Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

SEC Cyber Disclosure Rules

In force United States (Federal) · In force Sep 5, 2023 · no upcoming deadlines

Official text
Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics

Deadlines

ComplianceDec 18, 2024 · 22 months ago · Source
Inline XBRL tagging of Item 1.05 disclosuresForm 8-K Item 1.05 and Form 6-K incident disclosures must be tagged in Inline XBRL.
ComplianceDec 15, 2024 · 22 months ago · Source
Inline XBRL tagging of annual cybersecurity disclosuresItem 106 / Item 16K disclosures must be tagged in Inline XBRL for fiscal years ending on or after this date.
ComplianceJun 15, 2024 · 2.4 years ago · Source
Smaller reporting companies: Item 1.05 complianceSmaller reporting companies must begin complying with Form 8-K Item 1.05 incident disclosure.
ComplianceDec 18, 2023 · 2.9 years ago · Source
Form 8-K Item 1.05 incident disclosure beginsAll registrants other than smaller reporting companies must file material incident disclosures from this date.
ComplianceDec 15, 2023 · 2.9 years ago · Source
Annual cybersecurity disclosures begin (Item 106 / 16K)Required in annual reports for fiscal years ending on or after this date.

Summaries for reference, not legal advice. Check the official text.

What it does

Public companies must disclose a material cybersecurity incident on Form 8-K Item 1.05 within four business days of determining it is material (foreign private issuers use Form 6-K), and describe cybersecurity risk management, strategy and governance annually in Form 10-K (Item 106) or Form 20-F (Item 16K).

Who it applies to
SEC registrants filing Exchange Act reports, including smaller reporting companies and foreign private issuers. Disclosure delay is available only if the U.S. Attorney General determines immediate disclosure poses a substantial risk to national security or public safety.
Penalties
No fixed fine schedule; violations enforced under the federal securities laws (civil penalties, disgorgement, injunctions, officer and director bars).
Enforced by
U.S. Securities and Exchange Commission
Official name
SEC Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure (Release No. 33-11216)
Citation
Release No. 33-11216; 88 FR 51896 (Aug. 4, 2023); Form 8-K Item 1.05; Regulation S-K Item 106
Topics
Cybersecurity, Breach notification, Financial
Verified 2026-09-22 sec.gov sec.gov federalregister.gov
Research notes

Industry petitions (e.g. April 2026 comment letters) ask the SEC to rescind Item 1.05; no proposed rescission had appeared in the Federal Register as of 2026-09-22. In June 2025 the SEC withdrew its separate 2022/2023 cybersecurity risk management proposals for investment advisers/funds and for broker-dealers and other market entities.

Related

In forceUnited States
AI state-law preemption EODirects federal agencies to push back on state AI laws seen as onerous. It orders a DOJ AI Litigation Task Force, a Commerce list of conflicting state laws, BEAD and grant funding conditions, an FCC disclosure-standard proceeding and an FTC policy statement on AI outputs. It does not itself preempt any state law; that needs Congress or court rulings.In effect since Dec 11, 2025
EnactedUnited States
CFPB Open Banking Rule (Section 1033)Requires banks, card issuers and other data providers to give consumers and authorized third parties their transaction and account data through a secure developer interface, free of charge. Third parties must limit collection, use and retention to what the consumer requested. The CFPB is reconsidering the rule and a federal court has barred its enforcement until that reconsideration ends.Next: Apr 1, 2027 Tier 2 compliance date (original) · in 5 months
EnactedUnited States (Federal)
CIRCIADirects CISA to require covered critical infrastructure entities to report covered cyber incidents within 72 hours of reasonably believing one occurred and ransom payments within 24 hours of payment, and to preserve related data. Reporting obligations begin only once CISA's final rule takes effect.No date set
In forceUnited States (Federal)
CMMC 2.0Requires defense contractors and subcontractors that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) to meet a specified CMMC level (Level 1 self-assessment, Level 2 self- or third-party (C3PAO) assessment against NIST SP 800-171, Level 3 DIBCAC assessment against selected NIST SP 800-172 controls) as a condition of contract award. Requirements are phased into DoD solicitations over four years.Next: Nov 10 Phase 2: Level 2 C3PAO certification · in 14 days
AmendedUnited States (Federal)
COPPA RuleRequires operators of child-directed online services, or those with actual knowledge they collect personal information from children under 13, to give notice and obtain verifiable parental consent before collecting, using or disclosing that data. The 2025 amendments add separate parental consent for disclosures to third parties (including for targeted advertising), require a written data retention policy and a written information security program, expand 'personal information' to include biometric identifiers and government-issued identifiers, and tighten Safe Harbor program oversight.In effect since Apr 21, 2000
In forceUnited States (Federal)
DOJ Bulk Data RuleProhibits U.S. persons from data brokerage and genomic-data transactions with countries of concern or covered persons, and restricts vendor, employment and investment agreements involving bulk U.S. sensitive personal data or government-related data unless CISA security requirements are met. Restricted transactions require a data compliance program, due diligence, audits, recordkeeping and reporting.In effect since Apr 8, 2025
AmendedUnited States (Federal)
FCC CPNI Breach RuleThe 2023 order expands carrier breach rules from CPNI to all customer personally identifiable information, covers inadvertent disclosures, requires notice to the FCC (in addition to the Secret Service and FBI) within seven business days, and adopts a harm-based trigger for customer notice. Until the revised 64.2011 takes effect, the existing CPNI breach rule (law enforcement notice within 7 business days, customer notice after a waiting period) continues to apply.In effect since Mar 13, 2024
AmendedUnited States (Federal)
FTC Health Breach Notification RuleRequires vendors of personal health records (including health and wellness apps) and PHR related entities not covered by HIPAA to notify affected individuals, the FTC and, for 500+ residents of a state, prominent media, after a breach of unsecured PHR identifiable health information. The 2024 amendments confirm that unauthorized disclosures (not just hacks) are breaches, clarify coverage of health apps drawing data from multiple sources, allow email notice, and expand notice content.In effect since Sep 24, 2009
Questions about SEC Cyber Disclosure Rules
What are the SEC Cyber Disclosure Rules compliance deadlines?
Dec 15, 2023: Annual cybersecurity disclosures begin (Item 106 / 16K). Dec 18, 2023: Form 8-K Item 1.05 incident disclosure begins. Jun 15, 2024: Smaller reporting companies: Item 1.05 compliance. Dec 15, 2024: Inline XBRL tagging of annual cybersecurity disclosures. Dec 18, 2024: Inline XBRL tagging of Item 1.05 disclosures.
When does SEC Cyber Disclosure Rules take effect?
SEC Cyber Disclosure Rules took effect on Sep 5, 2023.
Who does SEC Cyber Disclosure Rules apply to?
SEC registrants filing Exchange Act reports, including smaller reporting companies and foreign private issuers. Disclosure delay is available only if the U.S. Attorney General determines immediate disclosure poses a substantial risk to national security or public safety.
What are the penalties under SEC Cyber Disclosure Rules?
No fixed fine schedule; violations enforced under the federal securities laws (civil penalties, disgorgement, injunctions, officer and director bars).