Regulon — NY-SB-10373 · NY SB 10373 (Frontier AI Third-Party Verification)

WHAT THIS BILL REGULATES · 2 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

Enforcement by the Attorney General through civil action. No private right of action. The Attorney General may bring suit for violations of Section 1425 (third-party verification requirements) under the expanded enforcement provision of Section 1428. The office established under Article 44-B has regulatory authority to accredit third-party verifiers and promulgate regulations.

Private Right of Action

No private right of action. Enforcement is exclusive to the designated authority.

Penalties

Civil penalty of up to $1,000,000 for a first violation and up to $3,000,000 per subsequent violation, determined based on the severity of the violation. The existing penalty structure in Section 1428 is extended to cover violations of the new Section 1425 third-party verification requirements.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

Gen. Bus. Law § 1420(17)

Definition of third party verifier

(17) "Third party verifier" means a person, other than an affiliate of a large frontier developer, who is retained, contracted, or otherwise engaged by a large frontier developer to verify such developer's compliance with such developer's frontier AI framework.

Section 1 adds a new subdivision 17 to Section 1420 of the General Business Law, defining third party verifier as a person, other than an affiliate of a large frontier developer, who is retained to verify a developer's compliance with its frontier AI framework. This definition underpins the entire third-party verification regime created by the bill.

Gen. Bus. Law § 1425

Third party verification requirements

Developer

(1)(a)–(d) 1 A large frontier developer shall annually retain, contract, or otherwise engage a third party verifier to produce a report assessing the following: (a) whether a large frontier developer has complied with its frontier AI framework as well as any instances of noncompliance with such framework; (b) where such AI framework may require additional clarity and detail in order to better assess compliance; (c) whether any redactions made by the large frontier developer pursuant to subdivision five of section fourteen hundred twenty-one of this article are in compliance with such subdivision; (d) whether any statements made by the large frontier developer to the public, office, attorney general, or to other governmental entities regarding catastrophic risk from such developer's frontier model, such developer's management of such risk, and/or such developer's compliance with such developer's frontier AI framework are inconsistent with the findings of the third party verifier's report.

(2)(a)–(c) 2 A large frontier developer shall grant the third party verifier access to: (a) All materials submitted to the office pursuant to this article; (b) Unredacted versions of all documents published by the large frontier developer pursuant to section fourteen hundred twenty-one of this article; and (c) Any other materials reasonably necessary to perform the assessment provided in subdivision one of this section.

(3) 3 In retaining, contracting, or otherwise engaging a third party verifier, a large frontier developer shall not condition any payment or form of compensation to a third party verifier upon the results of such verifier's assessment.

(4) 4 Prior to January first, two thousand twenty-nine, a large frontier developer may retain, contract, or otherwise engage a third party verifier of their choosing, provided that such developer may not retain, contract, or otherwise engage a third party verifier with a financial stake in such developer, nor may they retain, contract, or otherwise engage a third party verifier in which such developer has a financial stake.

(5) 5 A large frontier developer shall retain the third party verifier's report provided in subdivision one of this section for a minimum of five years and shall allow the office or the attorney general to inspect an unredacted version of such report upon request.

(6) 6 The third party verifier shall conspicuously publish a summary of the verifier's report within sixty days of such report's completion. Such publication shall not contain any information that would jeopardize the large frontier developer's trade secrets, cybersecurity, public safety, or the national security of the United States.

(7) 7 A large frontier developer shall clearly and conspicuously publish a link on its internet website to the summary provided in subdivision six of this section within fifteen days of a third party verifier's publication of such summary.

(8)(a)–(e) 8 No later than July first, two thousand twenty-eight, the office shall adopt regulations to: (a)(i) Establish a process by which the office accredits third party verifiers under this section. Such accreditation shall be conditioned upon: (A) sufficient expertise amongst the personnel retained, contracted, or otherwise engaged by the third party verifier to verify frontier developers' compliance with such developers' frontier AI frameworks, including expertise in corporate compliance and technical expertise in foundation and frontier model safety; and (B) the verifier's ability to address potential conflicts of interest that may undermine the integrity, quality, and/or independence of such verification. (ii) Such regulations shall also prescribe the circumstances under which and procedure by which the office may revoke accreditation. (iii) The office may place requirements on accredited third party verifiers as they deem reasonably necessary to ensure the integrity, quality, and/or independence of the verification process, including prohibiting the employees of the third party verifier from being employed by a frontier developer for a period of time after such employees' employment with the third party verifier; (b) Stipulate the level of access that large frontier developers must provide to third party verifiers to enable a meaningful assessment of compliance with such developers' frontier AI frameworks; (c) Ensure the protection of a large frontier developer's trade secrets and cybersecurity; (d) Stipulate the minimum amount of information that a third party verifier must include in its report of compliance assessment; and (e) Stipulate the required content and permissible redactions of summaries provided pursuant to subdivision six of this section.

(9) 9 On and after January first, two thousand twenty-nine, a large frontier developer may retain, contract, or otherwise engage no third party verifier for the annual report required in subdivision one of this section other than a third party verifier who has been accredited by the office pursuant to regulations promulgated under subdivision eight of this section.

(10) The office shall review the regulations promulgated under this section on an annual basis. Where the office deems necessary, the office shall update such regulations to account for changes in the third party verifier market, any verification gaps that have been identified over the course of implementation, and/or changes to scientific understanding of catastrophic risk that have developed since the last update to such regulations.

