1(a)–(e) 1 Before deploying a frontier modelFrontier model"Frontier model" means either of the following: (a) an artificial intelligence model trained using greater than 10^26 computational operations (e.g., integer or floating-point operations), the compute cost of which exceeds one hundred million dollars; or (b) an artificial intelligence model produced by applying knowledge distillation to a frontier model as defined in paragraph (a) of this subdivision.Gen. Bus. Law § 1420(6), the large developer of such frontier modelFrontier model"Frontier model" means either of the following: (a) an artificial intelligence model trained using greater than 10^26 computational operations (e.g., integer or floating-point operations), the compute cost of which exceeds one hundred million dollars; or (b) an artificial intelligence model produced by applying knowledge distillation to a frontier model as defined in paragraph (a) of this subdivision.Gen. Bus. Law § 1420(6) shall do all of the following: (a) Implement a written safety and security protocolSafety and security protocol"Safety and security protocol" means documented technical and organizational protocols that: (a) Specify reasonable protections and procedures that, if successfully implemented would appropriately reduce the risk of critical harm; (b) Describe reasonable administrative, technical, and physical cybersecurity protections for frontier models within the large developer's control that, if successfully implemented, appropriately reduce the risk of unauthorized access to, or misuse of, the frontier models leading to critical harm, including by sophisticated actors; (c) Describe in detail the testing procedure to evaluate if the frontier model poses an unreasonable risk of critical harm; (d) Describe in detail how the testing procedure assesses whether the frontier model could be misused, be modified, be executed with increased computational resources, evade the control of its large developer or user, be combined with other software or be used to create another frontier model in a manner that would increase the risk of critical harm; (e) State compliance requirements with sufficient detail and specificity to allow the large developer or a third party to readily ascertain whether the requirements of the safety and security protocol have been followed; (f) Describe how the large developer will fulfill their obligations under this article, including with respect to any requirements, safeguards, or modifications; and (g) Designate senior personnel to be responsible for ensuring compliance.Gen. Bus. Law § 1420(12); (b) Retain an unredacted copy of the safety and security protocolSafety and security protocol"Safety and security protocol" means documented technical and organizational protocols that: (a) Specify reasonable protections and procedures that, if successfully implemented would appropriately reduce the risk of critical harm; (b) Describe reasonable administrative, technical, and physical cybersecurity protections for frontier models within the large developer's control that, if successfully implemented, appropriately reduce the risk of unauthorized access to, or misuse of, the frontier models leading to critical harm, including by sophisticated actors; (c) Describe in detail the testing procedure to evaluate if the frontier model poses an unreasonable risk of critical harm; (d) Describe in detail how the testing procedure assesses whether the frontier model could be misused, be modified, be executed with increased computational resources, evade the control of its large developer or user, be combined with other software or be used to create another frontier model in a manner that would increase the risk of critical harm; (e) State compliance requirements with sufficient detail and specificity to allow the large developer or a third party to readily ascertain whether the requirements of the safety and security protocol have been followed; (f) Describe how the large developer will fulfill their obligations under this article, including with respect to any requirements, safeguards, or modifications; and (g) Designate senior personnel to be responsible for ensuring compliance.Gen. Bus. Law § 1420(12), including records and dates of any updates or revisions. Such unredacted copy of the safety and security protocolSafety and security protocol"Safety and security protocol" means documented technical and organizational protocols that: (a) Specify reasonable protections and procedures that, if successfully implemented would appropriately reduce the risk of critical harm; (b) Describe reasonable administrative, technical, and physical cybersecurity protections for frontier models within the large developer's control that, if successfully implemented, appropriately reduce the risk of unauthorized access to, or misuse of, the frontier models leading to critical harm, including by sophisticated actors; (c) Describe in detail the testing procedure to evaluate if the frontier model poses an unreasonable risk of critical harm; (d) Describe in detail how the testing procedure assesses whether the frontier model could be misused, be modified, be executed with