Law / United States / 
New York
New York Artificial Intelligence Act
Before the second chamber, dated , as of .
An AI risk obligations rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- periodic
- Who audits it
- Independent third party, Self
- Where the report goes
- Filed with regulator
Where it has got to
The text described here is Senate print S1169-B, as passed by the Senate. That print is S1169B, published .
Locally, this stage is delivered to the Assembly.
The stage above is recorded at nyassembly.gov.
Print S1169-A passed the Senate on and was returned to the Senate at the end of that year without an Assembly vote. Reprinted as S1169-B, it was discharged from committee and committed to the Senate Rules Committee, passed the Senate on and was delivered to the Assembly the same day; the Assembly's record shows no later action on it.
What it requires
- Inform the affected individual, at the immediate onset of the engagement, that a high-risk AI system will be used to make or assist in making a consequential decision (Section 108(1)).NIST AI RMFMEASURE 2.8
- Inform the affected individual and any covered agent within 10 days that a high-risk AI system has been used to make a consequential decision, and provide and explain a process to appeal it (Section 108(2)(a)).NIST AI RMFMEASURE 3.3NIST AI RMFMEASURE 2.8
- If you are a covered developer, file a report with the Department of Financial Services within 6 months after you complete development of the high-risk AI system and first offer it to a deployer (or, if you are the first deployer, after initial deployment), and another within 6 months of any substantial change to the system (Section 111(3)).NIST AI RMFGOVERN 1.1
- If you are a covered deployer, file a report with the Department of Financial Services within 6 months after initial deployment of the high-risk AI system, and another within 6 months of any substantial change to the system (Section 111(4)).NIST AI RMFGOVERN 1.1
- Conduct regular impact assessments of the high-risk AI system for algorithmic discrimination.NIST AI RMFMEASURE 2.11
- Preserve the individual's option to request human review of the decision.NIST AI RMFMEASURE 3.3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
- MEASURE 2.11Fairness and bias – as identified in the MAP function – are evaluated and results are documented.
- MEASURE 3.3Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator, Auditor or notified body
What the log must hold
Actor identity, System identity, Data lineage
Log retention
Section 108(6)(a)(iv) sets the five-year period for a developer's records of deployer agreements only; the audits, reports and risk management program of sections 110 to 112 carry no retention period.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
A developer that intends its AI system not to be used as a high-risk system must maintain records of its deployer agreements for at least five years (section 108(6)(a)(iv)). Covered developers and deployers must also have recurring independent audits (section 110), file periodic reports and the last completed audit with the Department of Financial Services (section 111), and plan, document and keep updated a risk management policy and program (section 112).
- Kind
- Explicit
- As of
- Provision
- Sections 108(6)(a)(iv), 110, 111 and 112
- Trigger
- high_risk_systems
- automated_decisions
Why the legislator wanted it
Section 2(d) of the bill's legislative findings and intent; no sponsor memorandum is available for S1169-B.
- As of
- Quote
- the companies employing and profiting from the use of AI must lead in ... ensuring that their products are free from algorithmic discrimination.
- Source link
- https://nyassembly.gov/leg/?default_fld=&bn=S01169&term=2025&Summary=Y&Text=Y
- Source kind
- Recital
- Purpose
- bias_and_performance_monitoring
- accountability_demonstration
What this law does
As passed by the Senate, it would add a new Civil Rights Law article 10-A requiring a company (a deployer) using a high-risk AI system for a consequential decision (covering, among other categories, employment, education, housing and essential utilities) to disclose that use to the affected individual at least five business days in advance, conduct regular fairness and non-discrimination impact assessments, and preserve the individual's option to request human review.
An earlier print passed the Senate in June 2025 and died in the Assembly in January 2026. The Senate repassed a new print, S1169-B, on and delivered it to the Assembly.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .