---
title: "Draft or review security and incident-notification clauses"
url: "https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/draft-or-review-security-and-incident-notification-clauses/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A24-T1-R6-US"
practice_area: "Technology, Media & Telecommunications / IT Contracts"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Draft or review security and incident-notification clauses

> Extract the contract’s detection, notice-to-customer, and notice-to-individuals timings and set them beside the statutes that apply to this customer. Do not send a breach notice.

Canonical page: https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/draft-or-review-security-and-incident-notification-clauses/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Technology, Media & Telecommunications / IT Contracts](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | Extract the contract’s detection, notice-to-customer, and notice-to-individuals timings and set them beside the statutes that apply to this customer. Do not send a breach notice. |
| What the lawyer must review | For a Securities and Exchange Commission registrant, Item 1.05 of Form 8-K requires disclosure of a cybersecurity incident the registrant determines to be material, describing the material aspects of its nature, scope and timing and its material impact or reasonably likely material impact. The Commission’s 26 July 2023 release says an Item 1.05 report is generally due four business days after the registrant determines the incident is material, with a delay only if the Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the Commission in writing. A person who owns or licenses computerised data and conducts business in California must disclose a qualifying breach to a California resident within 30 calendar days of discovery or notification, subject to the law-enforcement and scope exceptions in Cal. Civ. Code § 1798.82. The lawyer picks the clock that applies. Other states’ breach statutes are separate. |
| Written for | United States |
| Applies to | [Draft or review security and incident-notification clauses](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/draft-or-review-security-and-incident-notification-clauses.md) |

## Checking plan

- What the AI does: Extract the contract’s detection, notice-to-customer, and notice-to-individuals timings and set them beside the statutes that apply to this customer. Do not send a breach notice.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- The four-business-day SEC clock runs from the materiality determination, not from discovery. The California 30-calendar-day clock is a different event and a different audience.
- Section 1798.82(b) requires a business that maintains but does not own the data to notify the owner or licensee immediately following discovery. A contract clause that is slower does not remove that duty.

## Sources

- [SEC press release 2023-139, cybersecurity disclosure rules](https://www.sec.gov/newsroom/press-releases/2023-139) (checked 2026-10-22)
- [Cal. Civ. Code § 1798.82, security-breach disclosure](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.82.) (checked 2026-10-22)
- [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-10-22)

## Forms and precedents for this task

| Form or precedent | Kind | AI level | Summary |
| --- | --- | --- | --- |
| [Security incident clause](https://ailawframework.com/precedents/technology-media-and-telecommunications-it-contracts/us-security-incident-clause.md) | Clause | Yellow | Contract clause that makes a vendor who holds computerized personal information notify the customer immediately, using the California statute's maintainer rule.… |

Signed-in accounts can read the full text of each one.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*