---
title: "Prepare the ransomware payment report within 72 hours"
url: "https://ailawframework.com/practice/in-house-general-counsel/prepare-the-ransomware-payment-report-within-72-hours"
type: "task"
site: "AI Law Framework"
id: "A40-D20261018-3"
practice_area: "In-House / General Counsel"
tier: "yellow"
lawyer_review: "required"
last_reviewed: "2026-10-22"
---

# Prepare the ransomware payment report within 72 hours

> From the incident timeline, the payment record and the extortion communications, populate the reporting form fields: the reporting entity, when the payment was made or became known, the amount and method, the…

Canonical page: https://ailawframework.com/practice/in-house-general-counsel/prepare-the-ransomware-payment-report-within-72-hours  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [In-House / General Counsel](https://ailawframework.com/practice/in-house-general-counsel.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | From the incident timeline, the payment record and the extortion communications, populate the reporting form fields: the reporting entity, when the payment was made or became known, the amount and method, the attacker’s demand and communications, and the incident details known so far, with each field cited to its source record. |
| What the lawyer must review | The lawyer decides whether the business is a reporting business entity, whether the payment was made by or on behalf of it, when the 72 hours started, and whether paying raised a sanctions or other legal risk that changes what is reported or to whom, then checks every field before submission. |
| Written for / versions | 1 jurisdiction versions below |

## Checking plan

**Source-by-source verification**

Trace relied-on content to independent sources and check for relevant material the output has missed.

- What the AI does: From the incident timeline, the payment record and the extortion communications, populate the reporting form fields: the reporting entity, when the payment was made or became known, the amount and method, the attacker’s demand and communications, and the incident details known so far, with each field cited to its source record.
- What the lawyer does: The lawyer decides whether the business is a reporting business entity, whether the payment was made by or on behalf of it, when the 72 hours started, and whether paying raised a sanctions or other legal risk that changes what is reported or to whom, then checks every field before submission.
- Who reviews: Responsible lawyer with competence in the matter
- Basis: Practical workflow informed by the linked primary sources; the traffic light and working checks are editorial guidance, not a court classification.
- Why: The level reflects what the work is, the consequence of an error, and how much of the output the lawyer must independently re-derive.

## Checks the lawyer makes

1. Confirm the previous financial year’s turnover meets the $3 million threshold, or that another basis for reporting applies.
2. Fix the start of the 72 hours from the payment or the time the entity became aware of it, and record which.
3. Check the payment details against the bank or wallet record, not the incident summary.
4. Screen the recipient of the payment against the Consolidated List and record the result.

## Notes

- These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.

## Sources

- [Cyber.gov.au — Ransomware payment and cyber extortion payment reporting](https://www.cyber.gov.au/ransomware-payment-and-cyber-extortion-payment-reporting) (checked 2026-10-18)

## Jurisdiction versions

| Jurisdiction | Level |
| --- | --- |
| [United States](https://ailawframework.com/practice/in-house-general-counsel/prepare-the-ransomware-payment-report-within-72-hours/united-states.md) | Red |

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*