A Cyber and AI Disclosure Committee Charter Checklist

A disclosure committee charter is useful only if the right facts reach people who can decide what the company must say, to whom and when. A committee name does not create that path.

For cyber and AI matters, start with the events the company needs to evaluate, the people who can interpret their consequences and the authority to make the decision. Connect that process to incident response without confusing the two. Restoring a service and assessing a disclosure obligation are related jobs with different outputs.

This checklist is a governance design aid, not a model legal charter. Applicable obligations depend on jurisdiction, issuer status, sector, facts and contracts. Counsel should validate those boundaries and the final document.

Key takeaways

• Define what reaches the committee before debating its title.

• Separate fact gathering, legal advice, materiality assessment and approval.

• Give the process an urgent route that does not wait for a routine meeting.

• Keep cyber incident rules distinct from other cyber and AI obligations.

• Record uncertainty, decisions and reassessment triggers without promising legal adequacy.

Step 1: Define the remit and its boundaries

Identify the matters the committee evaluates: incidents, material changes in risk, statements about AI capabilities, significant limitations and potential inconsistencies in public claims. The remit should explain how an issue enters the process, not imply that every AI event has the same disclosure treatment.

Distinguish securities filings, privacy or sector notifications, contractual notices and customer communications. A single event can raise several questions with different recipients and clocks. Maintain an obligation map validated by counsel rather than putting one universal deadline in the charter.

The AI vendor contract checklist addresses a related dependency: the company may need a provider's facts before it can evaluate its own obligations. The charter should specify how missing external facts are escalated.

Step 2: Map roles and decision authority

Include the functions needed to assess business impact, technology facts, financial effects, legal duties and communications. Membership will vary. Identify deputies, an urgent convening route and the executive or body with final authority under the company's governance arrangements.

Do not make the security leader the sole legal decision maker by default. Do not assume the board must approve every notice either. Counsel should help define who recommends, who decides, who signs and when directors are informed.

Step 3: Put the charter through a checklist

This illustrative checklist is a practical drafting aid. It does not establish that a charter meets any legal requirement.

Charter element	Question to settle	Evidence to retain
Scope	Which events, claims and obligations reach this process?	Counsel-reviewed remit and obligation map.
Escalation	Who can convene an urgent review when facts are incomplete?	Named route, deputies and contact test.
Inputs	Who supplies operational, financial and customer-impact facts?	Source references, owners and timestamps.
Authority	Who recommends, decides, signs and informs the board?	Approved decision map and fallback authority.
Records	What is recorded, protected and revisited?	Decision record, access rules and reassessment triggers.

Test the route with an incomplete supplier update. The committee should be able to ask for more facts while still assessing what it already knows. Unknowns should not become a reason for indefinite inaction.

Step 4: Handle legal timing precisely

For U.S. registrants subject to Form 8-K Item 1.05, the SEC's 2023 rule requires a filing within four business days after determining a cybersecurity incident is material, subject to the rule's provisions and limited delay mechanism. The materiality determination must be made without unreasonable delay after discovery. The clock is not simply four days from discovering any incident.

SEC staff's May 2024 statement also distinguishes Item 1.05 disclosure of material incidents from voluntary disclosure of other incidents under another item. The staff statement is guidance, not a new rule. Counsel should determine the appropriate filing and confirm current requirements for the company's situation.

Those cyber incident provisions are not a universal AI reporting rule. An AI issue may raise other securities, contractual, privacy or sector questions. The charter should route the facts for analysis, not announce a legal conclusion from the technology label.

Step 5: Test records, updates and corrections

The decision record should identify facts considered, material uncertainties, participants, decision authority, rationale and next review trigger. Counsel should define how privilege, retention and access are handled. Labeling every document privileged does not itself settle its status.

Rehearse a later fact that changes the assessment. Who notices, reconvenes the group and checks whether an update or correction is needed? A charter that handles the first decision but not changing evidence is incomplete as an operating process.

Sources

SEC, 2023 final rule, Item 1.05 and related instructions; SEC Division of Corporation Finance, May 21, 2024 staff statement. Legal discussion is limited to the cited U.S. framework and is not company-specific legal advice. Checklist design is editorial guidance.

Frequently asked questions

Must every company create a separate cyber disclosure committee?

This checklist does not assert such a requirement. Companies should use a governance arrangement appropriate to their obligations and structure, validated with counsel.

Does a cyber incident automatically require an SEC filing?

No. The cited Item 1.05 requirement concerns incidents determined to be material for registrants subject to it. Other obligations and voluntary communications require their own analysis.

Is every AI issue a cyber incident?

No. The relevant facts and applicable definitions matter. The charter should route different issues to qualified reviewers rather than treating AI as one legal category.

Can the committee wait for a complete forensic report?

The process should assess available facts and uncertainty promptly. For the cited SEC rule, materiality must be determined without unreasonable delay. Counsel should guide the company-specific assessment.

Closing

Test one event from first warning to authorized decision. If the facts, clock or decision maker disappear between functions, fix the route before relying on the charter.