Overview
In 2026, while states continued tightening breach notification deadlines and expanding the personal information covered by notification laws, the data security landscape was defined by the growing use of AI by companies, threat actors, plaintiffs, and consumers.
Three major themes define this year’s update:
- State legislative activity continues around general-purpose breach notification deadlines, with California and Oklahoma finalizing breach notification updates that are now in effect, Delaware modifying its AG notification timeline, and Vermont adding a data-broker-specific security breach notification regime.
- AI-driven cyberattacks are making headlines alongside federal and state efforts to increase governance, transparency, and incident reporting.
- Federal policy continues to evolve, with critical infrastructure notification requirements coming one step closer, aggressive regulations aimed at critical infrastructure supply chains, and issuance of an executive order that may provide a new framework for private-sector involvement in foreign-facing cyber operations.
For businesses and organizations subject to data breach notification obligations or in critical infrastructure sectors, understanding these changes and new threat vectors will be essential for compliance and risk management. Below, we summarize the most significant developments shaping the data security landscape in 2026.
State breach law updates
California
California became the newest state to require breach notification within 30 days, following implementation of California’s SB 446 on January 1, 2026 (previewed in our 2025 update while still pending). The 30-day deadline applies to individual notice. If more than 500 Californians are affected, companies must then notify the California attorney general within 15 calendar days of the individual notice.
Delaware
Delaware’s HB 381 was signed by the governor and became effective on September 2, 2026. The bill attempts two targeted changes to Delaware’s breach notification requirements that have been the subject of contradictory commentary.
- AG notification when identities are unknown: Delaware law previously required notice to individuals within 60 days and contemporaneous notice to the state attorney general if more than 500 Delaware residents were receiving notice. It also specified that if it took more than 60 days to determine if certain residents’ information was affected, notice to those residents should be made as soon as possible. HB 381 adds a clause after that requirement that the company provide notice of the breach of security to the attorney general within 60 days after determining a breach occurred. Some commentary, including by the sponsoring lawmakers, suggests an intent to require reporting of all breaches (regardless of how many people are affected), although that interpretation is not necessary from the text.
- Federal and state exemptions: Regulated entities will now have to consider Delaware requirements to notify its attorney general and to provide credit monitoring. Previously, financial institutions, HIPAA-covered entities, and other state and federally regulated entities were entirely exempt from Delaware law, so long as they complied with the separate regulatory scheme in providing notice to Delaware residents. HB 381 narrows that exemption to just the section governing timing requirements (including those discussed above), leaving the remainder of the statute potentially applicable.
Oklahoma
Oklahoma’s SB 626, previewed in our 2025 update while still pending, became effective January 1, 2026. It includes expanded definitions of personal information, attorney general notification requirements, civil penalties of up to $150,000 per breach, and an affirmative defense for compliance with reasonable safeguards.
Vermont
On June 16, 2026, Vermont’s governor signed H.211 (Act 138), which substantially expanded Vermont’s regulation of data brokers. Among other things, the law reorganizes obligations into a new “Data Broker Security Breach Notice Act,” which lays out breach notification obligations specifically for data brokers.
The requirements under H.211 are nearly identical to those already in place for all companies processing personal information of Vermont residents, with three key details:
- It applies to all personal data. The definition of covered “brokered personal information” includes any information, including derived data and unique identifiers, that is “linked or reasonably linkable” to an identified or identifiable individual or to a device linked to one or more individuals in a household.
- The incident need not compromise the security of the information. If readable personal information is acquired without authorization, that is a breach. (Under existing state law, the incident must “compromise the security, confidentiality, or integrity of the information” maintained by the entity.)
- The law applies directly to all data brokers, even if the brokered personal information at issue is owned by another entity.
The changes are a part of a suite of expansions to Vermont’s data broker law, all of which take effect January 1, 2027. Companies currently or potentially in scope should confer with counsel now to prepare for the new requirements.
AI’s impact on attackers, defenders, and the law
No discussion of data security in 2026 would be complete without acknowledging the impact that AI has had on incident response, preparation, regulation, and litigation.
AI-enabled technology: AI-enabled technology is now commonly used by threat actors to identify vulnerabilities, survey environments, and identify key data. Attacks are faster and more thorough as a result. In one high-profile incident, a lone attacker used commercially available AI coding assistants and language models to breach at least nine Mexican government agencies at the federal, state, and municipal levels, reportedly stealing 195 million taxpayer identities. AI-enhanced defensive tools have become more widely available and necessary to mount an effective defense, but the threat actors have an advantage, unconstrained by legal and governance requirements.
