---
title: "Place AI-tool facts under the breach elements and write no notice"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/draft-a-notifiable-data-breach-assessment-involving-ai-tools/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A25-B8-3-US"
practice_area: "Privacy, Data Protection & Cyber"
tier: "red"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Place AI-tool facts under the breach elements and write no notice

> Place each fact the log already states about prompts, outputs, or logs under acquisition, encryption or key, personal information, and discovery date. Write no conclusion and no notice.

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/draft-a-notifiable-data-breach-assessment-involving-ai-tools/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Red: Lawyer writes; AI may check, clarify or collect data |
| How AI is used | Place each fact the log already states about prompts, outputs, or logs under acquisition, encryption or key, personal information, and discovery date. Write no conclusion and no notice. |
| What the lawyer must review | Section 1798.82(a) requires disclosure to a California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, and in the encryption case where the key or security credential was also acquired. Disclosure is generally due within 30 calendar days of discovery or notification. Subsection (g) defines a breach as unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information. Good-faith acquisition by an employee or agent for the business is not a breach if the information is not used or subject to further unauthorized disclosure. Whether prompts or outputs meet that definition is your decision. You write any notice. The notice title and headings, and the Attorney General sample when more than 500 California residents are notified, are in the section and are not drafted here. Subdivision (h), the personal-information list, was not fully read. Open it before you decide that an element is personal information. |
| Written for | United States |
| Applies to | [Draft a notifiable data breach assessment involving AI tools](https://ailawframework.com/practice/privacy-data-protection-and-cyber/draft-a-notifiable-data-breach-assessment-involving-ai-tools.md) |

## Checking plan

- What the AI does: Place each fact the log already states about prompts, outputs, or logs under acquisition, encryption or key, personal information, and discovery date. Write no conclusion and no notice.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- HIPAA notice periods are different and are not applied by this table.
- Do not decide that an entry in a prompt was acquired by an unauthorized person. That is the element you judge.

## Sources

- [California Civil Code section 1798.82 (security breach disclosure)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.82.) (checked 2026-10-22)
- [FTC: Data Breach Response: A Guide for Business](https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business) (checked 2026-10-22)
- [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-10-22)

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*