What does New York RAISE Act say about AI in banking?

What are the key points of New York RAISE Act?

• Enacted as Chapter 699 of the Laws of 2025 (S6953B/A6453B), announced as signed by the Governor on December 19, 2025, and then replaced and finalized by chapter amendment S8828/A9449, signed March 27, 2026 as Chapter 96 of the Laws of 2026; the amendment moved the effective date to January 1, 2027.
• Article 44-B §1420 definitions mirror California's SB 53: 'frontier model' means a foundation model trained using more than 10^26 operations; 'large frontier developer' means annual gross revenues above $500 million with affiliates; the 'office' is an office within the Department of Financial Services reporting to the Superintendent.
• §1421: large frontier developers must publish and follow a frontier AI framework, review it at least annually and publish material changes within 30 days; every frontier developer must publish a transparency report with each new or substantially modified frontier model; no materially false or misleading statements about catastrophic risk.
• §1422: critical safety incidents must be reported to the office within 72 hours of a determination or of learning facts sufficient to establish a reasonable belief that one occurred, or within 24 hours to an appropriate authority for imminent risk of death or serious injury; large developers file catastrophic-risk assessment summaries from internal use every three months.
• §1428: no large frontier developer may develop, deploy or operate a frontier model in whole or in part in New York without a current disclosure statement filed with the office and payment of its pro rata assessment; the statement is renewed every two years or on a transfer of ownership or material change, and the office may levy $1,000 a day for failure to file.
• §1427: the Attorney General may seek civil penalties up to $1 million for a first violation and $3 million for each subsequent violation by a large frontier developer; no private right of action. §1429 gives the office rulemaking authority and allows it to consider additional reporting requirements.
• §1422(7): from January 1, 2028 the office must produce an annual public report with anonymized incident information, relevant frontier-model safety information and recommended changes to the Act.
• §1425 limits the Act to frontier models developed, deployed or operating in whole or in part in New York; §1426 excludes accredited colleges and universities doing academic AI research and the Empire AI consortium.

What did New York RAISE Act change for banks?

The RAISE Act makes New York the second state, after California's SB 53, to impose binding transparency and incident-reporting duties on frontier AI developers, with a shorter 72-hour incident window, registration fees and a standing oversight office. For banks nothing changes directly, but it puts DFS, already the supervisor of the state's banks, in charge of a new office with rulemaking and information-gathering power over the AI labs that supply them. It also arrives alongside DFS's May 2026 industry letter on cyber risks of frontier AI models, which is guidance for DFS-regulated firms, not part of the Act.

What does the New York RAISE Act require, and does it apply to banks?

The New York RAISE Act (General Business Law Article 44-B), effective January 1, 2027, requires frontier model developers to publish transparency reports, and large frontier developers (more than $500 million in annual revenue) to publish and follow a frontier AI framework, report critical safety incidents within 72 hours, file quarterly assessments of catastrophic risk from internal use, and register with a new oversight office inside the Department of Financial Services before developing, deploying or operating a frontier model in New York. Penalties run to $1 million for a first violation and $3 million for later ones, enforced by the Attorney General. It does not regulate banks as users of AI; DFS-regulated banks are affected only indirectly, through the disclosures and incident reporting required of the frontier developers they buy models from.

The Act was enacted in two steps. The December 2025 law (Chapter 699 of 2025) was signed with a chapter amendment agreed in advance; the amendment, S8828/A9449, repealed and replaced Article 44-B, adopted the thresholds and duties above, and set the effective date at January 1, 2027. It was introduced January 8, 2026, passed the Senate January 28 and the Assembly March 11, and was signed March 27, 2026 as Chapter 96. The Governor's release described the result as building on California's framework.

DFS hosts the oversight office but the Act's duties fall on AI developers, not on the banks, insurers and licensees DFS supervises. DFS's September 21, 2026 announcement says New York will direct large frontier developers to register starting in November 2026 and that the DIGIT office will oversee implementation; the Act also lets that office adopt rules and consider additional reporting requirements, so the operative detail may change through rulemaking. Penalties for failing to file a disclosure are administrative, while the Attorney General brings the substantive civil actions.

For banks the Act matters as vendor intelligence. Large AI suppliers will publish frameworks and transparency reports, and report incidents to a regulator in the same state that licenses many banks, but banks will not receive those reports. DFS's separate May 2026 industry letter on frontier AI cybersecurity risk, and its 23 NYCRR Part 500 requirements on third-party service providers, remain the instruments that bind DFS-regulated banks.

WHAT THIS MEANS IN PRACTICE

• Do not treat the RAISE Act as a bank compliance obligation; log it in the AI third-party risk file as a source of vendor disclosures from January 2027.
• Request frontier AI frameworks and transparency reports from model vendors and compare them with those required under California SB 53.
• Write 72-hour incident notification, audit rights and cooperation duties into AI vendor contracts; the Act sends incident reports to the DIGIT office, not to bank customers.
• Watch DFS and the DIGIT office for registration notices, rulemaking and any additional reporting requirements, which the Act authorizes.
• Read the Act alongside DFS's frontier-AI cyber industry letter, which is the guidance that applies to DFS-regulated banks.