---
title: "Add a breach-register row from the incident facts"
url: "https://ailawframework.com/practice/financial-services-regulation/build-a-breach-register-row-from-the-incident-facts/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A28-A20260923-2-US"
practice_area: "Financial Services Regulation (AFSL/ASIC/credit)"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Add a breach-register row from the incident facts

> Record the date, what the file says happened, who in the file knows, and whether a notice has already been sent. Write no notice and no legal conclusion.

Canonical page: https://ailawframework.com/practice/financial-services-regulation/build-a-breach-register-row-from-the-incident-facts/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Financial Services Regulation (AFSL/ASIC/credit)](https://ailawframework.com/practice/financial-services-regulation.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | Record the date, what the file says happened, who in the file knows, and whether a notice has already been sent. Write no notice and no legal conclusion. |
| What the lawyer must review | Rule 206(4)-7 requires policies, an annual review, and a chief compliance officer. It does not, on the text opened, state a breach-notice deadline. Regulation S-P timing was not opened, so no notification period is stated. Model Rule 1.6 applies to the incident file. The lawyer decides whether a notice is required and writes it. |
| Written for | United States |
| Applies to | [Build a breach-register row from the incident facts](https://ailawframework.com/practice/financial-services-regulation/build-a-breach-register-row-from-the-incident-facts.md) |

## Checking plan

- What the AI does: Record the date, what the file says happened, who in the file knows, and whether a notice has already been sent. Write no notice and no legal conclusion.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- Do not invent a day count for notifying a regulator or a customer.
- The row is a record of facts, not an assessment that a breach is reportable.

## Sources

- [17 C.F.R. section 275.206(4)-7, Compliance procedures and practices](https://www.law.cornell.edu/cfr/text/17/275.206(4)-7) (checked 2026-10-22)
- [ABA Model Rule 1.6, Confidentiality of Information](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/) (checked 2026-10-22)
- [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-10-22)

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*