---
title: "Critical infrastructure risk management program: annual report contents"
url: "https://ailawframework.com/precedents/technology-media-and-telecommunications-it-contracts/cirmp-annual-report"
type: "precedent"
site: "AI Law Framework"
id: "a24-cirmp-annual-report"
area_id: "A24"
kind: "checklist"
ai_level: "yellow"
version: 1
task_ids: ["A24-T20261018-8"]
law_stated_as_at: "2026-10-22"
---

# Critical infrastructure risk management program: annual report contents

> The annual report on a critical infrastructure risk management program, as the CISC page describes it. The report is due within 90 days after the end of the financial year. It does not contain the full program.…

Canonical page: https://ailawframework.com/precedents/technology-media-and-telecommunications-it-contracts/cirmp-annual-report  
Law stated as at: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

The annual report on a critical infrastructure risk management program, as the CISC page describes it. The report is due within 90 days after the end of the financial year. It does not contain the full program. Enhanced timeframes are in a factsheet that was not opened.

## Key facts

- Kind: Checklist. Steps or checks to work through and tick off.
- Practice area: [Technology, Media & Telecommunications / IT Contracts](https://ailawframework.com/precedents/technology-media-and-telecommunications-it-contracts.md)
- Jurisdictions: Australia, Commonwealth
- AI level: Yellow. You and the tool draft together, with you directing. You check every statement you rely on.
- Law stated as at: 2026-10-22
- Status: Maintained. Checked on 2026-10-22 against the authority it cites, for Australia and Commonwealth.

## When to use it

Use when a responsible entity may have to adopt a written risk management program and lodge the annual report. Payment-system assets are regulated by the Reserve Bank, as the page states. The rules text was not opened.

## Used for these tasks

- [Prepare the annual report on the critical infrastructure risk management program](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts.md#A24-T20261018-8)

## How AI may be used

AI may assemble dates and the five contents the page requires, from material the lawyer supplies. The lawyer decides whether the program is up to date and signs off through the governing body.

**AI may:**

- Record the financial year and a date 90 days after it ended
- List hazards the lawyer has already identified against the vectors the page names
- Note whether the asset is in a baseline class, an enhanced class, or is a critical telecommunications asset, using only the classes the page lists

**AI must not:**

- Must not declare that the program is up to date
- Must not state the enhanced-program commencement timetable. That factsheet was not opened
- Must not attach the full program. The page says the report need not contain it

**The lawyer checks:**

- The asset is in a class the page lists for a baseline program, an enhanced program, or a telecommunications program
- The report includes each of the five matters the page says the Act requires
- The board, council or other governing body has approved the report before it is lodged

## Authorities

- [Cyber and Infrastructure Security Centre, SOCI Act regulatory obligations, critical infrastructure risk management program and annual report (within 90 days after the financial year; page last updated 30 June 2026)](https://www.cisc.gov.au/how-we-support-industry/regulatory-obligations)

## Full text and drafting notes

The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/technology-media-and-telecommunications-it-contracts/cirmp-annual-report and through the signed-in MCP connector https://ailawframework.com/mcp/firm.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*