From the State Government edition of September 21, 2026
New York begins RAISE Act registration build-out via DIGIT in DFS with 72-hour incident reporting
State of New York (Governor Hochul / Department of Financial Services DIGIT) · State government — frontier AI safety oversight / financial-services regulatory host · New York, United States
- Publisher
- WRGB/CBS6 Albany — Governor Hochul tightens leash on AI, demanding transparency
- Original publication
- 2026-09-21
- Source retrieved
- 2026-09-22
- Event date
- 2026-09-21
What happened
On 2026-09-21 Gov. Hochul announced next implementation steps for the Responsible AI Safety and Education (RAISE) Act: large frontier AI developers begin registering in November; compliance and regular reporting to the new Office of Digital Innovation, Governance, Integrity and Trust (DIGIT) inside DFS begin January 2027; critical safety incidents must be reported to DIGIT within 72 hours; quarterly catastrophic-risk assessments and biennial disclosure statements are required; Marc Gilman was appointed deputy director for RAISE as DIGIT’s first full-time hire; DIGIT will issue an annual public report. Emerging regulatory operating capacity—not yet an enforcement record. Cross-check: amNY quotes Hochul that AI kill-switch exploration carries “No commitments at this time.”
Why it matters
Shows a peer state moving from enacted frontier-AI statute to staffing, registration, and incident-reporting operations housed in a financial regulator—directly transferable planning signal for other state CIOs/AGs watching CA/IL/NY safety regimes.
Evidence and measured results
CBS6 09/21/2026: November registration start; DIGIT within DFS; Marc Gilman deputy director; Jan 2027 compliance; 72-hour critical incident reports to DIGIT; quarterly catastrophic-risk filings; biennial disclosure; public tip pathway; annual DIGIT report; AG James enforcement statements. amNY corroboration of exploratory kill-switch language without commitment.
Limitations and uncertainty
Independent reporting of announcement—not a .gov primary release URL located this run; registration portal UX unpublished; kill-switch not a current requirement; effectiveness awaits 2027 filings.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-09-21; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- States with frontier-AI safety statutes need operational registration, incident intake, and staffing models—not only bill text.
- Stakeholders
- DFS/DIGIT leadership
- Attorney General cyber/consumer units
- Frontier developer compliance officers
- State CIO liaison teams
- Discovery questions
- When does registration open and what evidence is required?
- Who triages 72-hour incident reports after hours?
- How will quarterly risk assessments be stored and shared?
- What is the staffing plan beyond the first deputy director?
- Value hypothesis
- A readiness assessment against NY’s published timelines can de-risk registration/incident-intake go-live before Jan 2027 duties bind.
- Potential engagement
- Implementation sprint: map intake workflows, RACI, secure document handling, and tabletop drills for critical-incident reporting.
- Unsupported claims
- That a kill switch is currently required
- That DIGIT is fully built
- Guaranteed penalty outcomes under AG actions
Pre-sales engineering
Role takeaway
- Fit
- Regulatory registration and incident-case platform for frontier developers, hosted in a financial-services supervisory environment.
- Architecture and integration
- Developer org identity → disclosure vault → incident ticket SLA clocks → controlled sharing to AG/other authorities → annual report extracts.
- Prerequisites
- Legal taxonomy of covered developers/incidents
- Secure document intake
- On-call triage staffing model
- Constraints
- NY RAISE-specific
- Public portal details not yet published on inspected pages
- Kill-switch exploration out of scope for v1 systems
- Security
- Protect sensitive incident and model-risk filings; enforce least-privilege, encryption, and immutable audit logs.
- Proof of value
- Successful test registrations
- 72-hour SLA drill results
- Published registrant guidance
Delivery
Role takeaway
- Work
- Hire/onboard DIGIT staff, build registration and incident workflows, publish guidance, and coordinate AG enforcement playbooks.
- Dependencies
- DFS technology and legal
- AG office
- Budget for additional FTE
- Developer outreach
- Ownership
- DIGIT/DFS for operations; AG for enforcement; Governor’s office for policy expansions.
- Skills and adoption
- Need AI-safety literacy plus financial-regulatory exam/case skills unusual in typical state IT shops.
- Governance checkpoints
- November registration readiness gate
- Jan 2027 compliance gate
- Annual public report
- Acceptance criteria
- Documented intake SOPs
- On-call incident roster
- Public FAQ for covered developers
- Risks
- Timeline slip
- Incident under-reporting
- Scope expansion before core ops stabilize
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Requires developer-facing registration/disclosure portals, secure incident intake, and cross-agency transmission paths from DIGIT—architecture is regulatory workflow more than model hosting.
Governance
Who approves, reviews and stays accountable for outcomes?
Operationalizes statutory transparency via a named office, hire, timelines, and AG enforcement partnership; keeps further safeguards (kill switch; independent reviews) in prospective legislative agenda rather than immediate mandate.
Security and privacy
What data, permissions and controls need testing?
Incident reports and catastrophic-risk assessments will contain sensitive safety data—DIGIT needs hardened intake, need-to-know sharing, and whistleblower pathways (AG portal referenced in companion coverage).
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Creates specialized DIGIT regulatory workforce roles; public annual reporting may improve transparency for residents, but page does not address accessibility of developer portals.
Procurement
What should contracts, pricing and exit terms secure?
Implies future needs for secure case-management, document vault, and possibly independent-auditor marketplace tools as companion bills advance—not procured in this announcement.
Operating model
Which teams own the service once it runs?
Places frontier-AI safety operations inside DFS rather than a general CIO shop—an operating-model choice other states may copy or avoid depending on financial-regulator capacity.
Publication history
- 2026-09-21State Government · Issue 164 resources
Stable resource ID: new-york-raise-act-digit-registration-20260921