United States law applies in WisconsinWisconsin is a state of the United States, whose 134 researched instruments are listed on the United States page, not here. The law of Wisconsin, described on this page below, applies here too.
9 of 10 named instruments researched to a stage, across four of the ten areas of law we track: 8 in force and 1 not yet in force. As of .
When each starts6 of 9 carry a date, 3 do not. Earlier is before 2015.
in forcenot yet in forceblocked by a courtproposedno longer in force
AI law4 instruments, 3 in force, 1 not yet in force
Research summary (319 words)
Wisconsin has enacted four AI-specific instruments binding a private actor. 2023 Wisconsin Act 123 (effective ) requires a clear on-screen or spoken disclosure on political audio and video communications containing synthetic media substantially produced by generative artificial intelligence, enforced by a forfeiture of up to $1,000 per intentional violation.
2023 Wisconsin Act 224 (effective ) created Wis. Stat. § 948.125, a felony ban on possessing, receiving, distributing, producing, or accessing obscene material containing a depiction of a purported child engaging in sexually explicit conduct, reaching a wholly computer-generated or AI-generated image with no real child involved.
2025 Wisconsin Act 34 (effective ) added a "synthetic intimate representation" definition and a matching felony ban, inside Wisconsin's existing intimate-image statute, on posting, publishing, distributing, or exhibiting a realistic AI-generated or technologically-generated intimate depiction of an identifiable person with intent to coerce, harass, or intimidate them; the same act created a related, non-synthetic-specific reproduction offense in the same section.
2025 Wisconsin Act 69 (enacted , effective ) created Wis. Stat. § 452.136(1m), requiring a real estate licensee to disclose in all advertising when it has been altered or modified using technology, including artificial intelligence, to add, remove, or change elements of the property in a way that creates a false or misleading impression of the property.
Separately, the Wisconsin Office of the Commissioner of Insurance issued a bulletin on adopting the NAIC's AI principles and setting governance expectations for insurers' use of AI systems in underwriting, pricing, and claims decisions, grounded in Wisconsin's existing unfair-trade-practices and insurance-administration statutes rather than creating a new statutory duty of its own.
Wisconsin's general deceptive trade practices statute, Wis. Stat. § 100.18, was checked and is not AI-specific; it is not catalogued as a separate instrument here. No general-purpose AI-risk-management statute, and no election-deepfake disclosure statute beyond the political-advertising provision above, was located.
Whoever receives, distributes, produces, or possesses, or accesses in any way with the intent to view, obscene material that contains a depiction of a purported child engaging in sexually explicit conduct is guilty of a felony, if the person knows or reasonably should know that the material contains such a depiction.
"Depiction of a purported child" is defined as a visual representation that appears to depict an actual child but may or may not depict an actual child, and "obscene material" is defined to include a digital or computer-generated image or picture satisfying the standard Miller obscenity test (appeals to the prurient interest, is patently offensive under contemporary community standards, and lacks serious literary, artistic, political, educational, or scientific value).
Because the depiction need not show a real child, this reaches wholly computer-generated or AI-generated child sexual abuse material with no actual child involved. Created by 2023 Wisconsin Act 224 (2023 Senate Bill 314), enacted and published ; because the act does not itself prescribe an effective date, it took effect the day after its publication, , under the state's general rule for acts enacted without an emergency clause.
A "synthetic intimate representation" is defined as a representation generated using technological means that uses an identifiable person's face, likeness, or other distinguishing characteristic to depict an intimate representation of that person, regardless of whether the representation includes components that are artificial, legally generated, or generally accessible, and that is so realistic that a reasonable person would believe it depicts conduct of the identifiable person; the definition is technology-neutral and reaches an AI-generated or partly AI-generated sexual deepfake.
Posting, publishing, distributing, or exhibiting a synthetic intimate representation of an identifiable person with intent to coerce, harass, or intimidate that person is a Class I felony, except that it is a Class H felony if the depicted person had not attained the age of 18 at the time of the violation.
