SEC Rule 13a-11

Overview and Regulatory Purpose

The periodic reporting framework of the Exchange Act was originally designed around annual and quarterly reporting cycles, providing investors with a regular flow of information about registered companies but not necessarily with immediate notification of material developments that occur between scheduled report dates. A company that executed a transformative acquisition, experienced a catastrophic operational event, or discovered a material error in its financial statements would historically disclose that development in its next Form 10-K or Form 10-Q — potentially months after the event had occurred and markets had begun to reflect it in trading activity through other channels.

The current report obligation addresses this temporal gap. By requiring prompt disclosure of specified material events — regardless of where those events fall in the reporting calendar — Rule 13a-11 and Form 8-K ensure that the investing public and the secondary market receive contemporaneous notice of developments that are material enough to warrant immediate disclosure rather than disclosure on the next scheduled reporting date. The four-business-day standard filing deadline reflects the Commission's balancing of two competing considerations: the investor protection interest in prompt disclosure and the operational reality that companies need a minimum period to assess the significance of an event, consult counsel, and prepare an accurate and complete disclosure.

Statutory Authority and Rulemaking History

Rule 13a-11 derives its statutory authority from Section 13(a) of the Securities Exchange Act, which authorises the Commission to prescribe the form and content of periodic reports by registered issuers. The current report obligation has existed in some form since the Exchange Act's early implementation, but Form 8-K in its modern comprehensive form was substantially overhauled in 2004 — Securities Exchange Act Release No. 34-49424, August 23, 2004, effective August 23, 2004 — which expanded the catalogue of triggering events from the prior eight-item structure to the current comprehensive framework, standardised the four-business-day filing deadline across most items, and added new items governing executive officer and director changes, amendments to articles of incorporation and bylaws, and departures from financial restatement obligations.

The 2004 overhaul remains the foundational architecture of the current Form 8-K. The most significant post-2004 addition is Item 1.05 — the material cybersecurity incident disclosure requirement — adopted as part of the cybersecurity disclosure rulemaking published July 26, 2023, in Securities Exchange Act Release No. 34-97989. Item 1.05 became effective for large accelerated filers and accelerated filers on December 18, 2023, and for smaller reporting companies on June 15, 2024.

Key Provisions and Operative Requirements

Rule 13a-11(a) establishes the core obligation. Every registrant subject to Rule 13a-1 shall file a current report on Form 8-K within the period specified in that form unless substantially the same information as that required by Form 8-K has been previously reported by the registrant. The previously-reported carve-out prevents duplicative filings where the same material information has already reached investors through another required disclosure — typically a proxy statement or registration statement. However, the carve-out is narrow: the previously reported information must be substantially the same as what Form 8-K would require, not merely related to or consistent with the triggering event.

Rule 13a-11(b) provides the limitation on current reports by asset-backed issuers, which are subject to a different current reporting framework under Rule 13a-17 and therefore exempt from the standard Form 8-K obligation under Rule 13a-11.

Form 8-K's triggering events are organised across nine sections. Section 1 covers the registrant's business and operations, including Item 1.01 for entry into a material definitive agreement not made in the ordinary course of business, Item 1.02 for termination of a material definitive agreement, Item 1.03 for bankruptcy or receivership, Item 1.04 for mine safety reporting obligations, and Item 1.05 for material cybersecurity incidents. Section 2 covers financial information, including Item 2.01 for completion of acquisition or disposition of a significant amount of assets, Item 2.02 for results of operations and financial condition — which covers earnings releases and is furnished rather than filed, removing it from Section 18 liability — Item 2.03 for creation of a direct financial obligation or off-balance-sheet arrangement, Item 2.04 for triggering events that accelerate or increase a direct financial obligation or off-balance-sheet arrangement, Item 2.05 for costs associated with exit or disposal activities, and Item 2.06 for material impairments. Section 3 covers securities and trading markets. Section 4 covers matters related to accountants and financial statements, including Item 4.01 for changes in registrant's certifying accountant and Item 4.02 for non-reliance on previously issued financial statements. Section 5 covers corporate governance and management, including Item 5.01 for changes in control, Item 5.02 for departures and appointments of directors and principal officers, and Item 5.03 for amendments to articles of incorporation or bylaws. Section 6 covers asset-backed securities. Section 7 covers regulation FD disclosures. Section 8 covers other events through Item 8.01. Section 9 covers financial statements and exhibits through Item 9.01.

