The Interagency 36-Hour Computer-Security Incident Notification Rule Applied to Bank AI Systems
The OCC's Part 53, the FDIC's Part 304 Subpart C, and the Federal Reserve's Part 225 Subpart N gave banks a 36-hour clock on notification incidents. The architecture we run so an AI agent failure, a model-vendor outage, or a prompt-injection-driven exfiltration is detected, classified, and reported inside the window.