New York AI Regulations Beyond NYC Local Law 144

Four. That's how many separate New York State instruments regulating AI have taken effect or been enacted since mid-2025 — on top of, and entirely independent from, NYC Local Law 144, the automated-hiring bias-audit rule most "New York AI law" coverage still treats as the whole picture. A frontier-model safety statute, a companion-chatbot disclosure law, a personalized-pricing disclosure act, and an insurance-underwriting circular have all arrived in roughly fifteen months, and none of them has anything to do with hiring or promotion decisions, which is the one and only thing Local Law 144 covers.

What Local Law 144 does and doesn't reach

Local Law 144 requires any employer using an automated employment decision tool — software that uses machine learning, statistical modeling, or AI to produce a score, classification, or recommendation that substantially assists or replaces a hiring or promotion decision — to commission an independent bias audit within the prior year, publish a summary of the results, and notify candidates that the tool is in use. New York City's Department of Consumer and Worker Protection enforces it, with civil penalties running $500 to $1,500 per violation per day.

That's a real, specific, narrow rule. It says nothing about a model used to triage insurance claims, a chatbot that talks to customers, or a pricing engine that sets a different price for different shoppers. A company can run a flawless Local Law 144 program and still be building toward violations under any of the four instruments below, because none of them check for Local Law 144 compliance as a substitute for their own requirements — which is exactly why New York earns its own expanding section on our state-by-state regulations tracker rather than a single line next to Local Law 144.

The RAISE Act: safety rules for frontier models, not live yet

The Responsible AI Safety and Education Act is the newest and, so far, the least settled of New York's AI statutes. The legislature passed it in June 2025, Governor Hochul signed the original version on December 19, 2025, and then — after a round of negotiation that drew comparisons to California's frontier-AI framework — she signed a chapter amendment on March 27, 2026 that narrowed the bill's scope and lowered its penalties before any of it took effect.

As it now stands, the RAISE Act applies to developers of "frontier" models: systems trained using more than 10^26 floating-point operations of compute, built by a developer with more than $500 million in annual gross revenue. A covered developer has to publish a safety framework describing how it evaluates and mitigates catastrophic risk, and has to report a critical safety incident to the state within 72 hours of determining one occurred. A new oversight office inside the Department of Financial Services handles rulemaking, fees, and an annual public safety report, with the Attorney General available to bring enforcement actions. Penalties reach $1 million for a first violation and $3 million for each one after that — lower than the $10 million and $30 million figures in the bill's original 2025 text, reflecting the scope-narrowing that came with the amendment.

None of that is in effect yet. The statute's obligations don't begin until January 1, 2027, which makes the RAISE Act the one entry on this page that's a planning item rather than a current compliance task — but it's close enough that a company training or fine-tuning anything near frontier scale should already be building the safety-framework and incident-reporting process it will need.

The AI Companion Models Law: a narrow category, a real disclosure duty

New York's Artificial Intelligence Companion Models Law, codified in Article 47 of the General Business Law, took effect November 5, 2025 — making New York, alongside California, one of the first states to regulate emotionally responsive AI chatbots as their own category. The statute defines an "AI companion" as a system designed to simulate a sustained human or human-like relationship with a user, and it requires operators to disclose, clearly and conspicuously, that the user isn't talking to a person. Operators also need a working protocol to detect a user expressing suicidal ideation or intent to self-harm and to direct that user to crisis-service resources.

The scope is narrower than the word "chatbot" suggests. The law expressly excludes customer-service bots, productivity tools, and systems a business uses purely for internal or employee-facing purposes — a support widget that answers billing questions isn't an AI companion just because it's conversational. Enforcement runs through the Attorney General alone, with civil penalties up to $15,000 per day per violation and no private right of action, which is a meaningful difference from California's companion-AI statute, SB 243, where California gave individual users a direct claim.