The standard filing deadline for most Form 8-K items is four business days after the occurrence of the triggering event. Certain items — notably Item 4.01 governing changes in certifying accountant — have a specific four-business-day deadline running from the triggering event with additional amendment obligations when the departing auditor's letter is received. Items filed as furnished rather than filed — principally Item 2.02 — are not subject to Section 18's strict liability for material misstatements, a distinction that continues to generate practitioner questions about the appropriate characterisation of earnings releases filed with reference to both items.

Item 1.05's cybersecurity incident disclosure obligation requires particular attention because of its materiality-determination trigger structure. Unlike most Form 8-K items where the triggering event is an objective occurrence — an agreement is signed, a director resigns, a restatement is announced — Item 1.05 is triggered by the registrant's determination that a cybersecurity incident is material, not by the discovery or occurrence of the incident itself. The four-business-day clock runs from the date of the materiality determination, which must itself occur without unreasonable delay after the incident's discovery. This two-stage structure — discovery triggering a prompt materiality assessment, materiality determination triggering the four-business-day filing clock — has been the subject of substantial Commission guidance and significant market uncertainty since Item 1.05's adoption.

Where an Item 1.05 Form 8-K is filed with information unavailable at the time of the initial filing, the registrant must amend the filing within four business days after it determines the omitted information or after it becomes available. This amendment obligation prevents registrants from filing initial Item 1.05 disclosures that satisfy the deadline without providing substantive information about the incident's nature and impact.

The national security delay mechanism under Item 1.05(c) permits the DOJ Attorney General to extend the filing deadline by up to 30 days where disclosure poses a substantial risk to national security or public safety, with a possible additional 30-day extension and a further 60-day extension — for a total potential delay of up to 120 days — where the national security threat continues. The mere filing of a delay request does not extend the deadline; the extension becomes effective only upon the DOJ's affirmative determination.

Scope of Application

Rule 13a-11 applies to every registrant subject to Rule 13a-1's annual reporting obligation — every issuer with a class of securities registered under Section 12 of the Exchange Act. Foreign private issuers are subject to a different current reporting framework under Rule 13a-16, which requires them to furnish Form 6-K reports for material home country disclosures rather than file Form 8-K current reports. Asset-backed issuers file distribution reports under Rule 13a-17.

The previously-reported information carve-out of Rule 13a-11(a) requires that the information previously reported be substantially the same as that required by Form 8-K — a standard applied conservatively. A registrant that has disclosed the general contours of a material agreement in a proxy statement but has not disclosed the specific terms required by Item 1.01 has not satisfied the carve-out with respect to those undisclosed terms.

Relationship to Related Rules and Regulations

Rule 13a-11's current report obligation operates as the real-time component of the Exchange Act periodic reporting framework, complementing Rule 13a-1's annual reporting and Rule 13a-13's quarterly reporting. The three rules together constitute a continuous disclosure system in which material annual information is captured in the Form 10-K, material quarterly developments are captured in the Form 10-Q, and material interim events are captured in the Form 8-K as they occur.

Rule 13a-14's certification requirements extend to Form 8-K reports filed pursuant to Rule 13a-11 — every Form 8-K containing financial information must include the CEO and CFO certifications required by Sarbanes-Oxley Section 302. However, the financial information in Item 2.02 earnings releases — because it is furnished rather than filed — is specifically excluded from Rule 13a-14's certification requirements.

Rule 12b-20's catch-all materiality completeness obligation applies to every Form 8-K filed pursuant to Rule 13a-11. Where the enumerated Item disclosures, taken as a whole and in light of circumstances known to management, would be misleading without additional information, Rule 12b-20 independently requires that additional information to be included. This interaction is particularly significant in the Item 1.05 cybersecurity context — a registrant that files an Item 1.05 Form 8-K disclosing that a material cybersecurity incident has occurred but omitting material information about its nature, scope, or financial impact may violate Rule 12b-20 regardless of whether it has technically complied with Item 1.05's specific disclosure requirements.

Regulation FD's prompt disclosure requirements interact with Rule 13a-11 where material nonpublic information is selectively disclosed to market professionals or significant shareholders. A registrant that selectively discloses material information — triggering Regulation FD's simultaneous or prompt public disclosure obligation — may satisfy that obligation through a Form 8-K filed pursuant to Rule 13a-11, typically under Item 7.01 or Item 8.01.

