US Cyber Incident Reporting Law (CIRCIA) Takes Effect, Requiring 72-Hour Breach Notifications

A landmark shift in US cybersecurity policy is now reshaping how businesses and insurers manage digital risk. The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) took effect in May 2026, establishing mandatory reporting requirements for entities operating in critical infrastructure sectors. Under the law, covered entities must report significant cyber incidents to the Cybersecurity and Infrastructure Security Agency (CISA) within 72 hours, and ransomware payments within 24 hours. The regulation represents one of the most significant federal cybersecurity mandates in US history.

The reporting requirement is accelerating an already fast-growing cyber insurance market. Regulatory mandates like CIRCIA — alongside the EU's Digital Operational Resilience Act (DORA) for financial services and a wave of state-level cybersecurity legislation — are compelling organizations to purchase cyber coverage as part of their compliance programs. The World Economic Forum's 2026 Global Cybersecurity Outlook found that only about 19% of organizations rate their cyber resilience above regulatory expectations, while 17% acknowledge falling below minimum standards — a protection gap that directly translates into insurance demand.

The broader cyber insurance market is expanding rapidly. Munich Re estimates global cyber insurance premiums reached approximately $15 billion in 2025 and projects growth exceeding 10% annually through 2030, potentially reaching $28 billion. The reinsurer identifies ransomware, data breaches, business email compromise, and distributed denial-of-service attacks as the primary drivers of insured cyber losses. Despite this growth, softening market conditions and intense competition are expected to push average premiums lower in 2026, making coverage more affordable even as demand rises.

Artificial intelligence is fundamentally reshaping the cyber landscape on both sides. Threat actors are deploying AI-powered tools for more effective ransomware campaigns and increasingly sophisticated deepfake-enabled fraud, while insurers use AI and machine learning to build more granular, dynamic underwriting models and detect fraudulent patterns. Carriers are also tightening policy language around contingent business interruption coverage and non-breach privacy claims, and at least one insurer has introduced a standalone AI policy. For businesses navigating this environment, the combination of new regulatory obligations and evolving threats makes robust cyber risk management and adequate insurance coverage a strategic necessity rather than an optional safeguard.