Section 1425 establishes the core third-party verification regime for large frontier developers. It requires annual engagement of a third-party verifier to produce a compliance assessment report covering four substantive areas: framework compliance, framework adequacy, redaction propriety, and consistency of public statements about catastrophic risk. The developer must grant the verifier access to all materials submitted to the state office, unredacted published documents, and any other reasonably necessary materials.

The section imposes structural independence safeguards: verifier compensation may not be conditioned on report results, and prior to January 1, 2029, developers may not engage verifiers with mutual financial stakes. After that date, only verifiers accredited by the state office may be retained. The developer must retain the full report for five years and allow regulatory inspection. The verifier must publish a report summary within 60 days, and the developer must link to it on its website within 15 days.

Subdivisions 8 through 10 direct the state office to adopt and annually review accreditation regulations by July 1, 2028, covering verifier expertise, conflicts of interest, access requirements, trade-secret protections, and minimum report content.

Compliance actions 8 items

Large frontier developers must annually engage an independent third-party verifier to produce a report assessing (1) compliance with the developer's frontier AI framework, (2) framework adequacy, (3) propriety of any redactions in published documents, and (4) consistency of public statements about catastrophic risk with the verifier's findings.

G-01.5

Large frontier developers must grant the third-party verifier access to all materials submitted to the state office, unredacted versions of all publicly published documents, and any other materials reasonably necessary to perform the compliance assessment.

G-01.4

Large frontier developers must not condition any payment or compensation to a third-party verifier upon the results of the verifier's assessment.

G-01.5

Prior to January 1, 2029, large frontier developers may choose their own third-party verifier but must not engage a verifier with a mutual financial stake — the developer may not retain a verifier that has a financial stake in the developer, nor a verifier in which the developer has a financial stake.

G-01.5

Large frontier developers must retain the third-party verifier's report for a minimum of five years and must allow the state office or the Attorney General to inspect an unredacted version upon request.

G-01.3

The third-party verifier must conspicuously publish a summary of its compliance assessment report within 60 days of report completion, excluding information that would jeopardize trade secrets, cybersecurity, public safety, or national security.

G-02.3

Large frontier developers must clearly and conspicuously publish a link on their website to the third-party verifier's published summary within 15 days of the verifier's publication.

G-02.4

On and after January 1, 2029, large frontier developers must use only third-party verifiers accredited by the state office for the annual compliance assessment report.

G-01.5

Gen. Bus. Law § 1428(1)

Enforcement penalties for verification noncompliance

(1) 10 The attorney general may bring a civil action to recover a civil penalty in an amount not to exceed one million dollars for a first violation and in an amount not to exceed three million dollars per subsequent violation, determined based on the severity of the violation where a large frontier developer fails to publish or transmit a compliant document required to be published or transmitted under this article, makes a statement in violation of subdivision four of section fourteen hundred twenty-one of this article, fails to report an incident as required by section fourteen hundred twenty-two of this article, fails to comply with its own frontier AI framework, or fails to comply with section fourteen hundred twenty-five of this article.

Section 3 amends the existing enforcement provision in Section 1428(1) (renumbered from the original Article 44-B structure) to add failure to comply with the new Section 1425 third-party verification requirements to the list of violations for which the Attorney General may bring a civil action. The penalty structure — up to $1,000,000 for a first violation and $3,000,000 per subsequent violation — is unchanged; the amendment merely extends it to cover the new verification obligations.

Pub. Officers Law § 87(2)(w)

FOIL exemption for third-party verifier reports

(w) is a report produced by a third party verifier under section fourteen hundred twenty-five of the general business law.

Section 4 adds a new paragraph (w) to the Freedom of Information Law exemptions, excluding third-party verifier reports produced under Section 1425 from mandatory FOIL disclosure. This protects the full unredacted reports from public records requests — the public's access is limited to the summary published under subdivision 6 of Section 1425.

NY SB 10373, § 5

Severability

If any clause, sentence, paragraph, subdivision, section or part of this act shall be adjudged by any court of competent jurisdiction to be invalid, such judgment shall not affect, impair, or invalidate the remainder thereof, but shall be confined in its operation to the clause, sentence, paragraph, subdivision, section, or part thereof directly involved in the controversy in which such judgment shall have been made.

Standard severability clause providing that invalidation of any portion of the act does not affect the remainder.

NY SB 10373, § 6

Effective date

This act shall take effect on the thirtieth day after it shall have become a law; provided, however, that if article 44-B of the general business law, as added by chapter 96 of the laws of 2026, shall not have taken effect on or before such date then this act shall take effect thirty days after such article takes effect.

The act takes effect on the thirtieth day after it becomes law, with a contingency provision: if Article 44-B of the General Business Law (added by Chapter 96 of the Laws of 2026) has not yet taken effect by that date, then this act takes effect thirty days after Article 44-B does. This ensures the amendment does not become operative before the statute it amends.

Governance Risk management · accountability programs

8 items

G-01.5

G-01.4

G-01.5

Large frontier developers must not condition any payment or compensation to a third-party verifier upon the results of the verifier's assessment.

G-01.5

G-01.3

G-02.3

G-02.4

Large frontier developers must clearly and conspicuously publish a link on their website to the third-party verifier's published summary within 15 days of the verifier's publication.

G-01.5

Beginning Jan 1, 2029 On and after January 1, 2029, large frontier developers must use only third-party verifiers accredited by the state office for the annual compliance assessment report.

Passage Likelihood

Low

Status Introduced

Chamber No passage

Committee No action

Majority party Yes

Bipartisan No

Prior session None

Legislative History

2026-05-15 REFERRED TO INTERNET AND TECHNOLOGY

Sources

Full Text ↗

Entry Last Reviewed

2026-05-20

AI generated