New York is preparing to begin registering large frontier AI developers this month, the next step in implementing the Responsible AI Safety and Education (RAISE) Act. Governor Hochul's office said in a September 21 announcement that the state will start directing developers to register in November, with compliance obligations beginning in January 2027.
What the State Announced
The announcement sets out a sequence. Large frontier developers will first register with the state. Starting January 1, 2027, they must file a disclosure statement at least every other year and pay assessments to fund oversight. They must also file quarterly assessments of catastrophic risks, and they must report critical safety incidents within 72 hours.
Two details stand out. The 72-hour window is the core of the incident-reporting regime, and it applies to the developers covered by the law rather than to all AI users. The release also makes clear that the framework applies to large frontier developers, but it does not spell out the revenue or compute thresholds that define that group. Companies that may be affected should review the statute directly rather than rely on summaries.
Who Oversees the Rules
Implementation sits with the Office of Digital Innovation, Governance, Integrity and Trust, known as DIGIT, which sits within the state Department of Financial Services. DIGIT receives developers' registrations, disclosure statements and quarterly catastrophic-risk assessments. It can pass those assessments to other government authorities.
The office also accepts public reports of suspected critical safety incidents, which gives outside parties a channel to raise concerns. It will publish an annual public report covering incident reports, observations about frontier model safety and recommended changes to the law. Marc Gilman has been appointed deputy director of the office.
According to the Department of Financial Services' summary of the announcement, Assemblymember Alex Bores said DIGIT can demand more data from AI companies, issue new rules and recommend legislation. That combination of data access and rulemaking powers is what distinguishes an active oversight body from a passive registry.
Incident Reporting and Assessments
The 72-hour reporting requirement is the most time-sensitive element. A developer that identifies a critical safety incident must notify DIGIT within three days, alongside any other authorities that the law requires. Quarterly catastrophic-risk assessments add a steady rhythm of reporting, so regulators will receive regular information rather than relying solely on incidents that companies choose to disclose.
Assessments also carry costs. Developers must pay them, which means compliance is not only a legal exercise but also a budget line. For large AI companies, that is likely to be manageable. For smaller developers that cross the threshold, the expense may be more significant.
Federal Context
New York's move comes as Congress has yet to act. The Center for Democracy and Technology reports that no federal AI bills have passed in the current session, and it lists proposals such as the GUARD Act and the CHATBOT Act that have not become law. Federal policy has instead relied on executive orders and voluntary frameworks, including a National Policy Framework for AI released in March 2026.
That gap helps explain why states are moving first. CDT's review found that 19 states passed chatbot legislation across the 2025 and 2026 sessions, and several states passed laws on AI auditing and frontier model frameworks. New York's approach is among the most specific, because it ties registration, reporting and assessments to named obligations and a dedicated office.
Why It Matters
For frontier developers, the New York framework turns voluntary safety commitments into a regulatory duty with a reporting clock. Companies that publish safety frameworks will need to show regulators how those frameworks work in practice, and they will need internal processes that can identify a critical incident within days.
For the public, the law offers a formal path to report concerns, and an annual report that can inform future legislation. Whether DIGIT uses its powers to demand data and issue rules will shape how much the law reveals about frontier AI risks.
What to Watch
- Whether the state opens its registration portal and publishes guidance in November.
- Which companies register first, and whether the state names covered developers publicly.
- The first annual DIGIT report and the recommendations it contains.
- Whether other states adopt similar registration and incident-reporting rules.
