New York RAISE Act

Not legal advice. This page summarizes the statute text as checked on October 17, 2026. Verified Oct 2026.

What it is

The Responsible AI Safety and Education (RAISE) Act is Article 44-B of New York’s General Business Law. Senate Bill S8828 repealed the version enacted in 2025 and replaced it with a new Article 44-B, sections 1420 to 1429. The New York State Assembly’s bill record shows S8828 was signed as Chapter 96 on March 27, 2026.

The law sets transparency and incident-reporting duties for developers of frontier AI models. Oversight sits with an office in the Department of Financial Services, and the Attorney General enforces it.

Who it applies to

• Frontier developers. The text defines these as people who train, or start training, a frontier model. A frontier model is a foundation model trained with more than 10^26 integer or floating-point operations, counting later fine-tuning and other material modifications.
• Large frontier developers. These are frontier developers that, together with their affiliates, had more than $500 million in annual gross revenue in the preceding calendar year. They carry most of the duties.
• Scope. The article applies only to frontier models developed, deployed, or operating in whole or in part in New York. It exempts some academic research and certain state research bodies named in the text.

Most organizations that use AI will not be covered directly. Our interpretation: the law mainly affects enterprises through what their model suppliers have to publish.

Key dates

• March 27, 2026: S8828 signed as Chapter 96 of 2026 (Assembly bill record).
• January 1, 2027: the act takes effect (S8828, sections 3 and 5).
• January 1, 2028 and every year after: the office must produce an annual report with anonymized, aggregated information about critical safety incidents (section 1422(7)). This is a duty of the state, not of developers.

What the law requires

• Frontier AI framework (large frontier developers): publish and follow a framework. It must cover catastrophic-risk thresholds and mitigations, third-party assessment, critical incident response, internal governance, and “cybersecurity practices to secure unreleased model weights from unauthorized modification or transfer by internal or external parties.” The framework must be reviewed at least once a year (section 1421).
• Transparency report (all frontier developers): publish one before or when deploying a new or substantially modified frontier model. Large frontier developers must add summaries of their catastrophic-risk assessments (section 1421(3)).
• Critical safety incident reporting: report to the office within 72 hours of determining that an incident occurred, or of learning facts sufficient for a reasonable belief that one occurred. Where an incident poses an imminent risk of death or serious physical injury, disclose it within 24 hours to an appropriate authority (section 1422(3)). The statute’s definition of a critical safety incident includes unauthorized access to, modification of, or exfiltration of model weights that results in death or bodily injury.
• Disclosure statement (large frontier developers): may not develop, deploy, or operate a frontier model in New York without a current disclosure statement filed with the office (section 1428).
• Penalties: the Attorney General may seek civil penalties of up to $1 million for a first violation and up to $3 million for each later violation. There is no private right of action (section 1427).

What security teams should do

These steps are our suggestions, not requirements of the law.

• If you build or fine-tune very large models: have counsel confirm whether your training compute and revenue cross the statute’s thresholds. Map your incident-response runbooks to the 72-hour and 24-hour clocks.
• Protect model weights as a reportable asset class. The framework must cover weight security, and weight theft is part of the incident definition. Access control, monitoring, and exfiltration detection for weights belong in that program.
• If you buy models: add the supplier’s published frontier AI framework and transparency reports to vendor risk reviews, and ask how the supplier would tell you about a critical safety incident.
• Track rulemaking. The office may adopt rules and add reporting requirements (section 1429).

This page is general information, not legal advice. Verified Oct 2026 against the Senate bill text and the Assembly bill record.