New York Wants Power to SHUT DOWN AI

hands interacting with a digital AI interface
Photo: everything possible / Shutterstock

New York’s RAISE Act treats information as the fulcrum of AI safety: it forces the biggest frontier-model developers to disclose how they manage risk and to notify the state within 72 hours when serious problems surface—creating, for the first time in a major U.S. market, legally enforceable visibility into systems whose hazards have largely been self-policed.

The Short Version

  • New York imposes statutory transparency and incident-reporting duties on large frontier-AI developers, with civil penalties for noncompliance.
  • An oversight office inside the Department of Financial Services will examine developers and publish recurring reports; the Attorney General can enforce.
  • The law names concrete severe-risk categories—automated crime, bio threats, large-scale harm, model theft, and dangerous behaviors—rather than only general “trustworthy AI” platitudes.
  • Critics argue thresholds leave gaps (pre-revenue labs, distilled derivatives) and that the framework mandates disclosure, not a “kill switch.”

What New York Actually Requires—and Why That Matters

The RAISE Act’s core move is to replace voluntary safety talk with enforceable duties targeted at large “frontier” developers. Covered firms must publish safety protocols—how they assess dangerous capabilities, red-team, manage model weights, handle access, and mitigate abuse—and must report qualifying incidents to the state within 72 hours of determining that an incident occurred. Those reports go to a new office within the Department of Financial Services (DFS), which is charged with examining developers, coordinating across agencies, and producing annual public reporting. The Attorney General can sue for failures to submit required reports or for false statements, with penalties of up to $1 million for a first violation and $3 million for subsequent ones.

Crucially, the statute identifies specific categories of severe risk and incident—automated or scalable criminal activity, biological-weapons enablement, widespread harm, theft of models by malicious actors, and manifestly dangerous behaviors. That design choice aims to move enforcement away from vague ethics language and toward recognizable triggers for duty, while still leaving DFS latitude to evaluate evolving threat patterns. The Governor’s case for the law has been consistent: in a federal vacuum, the state is obligating the companies with the most dangerous systems to document their safeguards and alert the public sector when those safeguards fail, so responders can act on timely, standardized information.

Mechanics: Oversight, Reporting, and Enforcement

Mechanism is where this framework distinguishes itself from aspirational AI “principles.” First, the law creates an institutional home for scrutiny inside DFS. New York’s choice leverages an agency that knows complex, high-stakes risk management—born in banking supervision—and tasks it with horizon-scanning, examinations, and annual reporting on large AI developers. The state describes a broader implementation cohort that also includes information technology and homeland security arms, the signal being that AI safety oversight is operational, not merely rhetorical. Second, the 72-hour incident-reporting rule aligns with established practice in other risk domains, where early notification lets authorities triage responses and look for systemic patterns across firms. Third, penalties and the Attorney General’s litigation authority give the law teeth when developers ignore obligations or obfuscate.

For developers, the practical upshot is a compliance program that looks like other high-consequence domains: document risk controls; test adversarially; retain evidence; maintain incident playbooks that trigger state notice rapidly; and treat transparency lapses as legal exposure, not just reputational risk. For the public sector, the benefit is structured access to the information only the builders possess—model evaluations, safety incidents, and mitigation status—an approach consistent with broader analyses arguing that frontier-AI risk governance starts with closing the information asymmetry between labs and regulators.

What the Law Does Not Do—and Why That Gap Matters

There is no established evidence that the statute empowers DFS to halt deployment preemptively; the official materials emphasize publication, registration, reporting, and civil enforcement, not suspension or licensing authority. That has led security practitioners to argue the framework compels disclosure but not interdiction—a meaningful limitation if a compliant developer ships a system that causes sustained, sub-catastrophic harm. Joshua Marpet’s DEF CON analysis is explicit on four structural gaps: a $500 million revenue threshold that can exclude well-funded pre-revenue labs; a compute-centric frontier definition that may miss dangerous distilled or fine-tuned derivatives; a catastrophic-harm trigger set so high it risks after-the-fact alerts; and the absence of a functional “kill switch” to pause deployment when testing reveals acute danger.

