New York AI Regulations
New York regulates AI in three separate layers that rarely touch the same organization. The RAISE Act, rewritten by chapter amendment on March 27, 2026, applies to frontier model developers from January 1, 2027 and is now enforced through a new office at the Department of Financial Services. The LOADinG Act has governed state-agency automated decision-making since December 2024. NYC Local Law 144 has required annual independent bias audits of automated employment decision tools since July 5, 2023 — and on December 2, 2025 the State Comptroller concluded that the agency responsible for enforcing it has not been doing so effectively.
Last reviewed against primary sources: . AI legislation is moving quickly — statutes have been delayed, repealed and replaced mid-cycle. Verify against the linked primary sources before relying on any date here.
Where we work in New York
TrustEdge serves organizations across New York, including these markets.
In-Depth Analysis
New York is the clearest case in the country of a rule that exists on paper and an enforcement record that does not match it.
The December 2, 2025 State Comptroller audit is worth reading in full if you have New York City hiring exposure. Over two years DCWP received two complaints. It reviewed 32 companies and found one problem. The Comptroller looked at the same 32 companies and found at least 17 potential violations. That is not a close call about interpretation; it is a finding that the agency was not looking.
The honest read of that is uncomfortable in both directions. If you have skipped your bias audit, the probability of being caught to date has been very low. But an audit report from the State Comptroller telling a city agency it is under-enforcing is the single most reliable predictor of enforcement increasing, and the audit handed DCWP a specific method — review published bias audit summaries proactively rather than waiting for complaints. Published summaries are exactly the artifact that makes non-compliance visible without an investigation. The organizations most exposed are the ones that published nothing.
There is a second reason to comply that has nothing to do with DCWP. A missing or stale bias audit is discoverable in employment litigation and in state and federal discrimination proceedings, where the penalty is not $500 a day. Local Law 144 sets a floor for what a reasonable employer does; falling below a published floor is a fact a plaintiff will use.
On the RAISE Act, the practical point is that it is not an enterprise AI law. The 10^26 compute and $500 million revenue thresholds put it out of reach of essentially every organization that buys AI rather than trains it. What matters to enterprise buyers is downstream: the frontier developers you license from will publish frameworks and transparency reports under New York, California, and Illinois law, and those documents are now the best available due-diligence evidence about the models in your stack. Ask for them by name in vendor reviews.
The one thing about the RAISE Act that should change a plan is the chapter amendment. The regulator moved to DFS, penalties fell by an order of magnitude, and the whistleblower protections were removed. A summary written from the December 2025 text is wrong on all three.
Practical Implications for SMBs & Healthcare
If you hire in New York City and use any tool that scores, ranks, or filters candidates, Local Law 144 applies to you today regardless of your size, and the audit you need is an independent one conducted within the last twelve months. Weak enforcement so far is a fact about the past two years, not a compliance position.
Check three things this week: whether a bias audit was performed in the last year, whether its summary is actually published and reachable on your careers site, and whether your job postings carry the 10-business-day notice. Those are the three artifacts a proactive reviewer would look for, and they are the three the Comptroller told DCWP to start checking.
For healthcare and financial services organizations, the RAISE Act is almost certainly not your problem — but your model vendors' RAISE, SB 53, and SB 315 disclosures are your evidence. If you sell to a New York State agency, read the LOADinG Act impact assessment requirements before your next RFP; the agency will pass them to you.
Key Provisions
RAISE Act — who is actually covered
The Act reaches a "frontier model": a foundation model trained using computing power greater than 10^26 integer or floating-point operations, counting fine-tuning, reinforcement learning, and other material modifications. The heavier duties fall on a "large frontier developer" — a frontier developer with annual revenue exceeding $500 million. Scope is expressly limited to models developed, deployed, or operating in New York, and New York colleges and universities and the Empire AI consortium are exempted. If you buy and deploy AI rather than train models above that compute threshold, the RAISE Act does not apply to you. Most New York healthcare, financial services, and legal organizations are outside it.
RAISE Act — the published framework and transparency reports
Large frontier developers must publish a frontier AI framework covering capability thresholds, catastrophic-risk assessment and mitigation, third-party assessments, cybersecurity and model-weight protection, internal governance, and incident response, reviewed and updated annually. Before deploying a new or materially modified frontier model, developers must publish a transparency report covering contact information, release date, supported languages, intended uses, and use restrictions. Developers may redact trade secrets, cybersecurity details, and national security information, with justification.
