New York's continuing legal education rules don't sit still for long. Since 2023, the New York State CLE Board has layered in a mandatory cybersecurity category, and as of January 1, 2026, it tightened the format rules for Skills credits as well. Both changes apply on top of the existing structure that distinguishes experienced attorneys from newly admitted attorneys, so it's easy to miss a detail if you're working from an older summary of New York CLE requirements. If you haven't checked your compliance plan against these updates recently, here's what's changed and what it means for your current compliance period.

The Cybersecurity, Privacy and Data Protection Requirement: A Quick Recap

Effective July 1, 2023, every New York attorney — experienced and newly admitted alike — must complete at least 1 CLE credit hour in Cybersecurity, Privacy and Data Protection as part of their regular CLE requirement. Courses in this category fall into two tracks:

• Cybersecurity, Privacy and Data Protection — Ethics, covering an attorney's ethical obligations to protect electronic data and communications: client protection, obtaining client consent, firm data policies, secure storage and destruction of electronic records, and supervision of employees and third-party vendors.

• Cybersecurity, Privacy and Data Protection — General, covering the technological side: sending, receiving, and storing client data; recognizing threats and inadvertent disclosures; remote-work cybersecurity issues; vendor evaluation; and incident response planning.

You can satisfy the 1-credit requirement entirely through one track, or split it — a course combining ½ credit Cybersecurity Ethics and ½ credit Cybersecurity General works too. The New York State CLE Program Rules govern exactly how each track is defined, so it's worth confirming a course's designation before assuming it counts toward the requirement you need.

How the Cybersecurity Requirement Works for Experienced Attorneys

Attorneys admitted to the New York State Bar for more than two years are experienced attorneys, and this requirement does not add to their total. Experienced attorneys still complete 24 credit hours every two years — the cybersecurity credit is simply pulled from within that existing total. Up to 3 credits of Cybersecurity Ethics coursework can also count toward your separate Ethics and Professionalism requirement, so a heavier cybersecurity course load can do double duty.

Any cybersecurity credit hours completed beyond the 1-credit minimum count toward your general CLE total and can be included in the standard 6-credit maximum carryover into your next compliance period, the same as any other excess credit.

How the Cybersecurity Requirement Works for Newly Admitted Attorneys

Attorneys admitted two years or less are newly admitted attorneys, and the cybersecurity requirement works similarly for them — it doesn't increase their 32-credit total across the two-year newly admitted cycle (16 credits per year). The 1 CLE credit hour can be completed in either year of the cycle, not both, and up to 3 credits of Cybersecurity Ethics coursework can count toward the 6-credit Ethics and Professionalism requirement spread across that cycle.

Carryover treatment differs by track here: excess Cybersecurity Ethics credit cannot carry into the next two-year reporting period, but excess Cybersecurity General credit can.

What's New for January 1, 2026: Tighter Format Rules for Skills Credits

The more recent change affects newly admitted attorneys specifically. Through the end of 2025, Skills credits could be earned not just in a traditional live classroom setting or by fully interactive videoconference, but also through live simultaneous transmission formats — webinar, teleconference, or live webcast — as long as the program allowed real-time audience questions.

As of January 1, 2026, that flexibility is gone for Skills CLE credits. Newly admitted attorneys must now complete Skills credits exclusively through a traditional live classroom setting or a fully interactive videoconference where participants are physically grouped together. Teleconference and webinar formats, even with live Q&A, no longer satisfy the Skills category — though they still work fine for Ethics and Professionalism and Cybersecurity Ethics credit, which retain the broader synchronous-format allowance.

This is a meaningful planning shift if you've been relying on remote, interactive formats to knock out Skills credits. Programs like the New York State Bar's Bridge the Gap series — an in-person foundational program built for newly admitted attorneys — are a reliable way to satisfy the new format requirement while also covering substantive practice fundamentals in one sitting.

