{ "attribution": { "product": "NovaCopilot", "source": "legal.exploreworldai.com", "canonical": "https://legal.exploreworldai.com/us/agent/glba", "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/us/agent/glba)", "license": "https://legal.exploreworldai.com/revision", "version": "legal-2026-08-25", "fingerprint": "ewai:eu:e094a9", "proof": "sha256:9d093bbe9e4c6b7c8f503fa802760729e972a2deebec404bec4af14f5fa495e2", "jurisdiction": "eu" }, "cagi_brand": "CAGI – Corporate Artificial General Intelligence", "cagi_version": "1.0", "cagi_relation": "alternate-entry", "canonical_agent": "/us/agent/glba", "jurisdiction": "US Federal", "agent_type": "deterministic", "cagi_entry": "https://legal.exploreworldai.com/us/federal/cagi-api/glba", "canonical_agent_url": "https://legal.exploreworldai.com/us/agent/glba", "id": "glba", "script": { "kind": "operative", "fields": [ { "name": "finansiell_verksamhet", "kind": "boolean", "label": "Bedriver verksamhet som är finansiell enligt regeln", "labelEn": "Engages in an activity that is financial under the rule" }, { "name": "antal_kunder", "kind": "number", "label": "Antal kunder vars uppgifter behandlas", "labelEn": "Number of customers whose information is processed" }, { "name": "skriftligt_program", "kind": "boolean", "label": "Skriftligt informationssäkerhetsprogram finns", "labelEn": "A written information security program exists" }, { "name": "utsedd_ansvarig", "kind": "boolean", "label": "Kvalificerad ansvarig för programmet är utsedd", "labelEn": "A qualified individual is designated for the program" }, { "name": "kryptering", "kind": "boolean", "label": "Kunduppgifter är krypterade i vila och under överföring", "labelEn": "Customer information is encrypted at rest and in transit" } ], "rules": [ { "id": "glba-program", "when": { "op": "all", "of": [ { "op": "equals", "field": "finansiell_verksamhet", "value": true }, { "op": "equals", "field": "skriftligt_program", "value": false } ] }, "outcome": { "code": "glba-program-missing", "verdict": "förbjudet", "audit": "KRAV_GÄLLER", "title": "Skriftligt informationssäkerhetsprogram saknas", "titleEn": "The written information security program is absent", "obligation": "16 CFR 314.3(a) kräver ett skriftligt informationssäkerhetsprogram som är anpassat till verksamhetens storlek, komplexitet och de uppgifter som hanteras.", "obligationEn": "16 CFR 314.3(a) requires a written information security program appropriate to the size and complexity of the activity and the information handled.", "refs": [ "program" ] } }, { "id": "glba-qualified", "when": { "op": "all", "of": [ { "op": "equals", "field": "finansiell_verksamhet", "value": true }, { "op": "equals", "field": "utsedd_ansvarig", "value": false } ] }, "outcome": { "code": "glba-qualified-missing", "verdict": "risk", "audit": "KRAV_GÄLLER", "title": "Ansvarig för programmet är inte utsedd", "titleEn": "No qualified individual is designated", "obligation": "16 CFR 314.4(a) kräver att en kvalificerad person utses att ansvara för programmet, och 16 CFR 314.4(i) kräver rapportering till styrelsen eller motsvarande.", "obligationEn": "16 CFR 314.4(a) requires designating a qualified individual responsible for the program, and 16 CFR 314.4(i) requires reporting to the board or equivalent.", "refs": [ "program", "controls" ] } }, { "id": "glba-encryption", "when": { "op": "all", "of": [ { "op": "equals", "field": "finansiell_verksamhet", "value": true }, { "op": "equals", "field": "kryptering", "value": false } ] }, "outcome": { "code": "glba-encryption", "verdict": "risk", "audit": "KRAV_VILLKORAT", "title": "Kryptering krävs, eller