How to decide whether an AI data exposure is an FTC Safeguards Rule notification event

A staff member pastes a client list into a free AI chatbot to draft a mailing, then mentions it to a manager that afternoon. For a mortgage broker, tax preparer, lender or investment adviser that is not registered with the SEC, the next question is whether this is an FTC Safeguards Rule notification event, and the 30-day clock may already be running.

What counts as a notification event under the FTC Safeguards Rule?

A notification event is the "acquisition of unencrypted customer information without the authorization of the individual to which the information pertains," as defined in 16 CFR 314.2(m). When one involves at least 500 consumers, 16 CFR 314.4(j) requires the financial institution to notify the FTC as soon as possible and no later than 30 days after discovery.

The rule reaches non-bank financial institutions under FTC jurisdiction. 16 CFR 314.1(b) lists examples including mortgage lenders and brokers, finance companies, tax preparation firms and investment advisers that are not required to register with the SEC. SEC-registered advisers and broker-dealers answer to Regulation S-P instead, which has its own notice standard and its own approach to documenting a no-notice decision.

The reporting requirement came from the FTC's 2023 amendment to the rule (88 FR 77499), effective May 13, 2024. The FTC had proposed a trigger based on misuse of the information and dropped it as ambiguous and open to underreporting. The final trigger is acquisition, so an event can qualify even when there is no evidence that anyone used the data to commit fraud.

Is pasting customer information into an AI tool an acquisition?

It often can be, and the rule puts the burden on the firm to show otherwise. Section 314.2(m) states that "unauthorized acquisition will be presumed to include unauthorized access to unencrypted customer information" unless the firm has "reliable evidence showing that there has not been, or could not reasonably have been, unauthorized acquisition." In practice, once customer information reaches someone without the customer's authorization, the firm should treat it as acquired until its evidence shows otherwise. The FTC described this presumption as consistent with its Health Breach Notification Rule, citing how hard it is to tell whether access led to acquisition.

An AI prompt works differently from a stolen laptop. A staff member sent the data, and the AI provider's systems received it, processed it and, depending on the account type and settings, stored it. Encryption in transit protects the data on the way to the provider, and the provider then reads the content in order to process it. The rule's encryption carve-out covers data an unauthorized party holds only in a form it cannot read. Prompt text reaches the provider in readable form, so that carve-out rarely applies.

Does it matter whether the firm approved the AI tool?

Yes, in practice, although the rule does not mention AI and this is a point to take to counsel. The definition turns on authorization from "the individual to which the information pertains," meaning the customer. The firm's approval of a tool is a separate question from what the customer authorized.

The rule also expects firms to oversee service providers, defined in 314.2(r) as any entity permitted access to customer information through services it provides directly to the firm. Section 314.4(f) requires reasonable steps to select providers capable of appropriate safeguards, a contract requiring those safeguards, and periodic assessment based on the risk each provider presents. An enterprise AI tool selected through that process, under a contract with data retention and model training terms, sits in a very different position from a free personal account an employee opened on their own.

The difference shows up in the evidence. For an approved tool, a firm may be able to point to contract terms, retention settings, administrator logs and the provider's own commitments. For a personal account, the firm usually has none of that and cannot see what the provider kept. A deletion confirmation obtained afterward shows what happened next; by itself, it does not show that acquisition never occurred. Our article on requesting deletion from an AI vendor after an exposure covers that step.

How do you count the 500 consumers?

Count the individual consumers whose customer information was in the material the tool received, regardless of how many prompts or files were involved. Customer information is any record containing nonpublic personal information about a customer (314.2(d)). Nonpublic personal information (314.2(l)) covers personally identifiable financial information, which includes any information a consumer provides to obtain a financial product or service (314.2(o)).

A single paste can cross the threshold. A client list exported for a mail merge, a loan pipeline report or a household billing file may carry hundreds of names with account or loan details. Build the count from the content actually submitted, such as the prompt history or the uploaded file, and keep the working. The FTC's online reporting form asks for the number of consumers affected or potentially affected, so a documented method is worth more than a round estimate.

Small firms are inside this requirement. 16 CFR 314.6 relieves institutions holding customer information on fewer than 5,000 consumers from four requirements, including the written incident response plan in 314.4(h) and the board report in 314.4(i). The FTC notice requirement in 314.4(j) is not on that list.

When does the 30-day clock start?

On the first day the event is known to the firm. Under 314.4(j)(2), the firm is treated as knowing once any employee, officer or other agent knows, other than the person who committed the breach. In practice, the day an employee reports an AI mistake to a colleague, a manager or IT is likely day one.

That makes same-day internal reporting part of compliance. Every day that passes before the right people hear about an AI mistake is a day taken from the 30 available for the analysis below.

How do you decide whether an AI exposure is reportable to the FTC?

Work through the same steps every time, in order, and write each one down. The record of the reasoning matters as much as the conclusion.

• Preserve the facts first. Capture the prompt history, any uploaded files, timestamps, the tool and the account type before anyone deletes the chat.
• Confirm the data is customer information. Identify which customers and which data elements were included, and whether any of it was encrypted in a form the provider could not read.
• Establish the tool's status. Record whether it was an approved service provider under contract, and pull the retention, training and access terms in effect at the time.
• Test the presumption. Ask whether the firm has reliable evidence that acquisition did not occur or could not reasonably have occurred, and write down what that evidence is.
• Count consumers. Use the submitted content to count affected or potentially affected consumers against the 500 threshold.
• Decide and document. Record who made the call, the facts, the rule text relied on, any counsel input and the date. If the event is reportable, file through the FTC's form within 30 days of discovery. Our guide to reporting a breach to the FTC walks through the form.
• Check state law separately. The FTC declined to add a consumer notice requirement, calling it largely duplicative of state laws, so customer notice depends on where your customers live. For California residents, see how the California breach notification law treats AI exposures.

What should a firm put in place before an AI exposure happens?

The decision is faster and better documented when the groundwork exists before an incident. Five items cover most of it.

• An AI exposure scenario in the incident response plan, with the roles and decision-making authority that 314.4(h)(3) calls for. Firms below 5,000 consumers are exempt from the written plan requirement but still have to make the FTC notice decision.
• An approved AI tool list, with each tool's contract, retention and training terms on file as part of service provider oversight.
• Logging of AI tool use and data loss prevention rules for account numbers and Social Security numbers, consistent with the requirement in 314.4(c)(8) to monitor and log the activity of authorized users. Logs are a likely source of the reliable evidence the presumption asks for. Our article on AI audit logs for Safeguards Rule monitoring shows what those logs can capture.
• A one-line staff instruction: report any customer data sent to an AI tool to a named person the same day.
• A tabletop exercise that runs an AI exposure through this decision. After any real event, 314.4(h)(7) calls for evaluating and revising the plan as necessary.

Will the FTC make the report public?

It may. In the 2023 final rule, the FTC said it intends to enter notification event reports into a publicly available database. Under 314.4(j)(1)(vi), a law enforcement official can request a delay of up to 30 days if public notice would impede a criminal investigation or harm national security, with up to 60 more days available on a written request. That makes the accuracy of the description and the consumer count more important, since the report may be read by clients, competitors and the press.

How can s90 help?

s90 builds the Safeguards Rule controls around AI for non-bank financial firms: approved tool lists, data loss prevention and prompt monitoring, logging that produces usable evidence, and an incident response plan with an AI scenario built in. Our agreements include a 72-hour breach notification commitment and 24-hour evidence production, so the facts this decision depends on arrive quickly. If you would like to test your current plan against an AI exposure scenario, we are glad to walk through it with you.