New York opens its AI safety registry for OpenAI and Anthropic

New York is moving from law to enforcement on frontier AI. On Tuesday 10 November, the state opened a registration portal that large frontier developers such as OpenAI and Anthropic will have to use by 1 January 2027, according to TechCrunch. That is also the date on which the obligations of the RAISE Act begin to apply, so the headline is less a sudden change than the start of a countdown.

What the law requires

The Responsible AI Safety and Education (RAISE) Act targets large frontier developers, defined by TechCrunch as companies with more than $500 million in annual revenue. According to the office of Governor Kathy Hochul, which described the law in a statement dated 21 September, these companies must:

• establish safety and transparency frameworks and publish them on their own website;
• report critical safety incidents to the new DIGIT office within 72 hours;
• file quarterly assessments of catastrophic risks with DIGIT;
• register with DIGIT, file a disclosure statement at least every other year starting 1 January 2027, and pay assessments.

TechCrunch also mentions public model transparency reports. CIO Dive, reporting on the signing of the law in December 2025, adds that developers must name a senior person responsible for compliance. It lists examples of reportable incidents: a frontier model autonomously behaving outside what the user asked, a critical failure of technical controls, or theft, malicious use or unauthorized access to the model.

The public can also file suspected critical incident reports with DIGIT, which may pass them to other authorities, says the governor's office. DIGIT will publish an annual report summarizing the reports received, its observations on frontier model safety and any changes it recommends to the law.

Who enforces it, and what it can cost

The Office of Digital Innovation, Governance, Integrity, and Trust (DIGIT) sits within the New York State Department of Financial Services. Marc Gilman, named Deputy Director for the RAISE Act in September, is its first full-time hire, and the governor's office says more staff will join in the coming weeks and months. Attorney General Letitia James said her office will enforce the law.

Penalties can reach $1 million for a first violation and $3 million for subsequent ones, according to TechCrunch. CIO Dive specifies that this applies to developers who fail to submit required reports or make false statements. The state can also take action against companies that do not register in the new portal, but a spokesperson declined to give TechCrunch any specifics, so how that would work in practice is not yet known.

Alongside the portal, Hochul launched the New York Center for AI Responsibility and Research at Binghamton University, part of the State University of New York. Per TechCrunch, it will independently evaluate the safety, security and operation of advanced AI systems and work with DIGIT to review companies' safety frameworks. The governor first announced it in January, with $55 million in donations and capital.

We're building a national model for smart, sensible AI regulation, a model that puts communities above corporations and people above powerful technology.

A patchwork of state rules, and a federal dispute

New York is not alone. TechCrunch notes that California's SB 53, in force since January, also requires frontier labs to maintain and publish safety frameworks and to put whistleblower protections in place, with critical incidents reported within 15 days. Illinois' SB 315, which starts at the beginning of 2027, has similar requirements and adds independent safety compliance audits. New York has other AI safety texts too: a companion-chatbot law already enforced, and a chatbot law for minors signed in October that takes effect on 1 June 2027.

The federal backdrop is tense. CIO Dive reported in December 2025 that the RAISE Act was the first state AI law signed after President Donald Trump's executive order creating an AI Litigation Task Force to challenge state laws. It said it remained to be seen which states the task force would target first, and named Colorado. The sources we read do not say whether New York's law is or will be challenged. For its part, the governor's office says the federal government has taken no new action on AI safety.

What it changes for a business

The text covers only developers above the revenue threshold, so a typical US company that simply uses models from OpenAI or Anthropic has no filing to make. The effects are likely to be indirect. Safety frameworks that must be published, and incident reporting on a 72-hour clock, give buyers new material to read when they assess an AI vendor. This is our analysis, not something the law states.

A business building agents on top of these models can already ask its suppliers where their framework is published and how incidents are communicated. Companies close to the threshold that train their own large models should check now whether they fall under the registration requirement. We discuss how to organise that oversight internally in our guide on AI agent governance.