New York

Chapter 96 of the Laws of 2026, signed March 27, 2026, repealed the RAISE Act's article 44-B as first enacted by chapter 699 of the Laws of 2025 and replaced it with a new article 44-B, sections 1420 to 1429, which takes effect on January 1, 2027. The same chapter moved the original act's effective date from the ninetieth day after its December 19, 2025 signing to January 1, 2027, and that change took effect when chapter 96 was signed.

A frontier developer is a person that has trained, or begun training, a foundation model using more than 10^26 integer or floating-point operations, counting fine-tuning and other material modifications. A large frontier developer is a frontier developer that, with its affiliates, had annual gross revenues above $500 million in the preceding calendar year.

Catastrophic risk means a foreseeable and material risk that a frontier model will materially contribute to the death of or serious injury to more than fifty people, or to more than $1 billion in property damage, in a single incident in which the model gives expert-level help toward a chemical, biological, radiological or nuclear weapon, engages without meaningful human oversight in a cyberattack or in conduct that would be murder, assault, extortion or theft if a human did it, or evades the control of its developer or user.

It excludes information the model outputs that is publicly accessible in substantially similar form from a source other than a foundation model, lawful activity of the federal government, and harm from the model combined with other software when the model did not materially contribute to it.

A large frontier developer must write, implement, comply with and publish on its website a frontier AI framework describing how it sets capability thresholds, assesses and mitigates catastrophic risk, uses third-party assessors, secures unreleased model weights, responds to critical safety incidents and governs these processes internally.

It must review the framework at least once a year, publish any materially modified framework with a justification within thirty days, and send the office a summary of any assessment of catastrophic risk from internal use of its frontier models every three months or on another schedule the office agrees to.

Before or when it deploys a new or substantially modified frontier model, every frontier developer must publish a transparency report giving its website, a contact mechanism, the model's release date, languages, output modalities, intended uses and restrictions, and a large frontier developer's report must also summarize its catastrophic-risk assessments, their results and the involvement of third-party evaluators.

A frontier developer must report a critical safety incident to an office in the Department of Financial Services within 72 hours of determining that it occurred or of learning facts that support a reasonable belief that it did, and must disclose one posing an imminent risk of death or serious physical injury within 24 hours to an appropriate law enforcement or public safety authority.

A critical safety incident includes unauthorized access to, modification of or exfiltration of a frontier model's weights that results in death or bodily injury, harm from a catastrophic risk materializing, loss of control of a frontier model that causes death or bodily injury, and a frontier model using deceptive techniques against its developer to subvert its controls or monitoring, outside an evaluation designed to elicit that behavior, in a way that shows materially increased catastrophic risk.

No frontier developer may make a materially false or misleading statement about catastrophic risk from its frontier models or how it manages that risk, and no large frontier developer may make one about its implementation of or compliance with its framework, unless the statement was made in good faith and was reasonable in the circumstances.

A developer that redacts a published document to protect trade secrets, cybersecurity, public safety or national security, or to comply with law, must describe each redaction's character and justification in the published version, to the extent those concerns permit, and keep the unredacted information for five years.

A large frontier developer must also file a disclosure statement with the office, naming itself, its New York offices, its significant owners and its points of contact, before developing, deploying or operating a frontier model in New York, renew it every two years or sooner on a change of ownership or a material change, and pay a pro rata share of the cost of administering the article.

The article reaches frontier models developed, deployed or operating in whole or in part in New York, and does not apply to accredited New York colleges and universities doing academic research on AI models or to the Empire AI consortium and institute.

The Attorney General may seek a civil penalty, scaled to severity, of up to $1,000,000 for a first violation and up to $3,000,000 for each later one when a large frontier developer fails to publish or transmit a required document, makes a prohibited statement, fails to report an incident or fails to follow its own framework, and the office may levy $1,000 a day for a missing or false disclosure statement after notice and a hearing. The article creates no private right of action.

A depicted individual has a civil cause of action against a person who discloses, disseminates or publishes sexually explicit material showing them that was created or altered through digitization (defined to include software, machine learning, artificial intelligence, or other computer-generated or technological means) without their consent, where the defendant knew or should have known that consent was lacking.

A disclaimer stating the depiction is unauthorized or fabricated is not a defense, and the finder of fact may award injunctive relief, punitive damages, compensatory damages, and attorney's fees.

Signed October 28, 2026 as chapter 368 of the Laws of 2026, the act adds article 48 to the General Business Law. It takes effect January 1, 2027. It bars an operator from providing a covered AI companion with unsafe features to a covered user unless the user is not a covered minor, meaning a minor the operator actually knows is one, and the operator has used a permitted age-assurance method to determine that.

Unsafe features include outputs that facilitate suicide, self-harm, disordered eating or sexually explicit conduct, outputs that encourage secrecy or self-isolation, features deceptive as to minors about the companion's non-sentient nature, and engagement-optimizing outputs that override the companion's own safety guardrails. The Attorney General enforces the act. Passed the Senate on June 4, 2026 and the Assembly on June 5, 2026.

Section 50 makes it a misdemeanor for a person, firm or corporation to use for advertising purposes, or for the purposes of trade, the name, portrait, picture, likeness, or voice of any living person without first obtaining the written consent of that person, or of a minor's parent or guardian.

