# Are CIRCIA reporting requirements now in force?

**The official record reviewed still shows the final rule pending White House review, not an operative final reporting regime.** OIRA received the CIRCIA final-rule submission on **1 October 2026**. Its “Final Rule” stage describes the regulatory review stage; it does not mean that the rule has been published and become effective. ([reginfo.gov](https://www.reginfo.gov/public/do/eoDetails?rrid=1550967))

CISA’s guidance states that organisations are not required to submit incident or ransom-payment reports under CIRCIA until the final rule’s effective date. ([cisa.gov](https://www.cisa.gov/sites/default/files/2023-01/CIRCIA_07.21.2022_Factsheet_FINAL_508%20c.pdf?utm_source=openai))

### What should buyers do without a confirmed final deadline?

**Recommended readiness work:**

- Identify potentially relevant entities, services and incident owners.
- Maintain a shared incident chronology with separately controlled notification decisions.
- Make reporting triggers, deadlines, destinations and report versions configurable.
- Preserve the distinction between a proposed applicability decision and an approved final one.
- Assign a named owner to monitor publication and assess the final text.

Ask suppliers to demonstrate a rule change without code deployment and without altering closed incident records. Do not purchase a fixed-scope “CIRCIA compliance” implementation whose acceptance criteria merely repeat the proposal.

This is not a reason to suspend other applicable incident-reporting workflows. The recommended design is one factual incident record with distinct, legally reviewed reporting obligations—not one universal notification clock.