New York Opens RAISE Act Registration for AI Labs | Zeniteq
Loading
Loading article
Zeniteq is now available on mobile for iPhone, iPad and Apple Watch.Download nowLearn more
New York Opens RAISE Act Registration for AI Labs
Large frontier AI developers must register by January 1, 2027, with public disclosures, incident-reporting deadlines and million-dollar penalties shaping the compliance work ahead.
New York has officially launched its RAISE Act registration portal, requiring large frontier AI developers to register by January 1, 2027. This implementation marks the start of state-mandated oversight for companies developing or operating advanced AI models within New York.
Developers must now navigate complex compliance workflows, including public safety disclosures, quarterly risk assessments, and incident reporting. Large frontier developers, defined by specific compute thresholds and $500 million in annual revenue, face potential penalties of up to $1 million for initial violations.
New York opened its RAISE Act registration portal on November 10, 2026, according to TechCrunch. Large frontier AI developers, including companies such as OpenAI and Anthropic, face a January 1, 2027 registration deadline as the state begins implementing its safety and transparency law.
The immediate task extends beyond opening an account. New York’s Department of Financial Services guidance sets out recurring registration, public safety documentation, model-release disclosures and critical-incident reporting. Some duties apply to frontier developers below the law’s $500 million revenue threshold, a distinction that matters for companies assessing their exposure.
For compliance teams, the useful way to read this rollout is as several connected workflows: registration, release approval, recurring risk assessment and incident response. Each has a different trigger and schedule.
The Law Predates the Portal
Governor Kathy Hochul signed the RAISE Act on December 19, 2025. The signing announcement described public safety protocols, incident reporting, civil penalties and a new oversight office within the Department of Financial Services.
The November 2026 development is implementation: a registration portal, a named oversight organization and a research center supporting the state’s AI safety work. It is not a newly passed law.
DFS now says large frontier developers must file a disclosure statement and maintain current registration to develop, deploy or operate frontier models in New York beginning January 1, 2027. TechCrunch supplies the portal’s opening date; the official guidance confirms the registration requirement and effective date.
Who Must Register: Two Thresholds Matter
New York’s coverage test combines model-training computation with developer revenue. The DFS definitions identify three categories:
Frontier model: A foundation model trained using more than (10^{26}) integer or floating-point operations.
Frontier developer: A person who trained or initiated training of a frontier model using, or intending to use, the specified computing power.
Large frontier developer: A frontier developer whose annual gross revenue, together with affiliates, exceeded $500 million in the preceding calendar year.
The computation count includes the original training run and subsequent fine-tuning, reinforcement learning or other material modifications applied by the developer. It measures operations performed, not response speed or a dollar training budget.
The revenue calculation also deserves attention: DFS specifies gross revenue, affiliates and the preceding calendar year. A single subsidiary’s revenue figure would therefore be an incomplete starting point.
The practical consequence is a two-part coverage review. Developers need a model-training inventory and an entity-level revenue assessment. Companies below the revenue threshold may avoid the additional large-developer duties while still owing model transparency reports and critical-incident notifications.
Registration Requires Maintenance
Large developers must renew their disclosure statements every two years, upon a transfer of frontier-model ownership, or following a material change to previously reported information, whichever occurs earlier.
Access to the secure RAISE Portal requires an NY.gov ID account. DFS encourages all frontier developers to create an account in advance so they can report incidents promptly, including developers that are not required to register as large developers.
I’d treat account access as an incident-readiness task. Discovering an access problem after a reporting clock starts creates an avoidable dependency. The portal’s submission workflow has not been independently verified for this analysis.
Public Documents Follow Different Schedules
The DFS guidance separates disclosures tied to model releases from recurring safety obligations.
All frontier developers, with additional content for large developers
Before or concurrently with deployment of a new or substantially modified frontier model
Public frontier AI safety framework
Large frontier developers
Publish and maintain; review and update as appropriate at least annually
Summary of catastrophic-risk assessments from internal model use
Large frontier developers
Submit to DIGIT every three months
Model Reports Belong in the Release Process
A model transparency report must appear conspicuously on the developer’s website. It must include the developer’s website address and contact information, the model’s release date, supported languages, output modalities, intended uses, and restrictions or conditions on use.
