What happened
The New York governor’s announcement says Hochul signed the RAISE Act, identified as S6953B/A6453B, on December 19, 2025, in Albany. The law requires large AI developers to create and publish information about their safety protocols. It also requires them to report incidents of critical harm to the state within 72 hours of determining that an incident occurred. The announcement describes the law as applying to developers of powerful frontier AI models, but does not specify the threshold that makes a developer subject to it.
The law creates an oversight office within the New York State Department of Financial Services. That office will assess large frontier developers and support greater transparency, and will issue reports annually. The governor’s announcement frames the office as a state oversight mechanism rather than a voluntary industry forum. It does not describe its staffing, assessment methodology, intake process, or the information developers must provide to it beyond the law’s stated transparency and reporting requirements.
The announcement says the New York Attorney General can bring civil actions against large frontier developers for failing to submit required reports or for making false statements. Penalties can reach $1 million for a first violation and $3 million for subsequent violations. That places the enforcement mechanism with the state’s attorney general, while the Department of Financial Services office is assigned an assessment and reporting role. The announcement calls the law an agreed-upon version with chapter amendments and says it builds on California’s recently adopted framework.
Hochul described the law as setting a standard for frontier AI transparency and safety. State officials and lawmakers quoted in the announcement presented it as a way to establish accountability while maintaining innovation. The practical obligations described by the state are narrower and concrete: publish information about safety protocols, report a critical-harm incident within the stated period after determining it occurred, and avoid false statements or failures to submit required reports. The announcement does not set out how New York’s requirements will interact operationally with California’s framework, federal policy, or a developer’s existing internal safety processes.
What the archive adds
New Runtime’s earlier coverage reported that Anthropic had circulated a draft US AI-safety bill that could lead to a court-ordered halt of a model release: the October 21, 2026 note. That was a proposal; the RAISE Act is a signed New York law with defined reporting duties and penalties. New Runtime also covered New York’s separate law restricting unsafe AI-companion features for minors and unverified users: the October 31, 2026 note. This is a new event in the state’s AI regulation, not a restatement of that companion-focused law.
Trend signal
This supports the broader movement of AI safety obligations from voluntary policy toward institutional oversight and enforceable disclosure. It does not yet fit a specific pattern New Runtime tracks: the law establishes reporting and assessment duties, but the governor’s announcement does not show how those duties will change model development, application deployment, or runtime controls in practice.
Why it matters
For teams building on frontier models, a vendor’s safety posture increasingly has a regulatory dimension. New York’s reporting deadline and penalties could make incident escalation, evidence retention, and clear ownership across a provider’s safety, legal, security, and operations teams more consequential. A customer may need to understand how its provider detects and classifies serious incidents, and how customers’ own observations reach the provider quickly enough to inform any reporting obligation.
The announcement does not say that downstream application developers inherit the same duties. Still, procurement and deployment teams should watch for providers’ published frameworks and ask how incidents are identified, escalated, documented, and reviewed. This is not merely a request for a general safety statement: the law connects disclosure to a reporting obligation and potential enforcement. Those answers can matter to operational readiness even before the state’s oversight office publishes its first annual report.
What happens next
- New York will clarify how it assesses covered frontier developers and receives reports. (6 months, 65%). Watch for: Department of Financial Services guidance or the oversight office’s first public materials.
- Large model developers will make their published safety-protocol information easier to locate and compare. (12 months, 60%). Watch for: new or revised public safety-framework pages that address the law’s disclosure duty.
Limits and uncertainty
The governor’s announcement does not define the threshold for a “large” developer or “frontier” model, or explain what qualifies as critical harm. It does not describe the office’s assessment process, how reports will be made public, what evidence establishes that an incident occurred, or when the new requirements become operational. The announcement is a government statement about the law; implementation details and the law’s application to particular developers remain to be established. No independent assessment of compliance, expected enforcement volume, or the burden on covered developers is described.
Skill to build now
Create a short incident-escalation record for each frontier-model provider your product depends on: the provider’s published safety framework, a named internal owner, the route for reporting suspected severe misuse or harm, and the logs your team can preserve. Test the handoff with a tabletop scenario. This does not establish a statutory duty for an application team, but it makes a provider-risk question operational rather than contractual boilerplate.
Reader takeaway
New York has turned frontier-model safety disclosure and critical-incident reporting into statutory obligations for large developers. The 72-hour clock begins when a developer determines that an incident occurred, and violations can carry multimillion-dollar penalties. Builders should treat providers’ incident processes and published safety frameworks as practical diligence questions while watching for state guidance on scope and operation.
Open question
Which developers and models will New York treat as covered, and what factual threshold will trigger a reportable critical-harm incident?