What is AI regulation in New York?
AI regulation: countries and regions
New York regulates AI through a layered mix rather than one statute. New York City's Local Law 144 requires bias audits and candidate notices for automated hiring tools. At state level, the RAISE Act sets safety and transparency duties for the largest frontier model developers, the LOADinG Act governs state agency automated decisions, and newer laws cover algorithmic pricing disclosure and AI companions. Existing anti-discrimination and consumer-protection law, enforced by the Attorney General, still applies to all AI use.
What this means
New York does not have a single, comprehensive AI law. Instead it has a patchwork of targeted city and state rules, sectoral regulator guidance, and long-standing civil rights and consumer-protection statutes that apply to AI just as they apply to any other tool. The most mature single rule is New York City's Local Law 144, which since July 2023 has required employers using automated hiring tools to commission an independent bias audit, publish a summary, and notify candidates.
At the state level, activity accelerated through 2024 and 2025. The LOADinG Act regulates how state agencies use automated decision-making. The RAISE Act sets transparency and safety duties for the largest frontier AI developers. Separate laws now require disclosure of personalised algorithmic pricing and impose safeguards on AI companion chatbots. Several broader proposals, including a comprehensive New York AI Act on private-sector algorithmic discrimination, remain pending.
The practical upshot is that New York's framework is duty-specific and institution-specific. Different agencies enforce different pieces: the city's Department of Consumer and Worker Protection for hiring tools, the Department of Financial Services for insurers and frontier developers, and the Attorney General across consumer protection and civil rights.
Why it matters
New York is one of the most consequential AI jurisdictions in the world because its rules reach far beyond its borders. Local Law 144 applies to any employer hiring for a New York City role or a remote role tied to a city office, so companies headquartered elsewhere are routinely caught. The RAISE Act reaches frontier models "developed, deployed, or operating in whole or in part" in the state, and the algorithmic pricing law applies to any entity doing business in New York.
For founders, operators and governance leads, this means New York obligations cannot be treated as a local edge case. The duties are also durable in character even as specific bills change: bias auditing, candidate and consumer notice, human oversight of consequential decisions, incident reporting, and documentation. Getting these building blocks right positions an organisation for compliance across multiple jurisdictions, because New York's approach increasingly tracks and sometimes exceeds California and Colorado. Penalties are real, and published bias-audit results can themselves become evidence in discrimination litigation under separate human rights laws.
How it works
NYC Local Law 144: the automated employment decision tool regime
Local Law 144 of 2021 is the centrepiece of New York's AI-in-employment rules. It prohibits an employer or employment agency from using an automated employment decision tool (AEDT) to make hiring or promotion decisions in New York City unless three conditions are met: the tool has had a bias audit within the previous year, a summary of the audit results and the date of first use is posted publicly on the employer's website, and candidates or employees receive notice. The law was enacted on 11 December 2021, technically took effect on 1 January 2023, and the Department of Consumer and Worker Protection (DCWP) began enforcement on 5 July 2023 after adopting final rules on 6 April 2023.
An AEDT is defined as a computational process derived from machine learning, statistical modelling, data analytics or artificial intelligence that issues a simplified output, such as a score, classification or recommendation, used to "substantially assist or replace discretionary decision making." The DCWP rules narrow that phrase: the tool must either be the only criterion, be weighted more than any other single criterion, or be used to overrule human conclusions. This deliberately narrow definition is one of the law's most debated features.
The bias audit must be conducted by an independent auditor, defined as a person or group capable of objective judgement who did not build the tool, does not use it, and has no financial interest in it or the vendor. The audit calculates selection or scoring rates and impact ratios across sex and race/ethnicity categories required under federal EEO Component 1 reporting, including intersectional categories, and may exclude any category representing less than 2 per cent of the data. Historical data must be used where available; test data is permitted only where historical data is insufficient. Candidate notice must be given at least 10 business days before use, must describe the job qualifications the tool assesses, and must include instructions for requesting an alternative process or accommodation. The DCWP does not maintain an approved list of auditors, so selecting a genuinely independent one is the employer's responsibility. Crucially, the law does not require any particular action if the audit reveals bias, and it does not itself create a private right of action; enforcement of underlying discrimination falls to the NYC Commission on Human Rights.