RAISE Act — reporting to the Department of Financial Services
Large frontier developers file a disclosure statement identifying owners of 5 percent or more, submit catastrophic risk assessment summaries to the DFS office quarterly, and report critical safety incidents to DFS within 72 hours. Where there is imminent risk of death or serious physical injury, the report goes to law enforcement or a public safety authority within 24 hours. "Catastrophic risk" is defined as a foreseeable and material risk of death or serious injury to more than 50 people, or more than $1 billion in damage.
How New York compares to California and Illinois
The three frontier-model laws now use the same compute threshold (10^26 operations), the same revenue threshold ($500 million), and the same catastrophic-harm definition (more than 50 deaths or serious injuries, or more than $1 billion in damage). They diverge on clocks and regulators. New York requires critical safety incident reports within 72 hours to DFS; Illinois SB 315 requires 72 hours to the Illinois Emergency Management Agency and the Attorney General; California SB 53 allows 15 days. All three use a 24-hour clock for imminent risk of death or serious injury. Illinois is the only one of the three that mandates an annual independent third-party audit, beginning January 1, 2028. A single published framework and one incident-response runbook can satisfy all three — but it has to be built to the tightest clock, which is 72 hours.
What the March 2026 chapter amendment changed
The version signed in December 2025 is not the version that takes effect. The chapter amendment moved primary oversight from an Attorney General-centered model to a new office within the Department of Financial Services, cut civil penalties from $10 million to $1 million for a first violation and from $30 million to $3 million for subsequent violations, removed the whistleblower protections entirely, added the ownership disclosure requirement, and set the effective date at January 1, 2027. Any compliance plan built on the December 2025 text has the wrong regulator and the wrong penalties. Note that the removal of whistleblower protections from New York does not remove them from California SB 53 or Illinois SB 315, both of which retain them.
LOADinG Act — state agencies and the vendors who sell to them
In force since December 21, 2024. State agencies may not use automated decision-making systems in functions affecting public assistance benefits, individual rights, or civil liberties without legal authorization and meaningful human review. Agencies must conduct impact assessments before deployment and every two years thereafter, covering objectives, algorithms, accuracy, fairness, cybersecurity, and privacy, and must publish disclosures of the systems in use. Where an impact assessment shows discriminatory or biased outcomes, the agency must stop using the system. The statute also carries displacement protections for state employees. If you sell AI to a New York State agency, your buyer inherits these duties and will push the documentation burden to you in procurement.
NYC Local Law 144 — the obligation most employers actually have
Enforced since July 5, 2023. An employer or employment agency using an automated employment decision tool to substantially assist hiring or promotion decisions for a position in New York City must obtain an independent bias audit within the preceding year, publish a summary of the audit results on its website, and give candidates and employees at least 10 business days' notice before the tool is used. The bias audit must calculate selection or scoring rates by race/ethnicity and by sex. The audit and the notice are separate requirements and separate violations.
The Comptroller audit — enforcement has not matched the rule
On December 2, 2025 the New York State Comptroller published an audit of DCWP's enforcement of Local Law 144 covering July 2023 through June 2025. Over that two-year period DCWP received two AEDT complaints. It reviewed 32 companies and identified a single instance of non-compliance; the Comptroller's own review of those same 32 companies found at least 17 instances of potential non-compliance. The audit found DCWP had not used the formal procedures it had established with the city's technology office and had not addressed all requirements of the law, and recommended proactive enforcement beyond complaint intake and the use of technical experts to evaluate the tools.
AI companion safeguards — General Business Law Article 47
In force since November 5, 2025, and separate from everything above. Operators of AI companions — systems that retain prior interactions, ask unprompted emotion-based questions, and sustain ongoing personal dialogue — must detect expressions of suicidal ideation or self-harm and refer the user to crisis services, and must disclose that the user is not talking to a human at the start of a session and every three hours of continued use. The Attorney General enforces, with civil penalties up to $15,000 per day.
Seven passed bills that are not law
Seven AI bills passed both chambers in the 2026 session and are awaiting the Governor's action, with a deadline of December 31, 2026: S 9051 (children's chatbot safety), A 6578 (AI training data transparency), S 6954 (synthetic content provenance), S 8451 (FAIR News Act), A 9349 (surveillance pricing), A 11560 (a one-year data center moratorium), and A 3411 (generative AI warning labels). None of these is law today. Any of them could be by January.