The same act separately created a reproduction offense at subsection (3m)(a)3, making it a Class A misdemeanor (Class I felony if the depicted person was a minor) to make a reproduction of a private representation knowing the depicted person did not consent to the reproduction; that provision is not limited to synthetic or AI-generated content on its own terms.
Created by 2025 Wisconsin Act 34 (2025 Senate Bill 33), enacted and published ; the act does not carry a distinct effective-date clause of its own, so it took effect the day after publication, , under the state's general rule for acts of the legislature enacted without an emergency clause.
Every audio communication containing express advocacy, issue advocacy, or support of or opposition to a referendum that contains synthetic media, meaning audio or video content substantially produced in whole or in part by generative artificial intelligence, must include the words "Contains content generated by AI" both at the beginning and at the end of the communication.
Every covered video communication must include, throughout the duration of each portion containing synthetic media, a readable, legible, and readily accessible on-screen disclosure reading "This video content generated by AI," "This audio content generated by AI," or "This content generated by AI," depending on which kind of synthetic media is present.
Compliance does not exempt a person from other civil or criminal liability, including under Wisconsin's separate false political-communication statute, and the provision expressly preserves the immunities of an interactive computer service provider under 47 U.S.C. 230. A broadcaster or other host or carrier of a covered communication is not liable for a violation unless it is itself the committee responsible for the communication.
Created by 2023 Wisconsin Act 123 (2023 Assembly Bill 664), enacted and published ; because the act does not itself prescribe an effective date, it took effect the day after its publication, , under the state's general rule for acts enacted without an emergency clause.
Wis. Stat. § 452.136(1m)official session law text, Wisconsin Legislature (docs.legis.wisconsin.gov)
Not yet in force.from ,in 2 months It starts to bind on .
Binds private bodies.
What this law does
A real estate licensee must disclose, in all advertising, whether the advertising has been altered or modified using technology, including artificial intelligence, to add, remove, or change elements of the property in a way that creates a false or misleading impression of the property. The duty was added to Wisconsin's real estate practice statutes by an act enacted on , and takes effect on .
Wisconsin has never enacted a comprehensive controller or processor personal-data statute.
Its only enacted personal-data statute of general application is its breach-notification statute, Wis. Stat. sec. 134.98, which folds both a DNA profile and unique biometric data, including a fingerprint, voiceprint, or retina or iris image, directly into its definition of personal information, on exactly the same footing as a Social Security number, with no exclusion anywhere in the section for an identifier derived from a photograph, video, or audio recording.
Wisconsin's breach statute creates no private right of action; unusually, that finding rests not on a foreclosure clause in the statute's own text but on the statute's own official annotation, which cites a decided federal case, Fox v. Iowa Health System, 399 F. Supp. 3d 780 (2019), directly on the codified page.
Wis. Stat. sec. 134.98official Wisconsin statute text, Wis. Stat. sec. 134.98, current through 2025 Wis. Act 247, Wisconsin State Legislature website
In force since .Binds public and private bodies.
What this law does
An entity whose principal place of business is in Wisconsin, or that maintains or licenses personal information in Wisconsin, that knows personal information in its possession has been acquired by an unauthorized person must make reasonable efforts to notify each affected individual within a reasonable time, not to exceed 45 days after learning of the acquisition.
Personal information includes an individual's name combined with, among other elements, a Social Security number, a DNA profile, or unique biometric data such as a fingerprint, voiceprint, or retina or iris image, each on the same footing as the others, with no exclusion anywhere in the section for an identifier derived from a photograph, video, or audio recording. If a single incident requires notifying 1,000 or more individuals, the entity must also notify consumer reporting agencies.
Gramm-Leach-Bliley Act (GLBA)-compliant and Health Insurance Portability and Accountability Act (HIPAA)-covered entities are exempt outright. The statute's own official annotation states directly that the section does not create a private right of action, citing Fox v. Iowa Health System, 399 F. Supp. 3d 780 (2019).
No separate civil-penalty or forfeiture amount specific to a section 134.98 violation appears within the section itself; Wis. Stat. sec. 134.99 addresses only accomplice or conspirator liability for a chapter violation carrying a forfeiture, without stating the amount or who may bring the action, and the underlying enforcement mechanism is not traced further here into Wisconsin's general consumer-protection authority under chs. 93 or 100. The Act that enacted the notice duty, 2005 Wisconsin Act 138, became effective on .
