New York signs the RAISE Act, a frontier AI safety and transparency law

The RAISE Act is a New York State law requiring large developers of frontier artificial intelligence models to publish detailed safety frameworks and report serious safety incidents to a new state oversight office.

Governor Kathy Hochul signed the RAISE Act into law on December 19, 2025.

What it is

The RAISE Act, formally titled the Responsible AI Safety and Education Act, was created to require safety reports for powerful frontier artificial intelligence models in order to limit critical harm.

It targets the largest AI developers rather than all companies building AI products.

Assemblymember Alex Bores said the statute moves beyond California's earlier frontier AI law in several ways.

What it requires

Covered developers must write, implement, publish, and comply with plans that describe in detail how they handle various safety standards and best practices.

Those plans must cover how developers assess model safety risks, apply and review risk-mitigation techniques, use third parties to assess catastrophic risk potential, implement cybersecurity to prevent model theft, and identify and respond to safety incidents.

Developers must review their plans annually and publish a justification for any changes within 30 days.

The law creates a dedicated oversight office, funded by fees on developers, within the New York State Department of Financial Services to enforce the law, issue rules and regulations, assess fees, and publish an annual report on AI safety.

Developers must report critical safety incidents within 72 hours, rather than the 15 days contemplated in earlier drafts.

It also requires frontier developers to report any time they reasonably believe a safety incident has occurred.

Penalties run up to $1 million for a first violation and up to $3 million for subsequent violations.

The Attorney General can bring civil actions against large frontier developers for the failure to submit required reporting or making false statements.

What security leaders should do

Security teams at any organization that could meet New York's frontier-developer thresholds should inventory which models and deployments fall under the law and map existing model risk assessments against the framework the statute describes. Build or update an incident classification process now so a 72-hour reporting clock does not catch the security team unprepared, and make sure legal, safety, and security functions agree in advance on what counts as a critical safety incident. Treat the annual review and 30-day change-justification requirement as a forcing function to keep safety documentation current rather than a one-time compliance exercise. Finally, track guidance from the new Department of Financial Services oversight office, since it will shape what counts as adequate cybersecurity controls against model theft and acceptable third-party catastrophic-risk assessment.