---
title: "Prepare an incident-response checklist for an AI system"
url: "https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/prepare-an-incident-response-checklist-for-an-ai-system/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A24-B7-4-US"
practice_area: "Technology, Media & Telecommunications / IT Contracts"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Prepare an incident-response checklist for an AI system

> From the contract’s notice clause and the system description, list who must be told, the trigger the contract uses, and the clock the contract states. Leave the notice itself blank.

Canonical page: https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/prepare-an-incident-response-checklist-for-an-ai-system/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Technology, Media & Telecommunications / IT Contracts](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | From the contract’s notice clause and the system description, list who must be told, the trigger the contract uses, and the clock the contract states. Leave the notice itself blank. |
| What the lawyer must review | SEC Press Release 2023-139: an Item 1.05 Form 8-K is generally due four business days after the registrant determines a cybersecurity incident is material, and the disclosure may be delayed if the Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the Commission in writing. The clock runs from the materiality determination. Cal. Civ. Code § 1798.82 requires a disclosure, when that section applies, within 30 calendar days of discovery or notification of the breach, titled “Notice of Data Breach,” under the headings the statute names. The lawyer decides materiality and writes any notice. Formal Opinion 512: do not put incident facts into a tool that is not configured to keep them confidential. |
| Written for | United States |
| Applies to | [Prepare an incident-response checklist for an AI system](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/prepare-an-incident-response-checklist-for-an-ai-system.md) |

## Checking plan

- What the AI does: From the contract’s notice clause and the system description, list who must be told, the trigger the contract uses, and the clock the contract states. Leave the notice itself blank.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- Item 1.05 applies to a registrant. A private company that is not a registrant does not file that Form 8-K.
- Other states’ breach-notice statutes were not opened. The California heading and 30-calendar-day period apply only when § 1798.82 applies.
- Regulation S-K Item 106, also adopted in the 26 July 2023 release, is an annual disclosure of processes, not the incident notice.

## Sources

- [SEC Press Release 2023-139 (26 July 2023), cybersecurity disclosure rules](https://www.sec.gov/newsroom/press-releases/2023-139) (checked 2026-10-22)
- [Cal. Civ. Code § 1798.82, security-breach notification](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.82.) (checked 2026-10-22)
- [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-10-22)

## Forms and precedents for this task

| Form or precedent | Kind | AI level | Summary |
| --- | --- | --- | --- |
| [Security incident clause](https://ailawframework.com/precedents/technology-media-and-telecommunications-it-contracts/us-security-incident-clause.md) | Clause | Yellow | Contract clause that makes a vendor who holds computerized personal information notify the customer immediately, using the California statute's maintainer rule.… |

Signed-in accounts can read the full text of each one.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*