On November 10, 2026, New York began accepting registrations under the RAISE Act, which sets safety and transparency rules for frontier AI, and launched a research center to independently verify the safety of AI systems. The RAISE Act matches Illinois's SB 315 on three points: the revenue threshold that determines who is covered, the deadline for reporting critical safety incidents, and the cap on civil penalties. The new research center plans to bring together more than 80 researchers, but it has no legal authority to require companies to undergo audits. Its role is to assess safety measures and make recommendations for strengthening regulation. To understand this move, it helps to distinguish between the law that takes effect in 2027 and the separate research infrastructure being built alongside it.
RAISE Act registration opens; the law takes effect on January 1, 2027
On November 10, the Office of Digital Innovation, Governance, Integrity, and Trust (DIGIT), newly established within the New York State Department of Financial Services (DFS), opened a registration portal for large frontier developers. Under the RAISE Act, a "frontier developer" is a company that has trained, or has begun training, a foundation model that requires more than 10^26 integer or floating-point operations. Among these, those with total annual revenue, including affiliates, above $500 million (about ¥79 billion) in the previous year qualify as "large frontier developers." The yen conversion uses a rate of ¥158 to the dollar, based on the exchange rate published by the Bank of Japan at 5 p.m. on November 10, 2026. TechCrunch's report names Anthropic and OpenAI as examples of companies that must register.
The RAISE Act was signed by the governor on December 19, 2025. An amending bill, S8828, which revised the definitions of covered entities and the penalties, was introduced in the state Senate on January 8, 2026, passed the Assembly on March 11, and was signed by the governor on March 27. This history is also confirmed in the New York State Senate's records. The amendment moved the effective date to January 1, 2027, so what began on November 10 is the registration period ahead of enforcement.
Once the RAISE Act takes effect, large frontier developers will be required to publish a "frontier AI safety framework" describing their safety measures and review it at least once a year; to submit, in principle every three months and on a non-public basis, summaries of catastrophic-risk assessments related to internal use of their models; and to update their disclosure statements every two years and pay a fee. Catastrophic risk here means a serious danger that could lead to the death or serious injury of more than 50 people, or more than $1 billion in property damage, from a single incident. Specifically, it covers expert-level assistance in creating or releasing chemical, biological, radiological, or nuclear weapons; conduct such as cyberattacks carried out without meaningful human oversight; and situations in which an AI model escapes the control of its developer or user. The obligation to report critical safety incidents within 72 hours, and the obligation to publish transparency reports when deploying new models and in similar situations, apply to all frontier developers regardless of size.
On the same day, New York also announced the launch of the New York Center for AI Responsibility and Research (NYCAIRR), based at Binghamton University. Greg Morrisett, dean of Cornell Tech, and Jeannette Wing, executive vice president for research at Columbia University, have been named interim co-directors, and the center plans to gather more than 80 researchers from universities and research institutions across the state. It will use Empire AI's computing resources to independently test and evaluate frontier AI systems and companies' safety frameworks. The plan was first announced in January 2026, and the center is not an institution created by the RAISE Act.
Comparing three state AI safety laws: New York and Illinois align on three criteria
The distinguishing features of the RAISE Act become clear when compared with California's SB 53 and Illinois's SB 315, which came before it. All three states share the same revenue threshold for large frontier developers, but they differ on the deadline for reporting critical safety incidents and on whether third-party audits are required. Based on the statutes themselves and on analyses from Morrison Foerster (MoFo), Latham & Watkins, and the Future of Privacy Forum (FPF), the main provisions compare as follows.
| Item | New York RAISE Act | California SB 53 | Illinois SB 315 |
|---|---|---|---|
| Revenue threshold for large frontier developers | Total annual revenue above $500 million in the previous year | Above $500 million | Above $500 million |
| Deadline for reporting critical safety incidents | 72 hours | 15 days from discovery | 72 hours |
| Cap on civil penalties | $1 million for a first violation, $3 million for subsequent violations | $1 million per violation | $1 million for a first violation, $3 million for subsequent violations |
| Whistleblower protections | None | Yes | Yes |
| Independent third-party audit requirement | None | None | Annually from January 1, 2028 |
California's SB 53 took effect on January 1, 2026, while New York's RAISE Act and Illinois's SB 315 take effect on January 1, 2027. All three states also require a report within 24 hours when there is an imminent risk of death or serious injury. However, the frequency of disclosure updates differs: Illinois requires them annually and New York every two years, and New York's law also grants rulemaking authority to set additional reporting and disclosure requirements.
As the table shows, New York and Illinois match on the revenue threshold, the 72-hour reporting deadline, and the penalty caps of $1 million for a first violation and $3 million for subsequent ones. On the other hand, New York law has no counterpart to the independent third-party audit that Illinois will require from January 1, 2028. Whistleblower protections are likewise provided in California and Illinois but are not included in the RAISE Act. So even where the basic regulatory frameworks are similar, clear differences remain in the mechanisms for externally verifying safety measures and in the protection of employees.
The scale of the penalties also deserves a closer look. The $1 million cap (about ¥158 million) for a first violation under the RAISE Act equals 0.2% of the $500 million revenue threshold for large frontier developers. Because $500 million is the floor for covered companies' annual revenue, the ratio would be even smaller for actual covered companies. The penalty is also a per-violation cap that the state attorney general seeks through a civil action; it is not imposed automatically. The cap for subsequent violations is $3 million (about ¥474 million). The 2026 amendment cut both figures to one-tenth of the previous levels of $10 million for a first violation and $30 million for subsequent ones.
