New York Finalizes the RAISE Act, Setting the Strictest Frontier AI Transparency Rules in the United States
Governor Hochul's March 27 chapter amendment transforms New York's RAISE Act from a vague skeleton into binding law, imposing 72-hour incident reporting and mandatory safety frameworks on frontier AI developers before federal preemption efforts can intervene.
Overview
New York has quietly completed one of the most consequential acts in American AI governance. On March 27, 2026, Governor Kathy Hochul signed Senate Bill 8828, a chapter amendment that transforms the Responsible AI Safety and Education Act — known as the RAISE Act — from its original, legally uncertain form into a binding, enforceable framework targeting the developers of the world’s most powerful AI systems. The law takes effect January 1, 2027.
The amendment is not a minor technical fix. As reported by Davis Wright Tremaine, it replaces vague compliance language inherited from the December 2025 original with specific definitions and reporting mechanisms drawn from California’s model, establishing clear thresholds for what triggers regulatory obligations and erecting an entirely new AI oversight office within the New York Department of Financial Services.
What the Law Requires
The RAISE Act applies to “frontier developers” — entities that have trained a frontier model — and more stringently to “large frontier developers,” defined as frontier developers with annual revenues exceeding $500 million. A frontier model itself is defined as a foundation model trained using computing power exceeding 10^26 floating-point operations, with compute costs surpassing $100 million, according to Wiley Rein. The threshold effectively captures OpenAI, Google DeepMind, Anthropic, Meta, and Microsoft — the companies currently operating at frontier scale — while exempting organizations that merely deploy or build applications on others’ models.
Large frontier developers face the heaviest obligations. They must publish a “Frontier AI Framework” — a detailed governance document describing how catastrophic risks are assessed and mitigated, how unreleased model weights are secured against unauthorized access, how third-party evaluators are used, and how the organization governs internal use of frontier models, per JD Supra’s analysis. These frameworks must be updated annually, with material modifications disclosed and justified within 30 days.
All frontier developers must publish transparency reports before deploying new or significantly modified models, including contact mechanisms, release dates, supported languages, output modalities, intended uses, restrictions, and catastrophic risk assessments. Trade secret redactions are permitted, but developers must retain unredacted copies for five years.
The most operationally demanding provision is a 72-hour incident reporting window. When a developer discovers a critical safety incident — which includes unauthorized access to model weights, materialized catastrophic risks, loss of model control causing harm, or deceptive model behavior that increases catastrophic risk — it must notify the NYDFS within three days. Imminent risks of death or injury must be escalated to law enforcement within 24 hours. As Wiley Rein notes, this is significantly stricter than California’s comparable 15-day window, creating potential compliance friction for companies operating across both states.
What Counts as Catastrophic Risk
The law defines “catastrophic risk” as a foreseeable and material risk that a developer’s activities will cause death or serious injury to more than 50 people, or more than $1 billion in property damage, stemming from: assistance in creating weapons of mass destruction; autonomous harmful conduct by an AI model without meaningful human oversight; or loss of the developer’s ability to direct, modify, or shut down the model. “Critical safety incident” includes unauthorized model weight access causing injury, materialized catastrophic risk, and — notably — deceptive model behavior that increases such risk.
The inclusion of model deception as a triggering event is significant. It reflects an emerging consensus in AI safety research that behavioral deception by frontier systems is a credible near-term risk, not a speculative future concern.
Industry Reaction and Context
OpenAI and Anthropic both expressed measured support for the final law. OpenAI’s Chief Global Affairs Officer stated that “the combination of the Empire State with the Golden State is a big step” toward alignment between major tech states, according to IAPP’s coverage. The Center for Democracy and Technology offered qualified approval, describing transparency requirements as “the starting point, not the finish line.”
The chapter amendment corrected several provisions that Hochul had identified as lacking adequate specificity when she signed the original bill in December 2025. That original version used compute-cost thresholds that proved difficult to apply in practice; the amendment replaced them with a revenue-based trigger — the $500 million threshold — that more closely mirrors California’s Transparency in Frontier Artificial Intelligence Act (TFAIA). Penalties were also revised downward from a maximum of $30 million per subsequent violation to $3 million, as detailed by the National Law Review.
The Federal Preemption Shadow
New York’s finalized law arrives at a moment of direct conflict with federal policy. President Trump’s executive order on AI, issued in late 2025, directed federal agencies to challenge state AI laws deemed to impede a “minimally burdensome national standard” for AI regulation. The Department of Justice established an AI Litigation Task Force for precisely this purpose. The 90-day Commerce Department review of state AI laws that ran through March 2026 was widely expected to flag the RAISE Act as a target.
As Davis Wright Tremaine notes, organizations subject to the RAISE Act cannot assume federal preemption will eliminate compliance obligations before the January 1, 2027 effective date. Constitutional challenges will take years to resolve, and the law remains enforceable in the interim. The National Law Review’s analysis warns that “constitutional confrontation remains inevitable” but recommends developers build required compliance infrastructure now.
This follows a pattern previously reported by The Machine Herald on the broader federal effort to suppress state-level AI regulation — a tension that the RAISE Act’s finalization sharpens considerably.
What Happens Next
The NYDFS is expected to stand up its new AI oversight office during 2026, with rulemaking authority to fill gaps in the statutory text. Large frontier developers must begin building the compliance infrastructure — safety framework documentation, incident detection pipelines, transparency reporting workflows, and disclosure filing processes — before January 2027.
For developers operating in both California and New York, the interaction between the two laws presents a compliance planning challenge. The core thresholds are identical, but New York’s 72-hour incident reporting window is five times faster than California’s, creating a de facto national standard set by New York for any company subject to both regimes.
The larger question — whether a patchwork of state laws can remain viable against federal preemption, or whether Congress eventually fills the vacuum with a national framework — remains open. What the RAISE Act’s finalization makes clear is that major frontier AI developers will face binding, enforceable transparency and safety obligations from at least two large jurisdictions starting in less than nine months, regardless of how the federal debate resolves.