N.Y. Gen. Bus. Law § 1421

* § 1421. Transparency requirements. 1. A large frontier developer\nshall write, implement, comply with, and clearly and conspicuously\npublish on its internet website a frontier AI framework that applies to\nthe large frontier developer's frontier models and describes in detail\nhow the large frontier developer handles all of the following:\n (a) incorporating national standards, international standards, and\nindustry consensus best practices into its frontier AI framework;\n (b) defining and assessing thresholds used by the large frontier\ndeveloper to identify and assess whether a frontier model has\ncapabilities that could pose a catastrophic risk, which may include\nmultiple-tiered thresholds;\n (c) applying mitigations to address the potential for catastrophic\nrisks based on the results of assessments undertaken pursuant to\nparagraph (b) of this subdivision;\n (d) reviewing assessments and adequacy of mitigations as part of the\ndecision to deploy a frontier model or use it extensively internally;\n (e) using third parties to assess the potential for catastrophic risks\nand the effectiveness of mitigations of catastrophic risks;\n (f) revisiting and updating the frontier AI framework, including any\ncriteria that trigger updates and how the large frontier developer\ndetermines when its frontier models are substantially modified enough to\nrequire disclosures pursuant to subdivision three of this section;\n (g) cybersecurity practices to secure unreleased model weights from\nunauthorized modification or transfer by internal or external parties;\n (h) identifying and responding to critical safety incidents;\n (i) instituting internal governance practices to ensure implementation\nof these processes; and\n (j) assessing and managing catastrophic risk resulting from the\ninternal use of its frontier models, including risks resulting from a\nfrontier model circumventing oversight mechanisms.\n 2. (a) A large frontier developer shall review and, as appropriate,\nupdate its frontier AI framework at least once per year.\n (b) If a large frontier developer makes a material modification to its\nfrontier AI framework, the large frontier developer shall clearly and\nconspicuously publish the modified frontier AI framework and a\njustification for that modification within thirty days.\n 3. (a) Before, or concurrently with, deploying a new frontier model or\na substantially modified version of an existing frontier model, a\nfrontier developer shall clearly and conspicuously publish on its\ninternet website a transparency report containing all of the following:\n (i) the internet website of the frontier developer;\n (ii) a mechanism that enables a natural person to communicate with the\nfrontier developer;\n (iii) the release date of the frontier model;\n (iv) the languages supported by the frontier model;\n (v) the modalities of output supported by the frontier model;\n (vi) the intended uses of the frontier model; and\n (vii) any generally applicable restrictions or conditions on uses of\nthe frontier model.\n (b) Before, or concurrently with, deploying a new frontier model or a\nsubstantially modified version of an existing frontier model, a large\nfrontier developer shall include in the transparency report required by\nparagraph (a) of this subdivision, summaries of all of the following:\n (i) assessments of catastrophic risks from the frontier model\nconducted pursuant to the large frontier developer's frontier AI\nframework;\n (ii) the results of the assessments under subparagraph (i) of this\nparagraph;\n (iii) the extent to which third-party evaluators were involved; and\n (iv) other steps taken to fulfill the requirements of the frontier AI\nframework with respect to the frontier model.\n (c) A frontier developer that publishes the information described in\nparagraph (a) or (b) of this subdivision as part of a larger document,\nincluding a system card or model card, shall be deemed in compliance\nwith the applicable paragraph.\n 4. (a) (i) A frontier developer shall not make a materially false or\nmisleading statement about catastrophic risk from its frontier models or\nits management of catastrophic risk.\n (ii) A large frontier developer shall not make a materially false or\nmisleading statement about its implementation of, or compliance with,\nits frontier AI framework.\n (b) This subdivision shall not apply to a statement that was made in\ngood faith and was reasonable under the circumstances.\n 5. (a) When a frontier developer publishes documents to comply with\nthis section, such frontier developer may make redactions to such\ndocuments that are necessary to protect such frontier developer's trade\nsecrets, such frontier developer's cybersecurity, public safety, or the\nnational security of the United States or to comply with any federal or\nstate law.\n (b) If a frontier developer redacts information in a document pursuant\nto this subdivision, such frontier developer shall describe the\ncharacter and justification of such redaction in any published version\nof such document to the extent permitted by the concerns that justify\nredaction and shall retain the unredacted information for five years.\n * NB Effective January 1, 2027\n