Are CIRCIA reporting requirements now in force?

The official record reviewed still shows the final rule pending White House review, not an operative final reporting regime. OIRA received the CIRCIA final-rule submission on 1 October 2026. Its “Final Rule” stage describes the regulatory review stage; it does not mean that the rule has been published and become effective. (reginfo.gov)

CISA’s guidance states that organisations are not required to submit incident or ransom-payment reports under CIRCIA until the final rule’s effective date. (cisa.gov)

What should buyers do without a confirmed final deadline?

Recommended readiness work:

• Identify potentially relevant entities, services and incident owners.
• Maintain a shared incident chronology with separately controlled notification decisions.
• Make reporting triggers, deadlines, destinations and report versions configurable.
• Preserve the distinction between a proposed applicability decision and an approved final one.
• Assign a named owner to monitor publication and assess the final text.

Ask suppliers to demonstrate a rule change without code deployment and without altering closed incident records. Do not purchase a fixed-scope “CIRCIA compliance” implementation whose acceptance criteria merely repeat the proposal.

This is not a reason to suspend other applicable incident-reporting workflows. The recommended design is one factual incident record with distinct, legally reviewed reporting obligations—not one universal notification clock.