Forsmall businesses, from solo owners to 500 peopleUS (California noted)Canada (short section)
What keeps payments trusted, and what a small firm owes: The rules behind every card swipe and bank transfer, sorted into what you owe, what binds your bank, and what only big firms face.
A US firm of 1 to 50 people that takes cards faces 5 payment and data rule sets: card security checks (PCI), processor identity checks, network dispute limits, dispute deadlines and breach notice. Most heavier rules start far above small-firm size. Our estimate for the basics at ~5 people: about $3,455 a year.
Only if it fits you: Nacha ACH fraud monitoring (if you send ACH from your own bank, 2026) · state privacy laws (above size thresholds) · FTC Safeguards and IRS plan (tax preparers) · HIPAA (dental and health) · AI rules (Colorado from 1 Jan 2027; California hiring; 1 Jan 2027 check) · cyber-insurance conditions (if you buy cyber insurance).
On 1 Jan 2027, 70 days after 23 Oct 2026, new duties start in California, Colorado and New York. Most firms of 1 to 50 people are outside all three. This is information, not legal advice.
Only firms the CCPA covers
From 1 Jan 2027, if AI shapes a consequential decision (Colorado; 2026 law-firm report)
AI developers from 2027; city hiring tools now (New York; secondary reports, read in 2026)
Most small firms: not covered in California. If you are below every CCPA line above, California’s ADMT, risk-assessment and audit rules do not apply to you. Colorado and New York City matter only where AI or automated tools are used in consequential decisions, such as hiring, lending or housing. This is information, not legal advice.
1. Do you do business in California (sell to or serve people there)?
2. Is any of these true: gross revenue of $26.6M or more a year; you buy, sell or share data on 100,000+ Californians or households; or 50%+ of your revenue comes from selling or sharing Californians’ personal data?
3. Do AI or automated tools make, or materially shape, decisions about a person’s job, housing, loan, insurance, health care or education?
4. Do any of those decisions affect Colorado residents?
5. Does an automated tool screen or rank candidates for jobs in New York City?
How this works. It matches your answers to the thresholds in the sources above. It does not test exemptions, bill text or contracts. Your answers stay on this page; nothing is stored or sent. This is information, not legal advice.
We sorted 12 rule sets by nine business types. The first five reach any firm that takes cards. Safeguards, the IRS plan and HIPAA split the trades.
Hover or tap a mark for the condition. This is our reading of each rule’s scope, not a legal finding. Sources in each section below.
Your business
Start from a firm size
Tap any that are true
Assumptions. Yearly hours: SAQ 3, breach plan and privacy notice 3, training 1 a person, tax security plan 6, HIPAA review 10, AI notices 4. Cash: MFA and device tools $8 a person a month; cyber insurance $900 + $250 a person. Extras: website scans $300, full Safeguards testing $9,000, California program $10,000. All are ForeGaze assumptions, not quotes. Leaves out lawyers, breach costs and fines.
This series tests a claim: payments stayed fairly safe while breaches hit firms everywhere else. Part 1 of this series covers fraud rates. Here we ask what the rules do.
The bank, within days
1.5% is the line
0.96 claims per 100 policies
192.7 million people
Our reading. Card rules work because each layer carries a cost it can control. Data rules outside payments rely on notice after the fact. That gap is where small firms get hurt.
Next in the Trust series: Built to Be Trusted: High-Trust Architecture for a Small Firm wires these controls together. After it come What AI Can Learn From Payments; Safe, Private and Personal AI: a New Small-Business Type; and Robots and Your Business.
PCI DSS (Payment Card Industry Data Security Standard) is the card industry’s security standard. Version 4.0 retired on 31 Dec 2024, leaving v4.0.1 (PCI SSC bulletin, 15 Oct 2024).
Skipping it costs money. One law-practice processor charges $19.95 a month after six months without a filed SAQ: $239.40 a year.
| SAQ | Fits a firm that… | Typical trade |
|---|---|---|
| A | Takes cards online or by phone, fully outsourced; no card data on its systems | Coaches, consultants, invoice links |
| A-EP | Has a website that shapes the payment page but never receives card data | Custom booking sites |
| B-IP | Uses standalone approved terminals on its own network link | Front desk |
| C-VT | Keys cards one at a time into a web virtual terminal on an isolated computer | Phone payments |
| P2PE | Uses only listed point-to-point encrypted terminals | Dental, retail counters |
| SPoC | Uses a phone or tablet with a listed secure card reader | Plumbers, contractors in the field |
| D | Fits no other SAQ, or stores card data | Avoid this if you can |
Visa’s program counts fraud reports plus disputes against the number of online card transactions. Its count floor is far above a small firm’s volume.
Floor = minimum monthly fraud and disputes ÷ ratio line. Visa: 1,500 ÷ 1.5% = 100,000 (68,182 at the old 2.2%). Mastercard ECM: 100 ÷ 1.5% = 6,667. ECM and HECM are Mastercard’s “excessive” and “high excessive” chargeback levels. Examples are illustrations. Sources: Visa fact sheet; Nuvei documentation of the Mastercard program, modified 21 Oct 2025; read 24 Oct 2026.
