AI Watch: New York State Governor Hochul Signs Artificial Intelligence Law

December 23, 2025

On December 19, 2025, New York State Governor Kathy Hochul signed into law a state Artificial Intelligence act. The NYS AI law, the "RAISE Act" ("Responsible AI Safety and Education Act," S6953B/A6453B) can be found Here.

The RAISE Act follows and expands on California's SB 53 "Transparency in Frontier AI Act, or "TFAIA," enacted in September that goes into effect on January 1. Both state laws fly in the face of the Trump Administration's December 11, 2025 Executive Order on "Ensuring a National Policy Framework for Artificial Intelligence" that we reported on last week in setting out statewide, as opposed to national, rules regulating AI. Essentially, New York and California are attempting to impose a tentpole user and consumer protection-focused regulatory regime on AI development that will become the de facto national standard, while the Federal Executive Order attempts to maintain a basically unregulated environment.

The RAISE Act requires:

Large Developer/Frontier Model Regulation. "Large Developers" of the most advanced AI tools, called "Frontier Models," which include those AI models with the fastest computational operations and those that are "trained" by other AI models (in other words, one AI model that learns from another), and which operate wholly or in part in New York State, must report critical "Safety Incidents" within 72 hours, imposes civil liability of a $1 million fine for first violations and $3 million for subsequent ones. The Frontier Models immediately likely to be subject to the RAISE Act regime include OpenAI's ChatGPT, Anthropic's Claude, Google's Gemini, Microsoft's Copilot, and Meta's LLaMA (the California Act is laxer, requiring notification of critical safety incidents within 15 days and caps fines at $1 million);

Safety Incidents. The RAISE Act defines Safety Incidents subject to reporting and the above-referenced fines as incidents in which the Frontier Model engages in autonomous behavior not requested by the user; the model's algorithms weighing responses to queries are taken without authorization, maliciously misused or inadvertently released; the Frontier Model is subject to unauthorized use; or the Model suffers a critical failure of any technical or administrative controls. Any of these events would be deemed a Safety Incident creating a risk of Critical Harm under the RAISE Act and reportable within the 72-hour period as such.

Oversight Office. The establishment of an oversight office in the NYS Department of Financial Services to review and assess Frontier Models and enforce the RAISE Act;

Safety and Security Protocol and Framework. Large Developers of AI Frontier Models, must, prior to deploying a Frontier Model, establish, publish and transmit to the State government a "Safety and Security Protocol" respecting the risk of "Critical Harm" posed by the Frontier Model. Critical Harm is defined as the possibility of 100 deaths or serious injuries and/or $1 billion in damages or the creation of advanced weapons like bioweapons and enabling of automated criminal activity. The Safety and Security Protocol must detail how Large Developers manage standards and best practices; how they assess safety risks; apply and review risk management techniques; use third parties to assess catastrophic risk potential for the most severe AI risks; implement cybersecurity protocols to prevent Frontier Model theft; and institute "Frameworks" to ensure that best practices are followed, including by third-party developers and users and publish internal personnel contacts responsible for compliance. Large Developers must review these plans annually and publish justifications for any changes within 30 days. Finally, the RAISE Act prohibits the deployment of Frontier Models that do not pass the Critical Harm tests, although the deployment prohibition provision may be revisited in the future.

Compliance Burden and Third-Party Audits. The RAISE Act annual third-party audit requirement clearly creates a compliance burden compared to the Federal Government's current nearly completely unregulated posture. The civil monetary penalties imposed by the RAISE Act militate in favor of enterprises and not-for-profit institutions to establish programs of initial and annual audits for compliance, including both the technology and legal/regulatory piece, with "best practices" still to be established. It is important to remember that although the Large Developers are most immediately affected, the best practices standards set out in the RAISE Act are likely to be adopted by smaller and niche AI developers concerned about criminal and civil liability. In addition to the RAISE Act's own penalty structure and future showings of good faith compliance attempts as a partial or total defense to State enforcement action, showings of good faith compliance are likely to furnish partial or total defenses to private party civil actions and other criminal prosecutions.

Liability Avoidance Attempts Void. The RAISE Act declares void any Large Developer attempt to avoid or shift liability to any third party for liability covered by it. Courts are further directed to disregard corporate structures that would isolate and limit liability for Large Developers under the RAISE Act if put in place specifically to avoid liability, an important consideration for investors used to relying on liability-isolating structures,

False and Misleading Statements and Whistleblower Protection. The RAISE Act penalizes Large Developers making false or misleading statements with respect to Frontier Models and the foregoing compliance requirements. Large Developers are further prohibited from preventing or retaliating against an employee who discloses or threatens to disclose, information to the New York Attorney General respecting risks of Critical Harm posed by a Frontier Model in the employee's reasonable belief.

Owen D. Kurtin

For additional information on our professional services in AI and related technologies, please visit our website at Kurtin PLLC Information Technologies, Blockchain & Internet and contact us at info@kurtinlaw.com.

Kurtin PLLC, a New York City-based law firm, focuses on corporate, commercial and regulatory representation in the Biotechnology & Life Sciences, Communications & Media,

Information Technologies, Blockchain & Internet, Satellites & Space and Venture Capital & Private Equity sectors. Since our founding in 2008, we have represented clients in over forty countries on six continents and across the United States on transactional and dispute resolution matters. Among our key values, none rank higher than creative and individualized solutions to business issues, absolute client discretion and unsurpassed responsiveness.

Kurtin PLLC Website

The materials contained in this message and website pages, whitepapers, advisories and other items directly linked to it have been prepared for general informational purposes only and should not be construed or relied upon as legal advice or a legal opinion on any specific facts and circumstances. The publication and dissemination, including on-line, of these materials and receipt, review, response to or other use of them does not create or constitute an attorney-client relationship.

To ensure compliance with requirements imposed by the Internal Revenue Service, we inform you that any tax advice contained in this communication (including any attachments) was not intended or written to be used, and cannot be used, for the purpose of (i) avoiding tax-related penalties under the Internal Revenue Code or (ii) promoting, marketing or recommending to another party any tax-related matter(s) addressed herein.

These materials may contain attorney advertising. Prior results do not guarantee a similar outcome.

Kurtin PLLC |Website