U.S. SEC · cybersecurity disclosure and governance
Final rule issued July 26, 2023. Covered registrants face requirements around material cybersecurity incident disclosure and periodic governance/process disclosures.
Board/C-Suite implication: material-incident processes and governance disclosures can create senior oversight and disclosure questions, not merely technical reporting tasks.
Scope: Exchange Act reporting companies. Materiality and applicability remain fact-specific.
SEC source →NIST AI RMF · executive AI-risk responsibility
GOVERN 2.3 states that executive leadership takes responsibility for decisions about AI-system development and deployment risks.
Board/C-Suite implication: AI-risk decisions remain a senior leadership responsibility even when technical teams build or operate the systems.
Scope: voluntary framework; AI RMF 1.0 is under revision in 2026.
NIST source →NYDFS · AI-related cybersecurity risk
2024 guidance explains how Covered Entities should use the Part 500 framework to assess and address AI-related cyber risks and senior-governing-body oversight.
Board/C-Suite implication: covered financial institutions should treat AI-enabled cyber risk as part of existing cybersecurity governance and senior oversight.
Scope: NYDFS Covered Entities; not a universal Board duty.
NYDFS source →EU AI Act · transparency obligations
European Commission guidance published July 20, 2026 addresses Article 50 transparency obligations applying from August 2, 2026 to specified providers/deployers and use cases.
Board/C-Suite implication: role classification and use case drive obligations; governance must know where the organization sits before acting.
Scope, role classification and exceptions matter; customer-specific applicability requires legal analysis.
European Commission source →