A portal opens before the rules are finished
New York's Office of Digital Innovation, Governance, Integrity, and Trust, known as DIGIT, opened the state's frontier AI registration portal on Tuesday, November 10. The RAISE Act requires any developer with more than 500 million dollars in annual revenue to register by January 1, 2027, and OpenAI and Anthropic are explicitly named among the labs the law covers. Fines start at 1 million dollars for a first violation and rise to 3 million for anything after that, enforceable against companies whose enterprise contracts run into the billions, which makes the penalty structure more symbolic than deterrent on its own.
What makes this launch worth a CTO's attention is what is missing rather than what is present. DIGIT opened registration without finalized filing forms, fee standards, or guidance on what counts as a reportable incident. Enterprises relying on these labs' compliance posture are effectively watching the rulebook get written in public, in real time, with real penalties attached to a standard that is not yet fully defined. That sequencing is unusual for a law with teeth, and it means the first few months of enforcement will likely be shaped as much by negotiation between DIGIT and the major labs as by the statute's text itself.
What covered developers actually have to do
Beyond registering, covered developers must publish their safety frameworks on their own websites, report critical safety incidents to the state within 72 hours of discovery, and issue public transparency reports on their models. None of this is radical by the standards of financial services or pharma, where incident disclosure windows and public documentation requirements have existed for years. What is new is that it is being applied to frontier model developers at this speed, with a January deadline already on the calendar and no grace period built into the statute for labs still drafting their first framework.
Governor Kathy Hochul framed the law's ambition directly, saying the state is building a national model for smart, sensible AI regulation, one that puts communities above corporations. Whatever your view of that framing, the practical effect for enterprise buyers is concrete: your model vendor's safety documentation is about to become a public, dated artifact that journalists, competitors, and plaintiffs' lawyers can all read, and any gap between what a lab discloses and what it actually knew will be a far easier story to tell than it was a year ago.
A review body with real scientific weight behind it
The law is backed by the New York Center for AI Responsibility and Research, which Hochul announced in January with 55 million dollars in donations and capital. It is based at SUNY Binghamton and the state says it has more than 80 scientists on staff to evaluate advanced AI systems and help DIGIT assess the safety frameworks labs submit. That is a meaningfully larger technical bench than most state regulators have ever had for any technology, let alone one this fast-moving, and it changes who is actually reading a lab's safety documentation on the other end.
For enterprise technology leaders, that review capacity is the detail worth watching longer term. A regulator with genuine technical staff can push back on vague safety framework language in a way that a purely administrative office cannot. If DIGIT uses that capacity well, New York's standard could become the de facto bar other states reference, the way California's privacy law became a national baseline well before any federal rule existed, forcing every lab's compliance team to write for New York's reviewers first and everyone else second.
New York is not acting alone
California's SB 53 has required incident reporting within 15 days since it took effect in January, a notably looser window than New York's 72 hours. Illinois's SB 315 takes effect at the start of 2027 and adds independent safety compliance audits on top of disclosure requirements. New York itself has a separate chatbot safety law for minors coming June 1, 2027. None of these laws are identical, and none of them defer to a federal standard that does not exist, so each state is effectively running its own version of frontier AI oversight on its own clock.
That divergence is the real operational problem. A frontier lab serving enterprise customers in California, Illinois, and New York now has to satisfy three different incident reporting clocks and at least two different audit regimes, with more states likely to follow next year. Enterprises buying from these labs inherit that complexity indirectly, because a vendor juggling multiple compliance regimes under tight deadlines is a vendor with more places for something to slip, and your contract should assume that risk rather than ignore it.
What open questions mean for your vendor conversations
Two questions remain genuinely unresolved under New York's law: what qualifies as a critical safety incident under the 72-hour rule, and whether DIGIT's review extends to open-weight releases or only to closed-API deployments. Both answers will shape how much visibility enterprise customers actually get into problems with the models they are running, and both are likely to be contested as soon as the first real incident forces a definition, probably through litigation rather than clean regulatory guidance.
The practical move for CTOs and CIOs right now is to ask your frontier model vendors directly how they plan to meet the January 1 deadline and what their internal definition of a reportable incident looks like, rather than waiting for DIGIT to clarify it for you. Vendors who have already drafted their safety framework and transparency reporting process will tell you so plainly, often with a named compliance lead. Vendors who dodge the question, or point to a federal standard that does not yet exist, are telling you something too, and it belongs in your next renewal conversation.