Wisconsin diverges from the federal baseline only in computer misuse, and modestly.
Its computer crimes statute, Wis. Stat. § 943.70, requires access to be willful, knowing, and without authorization, so ordinary automated retrieval of a public page that performs none of the statute's listed acts (modifying, destroying, accessing, taking possession of, or copying data or programs, or disclosing restricted access codes) does not fit its elements merely because the access is unauthenticated; no Wisconsin case has applied the statute to a scraping or automated-collection fact pattern specifically.
Wisconsin has no comprehensive consumer privacy statute reaching scraped personal data: the state's only privacy-topic instrument is a data breach notification statute already catalogued under the privacy topic, so personal data adds nothing here beyond the federal position.
Wisconsin's general deceptive trade practices statute, Wis. Stat. § 100.18, contains no provision reaching scraping, automated collection, or robots.txt. Terms-of-service enforceability, copyright and text-and-data-mining exceptions, database rights, unfair competition doctrine as applied to scraping, and robots.txt's legal weight are governed in Wisconsin exclusively by federal law and general common-law contract doctrine, and are not restated here.
Subsection (2) makes it a crime for any person, willfully, knowingly, and without authorization, to modify, destroy, access, take possession of, or copy data, computer programs, or supporting documentation, or to disclose restricted access codes or other restricted access information to unauthorized persons; a separate paragraph, (2)(am), criminalizes intentionally causing an interruption in service by submitting a message or messages that exceed a computer, program, system, or network's processing capacity.
Subsection (3) parallels this for the underlying computer, computer equipment, or supplies themselves.
"Access" is defined broadly in subsection (1)(ag) to mean to instruct, communicate with, interact with, intercept, store data in, retrieve data from, or otherwise use the resources of a computer, which reaches ordinary automated retrieval; but because a violation additionally requires acting willfully, knowingly, and without authorization, ordinary access to a public, unauthenticated page that performs none of the statute's listed acts does not fit its elements.
No Wisconsin case has applied this statute to a scraping or automated-collection fact pattern specifically.
The Wisconsin Supreme Court has construed subsection (2)(a)6's phrase "access codes or other restricted access information" narrowly: it refers to the codes, passwords, or other information that permits access to a system or to programs or data within it, not to the system, program, or data accessed, and the statute was not meant to criminalize disclosure of information obtained with authorization in the first instance (Burbank Grease Services, LLC v. Sokolowski, 2006 WI 103, 294 Wis. 2d 274, 717 N.W.2d 781).
A Wisconsin appellate decision has separately held that the statute is constitutional and that federal copyright law does not preempt a prosecution under it for destroying data entered into a computer program (State v. Corcoran, 186 Wis. 2d 616, 522 N.W.2d 226 (Ct. App. 1994)).
The section was created by 1981 Wisconsin Act 293 and has been amended several times since, most recently by 2015 Wisconsin Act 300, which amended the definition of "property" at subsection (1)(h) to include digital property as defined elsewhere in the statutes. No day on which 1981 Wisconsin Act 293 came into force has been located.
Wisconsin has two enacted private-sector security duties, and both bind only a narrowly named class of business rather than any business generally; each is filed as a row of its own, flagged for the classes the activity vocabulary reaches.
Wis. Stat. sec. 134.97, Disposal of records containing personal information, originally enacted by 1999 Wisconsin Act 9, provides that a 'financial institution, medical business or tax preparation business may not dispose of a record containing personal information' unless it shreds the record, erases the personal information, modifies the record to make the information unreadable, or takes actions it reasonably believes will ensure no unauthorized person will have access to the information before the record's destruction.
'Financial institution' is defined narrowly as 'any bank, savings bank, savings and loan association or credit union that is authorized to do business under state or federal laws relating to financial institutions, any issuer of a credit card or any investment company,' and 'tax preparation business' as any for-profit organization that 'for a fee prepares an individual's federal, state or local tax returns or counsels an individual regarding' those returns; both are true sector definitions that a generic software developer does not meet merely by declaring an activity.