Civil penalties run from $500 to $1,500 per violation, and each day of non-compliance and each improper notice can count as a separate violation.
The RAISE Act: frontier model safety and transparency
The Responsible AI Safety and Education Act (RAISE Act), bill S6953B/A6453B, sponsored by Senator Andrew Gounardes and Assemblymember Alex Bores, makes New York the second state after California to regulate frontier AI safety. Governor Kathy Hochul signed it on 19 December 2025, and chapter amendments aligning it with California's framework were signed on 27 March 2026. It takes effect on 1 January 2027.
The Act applies to "large frontier developers", defined by annual revenue exceeding $500 million combined with a frontier model trained using more than 10 to the power of 26 integer or floating-point operations. Covered developers must write, publish and follow a safety and security protocol (a "frontier AI framework") describing how they assess and mitigate "critical harm", defined around mass-casualty or large-scale property-damage scenarios such as assistance in creating chemical, biological, radiological or nuclear weapons, or automated criminal conduct. They must publish transparency reports, conduct annual reviews, and report critical safety incidents to a new oversight office within the Department of Financial Services within 72 hours. The Attorney General can seek civil penalties up to $1 million for a first violation and up to $3 million for subsequent violations. There is no private right of action, and academic research is largely exempt.
The LOADinG Act: government use of automated decisions
The Legislative Oversight of Automated Decision-making in Government (LOADinG) Act, S7543B/A9430B, signed by Governor Hochul in December 2024, makes New York the first state to impose comprehensive oversight on how state agencies use automated decision-making systems. It requires meaningful human review of automated decisions that affect public benefits, rights, civil liberties, safety or welfare, mandates impact assessments, and prohibits agencies from displacing public employees with these systems or stopping use where assessments reveal discriminatory effects. Agencies must disclose existing systems. An expansion bill, S7599C/A8295D, signed on 19 December 2025, widens disclosure obligations and directs an inventory of state automated decision tools.
Consumer-facing and sectoral rules
New York has added several narrower, consumer-facing AI rules. The Algorithmic Pricing Disclosure Act, New York General Business Law section 349-a, requires any business that sets personalised prices using an algorithm that draws on a consumer's personal data to display the disclosure "THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA." The disclosure requirement took effect on 8 July 2025, with the full Act in force from 10 November 2025 after surviving a First Amendment challenge in the Southern District of New York. Insurers and financial institutions are exempt. The Attorney General enforces it with penalties up to $1,000 per violation; there is no private right of action.
A separate AI companion law, effective 5 November 2025, requires operators of AI systems that simulate sustained human-like relationships to disclose that the user is interacting with AI, to remind users at least every three hours that they are interacting with a machine and not a human, and to maintain protocols that detect and respond to expressions of suicidal ideation or self-harm. The Attorney General can seek penalties up to $15,000 per day, and any fines collected help fund suicide prevention programmes in New York State.
In insurance, the Department of Financial Services issued Insurance Circular Letter No. 7 on 11 July 2024, setting expectations for insurers using AI systems and external consumer data in underwriting and pricing, including governance, fairness and proxy-discrimination testing. New York has also enacted election deepfake disclosure rules (April 2024), a digital replica contracts law protecting performers' voice and likeness (effective 1 January 2025), and laws on synthetic performers in advertising and digital replicas of deceased personalities.
Existing law and the Attorney General
Underlying all of this, the New York State Human Rights Law and the New York City Human Rights Law prohibit discrimination regardless of whether a human or an algorithm causes it, and New York's deceptive-acts-and-practices law applies to misleading AI claims. Attorney General Letitia James has used these powers actively. On 9 December 2025 she joined a bipartisan coalition of 41 other attorneys general (42 in total) in a letter to 13 companies, including Meta, Microsoft and OpenAI, demanding 16 specific chatbot safeguards. She also led a bipartisan coalition of 36 attorneys general urging Congress to reject National Defense Authorization Act language that would have blocked states from enforcing their own AI laws, arguing that "every state should be able to enact and enforce its own AI regulations to protect its residents."
