New York RAISE Act (Responsible AI Safety and Education Act): Compliance Checklist

Compliance checklist

Run through these items to scope your obligations under New York RAISE Act (Responsible AI Safety and Education Act). Not legal advice; verify with counsel before acting.

1. Confirm scope: does the law apply to your operations? See Who Must Comply or use the Compliance Checker.
2. Inventory in-scope AI systems and classify them by role (developer/deployer) and decision type.
3. Address each obligation:
   • governance — Large frontier developers must write, implement, comply with, and publish a frontier AI framework for managing catastrophic risk, review it at least annually, and publish material modifications with a justification within 30 days.N.Y. Gen. Bus. Law § 1421(1)–(2)
   • transparency — Before or when deploying a new or substantially modified frontier model, publish a transparency report; large frontier developers include summaries of catastrophic-risk assessments, their results, and third-party evaluator involvement.N.Y. Gen. Bus. Law § 1421(3)
   • documentation — Report a critical safety incident to the Department of Financial Services office within 72 hours, and within 24 hours to an appropriate law-enforcement or public-safety authority when there is an imminent risk of death or serious physical injury.N.Y. Gen. Bus. Law § 1422(3)
   • documentation — Large frontier developers must transmit to the office a summary of any assessment of catastrophic risk from internal use of their frontier models every three months or on another agreed schedule.N.Y. Gen. Bus. Law § 1422(2)
   • governance — Large frontier developers must file a disclosure statement with the office before developing, deploying, or operating a frontier model in New York, renew it every two years or on an ownership or material change, and pay a pro rata assessment.N.Y. Gen. Bus. Law § 1428
4. Adopt a federal control framework: NIST AI RMF or ISO/IEC 42001 to demonstrate due care.
5. Document evidence of compliance for each obligation, refreshed at the cadence the law requires.
6. Build the AG-notification path if the law requires it (Colorado, California SB 53).
7. Set the refresh cadence — annual for most impact-assessment regimes; continuous for monitoring.