'Medical business' is defined more broadly, as 'any organization or enterprise operated for profit or not for profit ... that possesses information, other than personnel records, relating to a person's physical or mental health, medical history or medical treatment,' which sweeps in an organization by what data it holds rather than by trade name, and the health-records flag reaches it.
'Personal information' under the section is itself narrow: a medical condition, a financial account or transaction detail tied to a financial institution relationship, data given to open such an account or apply for a loan or credit, or a tax return, rather than the broad name-plus-identifier combination that triggers Arizona's, Hawaii's, or Alaska's disposal duties, each of which binds any 'entity' or 'business' regardless of sector and is filed as an instrument in this corpus.
The disposal duty's row is flagged for financial services and health records; no declared activity denotes a fee-based tax preparer, so that class is named here only.
For completeness: a violating financial institution, medical business, or tax preparation business may be required to forfeit not more than $1,000 per incident and is separately liable in damages to the person whose information was disposed of in violation of the section, and any person who later possesses a wrongfully disposed record and intends to use the personal information in it may be fined not more than $1,000 or imprisoned not more than 90 days, an offense committed by the person who acquires the discarded record rather than a duty on the disposing entity.
Wisconsin's second enacted security statute is the Insurance Data Security Law, 2021 Wisconsin Act 73 (Senate Bill 160), date of enactment , date of publication , effective under Wis. Stat. sec. 991.11, codified as subchapter IX of chapter 601, Wis. Stat. secs. 601.95 to 601.956, adopting the substance of the NAIC Insurance Data Security Model Law.
It requires a 'licensee,' defined at sec. 601.95(7) as 'a person licensed, authorized, or registered, or a person required to be licensed, authorized, or registered, under chs.
600 to 655' (Wisconsin's insurance code), other than an out-of-state purchasing or risk-retention group or an out-of-state-domiciled assuming insurer, to develop, implement, and maintain a comprehensive written information security program no later than , based on a risk assessment identifying threats to nonpublic information and covering the licensee's own operations and its third-party service providers, with board-of-directors oversight and an annual certification of compliance to the commissioner beginning in 2023.
Sec. 601.954(1) requires a licensee to notify the commissioner of a cybersecurity event in electronic form within three business days of determining it occurred, where the licensee is Wisconsin-domiciled and the event has a reasonable likelihood of materially harming a consumer or the licensee's normal operations, or where at least 250 consumers are reasonably believed affected and either a governmental-notice trigger or that same material-harm likelihood is present.
A licensee with fewer than $10,000,000 in year-end total assets, less than $5,000,000 in gross annual revenue, or fewer than 50 employees (including qualifying independent contractors) is exempt from the information security program duty under sec. 601.952(9); sec. 601.951(4) states the subchapter 'may not be construed to create or imply a private cause of action for violation of its provisions'; and sec. 601.956 gives the commissioner examination and investigation power to enforce the subchapter.
Its program and notice duties are filed as rows of their own, flagged for an insurer: a developer whose app is not itself an insurance licensee falls outside this law's scope regardless of which activities it declares.
No enacted Wisconsin statute was located, after an affirmative search for connected-device, Internet of Things, manufacturer, and vulnerability-disclosure terms, that sets security requirements a software product or connected device must meet before or after it reaches the market, comparable to California's or Oregon's connected-device statutes or the Cyber Resilience Act; this is a researched absence rather than a gap in coverage.
No general Wisconsin statute requires a private-sector business to report a vulnerability or a security incident to a state authority outside the insurance-sector regime described above, and no state-agency cybersecurity framework extending to a private vendor generally was located. Wisconsin's breach-notification statute, Wis. Stat. sec. 134.98, Notice of unauthorized acquisition of personal information, is already this jurisdiction's privacy-topic row and is not repeated here.
Wisconsin's computer crimes statute, Wis. Stat. sec. 943.70, penalizes a person who accesses a computer system without authorization, an offense committed by an intruder rather than a duty on the system's operator or manufacturer, so it sits with the scraping topic's computer-misuse family rather than here. Wisconsin's Insurance Data Security Law requires a licensee to develop, implement, and maintain a comprehensive written information security program.
