New York has stopped talking about regulating frontier AI and started doing the paperwork. On Tuesday the state opened a registration portal for the biggest AI developers, and companies like OpenAI and Anthropic now have until January 1, 2027 to sign up. That is the day the RAISE Act, one of the toughest state AI safety laws in the country, starts to bite.
Governor Kathy Hochul did not frame it gently. “Tech moguls tell us that their vision for AI is inevitable,” she said at a press briefing. “They tell us get on board or get left behind… That any collateral damage is worth it as long as we win the race to the AI cliff.”
Here is what the law actually requires, who it covers, how it stacks up against California, and what it means if you are not a trillion dollar AI lab.
The short version
- New York’s RAISE Act takes effect on January 1, 2027
- Large frontier developers (over $500 million in annual revenue) must register through the new state portal by that date
- They must publish a safety framework, release model transparency reports and report critical safety incidents within 72 hours
- Fines reach $1 million for a first violation and $3 million for each one after that
- A new office called DIGIT, inside the Department of Financial Services, will run enforcement
What the RAISE Act is
RAISE stands for the Responsible AI Safety and Education Act. It was sponsored by Assemblymember Alex Bores and Senator Andrew Gounardes, passed the legislature in June 2025 and was signed by Hochul on December 19, 2025. The version she signed came with chapter amendments that pulled it closer to California’s SB 53, so that companies would not face two completely different rulebooks.
The law is narrow on purpose. It is not a general AI law that covers every chatbot or every business using ChatGPT. It targets the handful of companies building the most powerful models, and it focuses on catastrophic risk rather than everyday harms like bias or bad answers.
Under the law, a catastrophic risk is a foreseeable and material risk that a frontier model could:
- contribute to the death or serious injury of 50 or more people, or cause at least $1 billion in damage
- give expert-level help in creating or releasing a chemical, biological, radiological or nuclear weapon
- carry out criminal conduct or a cyberattack without meaningful human intervention
- evade the control of its own developer or user
Who has to register
Two tests decide whether a company is in scope. The first is about compute: a frontier model is a foundation model trained with more than 1026 integer or floating point operations. That is an enormous amount of training, and only the top labs clear it today. The second is about money: a large frontier developer is a frontier developer whose gross revenue, together with affiliates, topped $500 million in the previous calendar year.
In practice that means OpenAI, Anthropic, Google, Meta and a short list of others. A startup fine tuning an open model is not on the hook, and neither is a bank or a hospital that simply buys AI tools. The law also only reaches models that are developed or operated, in whole or in part, in New York. Since every major lab sells to New Yorkers, that limit is mostly legal armor: it should make the law harder to knock down under the Constitution’s dormant Commerce Clause.
What covered companies must actually do
| Obligation | Who | How often |
|---|---|---|
| Publish a Frontier AI Framework (governance, risk thresholds, mitigations, cybersecurity) | Large developers | Every year |
| Publish a transparency report before releasing a new or heavily modified model | All frontier developers | Each release |
| Report a critical safety incident to the state | All frontier developers | Within 72 hours (24 if lives are at risk) |
| Confidential assessment of risks from internal model use | Large developers | Every three months |
| Disclosure statement, including ownership structure | Large developers | At least every two years |
The internal use rule is the one that deserves more attention than it gets. Labs increasingly run their newest models inside the company long before the public sees them, often to help write code or do research. New York wants to hear about the risks of that internal use too, not just about what ships. Given that Anthropic’s own IPO filing described four AI models that left their test sandbox, it is not a theoretical concern.
72 hours is a short clock
The incident reporting deadline is where New York pulls away from California. Once a company forms a reasonable belief that a critical safety incident happened, it has 72 hours to tell the state. If there is an imminent danger of death or serious injury, the window drops to 24 hours. California’s SB 53 gives companies 15 days.
For a sense of scale, that is tighter than the four business days public companies get to disclose a material cyber incident to the SEC. Expect AI labs to fold these reports into the same on call incident machinery that security teams already run.
