Through January you will see headlines announcing that New York's artificial intelligence law has taken effect. If you run a company that uses AI, or sells a product with AI in it, the useful question is whether the law is aimed at you. For nearly every business reading this, it is not.
There is a widening gap between how much AI regulation gets written about and how much of it applies to an ordinary company. Most new AI statutes target model developers. Most businesses are model users. Those are different legal positions, and conflating them produces a lot of unnecessary worry and some genuinely missed obligations.
New York's law, effective 1 January, is a useful case for telling the two apart.
What the RAISE Act Actually Covers
The Responsible AI Safety and Education Act takes effect on 1 January 2027. It regulates frontier model development, and its obligations attach to defined categories rather than to AI use generally.
A frontier model is one trained using more than 1026 computational operations. A large frontier developer is an entity that, together with its affiliates, had annual gross revenue above $500 million in the preceding calendar year and trains such models.
Those two thresholds do the work. If you are not training models at that compute scale, the heavier obligations do not reach you, and the revenue test narrows the covered population to a handful of firms.
What It Requires of the Companies It Covers
Frontier developers must publish a transparency report before or when deploying a new or substantially modified model, and must not make materially false or misleading statements about catastrophic risk.
Large frontier developers carry more. They must publish a frontier AI framework addressing risk thresholds, mitigations, third-party evaluations, cybersecurity for unreleased model weights, incident response and internal governance. They must file a disclosure statement before developing, deploying or operating a frontier model in New York, renew it every two years or on a change of ownership, and pay an assessment.
Critical safety incidents must be reported within 72 hours, or within 24 hours where there is an imminent risk of death or serious physical injury. Oversight sits with a new office within the Department of Financial Services.
Check the Version You Are Reading
The enacted law differs from the bill as originally passed. The earlier text defined covered developers by compute spend rather than revenue, and included a substantive prohibition on deploying models posing an unreasonable risk of critical harm. The amendment removed that prohibition. Commentary written before the amendment describes a materially different law.
"It Doesn't Apply" Is Not the Same as "Nothing Applies"
Using AI in your business creates real obligations. They come from other places, and they are the ones worth your attention in January.
Hiring Tools
If you use AI to screen, rank or assess candidates in New York City, bias-audit and notice requirements for automated employment decision tools are the regime most likely to apply to you. This catches companies that would never describe themselves as AI businesses, because the tool came bundled with an applicant tracking system.
Privacy Law
When a model processes personal data, ordinary privacy obligations apply. New York's SHIELD Act requires reasonable safeguards for the private information of New York residents. Washington's My Health My Data Act reaches consumer health data well beyond the healthcare sector. Feeding customer data into a third-party model is a disclosure, and it should be assessed as one.
What You Say About It
Claims about AI capability are advertising claims. The exposure here sits in consumer protection and false advertising law, not AI law, and it applies at any company size. "AI-powered" on a pricing page is a representation you need to be able to support.
Your Vendor Contracts
This is where most companies actually carry risk, and it is entirely within your control. For every AI tool in your business, you should be able to answer:
Does the vendor train on your inputs, and can you switch that off? The default varies by product and by plan tier, and it changes.
Who owns the output, and what have you told your own customers about ownership? A mismatch between the two is a problem you created in your customer contract, not in the vendor's.
What happens if an output infringes someone's rights? Indemnities differ widely and several are narrower than the marketing suggests.
Where does the data go? Subprocessors, retention periods, and whether any of it breaks a commitment in your own customer agreements or data processing terms.
Can you get the data out, and will it be deleted? Worth confirming before you need it rather than during an exit.
Reviewing How AI Sits in Your Business
An inventory of where AI is in use, and what the contracts behind it actually say, is usually a short engagement with a clear output.
Schedule a Consultation →A Rule of Thumb
When a new AI law appears, three questions sort it quickly.
Does it regulate building models, or using them? Most of the headline statutes regulate building. If you buy AI rather than train it, those obligations sit with your vendor.
Is there a size threshold? Revenue or compute thresholds in frontier-model laws are set deliberately high. Check the number before assuming exposure.
What is the underlying activity? AI used in hiring is employment law. AI touching personal data is privacy law. AI described in your marketing is advertising law. These apply at any size, they already exist, and they are where an ordinary company's real exposure sits.
Run those three questions and most AI headlines resolve in a minute. The obligations that survive the filter are worth genuine attention.
The Bottom Line
If you are not a frontier developer, 1 January is not your deadline. The sensible use of the attention the date generates is an inventory of where AI is genuinely in use in your business and a review of the vendor terms attached to each tool.
That exercise usually surfaces two or three things worth fixing. None of them will be the RAISE Act.