The same subchapter requires a licensee to notify the commissioner of a cybersecurity event as promptly as possible and no later than 3 business days from the determination that it occurred. A financial institution, medical business or tax preparation business may not dispose of a record containing personal information except by one of four listed methods.
A financial institution, medical business or tax preparation business may not dispose of a record containing personal information unless it shreds the record, erases the personal information, modifies the record to make the personal information unreadable, or takes actions it reasonably believes will ensure that no unauthorized person has access to the personal information between disposal and destruction.
A financial institution is any bank, savings bank, savings and loan association or credit union that is authorized to do business under state or federal laws relating to financial institutions, any issuer of a credit card or any investment company. A medical business is any organization or enterprise, for profit or not, that possesses information, other than personnel records, relating to a person's physical or mental health, medical history or medical treatment.
A tax preparation business is any for-profit organization that for a fee prepares an individual's federal, state or local tax returns or counsels an individual regarding those returns.
Personal information means personally identifiable data about an individual's medical condition that are not generally considered public knowledge, an individual's account or customer number, account balance, balance owing, credit balance or credit limit relating to an account or transaction with a financial institution, personally identifiable data provided to a financial institution on opening an account or applying for a loan or credit, or personally identifiable data about an individual's tax returns.
A sale of a record, or the transfer of a record for value, is not disposal. A violator may be required to forfeit not more than $1,000, and acts arising out of the same incident or occurrence are a single violation. A financial institution, medical business or tax preparation business is liable to a person whose personal information is disposed of in violation of the section for the amount of damages resulting from the violation.
The section's history note names the acts that created and renumbered it, and no source that states the day on which the section came into force has been located.
A licensee must develop, implement, and maintain a comprehensive written information security program based on its risk assessment, no later than . A licensee is a person licensed, authorized, or registered, or required to be, under chapters 600 to 655 of the Wisconsin Statutes, other than a purchasing or risk retention group chartered and licensed in another state or an assuming insurer domiciled in another state or jurisdiction.
The program must implement, as appropriate, protection by encryption or other means of nonpublic information transmitted over an external network and nonpublic information stored on a portable computer or storage device or media. A licensee must develop a written incident response plan to promptly respond to, and recover from, a cybersecurity event. A licensee must exercise due diligence when selecting any third-party service provider, no later than .
If a licensee has a board of directors, the board or an appropriate committee of the board has oversight duties for the program. A licensee domiciled in Wisconsin must annually submit, no later than March 1, a written certification to the commissioner that it is in compliance with the section. The section does not apply to a licensee that has less than $10,000,000 in year-end total assets, less than $5,000,000 in gross annual revenue, or fewer than 50 employees.
The subchapter, except for the notice to the commissioner, does not apply to a licensee that is governed by the federal health privacy and security rules and maintains nonpublic information in the same manner as protected health information. The commissioner may examine and investigate the affairs of any licensee and take action that is necessary or appropriate to enforce the subchapter. The subchapter may not be construed to create or imply a private cause of action for violation of its provisions.
A licensee domiciled in Wisconsin must notify the commissioner that a cybersecurity event involving nonpublic information has occurred if the event has a reasonable likelihood of materially harming a consumer or a material part of the normal operations of the licensee.
Any licensee must also notify the commissioner of a cybersecurity event that it reasonably believes involves the nonpublic information of at least 250 consumers and either requires notice to a government body, self-regulatory agency, or other supervisory entity or has a reasonable likelihood of materially harming a consumer or a material part of its normal operations.
The licensee must give the notice in electronic form and as promptly as possible, but no later than 3 business days from the determination that the cybersecurity event occurred. The notice must give as much as possible of ten listed items of information, from the date and source of the event to the name of a contact person who is familiar with the event and authorized to act for the licensee.
The licensee must update and supplement the information to address material changes as additional information becomes available. A licensee that learns a cybersecurity event has or may have occurred must conduct a prompt investigation. A licensee must maintain records concerning a cybersecurity event for at least 5 years from the date of the event and produce them upon demand of the commissioner.