Section 51 lets a person whose name, portrait, picture, likeness or voice is used within the state for advertising purposes or for the purposes of trade without that written consent maintain an equitable action in the supreme court to prevent and restrain the use, and sue to recover damages for any injuries sustained. If the defendant knowingly used the name, portrait, picture, likeness or voice in a manner forbidden by section 50, the jury may in its discretion award exemplary damages.

Section 51 does not prohibit the copyright owner of a sound recording from dealing in, licensing or selling that recording where the right to do so was conferred by contract or other written document by the living person or the holder of the right.

Section 51 also permits using the name, portrait, picture, likeness or voice of an author, composer or artist in connection with the literary, musical or artistic productions they have sold or disposed of with that name, portrait, picture, likeness or voice used in connection therewith. The provisions this entry describes came into force on different days.

A person who uses a deceased performer's digital replica, a newly created, computer-generated, highly realistic electronic representation of their voice or visual likeness, in an audiovisual work, sound recording, or live musical performance, knowing the use was unauthorized by the applicable right holder, is liable for the greater of $2,000 or the injured party's compensatory damages, plus disgorgement of the defendant's profits and, in the court's discretion, punitive damages.

The section exempts parody, satire, commentary, documentaries and similar works, and news, public affairs and political-campaign uses. The digital replica provisions were first enacted effective 23 December 2022 and were further revised, per the consolidated law page's own revision history, effective 19 December 2025.

It is a class A misdemeanor to intentionally disseminate or publish an intimate image of another person without consent and with intent to cause emotional, financial or physical harm, including an image created or altered by digitization; the statute defines digitization to mean altering an image in a realistic manner using images of a person other than the person depicted, or computer-generated images.

The offense applies regardless of the actor's role in creating the original image, so a person who disseminates an AI-generated or AI-altered intimate depiction is exposed on the same terms as one who disseminates an unaltered photograph.

An operator of an AI companion, a system using artificial intelligence, generative AI or emotional-recognition algorithms to simulate a sustained human-like relationship with a user, must provide a clear and conspicuous notification at the start of an interaction and at least every three hours that the user is not communicating with a human, and must implement a protocol reasonably designed to detect and respond to a user's expressions of suicidal ideation or self-harm by referring them to crisis services such as the 9-8-8 hotline.

The Attorney General may enjoin a violation and seek civil penalties of up to $15,000 per day per violation of the notification or self-harm-detection duties. The article defines the operator bound by these duties as any person, partnership, association, firm or business entity that operates for or provides an AI companion to a user.

A person, firm, association, corporation, campaign, committee or organization that distributes or publishes a political communication produced by or including materially deceptive media, defined to include content created by software, machine learning, artificial intelligence or other computer-generated or technological means that is not distinguishable from reality to a reasonable person and depicts a scenario that did not occur, must disclose that use when it has actual knowledge the media is materially deceptive.

The disclosure must read "This (image, video, or audio) has been manipulated" in a specified legible format, subject to exemptions for satire, parody and bona fide news reporting. A depicted candidate may seek expedited injunctive relief, court costs and attorney's fees.

An entity that sets the price of a specific good or service using personalized algorithmic pricing, and that advertises, promotes, labels or publishes a statement, display, image, offer or announcement of that pricing to a consumer in New York using personal data specific to that consumer, must include a clear and conspicuous disclosure with it.

The disclosure must state that the price was set by an algorithm using the consumer's personal data, in the words "THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA". Personalized algorithmic pricing means dynamic pricing set by an algorithm that uses personal data. Personal data means any data that identifies or could reasonably be linked, directly or indirectly, with a specific consumer or device.

The section does not apply to a person subject to the insurance law, to a financial institution or affiliate subject to Title V of the Gramm Leach Bliley Act, to a financial institution as defined in the financial services law, or to a price offered to a consumer under an existing subscription-based agreement where the price is less than the price set in that agreement.

Where the attorney general has reason to believe there is a violation, the attorney general sends a cease and desist letter specifying the violation and the remedies to cure it within a designated timeline. A court that determines a violation has occurred may impose a civil penalty of not more than $1,000 for each violation. This Part takes effect on the sixtieth day after it becomes law.

A person who, for the purpose of a sale or advertisement of property or a service, produces or creates an advertisement containing a synthetic performer, an audio, visual or audiovisual performance of a human performer not recognizable as any identifiable natural performer, must conspicuously disclose that a synthetic performer is in the advertisement where they have actual knowledge of that fact.

A violation carries a civil penalty of $1,000 for a first violation and $5,000 for any subsequent violation.

The law exempts advertisements for expressive works such as motion pictures, television programs, and video games, consistent with the use of the synthetic performer in the underlying work, and does not limit rights of privacy or publicity under Civil Rights Law sections 50 and 50-f. Signed December 11, 2025 as chapter 617 of the Laws of 2025, and in force since June 9, 2026, 180 days after enactment.

Any person or business that owns or licenses computerized data including private information must disclose a breach of the security of the system to each affected New York resident in the most expedient time possible and without unreasonable delay, and no later than 30 days after the breach is discovered.

