Read the date first. What happened on Tuesday was not a new law. The RAISE Act was signed on December 19, 2025. A chapter amendment, S8828, signed on March 27, 2026, established the current framework, including the revenue threshold, the January 1, 2027 effective date and reduced penalty ceilings — from $10 million and $30 million to $1 million and $3 million, per law-firm analyses of the amendment. What happened on November 10, 2026 is that New York opened the registration portal and put the machinery on the calendar: covered developers file before the requirements begin, or they are operating against a state law from the day it takes effect.
What registration actually obliges
Coverage turns on two tests, and revenue is only one of them. A frontier model is a foundation model trained using more than 10^26 integer or floating-point operations, counting fine-tuning and reinforcement learning. A large frontier developer is one whose annual gross revenues, together with its affiliates, exceeded $500 million in the preceding calendar year. TechCrunch names Anthropic and OpenAI as the kind of developer the Act is aimed at; the state has made no formal determination in the announcement.
From January 1, 2027, a covered developer must have a current disclosure statement filed with the Office of Digital Innovation, Governance, Integrity, and Trust — DIGIT, housed inside the Department of Financial Services — before operating a frontier model in New York, renewed every two years, and must pay the assessments that fund the office. It has to publish its safety and transparency framework on its own website, issue public model transparency reports, and transmit summaries of its catastrophic-risk assessments for internal use to the office every three months, subject to the statute's alternative-schedule provision. The office must publish its list of filers — which is a list of who has filed, not a ruling on who is covered.
The sharpest duty is the clock. A critical safety incident must be reported to DIGIT within 72 hours of determining that one occurred, or of learning facts sufficient to establish a reasonable belief that one occurred. California's SB 53, the closest comparison and in effect since January, allows 15 days for its critical-incident reports. New York is also accepting incident reports from the public, not only from the labs, and DIGIT will publish an annual report on what it receives.
Governor Kathy Hochul framed the launch in race terms on Tuesday: tech leaders say their vision is inevitable, she said, and that "any collateral damage is worth it as long as we win the race to the AI cliff." The same day, she launched the New York Center for AI Responsibility and Research at SUNY Binghamton, which is meant to evaluate advanced systems independently and help DIGIT review the frameworks companies file. The center was first announced in January with $55 million in donations and capital.
Penalties, and what is still unsaid
The penalty numbers are ceilings, not tariffs. Under §1427 of the amended Act, the Attorney General may bring a civil action to recover a penalty of up to $1 million for a first violation and up to $3 million per subsequent violation, determined based on the severity of the violation. For a developer with more than $500 million in revenue, the weight of the regime is not the fine itself. It is the filings: a published framework, recurring risk-assessment summaries and a 72-hour incident record are documents a regulator can audit against, long after a penalty would have been settled.
The statute provides the enforcement authority, including actions against companies that fail to register. What the announcement does not explain is the state's intended enforcement priorities or procedures in individual cases — a spokesperson declined to provide specifics. The open questions are now the practical ones: how DIGIT applies the statutory definition of a critical safety incident to particular facts, and how the first filing cycle runs. Those answers decide how much of the regime is felt in January.
A state pattern, at different speeds
New York is not the first state in this sequence. California's SB 53 has been in effect since January, pairs its 15-day incident clock with whistleblower protections, and was the template the March amendment deliberately aligned New York with. Illinois' SB 315 takes effect at the start of 2027 with similar requirements, and adds independent safety compliance audits. A frontier lab now faces state regimes that share a framework and differ in the details that compliance teams actually staff against: the clocks, the filing cadences, and who checks the work.
That is the practical consequence of November 10. Registration is open, the effective date is about seven weeks away, and the obligations that begin on January 1 are specific enough to plan against. What the regime is worth will be decided by the filings and the first enforcement choices, not by the portal.
Sources
- [1] Chapter amendment S8828 (2026), General Business Law Article 44-B §§1420–1429, official bill text, New York State Senate — read first-hand by the ALFW desk (definitions, 72-hour trigger, disclosure, §1427 penalties, January 1, 2027 effective date)Read source
- [2] TechCrunch, Rebecca Bellan, "OpenAI, Anthropic face new oversight as New York's AI safety law takes effect," November 10, 2026Read source
- [3] New York State Department of Financial Services, press release pr20260921, "Governor Hochul Announces Next Steps to Regulate Major AI Developers and Protect New Yorkers," September 21, 2026Read source
- [4] JD Supra, "NY Overhauls Transparency and Governance Requirements for Frontier AI Developers" (chapter amendment S8828 analysis; signing dates and alignment with California's TFAIA)Read source