A licensee that knows an event has or may have occurred in a system maintained by a third-party service provider must comply with the investigation duty or make reasonable efforts to confirm and document that the provider did so or failed to cooperate. The subchapter, except for the notice to the commissioner, does not apply to a licensee that is governed by the federal health privacy and security rules and maintains nonpublic information in the same manner as protected health information.
These areas of law were researched here and no instrument was recorded. Each finding says what the research checked, as of the date under it. It describes our search, not a guarantee that no such law exists.
Age gating law
Wisconsin has not enacted an age-gating statute in any of the four families as of this date, despite significant 2025-2026 legislative activity. An adult content age verification bill (AB 105) passed both the Assembly and Senate but was vetoed by Governor Evers on , and a veto override failed on .
A social media age verification and parental consent bill (AB 963, SB 936) passed the Assembly but failed in the Senate in March 2026, and a companion app store accountability bill (AB 962, SB 937) passed the Assembly but did not complete Senate passage before the session adjourned. A legislator introduced a draft age appropriate design code (LRB-5458) in January 2026.
As of .
Reuse law
Wisconsin has no press-publisher neighbouring right, no mandatory platform-to-publisher bargaining code, and no reported Wisconsin appellate decision recognizing a distinct hot-news misappropriation doctrine or addressing the framing or linking of news content. No Wisconsin bill comparable to California's since-failed Journalism Preservation Act or the federal Journalism Competition and Preservation Act proposals was identified.
Wisconsin's general deceptive trade practices statute, Wis. Stat. § 100.18, names no provision reaching reproduction, aggregation, or framing of journalism; Wisconsin's computer crimes statute, Wis. Stat. § 943.70 (catalogued under the scraping topic), likewise contains nothing specific to news content.
Snippet and headline reproduction, text-and-data-mining, database rights, and the liability of hyperlinking or framing are governed in Wisconsin exclusively by federal copyright law and are not restated here.
As of .
Case law
No current case law for Wisconsin AI law
No current case law for Wisconsin privacy law
No current case law for Wisconsin scraping law
No current case law for Wisconsin cybersecurity law
No current case law for Wisconsin communications law
No current case law for Wisconsin content moderation law
No current case law for Wisconsin product and AI liability law
No current case law for Wisconsin digital accessibility law
No current case law for Wisconsin age gating law
No current case law for Wisconsin reuse law
Reporting clocks that run here18 instruments
The instruments whose obligation lines set a deadline for reporting an incident, a vulnerability or a personal-data breach, each deadline read from the sentence that carries it and listed shortest first. The law of Wisconsin comes first, then the law of the bodies above it that applies here.
Each flag is one law, and a link to it. Read down the scale: the clocks document's time axis, with the empty stretches shortened so the deadlines sit close. Flags on one line set the same duty at the same deadline, and the laws behind them are named to the right, with what each clock counts from.
The deadlines above on one time axis, shortest at the top. The axis keeps its order and, between neighbors, its proportion, but a stretch with no deadline on it is shortened, so the hour marks on the left are what say how far apart two stations really are. Beside each action, the laws that set it, what each counts from, and a status where the law is not yet in force. The List tab has the same data in full, with the sentences.
Notify the commissioner of Insurance in electronic form, as promptly as possible and no later than 3 business days after you determine that a cybersecurity event involving nonpublic information has occurred, if you are domiciled in Wisconsin and the event has a reasonable likelihood of materially harming a consumer or a material part of your normal operations.
Give the same notice within the same 3 business days if you reasonably believe the event involves the nonpublic information of at least 250 consumers and either requires notice to a government body, self-regulatory agency, or other supervisory entity under state or federal law or has a reasonable likelihood of materially harming a consumer or a material part of your normal operations.
If your principal place of business is in Wisconsin, or you maintain or license personal information in Wisconsin, make reasonable efforts to notify each subject of personal information that you know a person you have not authorized has acquired, within a reasonable time, not to exceed 45 days after you learn of the acquisition; if your principal place of business is elsewhere, make reasonable efforts to notify each Wisconsin resident who is a subject.