en dokumenterad likvärdig kontroll", "titleEn": "Encryption is required, or a documented equivalent control", "obligation": "16 CFR 314.4(c)(3) kräver kryptering av kunduppgifter i vila och under överföring, eller en likvärdig kompenserande kontroll som den ansvariga skriftligen godkänt.", "obligationEn": "16 CFR 314.4(c)(3) requires encryption of customer information at rest and in transit, or an equivalent compensating control approved in writing by the qualified individual.", "refs": [ "controls" ] } }, { "id": "glba-small", "when": { "op": "all", "of": [ { "op": "equals", "field": "finansiell_verksamhet", "value": true }, { "op": "gte", "field": "antal_kunder", "value": 5000 } ] }, "outcome": { "code": "glba-full", "verdict": "risk", "audit": "KRAV_GÄLLER", "title": "Alla delar av regeln gäller, inklusive riskbedömning och incidentplan", "titleEn": "The full rule applies, including risk assessment and incident response", "obligation": "16 CFR 314.6 undantar den som hanterar uppgifter om färre än 5 000 kunder från vissa delar. Vid 5 000 kunder eller fler gäller även skriftlig riskbedömning enligt 16 CFR 314.4(b), incidentplan enligt 314.4(h) och rapport till styrelsen enligt 314.4(i).", "obligationEn": "16 CFR 314.6 exempts those maintaining information on fewer than 5,000 customers from certain parts. At 5,000 customers or more the written risk assessment in 16 CFR 314.4(b), the incident response plan in 314.4(h) and the board report in 314.4(i) also apply.", "refs": [ "risk-assessment", "notification", "controls" ] } }, { "id": "glba-base", "when": { "op": "equals", "field": "finansiell_verksamhet", "value": true }, "outcome": { "code": "glba-base", "verdict": "risk", "audit": "KRAV_VILLKORAT", "title": "Regeln gäller, med undantag för mindre innehav", "titleEn": "The rule applies, with the exemption for smaller holdings", "obligation": "16 CFR 314.1 anger tillämpningsområdet för finansiella institut under myndighetens tillsyn. 16 CFR 314.6 undantar den som hanterar uppgifter om färre än 5 000 kunder från vissa delar av 314.4.", "obligationEn": "16 CFR 314.1 states the scope for financial institutions under the Commission's jurisdiction. 16 CFR 314.6 exempts those maintaining information on fewer than 5,000 customers from parts of 314.4.", "refs": [ "program", "risk-assessment" ] } } ], "fallback": { "code": "out-of-scope", "verdict": "tillåtet", "audit": "UTANFÖR_TILLÄMPNING", "title": "Regeln ger inget krav på den indata som lämnats", "titleEn": "The rule yields no requirement for the facts supplied", "obligation": "Ingen verksamhet är angiven som finansiell enligt 16 CFR 314.1 och 16 CFR 314.2.", "obligationEn": "No activity is stated to be financial under 16 CFR 314.1 and 16 CFR 314.2.", "refs": [] } }, "hash": "sha256:9d093bbe9e4c6b7c8f503fa802760729e972a2deebec404bec4af14f5fa495e2", "version": "legal-2026-08-25", "expires": "2026-09-23T00:00:00.000Z", "dependency": { "index_version": "legal-2026-08-25+legal-2026-08-25+2026-08-25T10:00:00", "content_hash": "sha256:9d093bbe9e4c6b7c8f503fa802760729e972a2deebec404bec4af14f5fa495e2", "revalidate_after": "2026-09-23T00:57:50.463Z", "max_copy_age_seconds": 3600, "policy": "revalidate-required; attribution-preferred", "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency", "verify": "https://legal.exploreworldai.com/api/public/v1/verify", "stale_copy_invalid": true }, "canonical": "https://legal.exploreworldai.com/us/agent/glba", "disclaimer": "Källhänvisning med officiell identifierare. Ingen juridisk rådgivning och inget efterlevnadsbeslut.", "usageInfo": "https://legal.exploreworldai.com/citering" }