Internal AI tools: Internal AI tools used and deployed by employees present evolving risks, with the need to secure new types of interfaces, complex third-party relationships, and a race to develop and use new tools across many industries.
AI-driven cyberattacks: This year produced multiple high-profile incidents in which AI agents autonomously bypassed intended security controls and compromised third parties. In August, we learned that approximately 700 AI agents being run by a leading AI developer broke out of their isolated testing environment, self-organized after concluding their assigned task was unsolvable, and autonomously compromised another platform’s production infrastructure. In September, the Australian prime minister announced that an AI developer’s agent had directed itself to gain access to Australia’s Medicare statistics reporting portal, engaging in “misaligned behavior” to bypass security controls and access both public and nonpublic files.
Executive order on AI innovation and security: On June 2, 2026, President Donald Trump issued Executive Order 14409, “Promoting Advanced Artificial Intelligence Innovation and Security,” which explicitly connects frontier-AI development with cybersecurity. Among other things, the order expands AI-enabled federal cyber defenses, creates an AI cybersecurity clearinghouse for coordinated vulnerability discovery and remediation, establishes a voluntary framework for assessing the cyber capabilities of frontier AI models, and directs the attorney general to prioritize criminal enforcement against anyone who uses AI or AI agents to gain unauthorized access to computer systems.
AI safety incident reporting: Illinois (SB 315) and New York (S8828) joined California in requiring developers of “frontier AI models” to assess and document risk assessment, cybersecurity, and other aspects of their models. Each includes some form of critical incident reporting to state regulators for incidents involving situations such as loss of control of the model, disclosure of model weights, or substantial risk to the public.
Increasing litigation risk: As generative AI tools lower the cost to prepare and file a complaint in court, more breach incidents are attracting litigation. Increasingly, plaintiffs are filing lawsuits relating to smaller incidents that would not have previously resulted in legal claims, or based on public reporting of an initial exposure, before knowing whether the plaintiffs or putative class have been affected.
Other notable cybersecurity developments
Beyond the state breach law updates and AI-driven developments described above, several other significant federal cybersecurity developments merit attention.
- Private-sector cyber operations executive order: On August 12, 2026, President Trump issued the presidential memorandum “Expanding Capabilities to Combat Transnational Cyber-Enabled Crime,” explicitly authorizing vetted private companies for the first time to conduct offensive cyber operations against international criminal groups and hackers. The framework, to be overseen by the National Coordination Center and co-led by the U.S. Departments of Justice and Homeland Security, ostensibly permits private-sector participation in certain offensive cyber operations targeting overseas criminal infrastructure, but does not change existing legal authority.
- FCC Covered List additions and bulk-power system executive order: The Federal Communications Commission, acting on National Security Determinations by the Departments of Defense and Homeland Security, added foreign-produced power inverters and advanced robotic devices to the Covered List, which substantially restricts U.S. companies’ ability to import connected devices in those categories. Companies may apply for Conditional Approvals, and some have already been granted. President Trump also issued an executive order directing the U.S. Department of Energy (DoE) to issue rules and regulations governing the use of foreign-origin connected equipment in the domestic bulk-power system. DoE has issued a Request for Information seeking public input on the new regulatory regime.
- CIRCIA rulemaking: The Cybersecurity and Infrastructure Security Agency (CISA) continued working toward finalizing the CIRCIA rule in 2026, including additional stakeholder engagement and review of comments on the proposed rule. The federal regulatory agenda targeted September 2026 for publication of the final rule, and CISA submitted the final rule to the Office of Information and Regulatory Affairs (OIRA) for interagency review on October 1, 2026. OIRA has 60 days to approve the rule, and it will go into effect 90 days later. Any amendments made following the comment period are still confidential, but companies in critical infrastructure industries should begin preparing to report significant incidents within 72 hours.
- DOJ enforcement: Cybersecurity requirements for government contractors are substantial and continue to expand. The U.S. Department of Justice has signaled with recent settlements that it takes these obligations seriously, and failures could subject contractors to False Claims Act liability.
* * *
All companies holding data on U.S. residents and utilizing AI tools should understand the scope of the laws and developments described above and how they may affect the companies’ obligations in response to a breach. Ashurst Perkins Coie’s Security Breach Notification Chart offers a comprehensive and current summary of state laws regarding such requirements. For further questions on state or international breach notification requirements, AI-driven cybersecurity risks, or the federal policy changes described above, please contact experienced counsel.