The law of the United States, which applies in Wisconsin
Notify the NRC Headquarters Operations Center via the Emergency Notification System within one hour after discovery of a cyberattack that adversely impacted safety-related or important-to-safety functions, security functions, or emergency preparedness functions (including offsite communications), or that compromised support systems and equipment resulting in adverse impacts to those functions.
Also notify within one hour after discovery of a cyberattack that adversely impacted the safety, security, and emergency preparedness functions performed by digital assets described in 10 CFR 73.77(a)(1)(ii).
Notify the NRC Headquarters Operations Center within four hours after discovery of a cyberattack that could have caused such an adverse impact, after discovery of a suspected or actual cyberattack initiated by personnel with physical or electronic access to the systems in scope, or after notifying a local, State, or other Federal agency of an event related to your cyber security program that does not otherwise require notification.
Notify the NRC Headquarters Operations Center within eight hours after receipt or collection of information regarding observed behavior, activities, or statements that may indicate intelligence gathering or pre-operational planning related to a cyberattack against the systems in scope.
Use the site corrective action program to record vulnerabilities, weaknesses, failures and deficiencies in your cyber security program, and the notifications you make, within twenty-four hours of their discovery.
Once the final rule takes effect, report a covered cyber incident to the Agency not later than 72 hours after your organization reasonably believes that the covered cyber incident has occurred.
Once the final rule takes effect, report a ransom payment to the Agency not later than 24 hours after your organization makes the payment, even where the underlying ransomware attack is not itself a covered cyber incident.
Once the final rule takes effect, promptly submit an update to a previously submitted covered cyber incident report whenever substantial new or different information becomes available or a ransom payment is later made, continuing until your organization notifies the Agency that the incident has concluded and been fully mitigated and resolved, and preserve data relevant to the incident or payment under the procedures the final rule establishes.
Upon any responsible SCI personnel having a reasonable basis to conclude that an SCI event has occurred, begin appropriate corrective action and notify the Commission of the SCI event immediately.
Within 24 hours of that conclusion, submit a written notification to the Commission, made on a good faith, best efforts basis, that describes the SCI event and the systems affected and, to the extent available, your assessment of the market participants potentially affected, the potential impact on the market, and the steps you have taken, are taking or plan to take.
If the SCI event is resolved and the investigation closed within 30 calendar days, submit a final written notification within five business days after resolution. If not, submit an interim written notification within 30 calendar days after the event, and a final one within five business days after resolution and closure.
If your organization is a banking organization, notify your primary federal banking regulator, the OCC, the Federal Reserve Board, or the FDIC, whichever supervises it, about a notification incident, as soon as possible and no later than 36 hours after your organization determines that a notification incident has occurred.
A notification incident is the subset of computer-security incidents that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, your ability to serve customers, a business line, or an operation whose failure would threaten the financial stability of the United States, so a computer-security incident that falls short of that threshold does not by itself start this clock.
If your organization is a bank service provider, notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible after your organization determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to that banking organization for a period of four hours or more.
This duty carries a standard, as soon as possible, rather than a fixed number of hours to notify by, and that disruption threshold is what engages the duty rather than a period to notify within.
If you are a developer or provider of a frontier AI model, or an operator of critical infrastructure that uses an AI model to manage industrial control systems or other operational technologies, report any confirmed AI safety incident or AI security incident within 30 days of confirmation, and within 72 hours if the incident poses an imminent threat to national security, critical infrastructure or public safety.
If your organization is a federally insured credit union, notify the NCUA-designated point of contact of a reportable cyber incident by email, telephone, or another method the NCUA prescribes, so that the NCUA receives the notification as soon as possible and no later than 72 hours after your organization reasonably believes it has experienced a reportable cyber incident.
Where the reportable cyber incident is a disruption of business operations or unauthorized access to sensitive data facilitated through, or caused by, a compromise of a credit union service organization, cloud service provider, or other third-party data hosting provider, or by a supply chain compromise, the NCUA must receive the notification within 72 hours of your organization being notified by the third party if that is sooner.
