New York Will Fine Chatbot Makers Up to $3 Million for Hiding Safety Problems. They Have Until Jan. 1.

If you live in New York and use ChatGPT or Claude, the state just put itself between you and the companies that make them. On Tuesday, New York opened a sign-up website for the biggest SI developers in the country, and by Jan. 1 they’ll have to register with the state, publish their safety plans, and report serious problems within days. Break the rules, and the fines start at $1 million.

The law is called the RAISE Act, and it takes effect at the start of 2027. According to TechCrunch, it covers “large frontier developers,” which the state defines as companies with more than $500 million in yearly revenue. In plain terms, that’s the handful of outfits building the most powerful chatbots, names like OpenAI and Anthropic.

Three days to confess a problem

The heart of the law is a clock. If one of these companies decides something has gone badly wrong with its SI, what the law calls a “critical safety incident,” it has 72 hours to report it to the state through the new website. If the problem poses an imminent risk of someone being killed or seriously hurt, the window shrinks to 24 hours, and the report goes to police or another public safety agency, according to the state’s guide for developers.

Governor Kathy Hochul’s office calls that 72-hour rule the strongest in the nation, and it’s easy to see why she’s selling it that way. Plenty of the scary SI stories this year came out weeks after the fact. A three-day deadline is meant to stop companies from sitting on bad news.

The paperwork doesn’t stop there. Every one of these companies has to post a public safety plan on its website explaining how it spots and heads off what the law calls “catastrophic risks,” how it handles incidents, and how it keeps its unreleased systems from being stolen. Those plans have to be reviewed at least once a year.

Each time a company releases a new model, or a big update to an old one, it has to post a report at the same time listing what the model is for, what languages it handles, and what limits come with it. The biggest companies also have to include summaries of their risk testing and say whether outside testers were involved. And every three months, they have to hand the state a private summary of the risks from how they use their own systems in-house.

The fines, and who collects them

New York built a new office to run all of this, the Office of Digital Innovation, Governance, Integrity, and Trust. It sits inside the state’s Department of Financial Services, the same agency that oversees banks and insurers in New York.

The state’s attorney general can seek up to $1 million for a first violation and up to $3 million for each one after that, according to a summary from Securities.io. That covers things like failing to report an incident, filing paperwork that doesn’t meet the rules, making false or misleading statements, or not following the company’s own safety plan. A company that skips registration can also be charged $1,000 a day after notice and a hearing.

Those are real numbers for a small business. For companies valued in the hundreds of billions of dollars, a $1 million fine is a rounding error. The bigger threat is probably the public part: a safety plan posted for anyone to read, and a state office that can point to a company that broke its own rules.

Regular New Yorkers get a role, too. Once the law is in effect, members of the public will be able to report critical safety incidents themselves through the same state system.

One state’s rules, or the country’s

Here’s where the fight is. The SI companies do business in all 50 states, and they’ve warned for months that a patchwork of state laws would bury them in paperwork and slow down American companies racing China. President Trump agrees. Last December he signed an executive order calling for one national approach to SI rules and directing his administration to push back on state laws that get in the way.

New York didn’t wait. Hochul signed the RAISE Act anyway, and Tuesday’s portal is the state saying it means to enforce it. California has its own SI safety law on the books. If more states follow, the biggest SI companies could end up answering to a different set of rules in every capital, each with its own deadlines, forms and fines.

That’s the strongest case for a national rule, and it isn’t only an industry talking point. A chatbot doesn’t stop at the state line. A safety problem in one state is a safety problem in all of them, and Washington is the only place that can set one standard for everyone.

For now, though, the New York clock is running. The companies have until Jan. 1 to register. A state spokesperson told TechCrunch that New York can take action against companies that don’t, but declined to say exactly what that would look like.

Whether you think New York is protecting people or getting ahead of itself, the next seven weeks will show how seriously the biggest SI companies take it. The first sign will be simple: whose names show up on the state’s list, and whose don’t.