What New York’s RAISE Act requires from 1 January 2027
New York has opened its compliance registration portal for large frontier artificial intelligence developers under the Responsible AI Safety and Education Act, known as the RAISE Act. From 1 January 2027, frontier AI developers with more than US$500 million in annual revenue that operate in or serve New York must register with the state, publish their internal safety frameworks, issue model transparency reports and disclose critical safety incidents to regulators within 72 hours. TechCrunch reported the portal launch on 10 November 2026 and named OpenAI and Anthropic among the companies the law targets.
Enforcement will sit with a newly formed state body, the Office of Digital Innovation, Governance, Integrity, and Trust (DIGIT). The office can impose civil penalties of up to US$1 million for a first violation and up to US$3 million for subsequent violations. At the same announcement, New York confirmed a US$55 million independent testing centre at Binghamton University to evaluate and red-team registered frontier systems.
This is United States state law, and it creates no direct obligation for Australian businesses. It still matters to Australian environmental consultancies, law firms, developers and councils, because many of them now use large language models from these same developers to draft reports, summarise regulatory correspondence and interpret laboratory data. The safety and incident information that New York now requires the developers to publish is information Australian users can use in their own procurement and risk decisions.
72-hour incident reporting, registration and penalties under the RAISE Act
The RAISE Act applies to frontier AI foundation model developers with annual revenues above US$500 million that operate within or serve New York. Covered developers must complete four core obligations from 1 January 2027: register with the state through the new portal, publicly post their internal safety frameworks, publish model transparency reports, and notify regulators of critical safety incidents within 72 hours. The obligations fall on the model developers. Businesses that only use or license frontier models are not the regulated party under this law.
The 72-hour incident reporting window is the most demanding element of the regime. California’s SB 53, the first comparable state frontier safety law, generally allows 15 days to report a critical safety incident, shortening to 24 hours where there is an imminent risk of death or serious physical injury. New York applies the shorter 72-hour window more broadly. Developers will need internal detection, triage and escalation processes capable of producing a regulator notification within three days of an incident.
DIGIT holds the enforcement powers. Penalties are capped at US$1 million for an initial violation and US$3 million for each subsequent violation, and the state can take enforcement action against frontier developers that fail to register. For companies at the scale the law targets, the financial penalties are modest relative to revenue. The more material exposure is likely to be the public record created by registration, published frameworks and disclosed incidents, which customers, investors and litigants can all read.
The New York Center for AI Responsibility and Research at Binghamton University is the second pillar of the regime. Backed by US$55 million in capital, the centre is intended to independently test, red-team and evaluate both the published safety frameworks and the actual operating behaviour of registered frontier systems. This matters because it moves New York’s model beyond developer self-reporting. A safety framework that reads well on paper can now be checked against how the model performs under adversarial testing by a state-funded body.
Governor Kathy Hochul framed the law as a rejection of voluntary self-regulation. At the 10 November 2026 briefing she said: “Tech moguls tell us that their vision for AI is inevitable. They tell us get on board or get left behind… That any collateral damage is worth it as long as we win the race to the AI cliff. We’re building a national model for smart, sensible AI regulation, a model that puts communities above corporations and people above powerful technology.”
Australian context
Australia has no equivalent statutory regime for frontier AI developers. Australian businesses using generative AI are governed by existing laws, chiefly the Privacy Act 1988 and the Australian Privacy Principles, consumer law, professional obligations and contract. The Australian Government’s Voluntary AI Safety Standard, released by the Department of Industry, Science and Resources in September 2024, sets out guardrails for organisations deploying AI, including accountability, risk management, testing and transparency with end users, but it is voluntary. In practice, Australian firms buying AI tools from US developers will often rely on disclosures made under US state laws such as SB 53 and the RAISE Act to inform their own risk assessments.
The fragmentation in the United States is worth tracking. Comprehensive federal AI legislation has stalled, and states are moving independently. California’s SB 53 came first, New York’s RAISE Act now follows, and Illinois has a frontier safety bill, SB 315, in progress. Each sets its own thresholds, disclosure requirements and reporting windows. For Australian users this means the quantity and quality of public safety information will vary depending on where a developer operates and which state rule sets the higher bar. The practical effect is that the tightest state rule tends to shape what large developers publish globally, which benefits overseas customers who never fall within US jurisdiction.
For contaminated land consultants and other professional users, the practical step is to check whether their AI provider has published a safety framework and transparency reports under SB 53 or the RAISE Act, and to note that review in their own AI risk assessments and quality assurance procedures. Outputs used in site assessments, remediation reports or regulatory submissions remain the responsibility of the consultant who signs them, regardless of what the developer discloses.
References and related sources
- Primary source: techcrunch.com
- techcrunch.com
- https://techcrunch.com/2026/11/10/openai-anthropic-face-new-oversight-as-new-yor
How iEnvi can help
iEnvi integrates technology and data-driven approaches into environmental consulting. We monitor AI and technology developments that affect how environmental professionals deliver services to clients.
This is an iEnvi Machete news summary. Prepared by iEnvi to summarise the source article for environmental professionals tracking AI, data, and technology developments that affect consulting and project delivery.
Published: 14 Nov 2026
Need advice on this topic? Speak to an iEnvi expert at info@ienvi.com.au or 1300 043 684, or contact us online.
Need advice on this issue? iEnvi provides practical, senior-led environmental consulting across contaminated land, remediation, ecology and environmental risk.
Contaminated land services Remediation services Talk to iEnvi