Law / United States / 
New York
AI Content Provenance and Stop Deepfakes Act
N.Y. Gen. Bus. Law art. 45-A (proposed §§ 1510-1513), S6954-B / A6540
Finalized, with one agreed text, dated , as of .
An AI transparency rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Market targeting
- Audit expectation
- none
Where it has got to
The text described here is Senate print S6954-B, the text both houses passed. That print is S6954B, published .
Locally, this stage is passed both houses, not yet delivered to the Governor.
The stage above is recorded at www.nysenate.gov.
The Senate passed S6954-B on and the Assembly substituted it for its companion A6540-E and passed it on . In New York a bill passed by both houses reaches the Governor only when it is delivered, which can be months later; no delivery, signature or veto is recorded on the Senate docket.
What it requires
- Embed machine-readable provenance data in synthetic content you create or modify with a generative AI system, identifying it as synthetic.
- If you operate a social media platform, do not delete, disassociate from, or degrade the provenance data attached to content a user uploads.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Penalty structure
As passed: up to $100,000 per violation where intentional or grossly negligent, $50,000 where not, assessed by the Attorney General against the AI provider, hosting platform, or social media platform operator; a court may separately impose a civil penalty of up to $25,000 per violation.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 100,000
What it makes you log
Logging duty
A synthetic content creations system provider must apply provenance data, a content credential, to the synthetic content it produces; a large online platform may not delete, disassociate or degrade that data while the content is hosted and must surface it; state agencies must carry provenance data on the audio, images and video they publish. The provenance data travels with the content itself rather than being kept by the provider or platform as a separate log, and the bill states no duty to create, keep or produce on demand a record of the provenance data or of having applied it.
- Kind
- None
- As of
What this law does
As passed by both houses, it would require providers of generative AI content-creation systems to embed machine-readable provenance data identifying content they create or modify as synthetic, and would bar social media platforms from stripping that provenance data from user-uploaded content.
A grossly negligent or intentional violation exposes the AI provider or hosting platform, or the social media platform's operator, to an Attorney General penalty of up to $100,000 per violation ($50,000 if unintentional), and a court may impose a further civil penalty of up to $25,000 per violation in a private consumer-protection action. Passed the Senate on and the Assembly on .
When LexLint raises it
When your app profile says your app generates content with AI or operates a social platform.
Back to the example · Lint your app
Page updated .