After an AI-related cybersecurity incident, tell affected users what is known, what information may be involved, what the business has done, and what people can do now. Explain an AI system’s or vendor’s role only when it is confirmed and relevant. There is no single notice deadline or script for every business: legal duties depend on the data, organization, jurisdiction, and incident.
What an affected-user notice should say
A useful notice is specific enough to help people assess their risk and take action. Match every statement to the evidence available when the notice is issued; identify unresolved questions rather than presenting them as facts. Update users as the investigation develops.
As an Amazon Associate I earn from qualifying purchases.
- What happened: Describe the incident in plain language and give the relevant dates, including when it occurred and when it was discovered, if known.
- What information may be involved: Name the data categories, such as account credentials, health information, financial details, or Social Security numbers. Do not say a category was exposed unless the investigation supports that conclusion.
- What remains uncertain: State what the investigation has not established, such as the full scope or whether information was misused.
- What the business has done: Explain relevant containment, investigation, mitigation, and prevention steps without disclosing details that could increase risk.
- What the recipient can do: Give practical steps tailored to the data involved, and explain any support the business is actually offering.
- Where to get help and updates: Provide verified contact methods and a dependable update channel, with a date or cadence for the next update when possible.
The FTC’s Data Breach Response: A Guide for Business recommends clear, plain-language communication, a designated contact, and channels such as letters, a website, or a toll-free number. It cautions businesses: “Don’t make misleading statements about the breach.” State laws may also specify what a notice must or must not contain.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Explain the AI connection without guessing
If an AI-enabled system or an AI vendor was involved, describe its role only to the extent the incident investigation confirms it and the information is material to users. For example, distinguish a compromise of an AI service account from unauthorized access to a separate customer database. Do not speculate about model behavior, training data, or who carried out the attack. This follows the FTC’s broader guidance against misleading statements and against disclosing details that could increase consumer risk.
Do not use the label “AI incident” as a substitute for explaining what happened to people’s information. Users need to know whether their data or accounts may be affected, not just which technology was involved.
Give protective steps that fit the exposed information
Advice should correspond to the information that may be affected. Generic warnings are less useful than steps people can act on.
Rank #2
- Account credentials: Tell users which affected accounts they should secure and how to reach the genuine sign-in or support page. Warn them to be wary of unexpected messages that ask for passwords, payment, or verification codes.
- Social Security numbers or financial information: The FTC points people toward credit bureau fraud alerts or freezes when Social Security numbers are exposed, and toward IdentityTheft.gov for identity-theft recovery guidance. The FTC also recommends considering at least a year of free credit monitoring or other identity support particularly when financial information or Social Security numbers were exposed; this is a recommendation to consider, not a universal legal requirement.
- Health information: Identify the health-data categories involved and provide a contact who can address questions about the incident and any support available.
Tell people how the organization will send future incident updates. That makes unexpected breach-themed messages easier to recognize and helps users avoid phishing attempts that exploit the notice.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteNotification duties depend on the organization and incident
Do not assume one deadline applies to every business or confuse a report to a regulator with notice to affected people. The examples below are different frameworks, not a complete survey of applicable law. A business should assess its location and users, sector, data, discovery date, risk, and any applicable law-enforcement delay before deciding whom to notify and when.
Rank #3
| Framework | Who and what it covers | Recipient and timing |
|---|---|---|
| United States state breach-notification laws | The FTC says every state, the District of Columbia, Puerto Rico, and the Virgin Islands have laws requiring notification of security breaches involving personal information. Requirements vary. | Requirements differ by law and facts. Determine which state and federal rules apply; coordinate timing and content with law enforcement where needed to avoid impeding an investigation. See the FTC business guide. |
| FTC Health Breach Notification Rule | Applies to covered non-HIPAA businesses with breaches involving unsecured, individually identifiable personal health record information. FTC amendments announced on 26 April 2024 clarified application to most health apps and similar technologies. Coverage and interaction with HIPAA require a fact-specific assessment. | For covered entities, notice to affected people is due without unreasonable delay and within 60 calendar days after discovery. Required notice content and contact methods apply. See the FTC’s Health Breach Notification Rule: The Basics for Business and compliance guidance. |
| FTC Safeguards Rule | Covered financial institutions must report a notification event involving unauthorized acquisition of unencrypted information of at least 500 consumers, subject to the rule’s terms. | The reporting duty is to the FTC: report as soon as possible and no later than 30 days after discovery. This is not a general consumer-notice deadline. See the FTC Safeguards Rule guidance. |
| UK personal data breaches | The ICO describes a personal data breach as a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. The relevant duties depend on the breach and risk. | Qualifying breaches must be reported to the ICO without undue delay and, where feasible, within 72 hours. Individuals must be told without undue delay if the breach is likely to result in high risk to their rights and freedoms. Individual information should cover the breach’s nature, a contact point, likely consequences, and measures taken or proposed. The ICO guidance says it is under review following the Data (Use and Access) Act coming into force on 19 June 2025; check current guidance. |
These examples do not determine a particular company’s obligations. The FTC’s Health Breach Notification Rule guidance says covered notices must be “clear and conspicuous” and “reasonably understandable.” Have privacy or legal counsel assess the actual incident, applicable rules, deadlines, recipients, and any exceptions.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.A practical notice outline
The following outline is a starting point for communication, not a legally sufficient universal template. Replace each bracket only with verified information, and have the incident and legal teams review the notice and channels before use.
We are contacting you about a security incident involving [service or system]. We discovered it on [date]. Our investigation currently indicates that [plain-language description of confirmed event]. The information that may have been involved is [specific data categories]. We have [containment and remediation steps]. We are still investigating [clearly stated unknowns] and will update [location or channel] by [date or update cadence]. You can [specific steps appropriate to the data]. For help, contact us at [verified channels]. We will contact you about this incident only through [described channels]; be cautious of unexpected messages requesting credentials or payment.
Recommended Free Tools
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.Quick Recap
Bestseller No. 4Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