The two states' third-party audit regimes also differ in important ways. In Illinois, large frontier developers must have an independent third party audit them once a year for compliance with the law's requirements. By contrast, the RAISE Act requires New York companies to explain, within their safety frameworks, how they use third parties, and to state the extent of third-party evaluators' involvement in the transparency reports they publish when deploying new models. As Latham & Watkins points out, this is an obligation for companies to explain their own policies on using external evaluation, not a provision mandating an audit by an independent third party.
The new AI safety research center is not a statutory audit body
NYCAIRR, launched by New York, plays a different role from such statutory third-party audits. According to the state's announcement, the center will provide expertise, evaluation results, and scientific evidence at the state's request, supporting AI policymaking and oversight of frontier developers. Among the specific activities listed is working with DIGIT to review the safety frameworks that companies have published and to recommend ways to strengthen regulatory requirements. However, the announcement describes these reviews as activities to be started, and it shows no track record of any company's safety framework having already been examined.
It also remains unclear how independent an evaluation the center can carry out. The announcement does not describe any authority to compel companies to submit materials or cooperate with inspections, and it does not say how researchers will gain access to unreleased AI models. In addition, the figure of more than 80 is the number of researchers the center plans to assemble, not the number already participating. The launch of the research center cannot be equated with the establishment of an independent audit system for companies.
The oversight mechanism under the RAISE Act is set up separately from the research center. DIGIT receives company registrations, disclosure statements, and incident reports, and when violations occur, the state attorney general seeks penalties through civil actions. DIGIT has rulemaking authority to implement the law and, under Section 1429, can consider additional reporting and disclosure requirements to improve safety and transparency. NYCAIRR, by contrast, is positioned to provide technical evaluation and scientific evidence, and its recommendations do not in themselves impose new legal obligations on companies.
In considering the relationship between the research center and regulation, the RAISE Act's exemptions also deserve attention. The law excludes from its scope academic research on AI models conducted by accredited universities in the state, as well as the Empire AI Consortium and Institute. Empire AI, which NYCAIRR will draw on, is a computing infrastructure for research built through a public-private initiative worth $500 million. The plan is to carry out independent evaluations using this research infrastructure, but NYCAIRR was not established as a regulatory body with investigative powers or enforcement authority over companies.
In the announcement, Governor Hochul said, "The stakes are too high to simply take AI companies at their word," stressing the need for independent verification. The state aims to build a mechanism in which outside researchers evaluate the safety measures companies publish themselves and the results inform policy decisions. At present, however, the center's role is limited to evaluation and recommendations, and it does not create a statutory audit obligation. What New York added on November 10 was not a regulation within the text of the RAISE Act but a research structure that supports regulators on the technical side.
Will future expansions of AI safety law add third-party audits or whistleblower protections?
That said, the differences between New York's regulation and that of other states will not necessarily remain. Section 1429 of the RAISE Act gives DIGIT rulemaking authority, leaving room to strengthen oversight of companies through additional reporting and disclosure requirements. Alex Bores, the Assembly member who sponsored the RAISE Act, also explained in the state's September 21, 2026 announcement that DIGIT has been given authority to request additional data from companies, issue new rules, and recommend changes to the law. This differs from California's SB 53, where the role of the state's technology agency is mainly limited to recommending updates to the statutory definitions, whereas New York's DIGIT can directly issue rules implementing the law.
However, having rulemaking authority does not mean that an independent audit obligation or whistleblower protections like those in Illinois could be introduced without amending the law. The additional powers explicitly provided in the RAISE Act relate mainly to reporting and information disclosure. Establishing independent third-party audits or employee protections as new legal obligations would likely require legislative amendments by the state legislature.
Against this backdrop, at a November 10 press conference, Governor Hochul said she intends to unveil new measures to expand the AI safety law within the next few weeks. The state's official announcement, meanwhile, says it will consider ways to strengthen the RAISE Act over the coming months. If an expansion proposal includes third-party audits or whistleblower protections, it would narrow the gap between New York's and Illinois's rules. But presenting a policy proposal or introducing a bill does not by itself change existing obligations, so actual legal amendments or rulemaking will need to be confirmed.
The research center's effectiveness will also be judged by its future activities. The state's announcement says NYCAIRR can provide evaluation results and scientific evidence, but it is not known how far these will be reflected in DIGIT's rulemaking or in changes to state policy. If the results of its safety framework reviews are published and lead to revisions of regulatory requirements, the center could be seen as substantively reinforcing the statutory oversight system. If no recommendations or evaluation results can be seen, however, it will be hard to judge its impact from the announcement of an independent verification structure alone.
Two points will matter most in future verification. First, whether the expansion proposal the governor previewed, or bills submitted to the 2027 legislative session, include third-party audits, whistleblower protections, and access to the AI models needed for evaluation, and whether these are actually institutionalized. Second, whether NYCAIRR reviews companies' safety frameworks and whether its results and recommendations can be seen in DIGIT's draft rules, state policy documents, or the center's own published materials. Because DIGIT's annual reporting under the RAISE Act begins on January 1, 2028, how the center's activities connect to the operation of regulation by then will be one benchmark.
As of November 10, 2026, New York's RAISE Act matches Illinois's SB 315 on three main criteria but has no provisions on independent third-party audits or whistleblower protections. The new research center is not a mechanism that immediately closes this gap; it is a structure intended to support future regulatory strengthening through scientific evaluation. The focus going forward will be on the specifics of the legal amendments the state has previewed and on whether the center's evaluation results are reflected in actual oversight and policy.