Industry advocacy groups add a different critique: that broad, state-level AI rules impose fixed costs that startups and researchers cannot absorb, thereby consolidating advantage among incumbents and nudging investment elsewhere. Comments from the Computer & Communications Industry Association warn about compliance burdens and capital flight, echoing a longstanding concern in tech regulation that broad obligations bite unequally at the early stage. A congressional letter amplifies the interstate implications, arguing that New York’s jurisdictional reach can make it a de facto national regulator for AI built or operated “in part” in the state—an attractive feature for harmonization if the rules perform well, but combustible if they don’t.

How It Fits the Emerging Governance Baseline

New York’s architecture—safety frameworks, incident reporting, oversight capacity, and enforceable transparency—tracks closely with the pattern now visible across state and international proposals. Comparative work on frontier-AI governance points to those same building blocks as the emergent baseline for responsible oversight: formal safety management, adversarial testing and documentation, secured model access, and incident reporting to public authorities, with audits following as capacity matures. The logic is pragmatic. When technology outruns statutory design, disclosure and reporting are often the first lever lawmakers can pull credibly; licensing, preclearance, or product-interdiction powers tend to come later, once regulators have learned where voluntary controls and reporting fall short.

That sequencing also explains why the 72-hour rule, while operationally familiar from cybersecurity, remains unproven here. The state’s releases to date do not identify completed incident reports, corrective orders, or enforcement outcomes under the Act; the deterrent effect of penalties and the utility of the incident pipeline will be measurable only after one or two reporting cycles. The same uncertainty surrounds the new office’s resources and expertise. Announcing a unit is not the same as staffing it with red-teamers, eval specialists, and model-security auditors at the scale frontier oversight requires—a genuine execution risk until budget, hiring, and published examinations demonstrate depth.

The Real Disagreements: Coverage, Consequence, and Preemption

Substantive debate concentrates in three places. Coverage: whether revenue and compute thresholds capture the systems that most worry safety researchers, or whether derivatives and pre-revenue projects slip through. Consequence: whether a transparency-and-reporting regime without interdiction authority can prevent foreseeable harm, especially harms that accumulate below catastrophic thresholds. Preemption: whether future federal action will displace state rules, either mooting New York’s framework or using it as scaffolding for a national standard. On coverage, the security critique is specific and testable: track who registers, which models are in scope, and where the gaps lie—particularly among distilled, fine-tuned, or open-weight successors to frontier models. On consequence, incident data and DFS annual reports will decide whether early notice and public protocols meaningfully change behavior, or merely formalize press releases. On preemption, Congress will ultimately determine whether a patchwork continues or yields to uniform obligations; for now, developers have to plan for multi-jurisdiction compliance.

What to Watch Over the Next Two Cycles

Four signals will tell you whether this framework is bite or bark. First, the registry: which entities register, which claim exemptions, and how DFS interprets the frontier thresholds. Second, incident flow: the cadence, specificity, and remediation timelines in 72-hour reports—especially whether cross-firm patterns produce joint advisories or technical mitigations. Third, examinations: published summaries that evidence genuine technical engagement—eval methodologies, red-team scope, model-weight governance—not just paperwork checks. Fourth, enforcement: referrals to the Attorney General, settlements, or penalties that show the state will use its tools when firms withhold or misstate material safety information.

If those signals materialize, New York’s bet on enforceable transparency will look like the right first step: not a panacea, but a disciplined way to surface facts quickly in a domain where facts have been scarce. If they don’t, the critics will have the stronger case—thresholds will look porous, transparency will feel ceremonial, and the absence of interdiction power will loom larger than the value of a 72-hour clock.

Bottom Line

New York has moved the frontier-AI conversation from promises to duties: publish how you manage risk, tell the state fast when you fail, accept examination, and face civil exposure when you don’t comply. That scaffolding is real. Whether it is sufficient depends on execution—resourcing the new office, using incident intelligence to drive remediation, and, if gaps persist, building the next layer of authority. In the governance of fast-moving, high-consequence technologies, that is how credible regimes are built: start with visibility, prove it adds signal, then calibrate sharper tools with evidence rather than hope.

Sources:

reclaimthenet.org, nysenate.gov, governor.ny.gov, dfs.ny.gov, legislation.nysenate.gov, gabeevans.house.gov

Breaking Now

© 2026 United Cause. All Rights Reserved.