increased computational resources, evade the control of its large developer or user, be combined with other software or be used to create another frontier model in a manner that would increase the risk of critical harm; (e) State compliance requirements with sufficient detail and specificity to allow the large developer or a third party to readily ascertain whether the requirements of the safety and security protocol have been followed; (f) Describe how the large developer will fulfill their obligations under this article, including with respect to any requirements, safeguards, or modifications; and (g) Designate senior personnel to be responsible for ensuring compliance.Gen. Bus. Law § 1420(12), including records and dates of any updates or revisions, shall be retained for as long as a frontier modelFrontier model"Frontier model" means either of the following: (a) an artificial intelligence model trained using greater than 10^26 computational operations (e.g., integer or floating-point operations), the compute cost of which exceeds one hundred million dollars; or (b) an artificial intelligence model produced by applying knowledge distillation to a frontier model as defined in paragraph (a) of this subdivision.Gen. Bus. Law § 1420(6) is deployed plus five years; (c) (i) Conspicuously publish a copy of the safety and security protocolSafety and security protocol"Safety and security protocol" means documented technical and organizational protocols that: (a) Specify reasonable protections and procedures that, if successfully implemented would appropriately reduce the risk of critical harm; (b) Describe reasonable administrative, technical, and physical cybersecurity protections for frontier models within the large developer's control that, if successfully implemented, appropriately reduce the risk of unauthorized access to, or misuse of, the frontier models leading to critical harm, including by sophisticated actors; (c) Describe in detail the testing procedure to evaluate if the frontier model poses an unreasonable risk of critical harm; (d) Describe in detail how the testing procedure assesses whether the frontier model could be misused, be modified, be executed with increased computational resources, evade the control of its large developer or user, be combined with other software or be used to create another frontier model in a manner that would increase the risk of critical harm; (e) State compliance requirements with sufficient detail and specificity to allow the large developer or a third party to readily ascertain whether the requirements of the safety and security protocol have been followed; (f) Describe how the large developer will fulfill their obligations under this article, including with respect to any requirements, safeguards, or modifications; and (g) Designate senior personnel to be responsible for ensuring compliance.Gen. Bus. Law § 1420(12) with appropriate redactionsAppropriate redactions"Appropriate redactions" means redactions to a safety and security protocol or audit report that a developer may make when necessary to: (a) protect public safety to the extent the developer can reasonably predict such risks; (b) protect trade secrets; (c) prevent the release of confidential information as required by state or federal law; (d) protect employee or customer privacy; or (e) prevent the release of information otherwise controlled by state or federal law.Gen. Bus. Law § 1420(1) and transmit a copy of such redacted safety and security protocolSafety and security protocol"Safety and security protocol" means documented technical and organizational protocols that: (a) Specify reasonable protections and procedures that, if successfully implemented would appropriately reduce the risk of critical harm; (b) Describe reasonable administrative, technical, and physical cybersecurity protections for frontier models within the large developer's control that, if successfully implemented, appropriately reduce the risk of unauthorized access to, or misuse of, the frontier models leading to critical harm, including by sophisticated actors; (c) Describe in detail the testing procedure to evaluate if the frontier model poses an unreasonable risk of critical harm; (d) Describe in detail how the testing procedure assesses whether the frontier model could be misused, be modified, be executed with increased computational resources, evade the control of its large developer or user, be combined with other software or be used to create another frontier model in a manner that would increase the risk of critical harm; (e) State compliance requirements with sufficient detail and specificity to allow the large developer or a third party to readily ascertain whether the requirements of the safety and security protocol have been followed; (f) Describe how the large developer will fulfill their obligations under this article, including with respect to any requirements, safeguards, or modifications; and (g) Designate senior personnel to be responsible for ensuring compliance.Gen. Bus. Law § 1420(12) to the division of homeland security and emergency services; (ii) Grant the division of homeland security and emergency