Jurisdiction ยท 3 regulationsNew York privacy and AI laws
3 regulations in New York that affect companies handling data: NY RAISE Act, NYC Local Law 144 (AEDT), NYDFS Cybersecurity Regulation (Part 500). Part of US States.
3 regulations
Add to calendar
- NY RAISE Act
New York
EnactedAINext: Jan 1, 2027 RAISE Act takes effect
- NYC Local Law 144 (AEDT)
New York City, New York
In forceAIEffective Jul 5, 2023
- AmendedCybersecurityBreach notification
Effective Mar 1, 2017
Upcoming deadlines
January 20271 deadline
RAISE Act takes effect
Transparency reports, frontier AI frameworks, incident reporting and DFS disclosure filings apply.
Past deadlines
April 20261 deadline
Annual compliance notification
Annual certification or acknowledgment covering calendar year 2025 due.
March 20261 deadline
Chapter amendment S8828 signed
Chapter amendment (ch. 96) finalizes the RAISE Act text.
December 20251 deadline
RAISE Act signed
Governor Hochul signs the RAISE Act with an agreed chapter amendment.
November 20251 deadline
Universal MFA and asset inventory
500.12 multi-factor authentication for all users and 500.13(a) asset inventory requirements apply.
May 20251 deadline
Vulnerability scans, access privileges, malware controls, Class A monitoring
500.5(a)(2) automated scans, 500.7 access privilege restrictions, 500.14(a)(2) malicious code protection, and 500.14(b) Class A endpoint detection and centralized logging apply.
November 20241 deadline
Governance, encryption, IR/BCDR, exemptions
500.4 governance, 500.15 encryption, 500.16 incident response and business continuity plans, and 500.19(a) revised exemptions apply.
April 20242 deadlines
General 180-day transition ends
Most new Second Amendment requirements apply, e.g. annual reporting to the board and risk assessment updates.
Annual compliance notification
Certification of compliance or acknowledgment of non-compliance due (recurs every April 15).
December 20231 deadline
Amended notification requirements (500.17)
New 72-hour event notice, 24-hour extortion payment notice and certification changes apply (30 days).
November 20231 deadline
Second Amendment effective
Second Amendment takes effect; 500.19(e)-(h), 500.20, 500.21, 500.22 and 500.24 apply immediately.
July 20231 deadline
DCWP enforcement begins
Bias audit, results publication and candidate notice requirements are enforced.
March 20171 deadline
Part 500 effective
Original cybersecurity regulation takes effect.