.
Notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured protected health information.
For a breach of unsecured protected health information involving more than 500 residents of a State or jurisdiction, notify prominent media outlets serving that State or jurisdiction without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.
If you are a business associate, notify the covered entity of a breach of unsecured protected health information without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.
If your organization is a derivatives clearing organization, notify staff of the Division of Clearing and Risk promptly of any hardware or software malfunction, security incident, or targeted threat that materially impairs, or creates a significant likelihood of material impairment of, automated system operation, reliability, security, or capacity, and of any activation of your business continuity and disaster recovery plan.
If your organization is a designated contract market, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and significant systems malfunctions and activations of your business continuity-disaster recovery plan.
If your organization is a swap execution facility, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and material system malfunctions and activations of your business continuity-disaster recovery plan.
Evidence of sabotage, subversive activity, or an actual or threatened cyber incident involving or endangering any vessel, harbor, port, or waterfront facility must be reported immediately to the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency (for any cyber incident), and the Captain of the Port, or to their respective representatives.
Which of these one incident starts turns on the facts: the incident method works that through. The clocks document draws every clock in the LexLint law library on one axis, with the sentence beside every rung.
AIDrafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
This page covers the instruments LexLint has researched
to a stage. Instruments named in the law library but not yet researched are
counted in the head and are not listed here. Every entry carries its own
primary source on its note page. This is a research index, not legal
advice.
