---
title: "Assemble facts for a ransom-payment report without filing it"
url: "https://ailawframework.com/practice/in-house-general-counsel/prepare-the-ransomware-payment-report-within-72-hours/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A40-D20261018-3-US"
practice_area: "In-House / General Counsel"
tier: "red"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Assemble facts for a ransom-payment report without filing it

> From the facts the lawyer enters, list the date the payment was made, the amount, and the demand as the lawyer states them. Do not write the report, do not send it, and do not decide that the entity is a covered entity.

Canonical page: https://ailawframework.com/practice/in-house-general-counsel/prepare-the-ransomware-payment-report-within-72-hours/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [In-House / General Counsel](https://ailawframework.com/practice/in-house-general-counsel.md) |
| Human involvement | Red: Lawyer writes; AI may check, clarify or collect data |
| How AI is used | From the facts the lawyer enters, list the date the payment was made, the amount, and the demand as the lawyer states them. Do not write the report, do not send it, and do not decide that the entity is a covered entity. |
| What the lawyer must review | 6 U.S.C. 681b(a)(2)(A) provides that a covered entity that makes a ransom payment as the result of a ransomware attack against the covered entity shall report the payment to the Agency not later than 24 hours after the ransom payment has been made. Paragraph (a)(1)(A) is a different report: a covered entity that experiences a covered cyber incident shall report that incident not later than 72 hours after the covered entity reasonably believes the incident has occurred. The definitions of covered entity, covered cyber incident, and ransom payment were not opened. CISA's CIRCIA page, checked on 22 October 2026, states that covered cyber incident and ransomware payment reporting under CIRCIA will not be required until the CIRCIA final rule goes into effect, and that CISA continues to work on the final rule. The lawyer decides whether any report is made. The tool writes and sends nothing. |
| Written for | United States |
| Applies to | [Prepare the ransomware payment report within 72 hours](https://ailawframework.com/practice/in-house-general-counsel/prepare-the-ransomware-payment-report-within-72-hours.md) |

## Checking plan

- What the AI does: From the facts the lawyer enters, list the date the payment was made, the amount, and the demand as the lawyer states them. Do not write the report, do not send it, and do not decide that the entity is a covered entity.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- The ransom-payment clock in section 681b(a)(2) is 24 hours after the payment. The 72-hour clock is the covered-cyber-incident report.
- CISA states that neither report is required until the final rule is in effect. The tool does not treat the statute as a present filing duty.

## Sources

- [6 U.S.C. 681b, Required reporting of certain cyber incidents](https://www.law.cornell.edu/uscode/text/6/681b) (checked 2026-10-22)
- [CISA, Cyber Incident Reporting for Critical Infrastructure Act of 2022](https://www.cisa.gov/topics/cyber-threats-and-advisories/information-sharing/cyber-incident-reporting-critical-infrastructure-act-2022-circia) (checked 2026-10-22)

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*