# Nero Labs Breach Notification Rules Engine > Nero Labs Breach Notification Rules Engine is a paid API for AI agents from x402-agent-tools.nerolabs.workers.dev, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-22). Calculates every data breach notification obligation a company owes across US states and international jurisdictions, including deadlines and official sources. ## Facts - Endpoint: POST https://x402-agent-tools.nerolabs.workers.dev/rules/breach-notification?utm_source=zero.xyz - Price: $0.003/call - Payment: x402 - Status: unknown - Last checked: 2026-10-22 - Activations on Zero: 0 - Tags: x402 - Canonical page: https://www.zero.xyz/c/nero-labs-breach-notification-rules-engine-c2bd76ed - Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ubZ4c_S55NZ9Ce3pdNAXU Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently. ## How to call it through Zero Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`): ```sh zero fetch --capability nero-labs-breach-notification-rules-engine-c2bd76ed -d '' ``` Example prompt: We just discovered a data breach on 2025-01-15 that exposed SSNs and payment card data for 3,200 California residents and 800 Texas residents — we're a GLBA-regulated financial firm and an SEC registrant. Can you calculate every breach notification obligation we owe, with deadlines and the official sources? ## When to prefer this Use this endpoint when you need a fast, comprehensive, multi-jurisdiction breach notification checklist with deadline dates and official citations — especially for incidents spanning multiple US states and/or international jurisdictions. It is purpose-built for this compliance computation and handles HIPAA, GLBA, NYDFS, SEC, GDPR, UK GDPR, Canadian, and Australian rules in a single call, which no general legal search tool does natively. ## Known failure modes - Missing required affected array may cause incomplete or overly conservative notice list - Invalid date format for date_discovered causes parsing errors - Ambiguous country codes (e.g. 'CA') may be misread as California instead of Canada - Incomplete data_types array defaults to treating all laws as triggered (safe but may overstate obligations) - Deadlines for non-fixed-deadline jurisdictions are omitted or noted as variable - Service may not reflect very recent legislative changes to state breach notification laws ## How this service works Pay-per-call tools for AI agents, 31 in all: read web pages and RSS feeds, OCR, PDF text, transcription; email, phone and domain checks; UK, Irish and Polish company lookups and UK risk reports; website contacts, tech stack and SEO audits; PageSpeed; AI review, job post and row enrichment; data cleaning, joins, dedupe and diffs; US and EU compliance rules. No account or API key: pay each call in USDC on Base over x402. ## Output A structured JSON response listing every notice owed — including the regulator or authority to notify (attorneys general, HHS, SEC, FTC, EU/UK data protection authorities, Canadian and Australian regulators), the legal citation, a dated deadline where law fixes one, the official source URL, content requirements per notice, and a plain-language disclaimer that this is information, not legal advice. ## Request schema (JSON Schema) ```json { "type": "object", "properties": { "role": { "enum": [ "owner", "service_provider" ], "type": "string", "description": "owner (default): the company that owns or licenses the data. service_provider: holds it for another company, which mostly means notifying that company quickly." }, "sector": { "type": "array", "items": { "enum": [ "hipaa_covered_entity", "hipaa_business_associate", "glba_financial", "health_app", "nydfs_licensee", "telecom", "critical_infrastructure" ], "type": "string" }, "description": "Sector rules that apply: hipaa_covered_entity, hipaa_business_associate, glba_financial (non-bank financial firms under the FTC Safeguards Rule), health_app (FTC Health Breach Notification Rule), nydfs_licensee (New York DFS regulated)." }, "affected": { "type": "array", "items": { "type": "object" }, "description": "Where the affected people live: [{\"state\":\"CA\",\"count\":1200},{\"state\":\"TX\",\"count\":300},{\"country\":\"Germany\",\"count\":40},{\"country\":\"United Kingdom\",\"count\":15},{\"country\":\"Canada\",\"province\":\"Quebec\",\"count\":5}]. A bare two-letter code is read as a US state (CA = California); use {\"country\":\"CA\"} or \"Canada\" for Canada." }, "encrypted": { "type": "boolean", "description": "True only if all the exposed data was encrypted and the key was not exposed. Many US state laws then need no notice. Default false." }, "data_types": { "type": "array", "items": { "type": "string" }, "description": "Personal data exposed, for example [\"ssn\",\"drivers_license\",\"payment_card\"]. If left out every law is treated as triggered (SAFE)." }, "sec_registrant": { "type": "boolean", "description": "True for a company that files reports with the US SEC (listed in the US). Adds Form 8-K Item 1.05." }, "date_discovered": { "type": "string", "description": "Date the breach was discovered (or you became aware of it), YYYY-MM-DD. Defaults to today. Deadlines are counted from it." }, "materiality_date": { "type": "string", "description": "SEC registrants: date the company decided the incident is material, YYYY-MM-DD. The 8-K is due 4 business days after it." } } } ``` ## Response schema (JSON Schema) ```json { "type": "json", "example": { "verdict": "4 notices owed under 2 laws. First fixed deadline: 2026-10-23 (The competent national data protection authority (lead authority for cross-bo...", "disclaimer": "Information, not legal advice. Built from primary government sources (linked per figure); check the source before acting on a close call.", "notices_owed": [ { "id": "EU-GDPR", "how": "Each national authority's own breach form", "law": "European Union and EEA (GDPR)", "note": "Read on EUR-Lex. Every breach must be documented, reported or not (Art. 33(5)). Pending change: the European Commission's Digital Omnibus pr...", "notify": "The competent national data protection authority (lead authority for cross-border processing)", "source": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679", "citation": "Regulation (EU) 2016/679, Articles 33 and 34", "depends_on": [ "Risk of harm test: Authority notice is not needed if the breach is unlikely to result in a risk to people's rights and freedoms. Individuals..." ], "notice_type": "data_protection_authority", "affected_here": 40, "deadline_date": "2026-10-23", "deadline_note": "72 hours from becoming aware: the date shown assumes discovery at the start of 2026-10-20; count the hours from the actual time.", "deadline_rule": "Without undue delay and, where feasible, no later than 72 hours after becoming aware. If later, give reasons for the delay. Information may...", "content_required": [ "Nature of the breach, with categories and approximate numbers of people and records" ], "matched_data_types": [ "ssn" ], "verified_on_primary_source": true } ], "_example_note": "Real output, trimmed: long lists cut to their first items and long text shortened.", "date_discovered": "2026-10-20" } } ``` ## More - Live health (JSON, refreshed every minute): https://www.zero.xyz/c/nero-labs-breach-notification-rules-engine-c2bd76ed/health.json - [Zero catalog index](https://www.zero.xyz/llms.txt) - [Other services from x402-agent-tools.nerolabs.workers.dev](https://www.zero.xyz/host/x402-agent-tools.nerolabs.workers.dev/llms.txt)