Large developers must add summaries and results of catastrophic-risk assessments, the extent of third-party evaluator involvement, and other steps taken to fulfill their safety framework.
That timing makes disclosure a release dependency. A report assembled after deployment would miss the published requirement to disclose before or concurrently with release. Teams also need a way to decide when a modification is substantial enough to trigger a new report.
Disclosure of third-party involvement is not, by itself, a blanket independent-audit requirement. The published guidance asks large developers to explain the extent of that involvement.
Safety Frameworks Cover Processes and Governance
Large developers’ public safety frameworks must describe how they define, assess and mitigate catastrophic risks; respond to critical safety incidents; secure unreleased model weights; and establish internal governance to implement those processes.
The quarterly submission is separate: it summarizes catastrophic-risk assessments resulting from internal use of frontier models. DFS describes this as a submission to DIGIT, while the framework and model transparency reports are public website disclosures.
My reading is that a compliance calendar needs both release-triggered and recurring checkpoints. An annual framework review alone cannot cover a model launch or the next quarterly submission.
The 72-Hour Clock Has an Earlier Warning Trigger
Frontier developers must report qualifying critical safety incidents to DIGIT through the RAISE Portal within 72 hours. According to DFS, the clock starts upon determining that an incident occurred or “learning facts sufficient to establish a reasonable belief” that one occurred.
That second trigger is consequential. A response process built around waiting for a final investigation report could be too slow. Developers need a route for escalating credible facts while an investigation continues.
A more urgent rule applies when a critical safety incident poses an imminent risk of death or serious physical injury: disclosure must occur within 24 hours to an appropriate authority, such as a law-enforcement or public-safety agency with jurisdiction.
These are distinct obligations with different recipients:
DIGIT: Critical safety incident reporting through the portal within 72 hours of the specified trigger.
Appropriate authorities: Disclosure within 24 hours when the incident presents the specified imminent danger.
The practical implication is to prepare both reporting paths. A portal account cannot substitute for identifying which public-safety authority should receive an urgent notification.
The guidance concerns qualifying critical safety incidents. Teams still need to apply the law’s definitions when classifying an event; these deadlines should not be read as applying automatically to every inaccurate or objectionable model response.
DIGIT Oversees Compliance; the Attorney General Can Sue
The rollout involves three institutions with different responsibilities.
DIGIT, the Office of Digital Innovation, Governance, Integrity, and Trust, will implement the RAISE Act and oversee large frontier AI developers, TechCrunch reports.
The New York Center for AI Responsibility and Research, launched at Binghamton University, will independently evaluate advanced AI systems’ safety, security and operation and work with DIGIT to review companies’ safety frameworks.
The state attorney general can bring civil actions against large frontier developers for failing to submit required reporting or making false statements, according to the state’s signing announcement. Penalties can reach:
$1 million for a first violation
$3 million for subsequent violations
Those figures are maximums, not automatic fines. TechCrunch also reports that the state can pursue enforcement against companies that fail to register, although a spokesperson declined to explain the specifics.
For affected developers, the clearest immediate priority is to assign ownership across these obligations. Registration needs an accountable filer; model disclosures need a release checkpoint; incident reporting needs an escalation path; and quarterly assessments need a recurring deadline. Completing the portal registration addresses only one part of that work.
Frequently Asked Questions
3 questions
1
When Is RAISE Act Registration Due?
Large frontier developers must maintain current registration to develop, deploy or operate frontier models in New York beginning January 1, 2027.
2
Does the $500 Million Threshold Exempt Smaller Developers?
It separates large frontier developers from other frontier developers. Smaller frontier developers still face model transparency and critical-incident reporting requirements under DFS guidance.
3
When Does the 72-Hour Reporting Window Start?
It begins when a developer determines that a critical safety incident occurred or learns facts sufficient to reasonably believe one occurred. An imminent risk of death or serious physical injury also triggers a 24-hour disclosure requirement to an appropriate authority.