The NIST AI Risk Management Framework as a voluntary anchor
The NIST AI Risk Management Framework (AI RMF 1.0), published in January 2023, is voluntary, sector-agnostic guidance organised around four functions: Govern, Map, Measure and Manage. It is not New York law and does not satisfy any specific New York requirement on its own, but employers, auditors and governance leads frequently use it as a structured reference for bias testing, documentation and oversight that maps usefully onto Local Law 144 audits and to anticipated obligations under pending bills.
How New York differs from California and Colorado
New York's model is targeted and incremental rather than comprehensive. Colorado's AI Act (SB 24-205) is a single broad statute imposing duties on developers and deployers of "high-risk" systems across many consequential-decision sectors, though it has been delayed to 30 June 2026 and substantially revised. California combines a frontier-safety law (SB 53) with privacy-rooted automated decision-making technology rules under the CCPA. New York instead stacks one mature employment rule, a frontier-safety law aligned with California, a public-sector law, and several consumer-facing statutes, while leaving a comprehensive private-sector algorithmic-discrimination law (the New York AI Act) pending.
Examples
A technology company headquartered outside New York advertises a remote software role tied to its Manhattan office and uses a resume-screening tool that ranks applicants. Because the role is associated with a New York City office, Local Law 144 applies. The company must ensure an independent bias audit was completed within the past year, post the summary and first-use date on its careers page, and give candidates at least 10 business days' notice describing what the tool assesses and how to request an alternative process.
A frontier AI developer with annual revenue above $500 million trains a model exceeding the RAISE Act compute threshold and makes it available to New York residents. From 1 January 2027 it must publish a frontier AI framework describing its safety and security protocols, file transparency reports, and report any critical safety incident to the new Department of Financial Services oversight office within 72 hours, with the Attorney General able to seek civil penalties for failures.
A retailer doing business in New York uses a pricing engine that adjusts prices based on an individual shopper's location and past purchases. Under the Algorithmic Pricing Disclosure Act it must display "THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA" near the price, or risk Attorney General enforcement and penalties up to $1,000 per violation.
Common misunderstandings
"New York has one AI law." It does not. The framework is a patchwork of city rules, state statutes, sectoral guidance and pre-existing civil rights and consumer law, each enforced by a different body.
"Local Law 144 bans biased hiring tools." It does not prohibit using a tool that shows adverse impact, nor does it mandate any fix. It requires auditing, publication and notice. The substantive discrimination question is governed by separate human rights laws.
"If our vendor ran a bias audit, we are covered." The employer, not the vendor, is ultimately responsible for ensuring a compliant audit, posting the summary, and providing candidate notice. A vendor cannot independently audit its own tool.
"Compliance is well policed, so low complaint volume means low risk." A December 2025 State Comptroller audit found city enforcement "ineffective", and Cornell-led research found very low uptake. Low enforcement to date does not equal low legal exposure, and the city has committed to tighter enforcement.
"The RAISE Act applies to any company using AI." It targets only the largest frontier model developers above specific revenue and compute thresholds, not ordinary AI deployers.
Risks and boundaries
New York's framework is powerful but uneven, and several pieces are in flux. The RAISE Act's final shape was settled by chapter amendments in March 2026 and does not take effect until 1 January 2027, so its operational detail will continue to develop through Department of Financial Services rulemaking. The comprehensive New York AI Act (S1169/A8884) remains in committee and has not passed; its most recent action as of mid-2026 was a routine committee referral in January 2026, so treat it as a signal of direction, not current law. Colorado's comparison point is itself being revised and delayed, so cross-state contrasts should be checked against current text.
The federal layer adds genuine uncertainty. A December 2025 federal executive order directs agencies to challenge state AI laws seen as obstructing a national standard, and there have been repeated attempts to pre-empt state AI regulation. Whether and how this affects New York's laws is unresolved.
