Jun 292023

SEC Delays Enactment of Cyber Rules Related to Investment Adviser and Public Companies to October 2023, Updates Timeline to April 2024 for Recently Proposed Cybersecurity Rules

Sonia Gupta Barros, Colleen Theresa Brown, Charles A. Sommers and Sasha Hondagneu-Messner
, , , ,

On June 13, 2023, the Office of Management and Budget released its Spring 2023 Unified Agenda of Regulatory and Deregulatory Actions, which includes updates on Securities and Exchange Commission (“SEC”) proposed rules.  The SEC pushed back  its estimate for the final action date to October 2023 for its proposed cybersecurity rules related to public companies, as well as for its investment advisers and funds proposal.  Notably, the SEC’s timelines are typically estimates for implementation, and the proposed rules could be introduced sooner or later than these dates. However, the updated timeline indicates that the SEC is prioritizing finalizing its cybersecurity rules related to public companies and investment advisers and funds.

The agenda sets out the following timelines for SEC proposed rules:

  • Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure: stated Final Action Date: October 2023.  See here for more information on this proposal.
  • Cybersecurity Risk Management for Investment Advisers, Registered Investment Companies, and Business Development Companies: stated Final Action Date: October 2023.  See here for more information on this proposal.
  • Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information: stated Final Action Date: April 2024.  See here for more information on this proposal.
  • Cybersecurity Risk Management Rule for Broker-Dealers, Clearing Agencies, Major Security-Based Swap Participants, the Municipal Securities Rulemaking Board, National Securities Associations, National Securities Exchanges, Security-Based Swap Data Repositories, Security-Based Swap Dealers, and Transfer Agent: Stated Final Action Date: April 2024.  See here for more information on this proposal.
  • Regulation Systems Compliance and Integrity: stated Final Action Date: April 2024. See here for more information on this proposal.

Sidley represented the Securities Industry and Financial Markets Association (“SIFMA”) and other trade associations in preparing comments submitted to the SEC in response to the proposed [public company], [Regulation S-P] and [Rule 10] rulemakings.

This post is as of the posting date stated above. Sidley Austin LLP assumes no duty to update this post or post about any subsequent developments having a bearing on this post.

Sonia Gupta Barros

Washington, D.C.

sbarros@sidley.com

Colleen Theresa Brown

Washington, D.C.

cbrown@sidley.com

Charles A. Sommers

Washington, D.C.

csommers@sidley.com

Sasha Hondagneu-Messner

New York

shondagneumessner@sidley.com

You might also like
CMS Proposes Artificial Intelligence Limits and Utilization Management Guardrails for Medicare Advantage

On December 10, 2024, the Centers for Medicare & Medicaid Services (CMS) published a proposed rule with technical changes for the Medicare Advantage (MA) Program and the Medicare Prescription Drug Benefit Program for Calendar Year 2026 (Proposed Rule). Citing the growing use of Artificial Intelligence (AI) within the healthcare sector and reports that the use of AI may lead to “algorithmic discrimination” that exacerbates inequalities within healthcare, CMS proposes, for the first time, new guardrails that must be adopted by MA plans when using AI to manage patient care. CMS also proposes several reforms addressing utilization management (UM) techniques adopted by MA plans, including requirements for such plans to conduct and report detailed analyses on the use of prior authorizations. Notably, the Proposed Rule primarily modifies MA regulations, without direct application to the Medicare Part D prescription drug program.

EU AI Act: Are You Prepared for the “AI Literacy” Principle?

The EU AI Act is the world’s first horizontal and standalone law governing the commercialization and use of AI, and a landmark piece of legislation for the EU. Among the various provisions of the EU AI Act, the “AI literacy” principle is an often overlooked but key obligation which requires organizations to ensure that staff who are involved in the operation and use of AI have the necessary skills, knowledge and understanding to adequately assess AI-related risks and opportunities (e.g., through training and hiring staff with the appropriate background and skillset). This obligation – which applies from February 2, 2025 – is one of the few obligations under the EU AI Act that applies to all AI systems i.e., irrespective of the level of risk that the AI system presents. Indeed, by introducing AI literacy as one of the first provisions of the AI Act (Article 4), the EU legislators appear to underscore the significance of this requirement.

Advisor to the CJEU Confirms GDPR Fines For Subsidiary Infringements Should Reflect Group Turnover

On 12 September 2024, Advocate General Medina issued their Opinion in Case C-383/23 (Opinion) in which they confirmed that supervisory data protection authorities (SAs) must, when calculating the fine for a GDPR infringement committed by a subsidiary, take into account the total annual turnover of the entire group—a concept known as parental liability.