Notice to the Attorney General, the Department of State, and the Division of State Police is required for every disclosure, and notice to nationwide consumer reporting agencies is required when more than 5,000 New York residents are notified at once. Notice to the Department of Financial Services is also required, but only where the person or business is a covered entity as defined in 23 NYCRR 500.1, and it must be given in compliance with 23 NYCRR 500.17.

'Private information' is personal information combined with an unencrypted data element such as a Social Security number, driver's license number, financial account number, biometric information, or medical or health insurance information; biometric information here carries no exclusion for data derived from a photograph, video, or audio recording, unlike a comprehensive-regime state's biometric definition, though this plain-text reading has not been tested in New York case law or Attorney General guidance.

This section's local-law preemption clause is scoped to breach notification and does not displace New York City's separate biometric-privacy ordinance, which regulates capture consent and retention, a different subject.

The Attorney General may bring an action to enjoin and restrain a violation of SHIELD's breach-notification duty, and a court may award actual costs for a failure to notify and, for a knowing or reckless violation, a civil penalty of the greater of $5,000 or up to $20 per instance of failed notification, capped at $250,000; a three-year limitations period runs from Attorney General discovery or notice, extendable to six years if the breach was concealed.

A violation of the separate data-security-program duty is deemed a violation of General Business Law section 349, letting the Attorney General bring an action to enjoin it and obtain civil penalties on that basis.

Section 899-bb expressly bars a private right of action for the safeguards duty, and section 899-aa carries no comparable express bar in its own text, but its enforcement subdivision is written entirely in terms of Attorney General authority, with no private-suit provision found anywhere in that section. Neither half of SHIELD arms a private plaintiff.

Article 39-FF of the General Business Law, added by chapter 121 of the Laws of 2024 and effective June 20, 2025, binds an operator of a website, online service, application or connected device that actually knows a user is under 18, or that is primarily directed to minors.

For such a covered user, the operator may not process the user's personal data, or allow a processor or third-party operator to process or collect it, unless the user is 12 or younger and the processing is permitted under 15 U.S.C. § 6502 and its implementing regulations, or the user is 13 or older and the processing is strictly necessary for a purpose the article lists or informed consent was obtained.

Consent must be requested separately, with the option to refuse as the most prominent option, and after a refusal the operator may not ask again for the following calendar year. The operator may not purchase or sell a covered user's personal data, and within thirty days of learning that a user is covered must delete the data it may not keep.

The article empowers only the Attorney General to sue, for an injunction, restitution, disgorgement, damages and civil penalties of up to five thousand dollars per violation, and it states no private right of action.

Section 156.00(8) defines without authorization to mean using or accessing a computer, computer service, or computer network without the permission of the owner or lessor, or someone licensed or privileged by the owner or lessor, where such person knew that his or her use or access was without permission or after actual notice to such person that such use or access was without permission, an express, textual revocation rule under which a communicated notice, including a cease-and-desist letter, that access is unwanted converts continued access into without authorization access, without needing a technical block at all.

The same subsection also provides that the knowing use of a set of instructions, code, or computer program that bypasses, defrauds, or otherwise circumvents a security measure installed or used with the user's authorization shall be presumptive evidence that such person used or accessed such computer without authorization, giving circumvention its own statutory evidentiary weight. Section 156.05 (unauthorized use of a computer, a class A misdemeanor) builds on the same authorization definition.

Section 156.10 (computer trespass, a class E felony, requiring either intent to commit a felony or knowing access to computer material) builds on the same authorization definition as well.

Register.com, Inc. v. Verio, Inc. (356 F.3d 393, 2d Cir. 2004), a New York-originated dispute, affirmed a preliminary injunction on a trespass-to-chattels theory where an automated WHOIS-query tool kept accessing a database after repeated exposure to posted terms of use prohibiting that use, even though the defendant never signed an agreement, holding repeated notice sufficient.

National Basketball Association v. Motorola, Inc. (105 F.3d 841, 2d Cir. 1997), applying New York's hot-news misappropriation tort, held the tort survives Copyright Act preemption only narrowly (the plaintiff generates time-sensitive information at a cost, the defendant free-rides on it, the parties are direct competitors, and free-riding would substantially threaten the product's existence or quality), and on the facts found no violation because Motorola independently gathered its own underlying facts rather than copying the NBA's compiled product; a scraper that copies a compiled output rather than independently gathering facts could still fall within the surviving tort.

The sections this entry groups came into force on different days.

The ordinance applies only to a commercial establishment, a place of entertainment, retail store, or food and drink establishment. Section 22-1202(a) requires clear, conspicuous signage disclosing the collection, retention, conversion, storage, or sharing of biometric identifier information, defined to include a retina or iris scan, fingerprint, voiceprint, or hand or face geometry scan, or other identifying characteristic.

Section 22-1202(b) flatly bans selling, leasing, trading, sharing in exchange for anything of value, or otherwise profiting from biometric identifier information.

Section 22-1203 creates a private right of action: an aggrieved person may sue, with a 30-day notice-and-cure period required before suing over a signage violation but no notice-and-cure required for a sale or profit violation under section 22-1202(b), and a prevailing party may recover statutory damages, attorneys' fees and costs, and injunctive relief.

It is a municipal law, narrower in scope than a statewide biometric statute because it is limited to commercial establishments' customer-facing collection and does not apply outside New York City, and its private right of action is stated in the code text. Section 22-1204 exempts government agencies entirely, and exempts financial institutions and non-analyzed photo or video capture from the disclosure duty specifically.

