N.Y. Gen. Bus. Law § 1422

* § 1422. Reporting. 1. The office shall establish a mechanism to be\nused by a frontier developer or a member of the public to report a\ncritical safety incident that includes all of the following:\n (a) the date of the critical safety incident;\n (b) the reasons the incident qualifies as a critical safety incident;\n (c) a short and plain statement describing the critical safety\nincident; and\n (d) whether the incident was associated with internal use of a\nfrontier model.\n 2. (a) A large frontier developer shall transmit to the office a\nsummary of any assessment of catastrophic risk resulting from internal\nuse of its frontier models every three months or pursuant to another\nreasonable schedule requested by the large frontier developer,\ncommunicated in writing to the office with written updates, as\nappropriate, and agreed upon by the office. The office shall establish a\nmechanism to be used by a large frontier developer to confidentially\nsubmit summaries of any assessments of the potential for catastrophic\nrisk resulting from internal use of its frontier models.\n (b) The office shall take all reasonable precautions to limit access\nto any reports related to internal use of frontier models to only\npersonnel authorized to know the information and to protect the reports\nfrom unauthorized access.\n 3. (a) Subject to paragraph (b) of this subdivision, a frontier\ndeveloper shall report any critical safety incident pertaining to one or\nmore of its frontier models to the office within seventy-two hours from\na determination that a critical safety incident has occurred or within\nseventy-two hours of the frontier developer learning facts sufficient to\nestablish a reasonable belief that a critical safety incident has\noccurred.\n (b) If a frontier developer discovers that a critical safety incident\nposes an imminent risk of death or serious physical injury, the frontier\ndeveloper shall disclose that incident within twenty-four hours to an\nauthority, including any law enforcement agency or public safety agency\nwith jurisdiction, that is appropriate based on the nature of that\nincident and as required by law.\n (c) A frontier developer that discovers information about a critical\nsafety incident after filing the initial report required by this\nsubdivision may file an amended report.\n 4. The office shall review critical safety incident reports submitted\nby frontier developers and may review reports submitted by members of\nthe public.\n 5. (a) The office may transmit reports of critical safety incidents or\nsummaries of any assessments of catastrophic risk from internal use of\nfrontier models to other governmental entities at their discretion,\nconsidering for example and without limitation the following: the\nseverity of any such incident, potential ongoing risks, legal or\nregulatory obligations, the need for coordinating with other\ngovernmental agencies or other entities and the availability of\ninformation. The office shall consider transmitting such reports or\nsummaries to the office of the attorney general, as appropriate. Any\nreport transmitted from the office to another governmental entity shall\nbe exempt from disclosure under article six of the public officers law.\n (b) The office may consider, at its discretion, any risks related to\ntrade secrets, public safety, cybersecurity of a frontier developer, or\nnational security when transmitting reports.\n 6. A report of a critical safety incident submitted to the office\npursuant to this section and a report of assessments of catastrophic\nrisk from internal use pursuant to section fourteen hundred twenty-one\nof this article, are exempt from disclosure under article six of the\npublic officers law.\n 7. (a) Beginning January first, two thousand twenty-eight, and\nannually thereafter, the office shall produce a report, that includes\nthe following:\n (i) anonymized and aggregated information about critical safety\nincidents that have been reviewed by the office since the preceding\nreport;\n (ii) any information that the office deems relevant to frontier model\nsafety;\n (iii) recommended updates to this article, if any; and\n (iv) any developments relevant to the purposes of this article.\n (b) The office shall not include information in a report pursuant to\nthis subdivision that would compromise the trade secrets or\ncybersecurity of a frontier developer, public safety, or the national\nsecurity of the United States or that would be prohibited by any federal\nor state law.\n (c) The office shall transmit a report pursuant to this subdivision to\nthe governor, the temporary president and minority leader of the senate,\nthe speaker and minority leader of the assembly, the chair and ranking\nmember of the senate committee on internet and technology, and the chair\nand ranking member of the assembly committee on science and technology.\n 8. The office may adopt regulations designating one or more federal\nlaws, regulations, or guidance documents that meet all of the following\nconditions for the purposes of subdivision nine of this section:\n (a) (i) the law, regulation, or guidance document imposes or states\nstandards or requirements for critical safety incident reporting that\nare substantially equivalent to, or stricter than, those required by\nsubdivision three of this section; and\n (ii) the law, regulation, or guidance document described in\nsubparagraph (i) of this paragraph does not need to require critical\nsafety incident reporting to the state of New York; and\n (b) the law, regulation, or guidance document is intended to assess,\ndetect, or mitigate the catastrophic risk.\n 9. (a) A frontier developer that intends to comply with subdivision\nthree of this section by complying with the requirements of, or meeting\nthe standards stated by, a federal law, regulation, or guidance document\ndesignated pursuant to subdivision eight of this section shall declare\nits intent to do so to the office.\n (b) After a frontier developer has declared its intent pursuant to\nparagraph (a) of this subdivision, the following shall apply:\n (i) the frontier developer shall be deemed in compliance with\nsubdivision three of this section to the extent that the frontier\ndeveloper meets the standards of, or complies with the requirements\nimposed or stated by, the designated federal law, regulation, or\nguidance document until the frontier developer declares the revocation\nof that intent to the office or the office revokes a relevant regulation\npursuant to subdivision ten of this section;\n (ii) the failure by a frontier developer to meet the standards of, or\ncomply with the requirements stated by, the federal law, regulation, or\nguidance document designated pursuant to subdivision eight of this\nsection shall constitute a violation of this article; and\n (iii) frontier developers who comply with subdivision three of this\nsection by meeting such federal standards shall send copies of any\ncritical safety incident reports required by such federal standards to\nthe office concurrently with sending them to federal authorities.\n 10. The office shall revoke a regulation adopted under subdivision\neight of this section if the requirements of subdivision eight of this\nsection are no longer met.\n * NB Effective January 1, 2027\n