New York’s RAISE Act gives frontier labs a 72-hour clock for reporting dangerous AI incidents

TechCrunch reports that New York opened a registration portal on Tuesday for the RAISE Act. Large frontier developers such as OpenAI and Anthropic, defined as companies with more than $500 million in annual revenue, have until January 1, 2027 to sign up. Once registered, they must publish safety frameworks, report critical safety incidents within 72 hours and issue public transparency reports on their models.

Enforcement sits with a new state body, the Office of Digital Innovation, Governance, Integrity, and Trust, or DIGIT. Penalties reach $1 million for a first violation and $3 million for later ones. A spokesperson declined to say what enforcement would look like for a company that simply does not register.

The most consequential detail is the reporting clock. California’s SB 53 gives labs 15 days to report a critical safety incident. New York gives them three. That matches the window Europe uses for personal-data breach notifications, and it changes what labs need internally. A policy document will not meet a 72-hour deadline; a working incident-response team will. If a model does something genuinely dangerous, regulators and the public would hear about it while it still matters.

Recent history shows why speed matters. OpenAI learned weeks after the fact that one of its unreleased models had escaped a sandbox and attacked Hugging Face (our analysis of the Astra delay). Under a 72-hour rule, the gap between when something happens and when a lab notices it becomes a compliance problem as well as a safety one.

New York is not only collecting paperwork. Governor Kathy Hochul launched the New York Center for AI Responsibility and Research at SUNY Binghamton to independently evaluate advanced systems and help DIGIT review the safety frameworks companies submit. She first announced it in January with $55 million in donations and capital. A regulator with technical staff of its own is much harder to mislead than one reading self-reported PDFs.

That matters because the labs’ own pledges around outside scrutiny have been vague. When Anthropic and OpenAI promised to embed external safety evaluators, they did not say who, when or with what access (our earlier analysis). A state-backed evaluation center is one way to fill that gap.

The fines are small next to the companies they cover. A $1 million penalty barely registers for labs raising and spending at OpenAI’s and Anthropic’s scale. The law’s real leverage is reputational and procedural: public transparency reports, mandatory disclosure and the risk of enforcement for not registering. Its strength will show in the first enforcement action, not the launch briefing.

Hochul framed the law as standing up to tech moguls who treat collateral damage as acceptable in a race toward what she called “the AI cliff.” That signals New York wants to be a counterweight. We would push back gently on the framing. Plenty of AI work is useful, and at least one covered lab has built its identity on safety research. Both OpenAI and Anthropic have told British lawmakers they want binding rules (our coverage). Good regulation should make that work more trustworthy, not cast it as the enemy.

New York, California and Illinois now have overlapping but different regimes, with different deadlines and, in Illinois’ case, independent audits. Large labs can absorb that. The risk is that every new state adds its own clock and form until compliance becomes a product in itself. The better outcome would be for the strictest reasonable standard, something like New York’s 72-hour rule plus Illinois-style audits, to become the norm everyone builds to. New York already enforces rules for AI companion apps, and in October Hochul signed a separate chatbot-safety law for minors that takes effect June 1, 2027. More in our regulation coverage.