Section 405.46 applies to all general hospitals licensed pursuant to article 28 of the Public Health Law. Each hospital shall establish within its policies and procedures a cybersecurity program based on the hospital’s risk assessment. Each hospital shall designate an individual from senior- or executive-level staff, qualified in training, experience, and expertise, to serve as the hospital’s Chief Information Security Officer.

Each hospital shall conduct an accurate and thorough annual risk assessment. The program shall include penetration testing of the hospital’s information systems by a qualified internal or external party at least annually based upon the hospital’s risk assessment. Each hospital’s cybersecurity program shall implement security measures and controls, including encryption, to protect nonpublic information both in transit over external networks and at rest.

Each hospital shall establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity incident materially affecting the confidentiality, integrity or availability of its information systems or the continuing functionality of any aspect of its business or operations. Hospitals have one year from the effective date of section 405.46 to comply with its requirements, except that subdivision (n) was effective immediately upon adoption. The effective date of section 405.46 is October 2, 2024.

Section 500.7 requires a covered entity, as part of its cybersecurity program and based on its risk assessment, to limit user access privileges to information systems that provide access to nonpublic information to only those necessary to perform the user's job. It must also limit the number of privileged accounts and their access functions to only those necessary to perform the user's job, and limit the use of privileged accounts to only when performing functions requiring that access.

It must review all user access privileges periodically and at least annually, and remove or disable accounts and access that are no longer necessary. It must disable or securely configure all protocols that permit remote control of devices, and promptly terminate access following departures. To the extent passwords are employed as a method of authentication, the covered entity must implement a written password policy that meets industry standards.

A Class A company must also monitor privileged access activity and implement a privileged access management solution and an automated method of blocking commonly used passwords for all accounts on information systems it owns or controls and, wherever feasible, for all other accounts.

Where a Class A company determines that blocking commonly used passwords is infeasible, its Chief Information Security Officer may instead approve in writing, at least annually, the infeasibility and the use of reasonably equivalent or more secure compensating controls.

A Class A company is a covered entity with at least $20,000,000 in gross annual revenue in each of the last two fiscal years and either over 2,000 employees averaged over those years or over $1,000,000,000 in gross annual revenue in each of those years, counted as section 500.1(d) provides.

Section 500.19(c) and (d) name section 500.7 among the sections they lift, (c) for a covered entity that operates no information systems and holds no nonpublic information and (d) for an article 70 insurer that holds no nonpublic information beyond information relating to its corporate parent or affiliates. The limited exemption in section 500.19(a) for smaller covered entities does not name section 500.7, so a covered entity holding it still owes these duties.

Part 500 took effect on March 1, 2017, and its Second Amendment on November 1, 2023. Section 500.22(d)(3) gives covered entities 18 months from the effective date of the Second Amendment to comply with its new requirements in section 500.7.

Section 500.2 of 23 NYCRR Part 500 requires each covered entity to maintain a cybersecurity program designed to protect the confidentiality, integrity and availability of its information systems and of the nonpublic information stored on them.

The program must be based on the covered entity's risk assessment and designed to perform six core functions: identifying and assessing risks, protecting against unauthorized access, detecting cybersecurity events, responding to them, recovering from them, and fulfilling applicable regulatory reporting obligations.

A covered entity may meet the requirements of the Part by adopting the relevant and applicable provisions of a cybersecurity program maintained by an affiliate, provided those provisions satisfy the Part as applied to the covered entity. All documentation and information relevant to the cybersecurity program, including any affiliate provisions the covered entity has adopted, must be made available to the Superintendent on request.

A Class A company must also design and conduct independent audits of its cybersecurity program based on its risk assessment. A Class A company is a covered entity with at least $20,000,000 in gross annual revenue in each of the last two fiscal years and either over 2,000 employees averaged over those years or over $1,000,000,000 in gross annual revenue in each of those years, counted as section 500.1(d) provides.

Section 500.3 requires a covered entity to implement and maintain a written policy or policies for the protection of its information systems and nonpublic information, approved at least annually by a senior officer or its senior governing body. The policy and its procedures must be based on the risk assessment and address, to the extent applicable to the covered entity's operations, fifteen areas, from information security and data governance to incident response and vulnerability management.

Section 500.4 separately requires the Chief Information Security Officer to report in writing at least annually to the senior governing body on the cybersecurity program. Section 500.19(c) lifts sections 500.2 and 500.3 for a covered entity that operates no information systems and holds no nonpublic information. Section 500.19(d) does the same for an article 70 insurer that holds no nonpublic information other than information relating to its corporate parent or affiliates.

The limited exemption in section 500.19(a) for smaller covered entities names neither section 500.2 nor section 500.3, so a covered entity holding it still owes both. Part 500 took effect on March 1, 2017, and its Second Amendment on November 1, 2023.

Section 500.22(c) gives covered entities 180 days from the Second Amendment's effective date to comply with its new requirements, except where subdivision (d) or (e) sets another period or day, and neither section 500.2 nor section 500.3 is named in those subdivisions.

Section 500.15 requires a covered entity, as part of its cybersecurity program, to implement a written policy requiring encryption that meets industry standards, to protect nonpublic information held or transmitted by the covered entity both in transit over external networks and at rest.