Quick Reference: Current New York CLE Requirements

• Experienced attorneys: 24 credit hours every two years, including at least 4 in Ethics and Professionalism, 1 in Diversity, Inclusion and Elimination of Bias, and 1 in Cybersecurity, Privacy and Data Protection.

• Newly admitted attorneys: 32 credit hours over the first two years (16 per year), including 3 Ethics and Professionalism credits, 6 Skills CLE credits, and 7 credits in Law Practice Management and/or Areas of Professional Practice each year — plus the 1-credit cybersecurity requirement somewhere across the cycle. Diversity, Inclusion and Elimination of Bias is not required for newly admitted attorneys.

Both groups can fulfill general categories — Law Practice Management, Areas of Professional Practice, and Cybersecurity General — through nearly any accredited format, including on-demand and self-paced courses.

Make Sure Your CLE Provider Is Accredited

Whichever changes apply to you, the course itself still has to come from an accredited provider. Not every CLE provider holds accreditation in every credit category, so before you count on a program to satisfy Skills, Ethics, or Cybersecurity requirements, confirm the provider and the specific course are approved for that category under the New York State Continuing Legal Education Board's standards. It's also worth knowing who actually regulates this: the New York State Bar Association is a voluntary membership organization and CLE provider, but it doesn't write or enforce the rules. That authority sits with the New York State CLE Board, part of the Unified Court System, which is also the body that approved both the 2023 cybersecurity requirement and the 2026 Skills format change. NBI maintains accreditation across New York's credit categories and is continuing to expand its catalog of courses that satisfy the newer Skills format and Cybersecurity requirements as they roll out.

Frequently Asked Questions About New York's CLE Changes

When did the Cybersecurity, Privacy and Data Protection requirement take effect?

The requirement became effective July 1, 2023. Attorneys could begin earning qualifying credit starting January 1, 2023, though coursework completed before that date does not count toward the requirement.

Does the cybersecurity requirement add extra credits on top of my existing CLE total?

No. Experienced attorneys still complete 24 credit hours every two years, and newly admitted attorneys still complete 32 credit hours over their first two years. The cybersecurity credit is drawn from within those existing totals.

What changed for Skills credits on January 1, 2026?

Newly admitted attorneys must now complete Skills CLE credits exclusively through a traditional live classroom setting or a fully interactive videoconference with group participation. Webinar, teleconference, and live webcast formats no longer qualify for Skills credit, even with real-time interactivity.

Can Cybersecurity Ethics credit count toward my Ethics and Professionalism requirement?

Yes, up to a point. Experienced attorneys can apply up to 3 Cybersecurity Ethics credits toward their 4-credit Ethics and Professionalism requirement. Newly admitted attorneys can apply up to 3 credits toward their 6-credit Ethics and Professionalism requirement across the two-year cycle.

Can I carry over excess cybersecurity credits to my next compliance period?

For experienced attorneys, yes — excess cybersecurity credit falls under the standard 6-credit carryover maximum. For newly admitted attorneys, only excess Cybersecurity General credit carries forward; excess Cybersecurity Ethics credit does not.

How do I know if a course is accredited for these categories in New York?

Check that the course provider appears on the New York State CLE Board's accredited provider list and that the specific program is approved for the credit category you need — Skills, Ethics and Professionalism, or Cybersecurity General/Ethics each have their own approval standards.

Stay Ahead of New York's Evolving CLE Rules

Between the 2023 cybersecurity requirement and the 2026 Skills format changes, New York's CLE rules have shifted twice in a few years — and they're likely to keep evolving. NBI is committed to keeping New York attorneys covered as the rules change, with accredited courses across Ethics and Professionalism, Skills, Law Practice Management, Areas of Professional Practice, and Cybersecurity (both General and Ethics tracks). Browse NBI's New York CLE catalog to find courses that meet your current requirements, whichever category you're filling.

The New York CLE requirements page has more information on all New York MCLE requirements. This useful FAQ has additional answers about the new Cybersecurity, Privacy and Data Protection requirement.