Law / United States / 
New York
Responsible AI Safety and Education Act (RAISE Act)
N.Y. Gen. Bus. Law art. 44-B (§§ 1420-1429), ch. 699 of 2025, as amended by ch. 96 of 2026
Amended by Chapter 96 of the Laws of 2026 (S8828), which moved its start date from to .
An AI governance rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, Place of effect
- Audit expectation
- periodic
- Who audits it
- Self
- Where the report goes
- Published, Filed with regulator
What it requires
- From , if you are a large frontier developer (a frontier developer whose annual gross revenues, together with its affiliates, exceeded $500 million in the preceding calendar year), write, implement, comply with and conspicuously publish on your website a frontier AI framework describing how you set capability thresholds for catastrophic risk, apply and review mitigations before deploying a frontier model or using it extensively internally, use third-party assessors, secure unreleased model weights, respond to critical safety incidents, govern these processes internally, and manage catastrophic risk from internal use.NIST AI RMFGOVERN 1.4
- If you are a large frontier developer, review your frontier AI framework at least once a year, and publish any materially modified framework with a justification for the change within thirty days.NIST AI RMFGOVERN 1.5
- Before or at the same time as you deploy a new or substantially modified frontier model, publish on your website a transparency report giving your website, a way for a person to contact you, the model's release date, its supported languages and output modalities, its intended uses, and any general restrictions or conditions on its use; publishing this in a model card or system card satisfies the duty.NIST AI RMFMAP 2.2
- If you are a large frontier developer, include in that transparency report summaries of your catastrophic-risk assessments of the model, their results, the extent to which third-party evaluators were involved, and the other steps you took under your frontier AI framework.NIST AI RMFGOVERN 4.2
- Report any critical safety incident involving your frontier models to the Department of Financial Services office within 72 hours of determining that it occurred or of learning facts sufficient for a reasonable belief that it did, and, within 24 hours of discovering that an incident poses an imminent risk of death or serious physical injury, disclose it to an authority, including any law enforcement agency or public safety agency with jurisdiction, that is appropriate based on the nature of the incident and as required by law.
- If you are a large frontier developer, send the office a summary of any assessment of catastrophic risk from internal use of your frontier models every three months, or on another reasonable schedule the office agrees to.NIST AI RMFGOVERN 4.2
- Do not make a materially false or misleading statement about catastrophic risk from your frontier models or how you manage it, and, as a large frontier developer, about your implementation of or compliance with your frontier AI framework; a statement made in good faith and reasonable in the circumstances is excepted.NIST AI RMFGOVERN 4.2
- If you redact a document you publish under this article to protect trade secrets, cybersecurity, public safety or national security, or to comply with law, describe the character and justification of each redaction in the published version, to the extent those concerns permit, and keep the unredacted information for five years.no control in the NIST AI RMF
- If you are a large frontier developer, file a disclosure statement with the office before you develop, deploy or operate a frontier model in whole or in part in New York, renew it every two years, or sooner whenever the model's ownership transfers or the reported information materially changes, and pay the pro rata assessment the Department of Financial Services sets to cover the article's costs.NIST AI RMFGOVERN 1.1
- These duties do not reach an accredited New York college or university engaging in academic research on AI models, or the Empire AI consortium or institute.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.
- GOVERN 1.4The risk management process and its outcomes are established through transparent policies, procedures, and other controls based on organizational risk priorities.
- GOVERN 1.5Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities clearly defined, including determining the frequency of periodic review.
- GOVERN 4.2Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and they communicate about the impacts more broadly.
- MAP 2.2Information about the AI system’s knowledge limits and how system output may be utilized and overseen by humans is documented. Documentation provides sufficient information to assist relevant AI actors when making decisions and taking subsequent actions.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Private right of actionNo
Penalty structure
Civil penalty of up to $1,000,000 for a first violation and up to $3,000,000 for each subsequent violation, determined by severity, recovered by the Attorney General against a large frontier developer (section 1427(1)). Separately, the office may levy $1,000 for each day a disclosure statement is missing or false information goes uncorrected, plus the assessments owed, after notice and hearing (section 1428(5)).
