On November 1, 2026, the registration window for New York State's Responsible AI Safety and Education Act (RAISE Act) officially opens. Under the law, frontier AI developers with annual revenue exceeding $500 million and models trained with more than 10^26 integer or floating-point operations must complete registration with New York State's newly established DIGIT office (Office of Digital Innovation, Governance, Integrity and Trust). This is the first state-level frontier AI registration regime in the United States with substantive enforcement power, and companies such as OpenAI and Anthropic face binding legal obligations distinct from voluntary commitments for the first time.
Legal Framework and Enforcement Agency
The RAISE Act was signed by New York Governor Kathy Hochul on December 19, 2025. A subsequent amendment (S8828/A9449) was promulgated as Chapter 96 on March 27, 2026, setting the effective date of core compliance obligations uniformly at January 1, 2027. The November registration window is a preparatory phase before full compliance.
The enforcement agency DIGIT is part of the New York State Department of Financial Services (DFS). According to GRC Report, Hochul has appointed Marc Gilman as deputy director of DIGIT and RAISE Act lead, the office's first full-time employee. Gilman previously served as general counsel and vice president of compliance at Theta Lake, with an annual salary range of $173,000 to $214,000. New York Attorney General Letitia James said her office will handle enforcement to protect New York residents.
Who Is Covered and What They Must Do
The threshold for a “large frontier developer” consists of two conditions that must both be met: first, the company (including affiliates on a consolidated basis) had total revenue exceeding $500 million in the previous calendar year; second, it owns foundation models trained with more than 10^26 operations. This means many small and medium-sized AI companies, as well as firms focused on model applications rather than training, are outside the current law's scope.
Covered developers face the following mandatory obligations:
- 72-hour incident reporting: Critical safety incidents must be reported to the DIGIT office within 72 hours and, when necessary, to other government agencies
- Quarterly catastrophic risk assessments: Periodically submit assessment reports to DIGIT on the potential catastrophic risks of models
- Public safety and transparency framework: Publish a safety and transparency framework on the official website, review it at least once a year, and announce major changes within 30 days
- Biennial disclosure statement: Starting January 1, 2027, submit a complete compliance disclosure statement every two years
- Pay regulatory assessment fees: DIGIT's operating costs are shared proportionally by covered large developers, but specific rates have not yet been announced
The Law Exists, but Enforcement Details Remain Blank
The law is in effect, but there is a clear gap at the enforcement level: as of an October 9, 2026 analysis by Pillsbury law firm, DIGIT has not issued any specific filing forms, fee standards, or incident determination guidance. According to Threatfrontier, DFS announced that registration would “begin in November 2026,” but no exact date was given and no forms or filing instructions were released.
How should “catastrophic risk” be assessed? Where is the boundary of a “critical safety incident”? These definitions directly determine compliance costs and legal risks, yet all remain unresolved. If companies start investing compliance resources now, they face a ruler without markings. Pillsbury lawyers explicitly advise that before DIGIT issues detailed guidance, companies should not rely solely on the draft amendment text to determine the scope of specific obligations—because the draft and the final regulations may differ.
The End of the Voluntary Era
Over the past two years, major AI developers such as OpenAI, Anthropic, and Google have signed voluntary safety commitments with the U.S. federal government, covering incident sharing, red-teaming, watermarking, and other areas. These commitments share common features: no legal binding force, no third-party audit mechanism, and no penalty provisions.
The significance of the RAISE Act is that it cuts off this retreat. When announcing the implementation plan for the law, Hochul stated clearly: “Trump and Republicans in Washington may stand by as AI's increasingly unpredictable momentum grows, but New York will not.” This statement reveals the core logic driving the law: a federal regulatory vacuum has spurred state-level action.
New York is not alone. According to Pillsbury's analysis, California's SB 53 (Frontier Artificial Intelligence Transparency Act), Connecticut, and Illinois have all passed similar legislation, forming a state-level regulatory matrix for frontier AI. Illinois' standards closely overlap with the RAISE Act: the same 10^26 operations model threshold, a $500 million revenue company threshold, a maximum fine of $1 million for a first violation and up to $3 million for each subsequent violation—one of the few specific penalty provisions currently available for reference, while New York's penalty standards are not yet set.
The Real Structure of Compliance Pressure
For companies like OpenAI, Anthropic, and Google DeepMind, registration itself will not be an obstacle, but systemic compliance costs will be substantial. The 72-hour incident reporting requirement means building a 24/7 safety monitoring and reporting pipeline and internally defining and classifying “critical safety incidents”—before DIGIT issues standards, this definition work alone will require significant legal and technical resources. Quarterly catastrophic risk assessments require turning risk management from a one-off document into an ongoing operational process.
Deeper pressure comes from overlapping multi-state compliance. If requirements in California, New York, Connecticut, and Illinois differ in subtle ways, companies will need to maintain multiple compliance systems rather than a unified federal framework. Secure Privacy's analysis notes that New York favors “stacking multiple targeted laws” rather than a comprehensive AI act, in sharp contrast to the EU's single risk-tiered framework—the latter's advantage is concentrated compliance costs, while its disadvantage is that once legislation becomes outdated, the entire framework becomes obsolete.
Independent Judgment
The historical significance of the RAISE Act is that U.S. AI regulation moves from “soft law” to “hard law.” Once this door opens, the cost for other states to follow suit will drop sharply. But whether it can truly change AI developer behavior depends on a currently absent variable—whether DIGIT can establish assessment standards with genuine technical understanding, rather than turning compliance into a paper-piling game.
Starting with one deputy director, no filing forms, and pending penalty amounts, DIGIT faces extremely tight time to build substantive regulatory capacity covering the world's most complex AI systems by January 2027. The legal framework is a necessary but not sufficient condition. If final compliance obligations remain at the level of “publishing a framework document and filling out a quarterly form,” then the RAISE Act's actual binding force will be disproportionate to its symbolic significance.
For the AI industry, the more important signal may not be the law itself but the direction it signals: the next question is no longer “whether AI should be regulated,” but “who sets the standards and what methods are used to assess them.” So far, no regulator—federal or state—has given a convincing answer to this question.
© 2026 Winzheng.com 赢政天下 | 转载请注明来源并附原文链接