New York 2025-A768

• Authority: New York
• Parent authority: State governments
• Jurisdiction: United States
• Collections: U.S. state and local documents
• Most recent activity: Proposed
• Most recent activity date: 2025-01-08

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Unfair discrimination and misrepresentation
• Unequal performance across groups
• Governance failure
• Lack of capability or robustness
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Compromise of privacy
• AI system security vulnerabilities
• Fraud, scams, and targeted manipulation
• Loss of human agency and autonomy

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 8-10 subdomains, with strong focus on discrimination and bias (1.1, 1.3), privacy concerns (2.1), AI system security (2.2), transparency issues (7.4), lack of robustness (7.3), and governance structures (6.5). The legislation primarily addresses risks related to algorithmic discrimination, consumer protection, and AI system reliability in high-risk decision-making contexts.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Finance & Insurance
• Real Estate, Rental & Leasing
• Professional & Technical Services
• Educational Services
• Health Care & Social Assistance
• Public Administration (excl. National Security)

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Information
• Scientific Research & Development Services
• Arts, Entertainment & Recreation
• National Security

All other sectors had no coverage in this document.

Sectors Summary

The document governs AI use across multiple sectors through its definition of 'consequential decisions' which explicitly includes education, employment, financial services, government services, healthcare, housing, insurance, and legal services. The legislation applies broadly to any entity doing business in New York State that develops or deploys high-risk AI decision systems affecting these sectors.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding legislative statute enacted by New York State with mandatory compliance requirements, enforcement mechanisms through the Attorney General, and legal penalties for violations. The document uses mandatory language throughout ('shall') and establishes clear legal obligations for AI developers and deployers.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: This is a New York State legislative bill (2025-A768) that amends the general business law by adding a new article. The document is proposed by the state legislative authority.

Target

• Entity Types: AI_Developer, AI_Deployer
• Summary: The legislation explicitly targets two categories of entities: developers who create or substantially modify AI decision systems, and deployers who use high-risk AI decision systems. Both must be doing business in New York State.

Enforcer

• Entity Types: AI_Governance_Actor
• Summary: The Attorney General is explicitly granted exclusive enforcement authority over this legislation, including investigation powers, ability to require disclosures, and authority to bring enforcement actions.

Monitor

• Entity Types: AI_Governance_Actor
• Summary: The Attorney General monitors compliance through investigations and required disclosures. Additionally, the Attorney General identifies and publishes lists of qualified independent third-party auditors who conduct bias and governance audits.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document comprehensively covers multiple AI lifecycle stages with primary focus on deployment and operational monitoring. It addresses planning through risk management requirements, data processing through documentation requirements, model building through developer obligations, verification through bias audits, deployment through notification requirements, and ongoing monitoring through annual reviews and impact assessments.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems
• General Purpose AI
• Open Weight / Open Source

Technical Scope Summary

The document explicitly covers AI decision systems and AI models with detailed definitions. It specifically addresses general-purpose AI models with comprehensive technical documentation requirements. The document does not explicitly mention frontier AI, task-specific AI, foundation models, generative AI, predictive AI, open-weight models, or compute thresholds.