Pull to refresh
Logo
Daily Brief
Following
Why Ranks Sign Up
New York’s RAISE Act turns frontier AI safety into a 72-hour countdown

New York’s RAISE Act turns frontier AI safety into a 72-hour countdown

Rule Changes

The 72-hour reporting clock survives—but the penalty teeth are smaller, as Washington leans harder on preemption

December 21st, 2025: Reuters write-up spotlights how RAISE penalties were scaled down from earlier versions

Overview

New York just told the biggest AI labs: if something goes seriously wrong, you don't get to bury it. Under the RAISE Act, large "frontier AI" developers must publish a safety approach and report "critical harm" incidents to the state within 72 hours after determining one occurred. First violations carry civil penalties capped at $1M; later violations, $3M—far below the bill's June penalty structure.

The state's approach extends beyond frontier-lab transparency. Separate Hochul-signed measures target AI use in ads and post-mortem name/image/likeness protections in the film industry. These reinforce a broader New York strategy just as the White House ramps up pressure to preempt state AI rules before Congress acts.

Key Indicators

72 hours
Incident reporting window
Companies must notify the state quickly once they determine a qualifying incident occurred.
$1M / $3M
Civil penalty caps (first vs. subsequent violations)
Attorney General enforcement includes penalties for failing to report or making false statements.
1 new office
New DFS oversight unit
A new office inside New York’s financial regulator becomes the AI transparency referee.
2027-01-01
Reported compliance start date
Coverage indicates key obligations phase in starting January 1, 2027.
$500M+
Reported “largest company” threshold
Major coverage describes applicability tied to very large-company scale.

Voices

Curated perspectives — historical figures and your fellow readers.

Ever wondered what historical figures would say about today's headlines?

Sign up to generate historical perspectives on this story.

Play

Exploring all sides of a story is often best achieved with Play.

Log in to play. Track your picks, climb the leaderboards. Log in Sign Up
Predict 4 ways this could play out. Contrarian picks score more — points lock when the scenario resolves. Log in to play
Connections Sixteen names from the news. Find the four hidden groups of four. Log in to play

People Involved

Organizations Involved

Timeline

September 2024 December 2025

11 events Latest: December 21st, 2025 · 5 months ago Showing 8 of 11
Tap a bar to jump to that date
  1. Reuters write-up spotlights how RAISE penalties were scaled down from earlier versions

    Latest Media

    A Reuters story syndicated by Engadget highlighted that the final RAISE Act’s penalty caps ($1M/$3M) are substantially lower than the higher fine levels described for earlier versions, while also noting Hochul’s earlier December signings aimed at AI transparency in advertising and post-mortem likeness consent.

  2. Wall Street Journal frames it as defiance

    Media

    WSJ spotlights New York’s move despite the federal push for preemption.

  3. White House tries to freeze the states

    Rule Changes

    Trump signs an order aimed at blocking restrictive state AI laws.

  4. Parents push Hochul to sign

    Public Pressure

    A parent-led coalition urges Hochul to enact RAISE without weakening edits.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

2017–present

NYDFS Cybersecurity Regulation (23 NYCRR 500)

New York’s financial regulator imposed detailed cybersecurity obligations and incident reporting requirements on covered entities. Even outside New York, many firms treated it as a de facto baseline because compliance programs don’t scale well state-by-state.

Then

Companies built formal reporting and governance processes to avoid NYDFS penalties.

Now

New York proved a state regulator can set national compliance norms in practice.

Why this matters now

RAISE repeats the same playbook: make reporting mandatory, then make it enforceable.

2016–2018 (adoption to enforcement)

GDPR and the “Brussels effect” in privacy

Europe passed a privacy regime with strong disclosure and breach notification rules. Global companies often chose worldwide compliance rather than running separate systems by geography.

Then

Companies rewired privacy operations, contracts, and incident response for GDPR timelines.

Now

Privacy expectations shifted globally, even in places without identical laws.

Why this matters now

New York and California are trying to create an American version of that compliance gravity.

2018–2020 (passage to early enforcement)

California Consumer Privacy Act (CCPA)

California passed a sweeping consumer privacy law that forced national brands to update disclosures and data practices. Many firms rolled out CCPA-style controls nationally to simplify operations.

Then

National compliance teams treated California as the design constraint.

Now

State policy became the launchpad for broader U.S. privacy regulation.

Why this matters now

RAISE aims for the same dynamic—one big state sets the rulebook everyone else follows.

Sources

(13)