Amendment History and Regulatory Evolution

Form 8-K's 2004 overhaul established the current framework that Rule 13a-11 governs. The 2004 rulemaking standardised the four-business-day filing deadline, expanded the triggering event catalogue to its current comprehensive scope, and introduced the distinction between filed and furnished items that governs earnings releases under Item 2.02. Subsequent amendments have been additive — adding new items or modifying existing ones without restructuring the framework.

The July 2023 cybersecurity rulemaking's addition of Item 1.05 is the most consequential Form 8-K amendment since 2004. The two-year period since Item 1.05's effectiveness has generated significant regulatory guidance, enforcement activity, and market practice development. The May 2024 Director Gerding statement — clarifying that Item 1.05 should be reserved for incidents actually determined to be material — and the June 2024 C&DIs addressing the materiality determination process have substantially shaped the filing practice that has emerged, with registrants now more consistently using Item 8.01 for non-material incidents and Item 1.05 for incidents where a material determination has been made. Filing statistics as of May 21, 2026 — 29 Item 1.05 filings versus 50 Item 8.01 filings since the Gerding guidance — reflect this bifurcation.

The May 5, 2026 Semiannual Reporting proposal includes a technical amendment to Item 2.02 of Form 8-K to add references to semiannual periods alongside quarterly periods, accommodating the disclosure of earnings information by registrants electing semiannual reporting.

Enforcement Context and SEC Action Patterns

Form 8-K enforcement arises in three primary categories. The first involves untimely filing — registrants that fail to file within the four-business-day deadline face Section 13(a) liability and, for habitual non-filers, potential loss of Form S-3 eligibility, since Form S-3 requires current Exchange Act reporting as a registrant eligibility condition. The Division of Corporation Finance monitors Form 8-K filing compliance through EDGAR and has issued comment letters identifying instances where triggering events — particularly changes in certifying accountant, financial restatements, and director departures — appear to have occurred before the filing date suggested by the Form 8-K.

The second category involves material misstatements and omissions in filed Form 8-Ks, which are subject to Section 18 strict liability for the filed portions of the form and Section 10(b) and Rule 10b-5 liability for materially misleading disclosures. The distinction between filed and furnished items — with Item 2.02 earnings releases furnished rather than filed — has generated litigation about whether earnings releases containing material misstatements can support Section 18 claims.

The third and most rapidly developing enforcement category involves Item 1.05 cybersecurity disclosure. The Commission has commenced enforcement proceedings against registrants that failed to make timely materiality determinations following cybersecurity incident discovery, delayed Item 1.05 filings beyond the four-business-day post-determination deadline, or filed Item 1.05 disclosures that lacked substantive information about the incident's nature and impact. The AT&T cybersecurity incident disclosure — an Item 1.05 Form 8-K filed on July 12, 2024, 84 days after detection of the underlying data breach, with the company citing a DOJ-approved national security delay — attracted a Division of Corporation Finance comment letter and illustrated the range of compliance questions that the national security delay mechanism generates in practice.

Examination Relevance and Key Takeaways

Rule 13a-11 and Form 8-K are examined across the SIE, Series 7, Series 65, and Series 66 examinations as the current reporting component of the Exchange Act's periodic disclosure framework. The four-business-day standard filing deadline, the distinction between filed and furnished items, and the requirement that material definitive agreements, director departures, accountant changes, and financial restatements trigger current reports are consistently examined concepts.

Item 1.05 is increasingly examined as a recent and significant development in the Form 8-K framework, with candidates at the Series 65 level expected to understand that the four-business-day clock runs from the materiality determination rather than from the date of incident discovery, and that the materiality determination itself must occur without unreasonable delay following discovery.

The key points to retain are these. Rule 13a-11 requires every Section 12 Exchange Act registrant to file a Form 8-K current report within four business days of a triggering event — unless substantially the same information has been previously reported. Form 8-K's triggering events span nine sections covering business agreements, financial developments, accountant changes, governance events, and cybersecurity incidents. Item 2.02 earnings releases are furnished rather than filed, removing them from Section 18 strict liability. Item 1.05 — effective December 2023 for most registrants — requires disclosure of material cybersecurity incidents within four business days of the materiality determination, not the date of discovery; a national security delay of up to 120 days is available upon DOJ determination. The May 2024 Director Gerding statement established that Item 1.05 is reserved for material incidents, with Item 8.01 available for voluntary disclosure of non-material incidents or incidents without a materiality determination.