AI governance in Albany

The LOADinG Act has been in force since December 21, 2024. A state agency may not use an automated decision-making system in a function that affects public assistance benefits, individual rights, or civil liberties unless it has legal authorization and meaningful human review. Before deployment, and again every two years, the agency must complete an impact assessment covering objectives, algorithms, accuracy, fairness, cybersecurity, and privacy. It must publish disclosures of the systems in use. Where an assessment shows discriminatory or biased outcomes, the agency must stop using the system. The statute also carries displacement protections for state employees.

Those duties sit on the agency. Sell AI to a New York State agency and the buyer inherits these duties, then pushes the documentation burden back through procurement. The inputs the agency will ask for are the ones the impact assessment covers, refreshed on the two-year cycle. A private employer in Albany that does not sell to a state agency does not become a state agency by hiring in the capital. Applicability, in practice, also reaches the agency’s AI vendors. It does not reach every employer in the city.

New York colleges and universities, and the Empire AI consortium, are exempted from the frontier-model act described next. That exemption is a finding about one statute. It is not a finding that a campus has no systems and no contracts to list. The LOADinG Act reaches state agencies and, in practice, the vendors who sell AI to them.

NYC Local Law 144 has been enforced since July 5, 2023. It reaches an employer or an employment agency that uses an automated employment decision tool to substantially assist a hiring or promotion decision for a position located in New York City. Size does not matter. The employer must obtain an independent bias audit within the preceding year, must publish a summary of the results on its website, and must give candidates and employees at least 10 business days’ notice before the tool is used. The audit calculates selection or scoring rates by race/ethnicity and by sex. The audit and the notice are separate requirements, and they are separate violations. A first violation, and each additional violation on the same day, is $500. Each later violation is $500 to $1,500. Each day a violation continues counts as its own violation.

A position located in Albany is not a position located in New York City. An employer that uses the tool only for Albany positions does not pick up Local Law 144 because the headquarters is in the capital. An employer that uses the tool for a position located in New York City does, whichever city the headquarters sits in.

On December 2, 2025 the State Comptroller published an audit of that enforcement covering July 2023 through June 2025. In those two years the enforcing agency received two complaints. It reviewed 32 companies and identified a single instance of non-compliance. The Comptroller’s own review of those same 32 companies found at least 17 instances of potential non-compliance. The audit recommended proactive enforcement beyond complaint intake, and the use of technical experts to evaluate the tools. Weak enforcement across that period is a fact about those two years. It is not a compliance position. “At least 17 instances of potential non-compliance” is not a finding of 17 adjudicated violations.

Seven AI bills passed both chambers in the 2026 session. They await the Governor’s action, and the deadline is December 31, 2026. The seven are S 9051, on children’s chatbot safety; A 6578, on AI training-data transparency; S 6954, on synthetic-content provenance; S 8451, the FAIR News Act; A 9349, on surveillance pricing; A 11560, a one-year data-center moratorium; and A 3411, on generative-AI warning labels. The count is seven. None of them is law today. Any of them could be by January. Training-data transparency, synthetic-content provenance, and surveillance pricing would each reach ordinary deployers in a way the RAISE Act does not, if the Governor signs them. Until that happens, they are not duties.

The governance readiness assessment, as its service page specifies it, produces an inventory, a boundary note, a contract reading, and a gap list against ISO/IEC 42001 and the NIST AI Risk Management Framework. ISO/IEC 42001 and the NIST AI Risk Management Framework are what that gap list is set beside. The list is not, on its own, the document that sorts a system into a New York layer. The inventory is what makes that sorting possible. The reading is done on-site with the agency team, or with the vendor team, that operates the system.

The free diagnostic is the AI Academy readiness assessment. Use it when a scorecard is the deliverable. It will not commission a bias audit, and it will not draft a state-agency impact assessment. Where the work is an assessment, the credential claimed is HITRUST Authorized External Assessor, and only that credential. Its scope is assessing organizations other than TrustEdge. TrustEdge comes out of that review uncertified, and so does the organization whose systems were in scope. The credential does not award a certification to either one.