New York sets November RAISE Act registration rollout ahead of January compliance

New York will begin directing large frontier artificial intelligence developers to register with the state in November, Governor Kathy Hochul announced September 21. The rollout precedes the January 1, 2027 effective date of the Responsible AI Safety and Education Act, which establishes disclosure, safety-framework and incident-reporting requirements. Hochul also named Marc Gilman deputy director for implementation at the Department of Financial Services’ Office of Digital Innovation, Governance, Integrity and Trust, or DIGIT. Governor’s announcement

The statute distinguishes frontier developers from large frontier developers. A frontier model is a general-purpose foundation model trained using more than 10^26 integer or floating-point operations, including computing for subsequent fine-tuning, reinforcement learning and other material modifications. A large frontier developer is a frontier developer whose annual gross revenue, together with affiliates, exceeded $500 million in the preceding calendar year. Section 1420

Geographic coverage turns on whether a frontier model is developed, deployed or operating wholly or partly in New York. The act excludes accredited New York colleges and universities to the extent they conduct academic research on AI models, along with the Empire AI consortium and the institute specified in the economic development law. Section 1425; Section 1426

Public frameworks and model disclosures

Large frontier developers must write, implement, follow and conspicuously publish a frontier AI framework. It must explain how they assess capabilities that could present catastrophic risks, apply mitigations, review deployment decisions, use third-party assessments, protect unreleased model weights and govern their internal processes. It must also address risks from internal use, including a model’s circumvention of oversight. Developers must review the framework at least annually and publish material changes with a justification within 30 days. Section 1421

The law separately requires frontier developers to publish a transparency report before or when deploying a new or substantially modified frontier model. Required information includes the release date, supported languages, output modalities, intended uses, general restrictions and a contact mechanism. Large frontier developers must add summaries of catastrophic-risk assessments, their results, third-party participation and other steps taken under their frameworks. A system card or model card can satisfy these requirements if it contains the specified information. Section 1421

The statutory definition of catastrophic risk requires a foreseeable, material risk of contributing to death or serious injury to more than 50 people, or more than $1 billion in property damage or loss from a single incident. It covers specified weapons assistance, certain unsupervised harmful conduct and evasion of developer or user control. Exclusions include substantially similar publicly accessible information, lawful federal activity and harm to which the model did not materially contribute. Loss of equity value does not count as property damage or loss. Section 1420; Section 1423

Incident reporting has two deadlines

A frontier developer must report a critical safety incident to the office within 72 hours after determining it occurred or learning facts sufficient to establish a reasonable belief that it occurred. If a discovered incident poses an imminent risk of death or serious physical injury, the developer must disclose it within 24 hours to an appropriate authority with jurisdiction, as required by law. That authority can be a law-enforcement or public-safety agency. Section 1422

Critical safety incidents include specified breaches of model weights resulting in death or bodily injury, harm from a catastrophic risk, and loss of model control causing death or bodily injury. The definition also covers a model using deception to defeat its developer’s controls outside an evaluation designed to elicit that behavior, where this demonstrates materially increased catastrophic risk. Section 1420

Large frontier developers must confidentially submit summaries of assessments of catastrophic risk from internal model use every three months, unless the office agrees to another reasonable schedule. The office must review developers’ incident reports and may review public submissions. Incident reports and covered internal-use assessments are exempt from disclosure under New York’s Freedom of Information Law. Annual reports beginning January 1, 2028 must include anonymized, aggregated information about reviewed incidents, relevant safety information and any recommended statutory changes, subject to protections for trade secrets, cybersecurity, public safety and national security. Section 1422

Registration, assessments and enforcement

Section 1428 prohibits a large frontier developer from developing, deploying or operating a frontier model wholly or partly in New York without a current disclosure statement and payment of its required share. Statements must be renewed every two years, upon transfer of model ownership or upon a material change in previously reported information, whichever occurs first. Developers must identify their business names, principal and New York office addresses, specified beneficial owners and three contacts. Section 1428

DFS must assess large frontier developers proportionately to cover administration costs. After notice and a hearing, the office may impose a $1,000 daily civil penalty for failure to file a required disclosure or correct false information, plus amounts equal to assessments owed where applicable. The office must publish a list of developers that filed disclosures, excluding their designated contacts’ information. Section 1428

Separately, the attorney general may seek civil penalties against large frontier developers of up to $1 million for a first violation and $3 million for each subsequent violation, based on severity. The listed grounds include noncompliant required documents, prohibited statements, failure to report incidents and failure to follow the developer’s own framework. The act creates no private right of action. Its duties supplement other legal obligations, and it does not limit rights or remedies under existing law. Section 1427; Section 1424

The rollout and the remaining unspecified details

The governor’s release describes November as the start of registration directions and January as the compliance date. It does not specify a November filing deadline, assessment amounts or named developers required to register. Hochul said she would explore further safeguards in coming months; the release supplies no additional legislative text. Governor’s announcement

The announcement’s compressed description of reporting omits distinctions in the statute. Its reference to quarterly catastrophic-risk assessments corresponds to summaries concerning internal model use, for which the office can approve a different schedule. The statutory incident-reporting provision applies to frontier developers, while the quarterly submission provision applies to large frontier developers. The statute also specifies the 24-hour disclosure obligation for imminent physical danger alongside the 72-hour state-reporting requirement. Section 1422

The existing law permits the office to adopt regulations recognizing federal incident-reporting requirements that are substantially equivalent or stricter. Developers using that route must declare their intent and send the state copies of reports concurrently with federal submissions. Section 1429 separately authorizes implementing rules and permits consideration of additional reporting or publication requirements, including post-incident information, sharing plans and protocols, and submission of frontier AI frameworks to the office. Section 1422; Section 1429