New York’s New AI Safety Research Center: What Companies Building or Deploying AI Should Know

New York now has its own AI evaluation institute. On November 10, 2026, Governor Kathy Hochul launched the New York Center for AI Responsibility and Research (NYCAIRR), a statewide research network based at SUNY’s Binghamton University that will independently test advanced AI systems and the safety frameworks their developers publish. “The stakes are too high to simply take AI companies at their word,” the governor said. On the same day, the state’s new AI oversight office opened a portal for frontier developers to register under the RAISE Act. Taken together, the two announcements show how New York intends to oversee AI: a statute that sets obligations, a regulator that collects filings, and a research body that can check whether the filings hold up.

What New York launched

According to the governor’s announcement, the center will pursue three lines of work: independent testing of frontier AI systems, foundational research on how those systems work and how to measure their safety, and training a new generation of AI safety specialists. It will try to evaluate today’s systems while building the “scientific tools, measurements and standards” needed for more capable ones.

The center is not a new building full of staff. Morrisett, dean and vice provost of Cornell Tech, and Wing, executive vice president for research at Columbia University, will guide its scientific agenda, oversee its independent evaluation work and build a statewide network of researchers who stay at their home institutions. The state says that network will include more than 80 scientists. Computing comes from Empire AI, the state’s $500 million public-private research computing initiative.

Funding was announced earlier in the year: a $30 million philanthropic gift from donors led by Binghamton alumnus and Bloomberg LP co-founder Tom Secunda, an initial $25 million research investment from SUNY, and operating capital from the state. One of the center’s first tasks is a national recruiting drive for experts in areas that read like a map of current AI risk research:

• foundational limits and mathematical theory;
• formal methods and verification;
• agentic and complex systems;
• hardware security and privacy;
• interpretability and alignment;
• scientific AI and biosecurity.

One detail in early summaries is worth tightening. The center’s remit is not to evaluate “digital governance frameworks” in general. The state describes it as testing advanced AI systems and evaluating AI safety frameworks, with a specific role in reviewing the safety frameworks frontier developers must publish.

How the center connects to the RAISE Act

The center is a research body, not a regulator. The regulator is the Office of Digital Innovation, Governance, Integrity, and Trust (DIGIT), which sits within the Department of Financial Services and implements the RAISE Act. The link between the two is spelled out: at the state’s request, the center can provide “expertise, assessments and evidence” to inform policy and oversight of frontier developers, and it will coordinate with DIGIT to start reviewing developers’ published safety frameworks and recommend ways to strengthen requirements.

The DFS guidance for frontier developers sets out who is covered. A frontier model is a foundation model trained with more than 10^26 integer or floating-point operations, counting later fine-tuning and other material modifications. A large frontier developer is a frontier developer whose revenues, together with affiliates, exceeded $500 million in the preceding calendar year.

• All frontier developers must publish a model transparency report before or alongside deploying a new or substantially modified frontier model, and report critical safety incidents to DIGIT within 72 hours, or within 24 hours to an appropriate authority if there is an imminent risk of death or serious injury.
• Large frontier developers must also register with a current disclosure statement by January 1, 2027, publish and annually review a frontier AI safety framework, and send DIGIT quarterly summaries of catastrophic-risk assessments covering internal use of their models.

The governor’s office also signalled that it will keep “exploring ways to build on the RAISE Act” in the coming months. The center’s reviews are one obvious source of evidence for any future amendments.

Why an independent evaluator changes the picture

Most AI laws rely heavily on self-reporting. Developers write their own safety frameworks, run their own tests and publish their own transparency reports. That structure has an obvious weakness, and New York’s announcement names it directly. Morrisett put it diplomatically in Cornell’s announcement: AI companies care about safety, but “safety is one priority among many,” whereas at the center “safety and security will be our only focus.”

A state-backed evaluation capacity means published frameworks can be compared with what independent researchers find when they test systems. Other governments have built similar capacity, such as Singapore’s push to accredit AI testers and launch a safety starter kit. The difference in New York is the direct pipeline to a regulator with a filing system and a reporting clock.

New York’s approach also differs from laws aimed at the companies that use AI. Colorado’s AI Act, for example, put duties on deployers of high-risk systems and became a long-running compromise that pleases no one. California has moved to create a role for third-party AI auditors in its own regime. New York’s frontier model rules concentrate obligations on a small number of model makers.

What it means for companies building or deploying AI in New York

For the handful of firms that train models above the compute threshold, the implications are immediate: registration, safety frameworks and incident reporting are already on the calendar, and a credible research group will now read those frameworks closely. For everyone else, the effects are indirect but real. Here is a practical way to respond.

1. Confirm whether you are a frontier developer. Fine-tuning a vendor’s model rarely approaches 10^26 operations, but the definition counts compute for modifications, so teams training large models in-house should document their compute estimates. DFS also encourages smaller frontier developers to open RAISE Portal accounts early so they can report incidents quickly.
2. Use developers’ published documents in vendor reviews. If you buy from a covered developer, its safety framework and transparency reports become public, citable documents. Add them to vendor due diligence and record which uses the developer restricts.
3. Watch for the center’s findings. If independent testing shows a model behaving differently from what its developer claims, deployers relying on that model will want to know quickly. Assign someone to track the center’s publications and DIGIT’s recommendations.
4. Align your own incident process. Deployers are not bound by the 72-hour clock, but a vendor’s critical safety incident may become your incident. Contracts should require prompt notice of incidents affecting the models you use.
5. Keep testing your own deployments. Evaluating a frontier model in the lab says little about how it behaves inside your workflow and with your data. A full-year AI audit program that covers privacy, security and output quality remains your responsibility.

There is also a people dimension. New York officials have already encouraged insiders to speak up, with the attorney general calling on AI workers to report unsafe AI development. A research center that can test claims independently gives such reports a technical body able to look into them, which is another reason internal escalation routes should work well.

Limits worth keeping in mind

The center is new, its leadership is interim and its methods are not yet published. It has no enforcement powers of its own, and its framework reviews depend on requests from the state. Independent testing of frontier systems also depends on access to models, and the announcement does not explain how that access will be arranged. Compliance teams should resist treating any future “evaluated by New York” signal as a certificate; as debates about the limits of AI audits have shown, an evaluation covers only what it tested.

Frequently asked questions

Does the New York Center for AI Responsibility and Research regulate companies?

No. It is a research and evaluation body. Oversight of frontier developers sits with the DIGIT office at the Department of Financial Services, which can draw on the center’s assessments when the state asks for them.

Does the RAISE Act apply to companies that only use AI tools?

Generally not. Its obligations attach to frontier developers that train models above the 10^26 compute threshold, with extra duties for those with more than $500 million in annual revenue. Deployers may still face other state and federal rules on privacy, discrimination and consumer protection.

When do the main RAISE Act deadlines start?

Large frontier developers must register through the RAISE Portal by January 1, 2027. From January, the state says large developers must publish safety frameworks and all frontier developers must report critical safety incidents and publish transparency reports.

Will the center publish its evaluations?

The state has said the center will give public officials objective evidence and help build standards, but it has not yet said how or when results will be published. Watch for an announced methodology before relying on any finding.

New York has built a three-part structure: a law, a regulator and a lab to check the work. The lab is the newest piece and the least tested. How rigorous, and how public, its first reviews of developers’ safety frameworks turn out to be will show whether “independent testing” means real scrutiny.