On September 21, the RAISE Act stopped being a law on paper and became an enforcement program with a name, a face, and a calendar. Governor Hochul, standing next to Attorney General Letitia James, announced that registration opens in November — and named Marc Gilman as deputy director for RAISE Act implementation in the state’s new Office of Digital Innovation, Governance, Integrity and Trust (DIGIT), housed inside the Department of Financial Services.
Three weeks ago we wrote the deep-dive on the reporting machinery. This is the sequel: what the September 21 announcement actually changed, and why the countdown to November is the moment the evidence gap gets expensive.
What’s new since the deep-dive
The obligations haven’t changed. The seriousness has:
- A named enforcer. Gilman’s appointment as deputy director — the office’s first full-time hire — means there’s now a person whose job is to stand up the registration portal and run the reporting regime. Laws with named owners get enforced; laws without them get deferred.
- A home inside DFS. DIGIT sits within the Department of Financial Services — a regulator that already knows how to examine, penalize, and publish enforcement actions. This isn’t a new agency learning on the job; it’s a new mandate inside an old sheriff’s office.
- The 72-hour clock, reaffirmed on stage. Hochul and James reiterated the critical-incident reporting duty — 72 hours from detection — at the press conference. When the governor repeats your deadline at a podium, it’s not aspirational anymore.
- Penalties, stated plainly. Up to $1 million for a first violation, $3 million for subsequent ones — for missing reports or false statements. The AG doesn’t need a new theory of harm; the statute hands her the number.
- More regulation teased. Hochul declined to rule out further measures — including the “kill switch” concept we flagged in September. Exploratory, not law. But the direction of travel is unmistakable.
Registration is not paperwork — it’s a sworn statement
Here’s the part teams keep underestimating: registering means filing a disclosure statement and publishing your Frontier AI Framework on your own website. Those documents assert, in writing, that your safety and transparency machinery works the way you say it does.
And the statute penalizes false statements.
So the question isn’t “can we fill out the form?” It’s “can we defend every claim on it?” A framework that says you detect critical incidents within hours needs detection logs to prove it. A framework that describes quarterly catastrophic-risk assessments needs versioned test suites and results you can diff quarter over quarter. A framework that references intentions instead of evidence is now a signed confession waiting for an AG subpoena.
That’s why November matters more than January. January is when the duties take effect. November is when you put your claims on the record. The teams that spend the next eight weeks pressure-testing their evidence — not their prose — are the ones that register calmly.
The deployer problem just got a banking angle
The law targets developers, but the September coverage made the blast radius concrete — and it’s now wearing a suit. As PYMNTS reported, banks and credit unions are asking the operational question: what happens to your customer service, fraud detection, or payments process when your AI provider files a critical safety incident report?
The provider may have to investigate, restrict access, or change how the model works — while you still need to serve account holders. That’s not a hypothetical anymore; it’s the exact scenario the 72-hour reporting duty creates.
If you’re a bank, health system, or enterprise running on frontier models, you don’t register in November. But your board should be asking, this quarter: which of our critical processes depend on a vendor who will soon be filing incident reports with a state regulator? What’s our fallback when they do? Can we show our examiners we asked?
This is the finance vertical of the story, and it’s moving faster than the healthcare one. Regulated buyers are about to inherit vendor risk with a paper trail attached.
Your eight-week checklist
Registration opens next month. Between now and then:
- Confirm your coverage determination in writing. Do you clear the $500M revenue bar with affiliates? Do any of your models cross 10²⁶ FLOPs of training compute? Get the answer documented — “we assumed we were out of scope” is not a defense.
- Audit your framework against artifacts, not aspirations. Every claim in your published Frontier AI Framework should trace to a test run, a log, or an evaluation result. If a claim can’t be evidenced, rewrite the claim or build the evidence.
- Run a 72-hour drill. Simulate a critical incident and time your path from detection to a filed, defensible report. If it takes you a week in practice, you have eight weeks to fix that.
- Stand up the quarterly cadence. Define the catastrophic-risk test suites and datasets now. Q1 2027 is three months after registration — it will not be the time for your first attempt.
- Brief the board on vendor exposure. If you deploy frontier models, map which processes break when your provider reports an incident, and document the fallback.
Validated, not just documented
September gave you the law. September 21 gave you the enforcer, the office, and the date. November gives you the form where you sign your name to all of it.
We run hands-on IQ/OQ/PQ validation on AI systems and hand you audit-ready evidence packages — the kind of proof a disclosure statement, a 72-hour incident report, or a quarterly risk assessment is built on. If you’re staring at the November registration date wondering whether your reporting machinery actually works, let’s find out before DIGIT does.