AI in action · Regulation
New York Starts Registering Frontier AI Developers Next Month, Under Its Financial Regulator, With 72-Hour Incident Reports From January
New York's Department of Financial Services will begin directing large frontier AI developers to register in November 2026 under the RAISE Act, with full compliance due on January 1, 2027. Developers must publish safety frameworks, report critical safety incidents within 72 hours and file quarterly assessments of catastrophic risk. A new DFS office, DIGIT, will oversee them.
The first US state regulator to supervise the companies that build the largest AI models is a financial regulator. Under New York's Responsible AI Safety and Education Act, the RAISE Act, the Department of Financial Services will start directing large frontier AI developers to register with the state in November 2026, Governor Kathy Hochul's office and DFS announced on September 21, and full compliance, including regular reporting, begins on January 1, 2027. Oversight sits in a new unit inside DFS, the Office of Digital Innovation, Governance, Integrity and Trust, or DIGIT, whose first full-time hire is Marc Gilman, named deputy director for the RAISE Act.
The obligations are concrete. Covered developers must publish safety and transparency frameworks on their websites, report critical safety incidents to DIGIT within 72 hours, and file quarterly assessments of catastrophic risks, which DIGIT may share with other authorities. They must register, file disclosure statements at least every other year from January 2027, and pay assessments that fund the office. Members of the public can also report suspected critical safety incidents to DIGIT. The Attorney General, Letitia James, will enforce the law, and DIGIT will publish an annual report on incidents, its observations of frontier-model safety and recommended changes.
The thresholds follow California's. According to legal analyses by Wiley and others, the final version, amended in March 2026, defines a large frontier developer as one with annual revenue above $500 million, matching California's Transparency in Frontier AI Act, but New York's incident window is much shorter: 72 hours from forming a reasonable belief that an incident has occurred, and 24 hours where there is an imminent danger of death or serious injury, against 15 days in California. That makes New York, not Sacramento, the stricter of the two rulebooks for the handful of companies they cover.
Why a financial regulator? DFS already supervises banks, insurers and crypto firms licensed in New York, and has been one of the most active state agencies on cybersecurity, with a rule that requires regulated companies to report cyber incidents within 72 hours. The RAISE Act borrows that supervisory model, registration, reporting and assessments, and applies it to model developers. "AI companies are playing Russian Roulette with humanity's future," said State Senator Andrew Gounardes, a co-sponsor; Acting Superintendent Kaitlin Asrow said DFS was proud to lead the implementation.
For financial firms the law does not regulate their own use of AI, which remains a matter for existing banking, insurance and securities rules. Its relevance is indirect but real: the models that banks, brokers and insurers license come from the same few developers, and from January those developers will owe a New York regulator a quarterly account of their catastrophic risks and a 72-hour notice when something goes wrong. That is information no bank's vendor-risk team has had before.
Sources: New York State Department of Financial Services — Governor Hochul announces next steps for the RAISE Act (press release, Sep 21, 2026); Wiley — New York Finalizes RAISE Act for Frontier AI Models; Law Takes Effect January 1, 2027; Future of Privacy Forum — The RAISE Act vs. SB 53: A Tale of Two Frontier AI Laws