Send the notice as soon as practicable, but not later than 30 days, after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred, delaying it only for the period the United States Attorney General specifies where the Attorney General determines that notice poses a substantial risk to national security or public safety (17 CFR 248.30(a)(4)(iii)).
Maintain written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring, of service providers, including that a service provider notify you as soon as possible, and no later than 72 hours, after becoming aware of a breach in security resulting in unauthorized access to a customer information system it maintains (17 CFR 248.30(a)(5)(i)).
Rapidly report a cyber incident to the Department of Defense within 72 hours of discovering it, at the Department's DIBNet portal (dibnet.dod.mil), using a DoD-approved medium assurance certificate that you must obtain before you need to file a report.
Make those policies and procedures reasonably designed to ensure that each service provider takes appropriate measures to protect against unauthorized access to or use of customer information, and to notify you as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred resulting in unauthorized access to a customer information system the service provider maintains.
If your organization is an Securities and Exchange Commission (SEC) reporting company, determine, without unreasonable delay after you discover a cybersecurity incident, whether the incident is material, and if it is, file a Form 8-K under Item 1.05 within four business days after you make that determination.
If the information called for in Item 1.05 is not determined or is unavailable when you file, state that in the filing and file an amendment to the Form 8-K within four business days after you determine it or it becomes available.
After you reasonably determine that a breach of your customers' CPNI has occurred, electronically notify the United States Secret Service and the Federal Bureau of Investigation through the central reporting facility as soon as practicable, and in no event later than seven business days (47 CFR 64.2011(b)).
Do not notify customers or disclose the breach where the relevant investigating agency directs you in writing not to, for an initial period of up to 30 days that the agency may extend (47 CFR 64.2011(b)(3)).
If you are a vendor of personal health records (an entity that offers or maintains an electronic record of health information that can draw information from multiple sources and is managed, shared and controlled by or primarily for the individual) or a PHR related entity, notify each affected individual who is a citizen or resident of the United States, in plain language and without unreasonable delay, no later than 60 calendar days after you discover a breach of security of unsecured PHR identifiable health information.
Notify prominent media outlets serving a State or jurisdiction, without unreasonable delay and in no case later than 60 calendar days after you discover the breach, when the unsecured PHR identifiable health information of 500 or more of its residents is, or is reasonably believed to have been, acquired during the breach.
If you are a third party service provider, notify the official designated in a written contract by the vendor of personal health records or PHR related entity you serve (or else a senior official of that vendor or entity), without unreasonable delay and in no case later than 60 calendar days after you discover the breach; identify each customer of that vendor or entity whose unsecured PHR identifiable health information has been, or is reasonably believed to have been, acquired during the breach; and obtain acknowledgment that the notice was received.
Notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured protected health information.
For a breach of unsecured protected health information involving more than 500 residents of a State or jurisdiction, notify prominent media outlets serving that State or jurisdiction without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.
If you are a business associate, notify the covered entity of a breach of unsecured protected health information without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.
If your organization is a derivatives clearing organization, notify staff of the Division of Clearing and Risk promptly of any hardware or software malfunction, security incident, or targeted threat that materially impairs, or creates a significant likelihood of material impairment of, automated system operation, reliability, security, or capacity, and of any activation of your business continuity and disaster recovery plan.
If your organization is a designated contract market, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and significant systems malfunctions and activations of your business continuity-disaster recovery plan.
If your organization is a swap execution facility, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and material system malfunctions and activations of your business continuity-disaster recovery plan.
Evidence of sabotage, subversive activity, or an actual or threatened cyber incident involving or endangering any vessel, harbor, port, or waterfront facility must be reported immediately to the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency (for any cyber incident), and the Captain of the Port, or to their respective representatives.
Which of these one incident starts turns on the facts: the incident method works that through. The clocks document draws every clock in the LexLint law library on one axis, with the sentence beside every rung.
AIDrafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
This page covers the instruments LexLint has researched
to a stage. Instruments named in the law library but not yet researched are
counted in the head and are not listed here. Every entry carries its own
primary source on its note page. This is a research index, not legal
advice.
