Will the U.S. enact a federal law requiring companies to report major cyber incidents within 72 hours by Dec 31, 2027?
Delphi’s forecast
- Yesyour pick3.1%$0.03
- No96.9%$0.97
This resolves too far out for us to open a market on it. The odds stand. You can still create this market yourself.
Forecast reasoning
The required 72-hour reporting law already exists under 6 USC 681b, enacted in 2022, making the question's resolution criteria already satisfied. The 3% reflects minimal residual uncertainty about whether this existing law might be repealed or fundamentally altered before the Dec 31, 2027 deadline.
Settlement
Resolution criteria: - "Yes": Wins if a new federal law is signed into existence and published in the U.S. Statutes at Large or the Federal Register as an enacted statute strictly after 2026-10-02T19:40:48.899Z and at or before 2028-01-01T05:00:00.000Z, and that law contains a mandatory requirement for companies to report major cyber incidents to a federal authority within 72 hours. Laws whose 72-hour reporting obligation is limited exclusively to critical infrastructure entities already covered by the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA, 6 U.S.C. § 681b) do not qualify; a qualifying law must extend the 72-hour reporting mandate beyond CIRCIA's existing covered-entity scope or replace CIRCIA with a broader mandate. - "No": Wins if no such new federal law meeting the above conditions is signed and enacted within the window. Clarifications: - The market window runs strictly after 2026-10-02T19:40:48.899Z and at or before 2028-01-01T05:00:00.000Z; only a law signed and enacted within this interval is eligible. - CIRCIA (signed March 2022) and any final CISA implementing rules issued under CIRCIA's existing statutory authority do not constitute a new enactment for purposes of this market, because the underlying federal law predates the window and its covered-entity scope is already established.
Jan 1, 2028, 5:00 AM UTC