Draft or review security and incident-notification clauses
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- Extract the contract’s detection, notice-to-customer, and notice-to-individuals timings and set them beside the statutes that apply to this customer. Do not send a breach notice.
- What the lawyer must review
- For a Securities and Exchange Commission registrant, Item 1.05 of Form 8-K requires disclosure of a cybersecurity incident the registrant determines to be material, describing the material aspects of its nature, scope and timing and its material impact or reasonably likely material impact. The Commission’s 26 July 2023 release says an Item 1.05 report is generally due four business days after the registrant determines the incident is material, with a delay only if the Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the Commission in writing. A person who owns or licenses computerised data and conducts business in California must disclose a qualifying breach to a California resident within 30 calendar days of discovery or notification, subject to the law-enforcement and scope exceptions in Cal. Civ. Code § 1798.82. The lawyer picks the clock that applies. Other states’ breach statutes are separate.
- Written for / version
- United States versionUSCth
Who does what
| Role | What they do |
|---|---|
| Assistance | Potential support includes organising research leads and extracting and organising information. Confirm the tool’s capability and permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Calculate operative dates independently from the current rule and actual triggering event. Check exceptions and record the verified deadline.
- Review operative clauses in the complete document, including definitions, cross-references, schedules and inconsistencies with the instructions.
- Confirm instructions and personal circumstances through appropriate direct engagement. Have the responsible lawyer assess safety, capacity or vulnerability concerns and escalation.
- Verify the applicable jurisdiction and the version of each relevant law, rule or instrument in force at the material time.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.
Forms and precedents for this task
| Form or precedent | Kind | AI use | Summary |
|---|---|---|---|
| Security incident clause | Clause | AI use Yellow | Contract clause that makes a vendor who holds computerized personal information notify the customer immediately, using the California statute's maintainer rule. |
Signed-in accounts can read the full text of each one. All precedents.