Nacha writes the rules for ACH, the US bank-transfer network. Its 2026 rules require risk-based checks for fake or tricked payments (Nacha).
Banks and big senders
Every business originator
Ask your platform
Reg Z covers credit cards. Reg E covers debit cards, ACH and payment apps. Both bind the bank; you feel them as chargebacks and returns.
10 business days shown as about 14 calendar days (10 × 7 ÷ 5). Sources: Reg E, 12 CFR 1005.11; Reg Z, 12 CFR 1026.13; read 23 Oct 2026.
Banks owe anti-money-laundering checks under federal law. Processors pass them to you as document requests and account reviews.
“A required step”
Up to 180 days
US firms exempt
Avoidable triggers. A sudden jump in volume, a new kind of sale, or prepayments far ahead of the work. Tell your processor before a big month. Keep a second way to get paid.
Payment rules protect the card. Data rules protect everything around it: client files, tax returns and patient charts.
A non-profit’s survey, not statute text; the 51 likely include DC. California’s 30-day deadline is in Civil Code §1798.82(a)(2), as amended by SB 446 (Chapter 319, approved 3 Oct 2025), in force 1 Jan 2026 (Troutman Privacy, Oct 2025). It can be delayed for law enforcement or to scope the breach. With more than 500 residents affected, a sample notice goes to the Attorney General within 15 days of notifying them. Sources: Privacy Rights Clearinghouse, 28 Jan 2026; FTC business guide; HHS breach guidance.
What it is: a policy that pays some costs after a hack or data breach, such as forensics, notifying customers, legal defense, restoring systems and sometimes ransom or lost income. Many policies limit or exclude payment scams where you sent the money yourself. It is not required by law. But insurers set conditions, and a claim can fail if the controls you declared were not in place.
Severity figures as quoted in the NAIC report, rounded. Premiums grew 3.5% to about $9.46 billion. Source: NAIC 2026 report, read 23 Oct 2026.
No US law bans a small firm from using AI. The duties start when AI shapes who gets a job, a loan, a lease or care.
From 1 Jan 2027, notice-based
In force since 1 Oct 2025
Only CCPA-sized firms
High-risk rules delayed 16 months (EU AI Act; Future of Privacy Forum, Jul 2026, secondary)
Court note. A federal court order of 27 Apr 2026 paused enforcement of Colorado’s 2024 law, after a lawsuit (JD Supra, 28 May 2026). The lawsuit’s claims are allegations, not findings.
Filled dots are in force. Hollow dots are scheduled, and schedules have slipped before.
Dates from the sources in each section. The HIPAA and Colorado dates come from law-firm reports. Read 23 Oct 2026.
These are ForeGaze estimates, not quotes. Change the inputs in the picker above to use your own numbers.
Bars read left to right: your time, tools, insurance. Hours × $75, plus $8 a person a month for MFA tools, plus cyber insurance at $900 + $250 a person. Dental adds 10 HIPAA hours; tax adds 6 plan hours.
| Firm | Solo | ~5 | ~20 |
|---|---|---|---|
| Dental | $2,521 | $4,205 | $10,520 |
| CPA, tax | $2,221 | $3,905 | $10,220 |
| Plumber (and most other trades) | $1,771 | $3,455 | $9,770 |
PCI DSS and Visa’s program apply in Canada as in the US. Privacy and breach duties come from federal and Quebec law.
Report real risk of significant harm
Up to C$25M or 4%
Would amend PIPEDA
These are open, not answered.
Where a rule above comes from a provider's terms, The Small Print quotes and rates it.
We make the hidden visible, the complex simple and the unheard heard.
The research, views and analysis are our own.
Spotted an error, or represent a company named here? Write to hello@foregaze.ai . We fix errors, date each change and publish company responses.
We're not lawyers, accountants or financial advisers. This covers published prices and terms as read on the dates shown under Sources.
Read on the dates shown under Sources. Prices and terms change and vary by plan, region and contract, and custom-priced accounts can differ. Check the provider's own page before you sign or switch.
Complaints and forum reports are what businesses say, unverified unless marked. Nothing here says a company broke the law.
Written by ForeGaze Research. Claude (made by Anthropic) helped with drafting, layout and website design. Every number is checked against the sources listed and manually checked. ForeGaze is responsible for the content.
Company and product names are trademarks of their owners. Short quotes are used for commentary.
Every ForeGaze post sits in one or more series. See them all on the Post Map.
ForeGaze finds and fixes the money leaks in payments, invoicing and the tools between them. Start free, and pay only if we find something (terms on foregaze.ai).
Go to foregaze.aiRules change; check the regulator’s own page before you act. Provider names are trademarks of their owners. See Disclaimers above.