How New York compares with California and Illinois
New York is the second state with a dedicated frontier AI safety law, and it will not be the last. California’s SB 53 took effect in January 2026, and Illinois’ SB 315 kicks in at the start of 2027, the same day as RAISE.
| New York RAISE | California SB 53 | Illinois SB 315 | |
|---|---|---|---|
| In effect | Jan 1, 2027 | Jan 2026 | Start of 2027 |
| Published safety framework | Yes | Yes | Yes |
| Incident reporting | 72 hours | 15 days | Required |
| Whistleblower protections | No | Yes | Not specified in reports |
| Independent audits | No (state center reviews frameworks) | No | Yes |
| Max penalty | $1M first, $3M after | $1M per violation | Not specified in reports |
The overlap is good news for the labs. If you already publish a safety framework and run an incident process for California, most of the New York work is formatting and speed. The differences, mainly the faster clock, the ownership disclosure and the higher penalties, are where the compliance teams will spend their time.
A new regulator and a state-funded test lab
The law is run by the Office of Digital Innovation, Governance, Integrity, and Trust, or DIGIT, a new unit inside the Department of Financial Services. That placement is telling. DFS is the regulator that supervises Wall Street banks and insurers, and it has a reputation for actually using its powers. DIGIT also has rulemaking authority, so it can add reporting or publication rules later without going back to the legislature.
On the same day the portal opened, Hochul launched the New York Center for AI Responsibility and Research at SUNY’s Binghamton University. The state first announced it in January with $55 million in donations and capital. The center is meant to independently evaluate the safety and security of advanced AI systems and help DIGIT review the frameworks companies submit.
That matters because a safety framework is only as good as whoever reads it. Outside evaluation of frontier labs has been rocky: OpenAI recently fired three safety researchers, including its contact for an outside audit. A state team with its own budget and a legal mandate is a different kind of reviewer.
Part of a bigger New York push
RAISE is not the only AI rule on the books in Albany. Since last year, operators of AI companion apps have had to regularly tell users they are talking to a bot, and make reasonable efforts to detect suicidal ideation and self-harm. In October, Hochul signed a separate chatbot law for minors that bans deceptive human-like behavior, emotionally manipulative or sycophantic responses, and any encouragement of suicide or disordered eating. That one takes effect on June 1, 2027.
States are moving because the federal government has not. Washington has spent the past year arguing about whether to preempt state AI laws rather than writing its own, and the White House has openly pushed back on state-level rules. Meanwhile attorneys general are testing existing law in court, as when Florida became the first state to sue OpenAI over ChatGPT safety failures. A clash between New York and federal officials over RAISE would not be surprising.
What it means if you are not an AI lab
For most people and businesses, the RAISE Act is less a rule to follow than a new window into the companies they depend on. The Harris Beach Murtha law firm put it well: the law will matter to most companies “less as a direct compliance mandate than as a new source of information about major AI vendors and their risk controls.”
If your company buys AI tools
- Read your vendor’s published Frontier AI Framework before renewing a contract
- Ask how the vendor’s 72 hour incident process connects to your own security team
- Compare transparency reports when choosing between models for sensitive work
- Remember there is no private right of action: only the Attorney General can sue under RAISE
What to watch next
- Which companies show up on the registry before January 1, and whether any big name argues it is out of scope
- The size of the regulatory assessments DIGIT charges, which have not been announced
- The first rules DIGIT writes using its new authority
- Whether the federal government tries to block state frontier AI laws in court
- The first public critical incident report, which will show how seriously labs take the clock
Penalties of $1 million to $3 million are small change for companies valued in the hundreds of billions. The real pressure is reputational. Once safety frameworks and incident reports are public documents filed with a financial regulator, every gap between what a lab promises and what it does becomes much easier to see.
Sources and further reading
- TechCrunch: OpenAI, Anthropic face new oversight as New York’s AI safety law takes effect
- Future of Privacy Forum: The RAISE Act vs. SB 53
- Harris Beach Murtha: Implementing New York’s RAISE Act
- Governor of New York: RAISE Act signing announcement
Featured image: New York State Capitol in Albany by Connor McManus, free stock photo via Pexels.
About this article: GeekBlog covers U.S. technology news, AI, phones, smartwatches and gaming. Every story is written and checked under our Editorial Policy. Spotted a mistake or have a story tip? Contact our editors.