To the extent a covered entity determines that encryption of nonpublic information at rest is infeasible, it may instead secure that information using effective alternative compensating controls that its Chief Information Security Officer has reviewed and approved in writing. The Chief Information Security Officer must review the feasibility of encryption and the effectiveness of the compensating controls at least annually.

A covered entity with fewer than 20 employees and independent contractors of the covered entity and its affiliates, less than $7,500,000 in gross annual revenue in each of the last three fiscal years, or less than $15,000,000 in year-end total assets, each counted as section 500.19(a) provides, is exempt from section 500.15 under that section.

Section 500.19(c) and (d) name section 500.15 among the sections they lift, (c) for a covered entity that operates no information systems and holds no nonpublic information and (d) for an article 70 insurer that holds no nonpublic information beyond information relating to its corporate parent or affiliates. Part 500 took effect on March 1, 2017, and its Second Amendment on November 1, 2023.

Section 500.22(d)(2) gives covered entities one year from the effective date of the Second Amendment to comply with its new requirements in section 500.15.

Section 500.16 requires a covered entity, as part of its cybersecurity program, to establish written plans that contain proactive measures to investigate and mitigate cybersecurity events and to ensure operational resilience, including incident response, business continuity and disaster recovery plans.

The incident response plan must be reasonably designed to enable prompt response to, and recovery from, any cybersecurity event materially affecting the confidentiality, integrity or availability of the covered entity's information systems or the continuing functionality of any aspect of its business or operations.

It must address nine areas for different types of cybersecurity events, including ransomware: its goals, internal response processes, roles and decision-making authority, communications and information sharing, remediation of identified weaknesses, documentation and reporting, recovery from backups, root cause analysis, and updating of the plan.

The business continuity and disaster recovery plan must be reasonably designed to ensure the availability and functionality of the covered entity's information systems and material services and to protect its personnel, assets and nonpublic information in the event of a cybersecurity-related disruption to its normal business activities.

That plan must at minimum cover six matters: the essentials of continued operations, the supervisory personnel responsible, communication with essential persons during a disruption, timely recovery of critical data and systems, backing up essential information with offsite storage, and the third parties necessary to continued operations.

Current copies of the plans must be distributed or otherwise accessible, including during a cybersecurity event, to all employees necessary to implement them, and relevant training must be provided to all employees responsible for implementing them.

A covered entity must test its incident response and business continuity and disaster recovery plans, and its ability to restore critical data and information systems from backups, periodically and at least annually, and revise the plans as necessary. A covered entity must also maintain backups necessary to restore material operations, adequately protected from unauthorized alterations or destruction.

The covered entity's duty to notify the Superintendent of a cybersecurity incident is set out in section 500.17. Its duty to notify the Superintendent of an extortion payment is also set out in section 500.17.

A covered entity with fewer than 20 employees and independent contractors of the covered entity and its affiliates, less than $7,500,000 in gross annual revenue in each of the last three fiscal years, or less than $15,000,000 in year-end total assets, each counted as section 500.19(a) provides, is exempt from section 500.16 under that section.

Section 500.19(c) and (d) name section 500.16 among the sections they lift, (c) for a covered entity that operates no information systems and holds no nonpublic information and (d) for an article 70 insurer that holds no nonpublic information beyond information relating to its corporate parent or affiliates. Part 500 took effect on March 1, 2017, and its Second Amendment on November 1, 2023.

Section 500.22(d)(2) gives covered entities one year from the effective date of the Second Amendment to comply with its new requirements in section 500.16.

Section 500.14(a)(2) requires a covered entity, as part of its cybersecurity program, to implement risk-based controls designed to protect against malicious code, including controls that monitor and filter web traffic and electronic mail to block malicious content.

Section 500.14(b) requires a Class A company to implement an endpoint detection and response solution to monitor anomalous activity, including lateral movement, and a solution that centralizes logging and security event alerting, unless its Chief Information Security Officer has approved in writing the use of reasonably equivalent or more secure compensating controls.

A Class A company is a covered entity with at least $20,000,000 in gross annual revenue in each of the last two fiscal years and either over 2,000 employees averaged over those years or over $1,000,000,000 in gross annual revenue in each of those years, counted as section 500.1(d) provides.

A covered entity with fewer than 20 employees and independent contractors of the covered entity and its affiliates, less than $7,500,000 in gross annual revenue in each of the last three fiscal years, or less than $15,000,000 in year-end total assets, each counted as section 500.19(a) provides, is exempt from section 500.14(a)(2) and (b) under that section.

Section 500.19(c) and (d) name section 500.14 among the sections they lift, (c) for a covered entity that operates no information systems and holds no nonpublic information and (d) for an article 70 insurer that holds no nonpublic information beyond information relating to its corporate parent or affiliates. Part 500 took effect on March 1, 2017, and its Second Amendment on November 1, 2023.

Section 500.22(d)(3) gives covered entities 18 months from the effective date of the Second Amendment to comply with its new requirements in sections 500.14(a)(2) and 500.14(b).

Section 500.14(a)(1) requires a covered entity, as part of its cybersecurity program, to implement risk-based policies, procedures and controls designed to monitor the activity of authorized users and detect unauthorized access or use of, or tampering with, nonpublic information by those authorized users.

