New York’s RAISE Act expands executive power over AI at the expense of legislative oversight

New York is the latest in a growing number of states attempting to regulate artificial intelligence (AI). The Responsible AI Safety and Education (RAISE) Act seeks to impose transparency requirements and grant enforcement powers to state officials over companies developing advanced AI systems. Like similar efforts in California and Colorado, the law aims to ensure that AI models—especially those considered high-risk—are deployed safely.

But New York’s approach stands out for its narrow focus on the largest “frontier” AI developers and the significant authority it hands to the state’s executive agencies. The bill gives the attorney general extraordinary discretion to determine what constitutes an “unreasonable risk” and requires rapid compliance, making it difficult for the legislature—and, by extension, their constituents—to meaningfully weigh in on evolving AI safety standards.

The RAISE Act was sponsored in the Assembly by state Asm. Alex Bores (D-73) and in the Senate by state Sen. Andrew Gounardes (D-26). The bill has passed both chambers with bipartisan support. As of June 12, the bill is with Gov. Kathy Hochul for her signature, where it awaits final approval. The law targets only the largest AI developers, such as OpenAI, defined by their use of significant computing resources in developing so-called “frontier” models.

The bill authorizes substantial civil penalties for noncompliance, with estimates placing potential fines between $5 million and $15 million per violation. Companies are required to maintain and publish detailed safety plans, respond to major safety incidents within 72 hours, and keep records of mitigation strategies for up to five years. The act also mandates annual independent safety reviews to ensure adherence to transparency and risk mitigation standards.

The RAISE Act establishes several detailed compliance obligations for covered AI developers, with the largest companies subject to the most stringent requirements. It requires that any developer investing $100 million or more in the training of a single AI system must publish a safety and security plan, undergo an independent review, and make the results of such review easily accessible to the public. The law also requires rapid incident disclosure within 72 hours, defined as anything that could cause an “increased risk of critical harm.” A “critical” harm is one that results in seriously hurting 100 million people or causing $1 billion in damage.

Together, these provisions grant the attorney general substantial oversight of the largest AI developers, while requiring transparency, rapid incident reporting, and regular third-party evaluation.

Critics of the RAISE Act argue that its scope is overly broad and its definitions far too vague. Even Anthropic’s Jack Clark—whose AI company has been openly supportive of regulation—warned on X that key terms in the legislation are “overly broad/unclear in some of its key definitions,” raising concerns about how smaller developers might be swept up by expansive enforcement. He cautioned that ambiguity could hamper compliance and invite arbitrary application by regulators

Supporters of the RAISE Act, however, argue that the law merely codifies promises that leading AI firms have already made. As Bores explained in a statement on the official New York website of his office,

“Many major AI companies have voluntarily committed to create safety and security plans, but there is currently no legal requirement that they have such plans, that they be reasonable, or that they are followed in practice. By writing these common-sense protections into law, the RAISE Act ensures no company is incentivized to cut corners or otherwise put short-term profits over safety. The law only applies to the largest AI companies that have spent over $100 million in computational resources to train advanced AI models, and focuses on the most urgent, severe risks”.

While the RAISE Act is framed as a transparency and safety measure, its core enforcement provisions hinge entirely on the discretion of state agencies, especially the attorney general’s office. Nowhere in the bill does the legislature specify what constitutes an “unreasonable risk” or provide concrete examples, metrics, or probability thresholds that would guide decision-making. Instead, nearly every meaningful determination about what risks justify regulatory action is left to the administrative state. This approach effectively sidelines both the legislature and the public, leaving the scope of enforcement and compliance to be set by agency officials without further democratic oversight.

In practice, the RAISE Act leaves little room for genuine democratic input once enacted. While stakeholders from healthcare, education, and other innovation-driven sectors may be able to voice their concerns during agency rule making or public comment periods, the bill itself does not guarantee a transparent, participatory process for refining what counts as “unreasonable risk.” Instead, nearly all critical decisions are left to state agencies, with the legislature—and by extension, civil society—playing a limited role.

For industries that depend on the ability to adapt and innovate quickly, this framework raises real questions about how responsive and accountable AI governance will be in New York going forward.

The post New York’s RAISE Act expands executive power over AI at the expense of legislative oversight appeared first on Reason Foundation.