Bills & Statutes
RAISE Act — Responsible AI Safety and Education Act (GBL Article 44-B, Chapter 699)
Signed December 19, 2025; rewritten by chapter amendment signed March 27, 2026; effective January 1, 2027
Read the primary source(opens in a new tab)Governor Hochul signs legislation requiring AI safety frameworks for frontier models
December 19, 2025
Read the primary source(opens in a new tab)LOADinG Act — Legislative Oversight of Automated Decision-making in Government Act
Signed December 21, 2024; in force
Read the primary source(opens in a new tab)AI companion safeguards — General Business Law Article 47
In force since November 5, 2025
Read the primary source(opens in a new tab)Automated Employment Decision Tools — annual independent bias audit and candidate notice
Enforced by NYC DCWP since July 5, 2023
Read the primary source(opens in a new tab)New York State Comptroller — Enforcement of Local Law 144, Automated Employment Decision Tools
Published December 2, 2025; found DCWP enforcement ineffective
Read the primary source(opens in a new tab)Applicability & Enforcement
Who It Applies To
Three largely non-overlapping populations. The RAISE Act, from January 1, 2027, reaches developers of frontier models trained above 10^26 operations, with the framework, quarterly assessment, and disclosure duties limited to those with annual revenue above $500 million, and scope limited to New York operations. The LOADinG Act reaches New York State agencies and, in practice, their AI vendors. NYC Local Law 144 reaches any employer or employment agency — of any size — using an automated employment decision tool for a position located in New York City. GBL Article 47 reaches operators of AI companion systems available to New York users.
Enforcement
RAISE Act: a new office within the New York Department of Financial Services receives disclosure statements, quarterly catastrophic risk assessment summaries, and 72-hour critical safety incident reports; the Attorney General brings civil penalty actions. No private right of action. LOADinG Act: administered through state agency compliance and legislative oversight. NYC Local Law 144: NYC Department of Consumer and Worker Protection, complaint-driven in practice. GBL Article 47: New York Attorney General, exclusive.
Penalties
RAISE Act: up to $1 million for a first violation and up to $3 million for each subsequent violation, plus $1,000 per day for disclosure statement failures — reduced by the chapter amendment from $10 million and $30 million. NYC Local Law 144: $500 for a first violation and each additional violation on the same day, then $500 to $1,500 for each subsequent violation, with each day a violation continues counting as a separate violation and the audit and notice failures counting separately. GBL Article 47: up to $15,000 per day, with collected penalties directed to suicide prevention.
Recommended Compliance Actions
Steps organizations should consider to prepare for and comply with New York's AI regulations.
- 1
Inventory every tool that substantially assists a hiring or promotion decision for a New York City position, including resume screeners, video interview scoring, assessment platforms, and ranking features inside your ATS. Vendor features count.
- 2
Commission or refresh an independent bias audit covering selection and scoring rates by race/ethnicity and by sex. The audit must be within the preceding year and the auditor must be independent of the tool's vendor and of you.
- 3
Publish the bias audit summary on your website and confirm it is publicly reachable. This is the artifact the Comptroller told DCWP to review proactively, and the one most non-compliant employers are missing.
- 4
Add the 10-business-day candidate notice to every affected job posting and application flow, and record when it was given. Notice and audit are separate violations.
- 5
If you train frontier models above 10^26 operations, build one framework and one incident-response runbook to the 72-hour clock, and map it to New York DFS, the Illinois Emergency Management Agency and Attorney General, and California. Do not build three.
- 6
If the RAISE Act reaches you, add the DFS-specific items a California-only program will not have: the quarterly catastrophic risk assessment summary and the 5-percent ownership disclosure statement.
- 7
Request your model vendors' published frontier AI frameworks and transparency reports and file them with your vendor risk records. These are due under three state laws and are the strongest third-party evidence available for model due diligence.
- 8
If you sell AI to New York State agencies, prepare to supply the inputs to a LOADinG Act impact assessment — objectives, algorithm description, accuracy and fairness testing, cybersecurity and privacy risk — on a two-year refresh cycle.
- 9
Track the seven bills awaiting the Governor's signature through December 31, 2026. Training data transparency, synthetic content provenance, and surveillance pricing would each reach ordinary deployers in a way the RAISE Act does not.
Related TrustEdge Services
As of September 14, 2026. We are not lawyers and this is not legal advice. It is the responsibility of consumers of this data that they verify the applicability and current ratified statutes and legal precedence with a qualified attorney licensed in the state or country they are researching.
Need Help with AI Compliance?
Our team helps organizations build compliance-first AI systems that meet current and emerging regulatory requirements.