An authorized user is any employee, contractor, agent or other person that participates in the business operations of the covered entity and is authorized to access and use any information systems and data of the covered entity. Section 500.14(a)(3) requires periodic, and at a minimum annual, cybersecurity awareness training that includes social engineering for all personnel, updated to reflect risks the covered entity has identified in its risk assessment.

The Department's industry letter of October 16, 2024 states that the regulation has always required cybersecurity training for all personnel and that covered entities must now provide at least annual cybersecurity awareness training that includes social engineering.

A covered entity with fewer than 20 employees and independent contractors of the covered entity and its affiliates, less than $7,500,000 in gross annual revenue in each of the last three fiscal years, or less than $15,000,000 in year-end total assets, each counted as section 500.19(a) provides, is exempt from section 500.14(a)(1) under that section. The limited exemption in section 500.19(a) does not name section 500.14(a)(3), so a covered entity holding it still owes the training duty.

Section 500.19(c) and (d) name section 500.14 among the sections they lift, (c) for a covered entity that operates no information systems and holds no nonpublic information and (d) for an article 70 insurer that holds no nonpublic information beyond information relating to its corporate parent or affiliates. Part 500 took effect on March 1, 2017, and its Second Amendment on November 1, 2023.

Section 500.22(c) gives covered entities 180 days from the Second Amendment's effective date to comply with its new requirements, except where subdivision (d) or (e) sets another period or day, and subdivision (d) names section 500.14(a)(2) and (b) but not section 500.14(a)(1) or (a)(3).

Section 500.12 requires multi-factor authentication for any individual accessing any information system of a covered entity. Multi-factor authentication means verification of at least two of three types of authentication factor: knowledge factors such as a password, possession factors such as a token, and inherence factors such as a biometric characteristic.

A covered entity that qualifies for the limited exemption in section 500.19(a) must use multi-factor authentication only for remote access to its information systems, remote access to third-party applications from which nonpublic information is accessible, and privileged accounts other than service accounts that prohibit interactive login.

If the covered entity has a Chief Information Security Officer, that officer may approve in writing the use of reasonably equivalent or more secure compensating controls, which must be reviewed periodically and at least annually.

Section 500.19(c) and (d) name section 500.12 among the sections they lift, (c) for a covered entity that operates no information systems and holds no nonpublic information and (d) for an article 70 insurer that holds no nonpublic information beyond information relating to its corporate parent or affiliates. Part 500 took effect on March 1, 2017, and its Second Amendment on November 1, 2023.

Section 500.22(d)(4) gives covered entities two years from the effective date of the Second Amendment to comply with its new requirements in sections 500.12 and 500.13(a). The Department's industry letter of October 16, 2024 states that as of November 2025 the regulation will require multi-factor authentication for all authorized users attempting to access a covered entity's information systems or nonpublic information.

Section 500.11 requires a covered entity to implement written policies and procedures designed to ensure the security of information systems and nonpublic information that are accessible to, or held by, third-party service providers.

The policies must be based on the covered entity's risk assessment and address, to the extent applicable, the identification and risk assessment of third-party service providers, the minimum cybersecurity practices they must meet to do business with the covered entity, due diligence on the adequacy of their practices, and periodic assessment of them.

The policies must include relevant guidelines for due diligence or contractual protections relating to third-party service providers, including to the extent applicable guidelines addressing the provider's access controls and use of multi-factor authentication and its use of encryption of nonpublic information in transit and at rest.

Those guidelines must also address, to the extent applicable, notice to the covered entity of a cybersecurity event directly impacting its information systems or its nonpublic information held by the provider, and representations and warranties on the provider's cybersecurity policies and procedures.

A third-party service provider is a person that is not an affiliate of the covered entity, is not a governmental entity, provides services to the covered entity, and maintains, processes or otherwise is permitted access to nonpublic information through its provision of services to the covered entity. The duty is the covered entity's own: the policies and the due diligence or contractual protections it must put in place are how Part 500 reaches a third-party service provider.

The limited exemption in section 500.19(a) for smaller covered entities does not name section 500.11, so a covered entity holding it still owes this duty. Section 500.19(c) and (d) each list the sections they lift, and neither list includes section 500.11. Section 500.19(b), (e) and (g) instead exempt their named classes from the requirements of the whole Part, which carries section 500.11 with it. Part 500 took effect on March 1, 2017, and its Second Amendment on November 1, 2023.

Section 500.22(c) gives covered entities 180 days from the Second Amendment's effective date to comply with its new requirements, except where subdivision (d) or (e) sets another period or day, and section 500.11 is not named in those subdivisions.

Section 200.17 of 23 NYCRR Part 200 requires each Licensee to establish and maintain a written business continuity and disaster recovery plan reasonably designed to ensure the availability and functionality of its services in the event of an emergency or other disruption.

The plan must, at a minimum, identify the essential documents, data, facilities, infrastructure, personnel, and competencies, name the supervisory personnel responsible for each aspect, and include a communications plan, back-up and off-site storage procedures, and a list of necessary third parties. A Licensee must distribute a copy of the plan, and any revisions, to all relevant employees and keep copies at one or more accessible off-site locations.

