TL;DR · 30-second read

The Short Version

The US government’s cybersecurity agency plans to finish new rules in September 2026. They will require essential services, likely including hospitals, banks and power companies, to report serious hacks within three days and any ransom paid to hackers within one day.

The catch: many of these organizations run their computers inside buildings owned by someone else, including the huge data centers being built for artificial intelligence. A customer can only meet a three-day deadline if the building’s operator tells it about a break-in fast. Expect the contracts between them to get much stricter.

The Cybersecurity and Infrastructure Security Agency (CISA) expects to issue its final rule under the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) in September 2026, Hunton Andrews Kurth reported on July 17. The rule will require covered critical-infrastructure entities to report covered cyber incidents to CISA within 72 hours and ransom payments within 24 hours.

The date comes from a preview of the 2026 Unified Agenda, the federal government’s schedule of planned regulatory actions. CISA missed the statutory October 2025 deadline, then set an internal target of May 2026. Town halls originally planned for March and April were postponed by a lapse in Department of Homeland Security funding and held June 15 through 18, drawing more than 1,200 stakeholders over four days.

Executive Summary

CIRCIA is the first cross-sector federal mandate requiring critical-infrastructure operators to report cyberattacks to a single agency. After a proposed rule in April 2024 and more than a year of slippage, a final rule is now expected in September 2026, with the two headline obligations unchanged: 72 hours to report a covered cyber incident and 24 hours to report a ransom payment.

For the data center and cloud industry, the most immediate consequence may come less from whether operators are themselves covered and more from their customers’ obligations. Hospitals, banks, utilities and other covered entities increasingly run critical systems in third-party facilities and clouds, and the statute explicitly contemplates incidents that begin with a compromised hosting provider. A customer’s 72-hour clock therefore depends on how quickly and completely its provider tells it what happened, which turns incident notification into a negotiated contract term.

The practical window is short. Organizations that may be in scope should assess coverage against the proposed criteria, align incident response plans with the reporting deadlines, and review provider and customer agreements before the final text lands.

A Tenant’s 72-Hour Clock Runs Through Its Data Center

Under CIRCIA, the reporting duty sits with the covered entity: the hospital system, bank, utility or other organization that meets the final rule’s criteria. The 72-hour window runs from the point that entity reasonably believes a covered incident has occurred. Much of that entity’s computing, however, no longer sits in buildings it owns. It runs in colocation facilities, where a tenant rents space, power and cooling inside someone else’s building, and in public and GPU clouds, where it rents the computers themselves. The 2022 statute anticipates this: among the incidents the rule is meant to capture, it lists unauthorized access facilitated through the compromise of a cloud service provider, managed service provider or other third-party data hosting provider.

That places the provider’s detection and notification speed directly on the customer’s compliance path. A covered tenant cannot report what it has not been told, and it needs enough detail from its provider (what was accessed, when and how) to file a report that meets CISA’s content requirements. Breach-notification clauses are not new, but a binding federal deadline gives customers a concrete number to negotiate against: notification windows well inside 72 hours, named incident contacts, and obligations to share forensic detail. If a provider is itself swept in by the final size- or sector-based criteria, it will be running its own clock in parallel with its customers’.

The AI buildout sharpens the problem. New AI capacity is often delivered in layers: a facility owner, a GPU cloud or managed-infrastructure provider operating inside that facility, and the enterprise or model developer consuming the compute. Each layer is a hand-off in the notification chain, and each hand-off consumes hours of the covered entity’s window. Operators whose customer lists include regulated industries should expect incident-notification terms to be negotiated with the same seriousness as power and uptime commitments.

Three Targets, One Missed Deadline, No Final Text Yet

The timeline explains why caution is warranted. The statute required a final rule by October 2025. CISA missed that date and set an internal target of May 2026, citing the volume of comments on the April 2024 proposal and an intent to streamline requirements. Town halls meant to inform the final text were then pushed from March and April into mid-June by a Homeland Security funding lapse. September 2026 is the third target date.

CISA has signalled that it wants to streamline the rule but has not said how. Streamlining could mean narrower coverage, fewer required data fields, clearer thresholds for what counts as a reportable incident, or some combination. Until the text is published, the April 2024 proposal remains the best available guide, which is why the practical advice is to assess coverage against its proposed sector-based and size-based criteria rather than wait. The turnout of more than 1,200 stakeholders at the June sessions suggests how many organizations believe they may be affected.

Unified Agenda dates are projections, not commitments, and this rule has slipped before. Publication of a final rule is also not the same as the start of reporting obligations; the effective date and any transition period will matter as much as the publication date. Operators should treat September as a planning anchor, not a certainty.

The 24-Hour Ransom Report Tests Governance, Not Just Tooling

The 24-hour window for reporting a ransom payment is the tighter of the two deadlines. Ransom decisions typically involve executives, legal counsel and cyber insurers, not the security team alone. A one-day reporting clock after payment means the documentation behind that decision (who approved it, how much was paid, to whom, and why) has to be assembled as the decision is made, not reconstructed afterward. Organizations without pre-assigned authority and a documented escalation path will find the deadline hard to meet.

CIRCIA also lands on top of existing obligations. Public companies already face the SEC’s requirement to disclose material cybersecurity incidents within four business days of determining materiality, and several sector regulators have their own notification rules. The statute provides an exception where an entity reports substantially similar information to another federal agency under an agreement with CISA, but how widely that exception applies will depend on agreements not yet described. A data center operator serving customers across several sectors may find that its customers each face a different combination of deadlines, and that each will expect its provider’s notification terms to fit.

The intended payoff is real. CISA’s stated purpose is to deploy help to victims quickly, analyze reports across sectors for patterns, and share warnings with other defenders. For infrastructure operators, better cross-sector visibility into attack trends is a genuine benefit; the cost is process discipline that has to be in place before the first incident, not after.

Background

The Cybersecurity and Infrastructure Security Agency is the component of the Department of Homeland Security responsible for coordinating the protection of US critical infrastructure against cyber and physical threats. Before CIRCIA, cyber incident reporting to the federal government was largely voluntary or governed by a patchwork of sector-specific rules. CIRCIA, signed in March 2022, directed CISA to create a single cross-sector reporting regime, and CISA published its proposed rule in April 2024, setting out proposed coverage criteria, the scope of reportable incidents, and required report contents.

Data centers and cloud platforms sit underneath much of that critical infrastructure, hosting systems for healthcare, finance, energy and government customers. As AI demand drives new capacity, more of those workloads run in shared facilities and layered provider arrangements, which is why the reporting rules matter to operators whether or not they end up directly covered.

Sources

Source: CISA Plans to Finalize Cyber Incident Reporting Regulations in September 2026 (Hunton Andrews Kurth), on CISA’s expected timeline for the CIRCIA final rule and its 72-hour and 24-hour reporting requirements.