Enforcement of Local Law 144 has been weak in practice. A Cornell Citizens and Technology Lab study, with Data and Society and Consumer Reports, found that of 391 employers surveyed only 18 published bias-audit reports and 13 posted transparency notices; among the subset of 267 employers with open New York City jobs, only 14 audit reports (5 per cent) and 12 notices (4 per cent) were found. The New York State Comptroller's audit, published on 2 December 2025 and covering July 2023 to June 2025, found DCWP enforcement "ineffective": the agency reviewed 32 companies and identified only one likely violation, while the Comptroller's own auditors found 17 potential violations among the same companies, and most test calls to the 311 system were misrouted and never reached DCWP. The agency has agreed to strengthen enforcement.
Local Law 144's narrow AEDT definition means many tools that influence hiring may fall outside it, and its bias audits have been criticised by researchers as sometimes incomplete or based on unrepresentative test data. The law is not a safe harbour: a published audit showing impact ratios below the 0.80 four-fifths benchmark, without documented remediation, can become discoverable evidence in discrimination litigation under other laws. None of this article is legal advice; scoping and implementation should be confirmed with qualified counsel against primary sources.
What to do next
Start by inventorying where AI touches consequential decisions in your organisation: hiring and promotion, pricing, lending, insurance, and customer-facing chatbots. For each, ask which New York rule could apply and who the regulator is.
If you hire for any New York City role, including remote roles tied to a city office, map your hiring technology stack against the AEDT definition, commission a genuinely independent annual bias audit where the law applies, publish the summary, and confirm candidate notices meet the 10-business-day requirement. Treat the December 2025 Comptroller audit as a signal that enforcement is tightening.
If you set personalised prices using customer data, implement the statutory pricing disclosure. If you operate companion-style chatbots, build the disclosure and crisis-response protocols. If you are a large frontier developer, begin preparing RAISE Act framework documentation and 72-hour incident-reporting capability ahead of 1 January 2027.
Use the NIST AI RMF as a structuring reference for governance, documentation and bias testing, recognising it is voluntary and does not by itself satisfy any New York requirement. Monitor the New York AI Act and the federal pre-emption debate, since either could reshape obligations. Benchmarks that should change your plan: passage of the New York AI Act out of committee, publication of DFS RAISE Act rules, or any court ruling on federal pre-emption.
FAQs
Does New York have a single comprehensive AI law?
No. New York uses a patchwork of city and state rules, sectoral regulator guidance, and existing civil rights and consumer-protection law. A comprehensive private-sector bill, the New York AI Act, remains pending in committee as of mid-2026.
Who must comply with NYC Local Law 144?
Employers and employment agencies that use an automated employment decision tool to assess candidates or employees for hiring or promotion for a New York City role, including remote roles associated with a city office. The employer's headquarters location does not matter.
What are the penalties under Local Law 144?
Civil penalties range from $500 to $1,500 per violation, enforced by the Department of Consumer and Worker Protection, with each day of non-compliant use and each improper notice potentially counting as a separate violation.
When does the RAISE Act take effect and who does it cover?
It takes effect on 1 January 2027 and covers large frontier developers with annual revenue above $500 million whose models exceed a high compute threshold. It does not apply to ordinary AI users.
What does the algorithmic pricing law require?
Businesses doing business in New York that set personalised prices using a consumer's personal data must display "THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA." Insurers and certain financial institutions are exempt.
How is New York different from Colorado and California?
Colorado enacted a single broad high-risk AI statute. California combines a frontier-safety law with privacy-based automated decision rules. New York stacks targeted laws: a mature employment rule, a frontier-safety law, a public-sector law, and consumer-facing statutes, while a comprehensive bill stays pending.
Is the NIST AI Risk Management Framework mandatory in New York?
No. It is voluntary federal guidance. It is widely used as a structured reference for governance and bias testing, but it does not by itself satisfy any specific New York legal requirement.
Does Local Law 144 stop employers using biased tools?
No. It requires auditing, publication and notice, but does not prohibit using a tool that shows adverse impact or mandate a remedy. Substantive discrimination is addressed by separate human rights laws.