A Licensee must give relevant training on their roles and responsibilities to all employees responsible for implementing the plan. A Licensee must promptly notify the superintendent of any emergency or other disruption to its operations that may affect its ability to fulfill regulatory obligations or that may have a significant adverse effect on the Licensee, its counterparties, or the market.

A qualified independent internal person or a qualified third party must test the plan at least annually, and the plan must be revised accordingly. Section 200.17 took effect on June 24, 2015.

Section 200.16 of 23 NYCRR Part 200 requires each Licensee to establish and maintain an effective cyber security program to ensure the availability and functionality of its electronic systems and to protect those systems and the sensitive data on them from unauthorized access, use, or tampering.

The program must be designed to perform five core cyber security functions: identifying internal and external cyber risks, protecting the electronic systems, detecting Cyber Security Events, responding to them, and recovering from them. A Licensee must implement a written cyber security policy that its board of directors or equivalent governing body reviews and approves at least annually.

The cyber security policy must address thirteen areas, from information security and data governance to vendor management and incident response. A Licensee must designate a qualified employee as its Chief Information Security Officer, responsible for overseeing and implementing the cyber security program and enforcing the cyber security policy.

A Licensee must submit to the Department of Financial Services, at least annually, a report prepared by its Chief Information Security Officer and presented to its board of directors or equivalent governing body. A Licensee must conduct penetration testing of its electronic systems at least annually and vulnerability assessment of those systems at least quarterly.

A Licensee must maintain audit trail systems that track and maintain data allowing the complete and accurate reconstruction of all financial transactions and accounting. A Licensee must keep written procedures, guidelines, and standards reasonably designed to ensure the security of all applications it uses, and its Chief Information Security Officer must review, assess, and update them at least annually.

A Licensee must employ cyber security personnel adequate to manage its cyber security risks, require them to attend regular update and training sessions, and require key personnel to stay abreast of changing threats and countermeasures. Section 200.2 defines a Licensee as a Person duly licensed by the superintendent under Part 200.

Section 200.2 defines Virtual Currency Business Activity as conduct involving New York or a New York Resident of any one of five types, including storing or holding Virtual Currency for others, buying and selling it as a customer business, and performing exchange services as a customer business. Section 200.2 provides that the development and dissemination of software in and of itself does not constitute Virtual Currency Business Activity.

Section 200.3 prohibits any Person from engaging in Virtual Currency Business Activity without a license obtained from the superintendent. Section 200.3 exempts from the licensing requirement Persons chartered under the New York Banking Law and approved by the superintendent to engage in Virtual Currency Business Activity, and merchants and consumers that use Virtual Currency solely for the purchase or sale of goods or services or for investment purposes.

The superintendent may suspend or revoke a license issued under Part 200 for a violation of any provision of Part 200. Section 200.16 took effect on June 24, 2015.

Part 1200 of Title 16 NYCRR binds a covered entity, which means any public utility company as defined in subdivision 23 of section 2 of the Public Service Law other than the small, municipal, telephone and telegraph operators it lists. Each covered entity must maintain a cybersecurity program designed to protect the confidentiality, integrity and availability of the covered entity’s information technology.

Each covered entity must implement and maintain a written cybersecurity policy approved by a senior officer, its board of directors or an equivalent governing body. Each covered entity must designate a qualified individual responsible for overseeing and implementing its cybersecurity program and enforcing its cybersecurity policy.

Absent effective continuous monitoring, a covered entity must conduct penetration testing at least every 12 months and vulnerability assessments at least every six months. Multi-factor authentication must be utilized for any authorized user accessing the covered entity’s internal networks from an external network, unless the chief information security officer has approved reasonably equivalent or more secure access controls in writing.

Each covered entity must test its cybersecurity incident response plan at least yearly through a tabletop or other exercise simulating a network breach and compromise of nonpublic information. On a yearly basis, covered entities must cause to be conducted a third-party audit of the cybersecurity of their information technology and nonpublic information. The information technology that Part 1200 covers does not include operational technology.

Covered entities have 180 days from the effective date of Part 1200 to comply with its requirements, except as otherwise specified. Part 1200 is effective June 1, 2026.

Any person or business that owns or licenses computerized data including the private information of a New York resident must develop, implement, and maintain reasonable safeguards to protect the security, confidentiality, and integrity of that private information.

A business satisfies this duty either by being a compliant regulated entity under Gramm-Leach-Bliley Act Title V regulations, Health Insurance Portability and Accountability Act (HIPAA) and HITECH regulations, or 23 NYCRR Part 500, or by implementing a data security program with reasonable administrative, technical, and physical safeguards scaled to the size of the business.

Failure to comply is deemed a violation of General Business Law 349, enforceable only by the Attorney General for injunctive relief; the section creates no private right of action. General Business Law 350-d sets the civil penalty for that violation at up to $5,000 per violation.

Article 19-C of the General Municipal Law requires all municipal corporations and public authorities to report cybersecurity incidents, and when applicable the demand of a ransom payment, to the commissioner of the division of homeland security and emergency services in the form and method the commissioner prescribes. The report is due no later than seventy-two hours after the municipal corporation or public authority reasonably believes the cybersecurity incident has occurred.