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 1,000,000
Who enforces it
Enforcement body
New York Attorney General (civil penalties, section 1427); the Department of Financial Services office (disclosure-statement penalties, section 1428)
What it makes you log
Log retention
Five years for the unredacted information behind a redacted published document.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
A frontier developer that redacts a document it publishes under the article (a frontier AI framework, a transparency report) must retain the unredacted information for five years. The 2025 text's duty to record the tests behind each frontier-model assessment is not in the new article.
- Kind
- Explicit
- As of
- Provision
- § 1421(5)(b)
- Trigger
- all_systems
What this law does
Chapter 96 of the Laws of 2026, signed , repealed the RAISE Act's article 44-B as first enacted by chapter 699 of the Laws of 2025 and replaced it with a new article 44-B, sections 1420 to 1429, which takes effect on . The same chapter moved the original act's effective date from the ninetieth day after its signing to , and that change took effect when chapter 96 was signed.
A frontier developer is a person that has trained, or begun training, a foundation model using more than 10^26 integer or floating-point operations, counting fine-tuning and other material modifications. A large frontier developer is a frontier developer that, with its affiliates, had annual gross revenues above $500 million in the preceding calendar year.
Catastrophic risk means a foreseeable and material risk that a frontier model will materially contribute to the death of or serious injury to more than fifty people, or to more than $1 billion in property damage, in a single incident in which the model gives expert-level help toward a chemical, biological, radiological or nuclear weapon, engages without meaningful human oversight in a cyberattack or in conduct that would be murder, assault, extortion or theft if a human did it, or evades the control of its developer or user.
It excludes information the model outputs that is publicly accessible in substantially similar form from a source other than a foundation model, lawful activity of the federal government, and harm from the model combined with other software when the model did not materially contribute to it.
A large frontier developer must write, implement, comply with and publish on its website a frontier AI framework describing how it sets capability thresholds, assesses and mitigates catastrophic risk, uses third-party assessors, secures unreleased model weights, responds to critical safety incidents and governs these processes internally.
It must review the framework at least once a year, publish any materially modified framework with a justification within thirty days, and send the office a summary of any assessment of catastrophic risk from internal use of its frontier models every three months or on another schedule the office agrees to.
Before or when it deploys a new or substantially modified frontier model, every frontier developer must publish a transparency report giving its website, a contact mechanism, the model's release date, languages, output modalities, intended uses and restrictions, and a large frontier developer's report must also summarize its catastrophic-risk assessments, their results and the involvement of third-party evaluators.
A frontier developer must report a critical safety incident to an office in the Department of Financial Services within 72 hours of determining that it occurred or of learning facts that support a reasonable belief that it did, and must disclose one posing an imminent risk of death or serious physical injury within 24 hours to an appropriate law enforcement or public safety authority.
A critical safety incident includes unauthorized access to, modification of or exfiltration of a frontier model's weights that results in death or bodily injury, harm from a catastrophic risk materializing, loss of control of a frontier model that causes death or bodily injury, and a frontier model using deceptive techniques against its developer to subvert its controls or monitoring, outside an evaluation designed to elicit that behavior, in a way that shows materially increased catastrophic risk.
No frontier developer may make a materially false or misleading statement about catastrophic risk from its frontier models or how it manages that risk, and no large frontier developer may make one about its implementation of or compliance with its framework, unless the statement was made in good faith and was reasonable in the circumstances.
A developer that redacts a published document to protect trade secrets, cybersecurity, public safety or national security, or to comply with law, must describe each redaction's character and justification in the published version, to the extent those concerns permit, and keep the unredacted information for five years.
A large frontier developer must also file a disclosure statement with the office, naming itself, its New York offices, its significant owners and its points of contact, before developing, deploying or operating a frontier model in New York, renew it every two years or sooner on a change of ownership or a material change, and pay a pro rata share of the cost of administering the article.
The article reaches frontier models developed, deployed or operating in whole or in part in New York, and does not apply to accredited New York colleges and universities doing academic research on AI models or to the Empire AI consortium and institute.
The Attorney General may seek a civil penalty, scaled to severity, of up to $1,000,000 for a first violation and up to $3,000,000 for each later one when a large frontier developer fails to publish or transmit a required document, makes a prohibited statement, fails to report an incident or fails to follow its own framework, and the office may levy $1,000 a day for a missing or false disclosure statement after notice and a hearing. The article creates no private right of action.
When LexLint raises it
When your app profile says your app is a frontier developer.
Back to the example · Lint your app
Page updated .