The Algorithmic Pricing Disclosure Act: when the price is the product

Buried inside this year's state budget bill, New York enacted the Algorithmic Pricing Disclosure Act — now General Business Law § 349-a — which took effect November 10, 2025 after a First Amendment challenge to an earlier version was resolved. The rule is specific: if a business sets the price it shows a particular consumer using an algorithm that incorporates that consumer's personal data, the business has to disclose that fact alongside the price.

The trigger is personalization, not automation in general. A retailer running a storewide sale that every visitor sees isn't covered. A travel site that quietly raises the fare it shows a returning visitor based on that visitor's browsing history is squarely inside the statute. The Attorney General has exclusive enforcement authority, with a cease-and-desist process that includes an opportunity to cure before any penalty attaches, and civil fines capped at $1,000 per violation — a much lower ceiling than the companion-chatbot law, reflecting that this is a disclosure failure rather than a safety one.

NYDFS Circular Letter No. 7: AI underwriting gets a fairness test, not a statute

The New York Department of Financial Services took a different route entirely for insurance. Rather than legislation, DFS issued Insurance Circular Letter No. 7, first circulated for comment in January 2024 and adopted in substantially similar form on July 11, 2024. It applies to any insurer authorized to write business in New York that uses external consumer data and information sources, or AI systems, in underwriting or pricing — explicitly not marketing or claims handling, which the circular leaves untouched.

The circular's core demand is a proxy-discrimination analysis: an insurer has to evaluate whether the data it's feeding into underwriting correlates with membership in a protected class, and if it does, whether using that data anyway serves a legitimate business purpose that couldn't be achieved with less discriminatory alternatives. There's no standalone civil-penalty table attached to the circular the way there is for the three statutes above — DFS's leverage is its existing examination authority, meaning it can audit an insurer's underwriting data and AI governance during a regular or targeted exam and act on what it finds under the insurance code already on the books.

Four exposures, one company

Take Hudson Mutual, a mid-size property and casualty insurer licensed in New York that's leaned hard into AI over the past two years. Hudson licenses a large general-purpose model from an outside vendor to help triage incoming claims — a use heavy enough in compute terms that, once the RAISE Act's obligations start in 2027, Hudson's vendor (not Hudson itself, since the obligations run to the model's developer) will need to be tracking whether that model counts as a frontier system. Hudson also rolled out a policyholder-facing chat assistant with a persistent, friendly persona designed to build rapport over repeat interactions — close enough to the Companion Models Law's definition that Hudson's product team had to add an unambiguous "I'm an AI assistant" disclosure and a self-harm referral flow before launch. Separately, Hudson's renewal-pricing engine adjusts each policyholder's renewal quote using that policyholder's claims history and browsing behavior on Hudson's site — triggering the Algorithmic Pricing Disclosure Act's point-of-price disclosure. And Hudson's underwriting team uses an AI system fed by third-party consumer data to help set initial premiums, which puts it squarely inside Circular Letter No. 7's proxy-discrimination review.

Not one of those four obligations overlaps with Local Law 144, because Hudson isn't using any of these systems to decide who to hire. A compliance program built only around New York City's hiring-tool rule would miss all four of them.

Build a map, not a single checklist

The practical fix isn't writing one "New York AI compliance" memo — it's inventorying every AI-touched product and sorting each one by what it actually does: frontier-scale model training or fine-tuning, a persistent conversational relationship with users, personalized pricing driven by personal data, AI-assisted insurance underwriting, or an automated employment decision. Each bucket has its own trigger, its own regulator, and its own effective date, and a system can land in more than one bucket at once. The RAISE Act's January 1, 2027 start date is the next real deadline on this page, and it's worth building the safety-framework and incident-reporting muscle well before then rather than after — New York's AI rulebook has grown by four instruments in about fifteen months, and nothing suggests that pace is slowing down. Companies juggling exposure across more than one state should also expect the list of comparable statutes to keep growing elsewhere — Illinois already shows the same pattern of "one state, several unrelated AI statutes," and the open question of whether a future federal law could flatten any of this is still very much unresolved, as the ongoing preemption fight makes clear.