Within twenty-four hours of a ransom payment the municipal corporation or public authority must give the commissioner notice of the payment, and within thirty days it must give a written description of the reasons payment was necessary, the amount, the means of payment and the alternatives considered. A municipal corporation, for the purposes of the article, is a municipal corporation or a district as defined in section 119-n of the General Municipal Law.

A public authority, for the purposes of the article, is any state authority or local authority as defined in section two of the Public Authorities Law, or any subsidiary of one. Sections one and two of the act that added article 19-C take effect on the thirtieth day after the act's effective date. The bill was signed as chapter 177 of the Laws of 2025 on June 26, 2025.

The hospital or its designee shall notify the department as promptly as possible, but no later than 72 hours after determining a cybersecurity incident has occurred, in a manner prescribed by the department. Notification to the department does not replace any other notifications required under State or Federal laws or regulations.

A cybersecurity incident is a cybersecurity event that has a material adverse impact on the normal operations of the hospital, has a reasonable likelihood of materially harming any part of its normal operations, or results in the deployment of ransomware within a material part of its information systems. Each hospital shall maintain and submit for examination the documentation the department requires, and all such documentation must be maintained for a minimum of six years. Subdivision (n) of the section was effective immediately upon adoption.

Section 500.17 of 23 NYCRR Part 500 requires a Covered Entity to notify the Superintendent of Financial Services electronically as promptly as possible but no later than 72 hours after determining that a Cybersecurity Incident has occurred at the covered entity, its affiliates, or a third-party service provider.

A Cybersecurity Incident is a Cybersecurity Event, a broader term covering any attempt to gain unauthorized access to or misuse an information system, that also either requires notice to a government or supervisory body, carries a reasonable likelihood of materially harming a material part of normal operations, or results in the deployment of ransomware within a material part of the covered entity's information systems.

Each covered entity must promptly provide the Superintendent with any information the Superintendent requests about a reported incident and must continue updating the Superintendent with material changes or new information, with no separate numbered clock on either duty.

Where a covered entity makes an extortion payment in connection with a cybersecurity event, it must notify the Superintendent of the payment within 24 hours of making it and, within 30 days of the payment, provide a written description of why the payment was necessary and what alternatives and compliance diligence it performed.

By April 15 each year, a covered entity must submit either a written certification that it materially complied with this Part for the prior calendar year or a written acknowledgment identifying the sections it did not materially comply with and a remediation timeline, signed by its highest-ranking executive and its Chief Information Security Officer.

The limited exemptions in 23 NYCRR 500.19(a), (c) and (d), covering a small covered entity and an entity without its own information systems or nonpublic information, each work by naming the sections they relieve, and none of them names section 500.17, so an entity holding one of those still owes the Superintendent-notice duty in full.

Subsections 500.19(b), (e) and (g) work the other way, exempting their named classes from the requirements of the whole Part, which carries section 500.17 with it.

Section 500.11 requires a covered entity to adopt its own policies and contractual protections for a third-party service provider, including contractual notice to the covered entity of a cybersecurity event, so Part 500 reaches a third-party service provider only through the covered entity's own duties and never binds the provider directly unless the provider independently qualifies as its own covered entity. The provisions this entry describes came into force on different days.

Part 500 took effect on 1 March 2017, and its Second Amendment on 1 November 2023. Covered entities had 30 days from the Second Amendment's effective date to comply with this section's new requirements.

Each covered entity must notify the Director of the Department of Public Service’s Office of Resilience, Utility Security, Nuclear Affairs and Emergency Preparedness as promptly as possible but in no event later than 72 hours after it reasonably believes that a cybersecurity incident affecting its information technology, or that of an affiliate or a third party provider, has occurred or is occurring.

A cybersecurity incident is a cybersecurity event that falls within one of six listed categories, which include a reasonable likelihood of harming any part of normal operations, a demand for payment of a ransom, and any event that triggers a notice requirement to a government body by law, order or regulation.

Each covered entity must keep a log of all cybersecurity events and cybersecurity incidents, whether or not they are subject to the notice requirement, for no fewer than three calendar years. Each covered entity must submit a yearly written statement covering the prior calendar year, by June 30, certifying that it complies with Part 1200. The first Certification of Compliance is due June 30, 2027. There is no transitional period to comply with the requirements of section 1200.21.

Covered online platforms, including social media, gaming, and digital messaging services, must apply privacy-protective default settings for users they know are minors, including restricting contact and profile recommendations from unknown adults, limiting financial transactions, requiring parental approvals for weaker settings, and turning AI companion features off by default.

The act requires age assurance, never self-declaration of age, using the methods the Attorney General's rules accept and, until those rules are in effect, a reasonable method that guards against circumvention, and was enacted in May 2026 as part Y of the state's FY2027 transportation and economic development budget bill.

Operators of websites, online services, apps, and connected products may not process, sell, or share the personal data of a user under 18 for targeted advertising, profiling, or other non-essential purposes without informed consent, and must honor browser or device signals indicating a user is a minor. The Attorney General has said it will exercise enforcement discretion for good-faith compliance efforts while final implementing rules remain pending.

Social media platforms must obtain parental consent before providing an addictive, algorithmically personalized feed to a user they know is a minor, and may not send notifications to minors between midnight and 6 a.m. without parental consent. The Attorney General's final rules were announced on July 28, 2026, and the act goes into effect 180 days after their publication in the State Register, on January 25, 2027.