services or the attorney general access to the safety and security protocolSafety and security protocol"Safety and security protocol" means documented technical and organizational protocols that: (a) Specify reasonable protections and procedures that, if successfully implemented would appropriately reduce the risk of critical harm; (b) Describe reasonable administrative, technical, and physical cybersecurity protections for frontier models within the large developer's control that, if successfully implemented, appropriately reduce the risk of unauthorized access to, or misuse of, the frontier models leading to critical harm, including by sophisticated actors; (c) Describe in detail the testing procedure to evaluate if the frontier model poses an unreasonable risk of critical harm; (d) Describe in detail how the testing procedure assesses whether the frontier model could be misused, be modified, be executed with increased computational resources, evade the control of its large developer or user, be combined with other software or be used to create another frontier model in a manner that would increase the risk of critical harm; (e) State compliance requirements with sufficient detail and specificity to allow the large developer or a third party to readily ascertain whether the requirements of the safety and security protocol have been followed; (f) Describe how the large developer will fulfill their obligations under this article, including with respect to any requirements, safeguards, or modifications; and (g) Designate senior personnel to be responsible for ensuring compliance.Gen. Bus. Law § 1420(12), with redactions only to the extent required by federal law, upon request; (d) Record, as and when reasonably possible, and retain for as long as the frontier modelFrontier model"Frontier model" means either of the following: (a) an artificial intelligence model trained using greater than 10^26 computational operations (e.g., integer or floating-point operations), the compute cost of which exceeds one hundred million dollars; or (b) an artificial intelligence model produced by applying knowledge distillation to a frontier model as defined in paragraph (a) of this subdivision.Gen. Bus. Law § 1420(6) is deployed plus five years information on the specific tests and test results used in any assessment of the frontier modelFrontier model"Frontier model" means either of the following: (a) an artificial intelligence model trained using greater than 10^26 computational operations (e.g., integer or floating-point operations), the compute cost of which exceeds one hundred million dollars; or (b) an artificial intelligence model produced by applying knowledge distillation to a frontier model as defined in paragraph (a) of this subdivision.Gen. Bus. Law § 1420(6) that provides sufficient detail for third parties to replicate the testing procedure; and (e) Implement appropriate safeguards to prevent unreasonable risk of critical harmCritical harm"Critical harm" means the death or serious injury of one hundred or more people or at least one billion dollars of damages to rights in money or property caused or materially enabled by a large developer's creation, use, storage, or release of a frontier model, through either of the following: (a) The creation or use of a chemical, biological, radiological, or nuclear weapon; or (b) An artificial intelligence model engaging in conduct that does both of the following: (i) Acts with limited human intervention; and (ii) Would, if committed by a human, constitute a crime specified in the penal law that requires intent, recklessness, or gross negligence, or the solicitation or aiding and abetting of such a crime. A harm inflicted by an intervening human actor shall not be deemed to result from a developer's activities unless such activities made it substantially easier or more likely for the actor to inflict such harm.Gen. Bus. Law § 1420(7).

2 2 A large developerLarge developer"Large developer" means a person that has trained at least one frontier model, the compute cost of which exceeds five million dollars, and has spent over one hundred million dollars in compute costs in aggregate in training frontier models. Accredited colleges and universities shall not be considered large developers under this article to the extent that such colleges and universities are engaging in academic research. If a person subsequently transfers full intellectual property rights of the frontier model to another person (including the right to resell the model) and retains none of those rights for themself, then the receiving person shall be considered the large developer and shall be subject to the responsibilities and requirements of this article after such transfer.Gen. Bus. Law § 1420(9) shall not deployDeploy"Deploy" means to use a frontier model or to make a frontier model foreseeably available to one or more third parties for use, modification, copying, or a combination thereof with other software, except for training or developing the frontier model, evaluating the frontier model or other frontier models, or complying with federal or state laws.Gen. Bus. Law § 1420(5) a frontier modelFrontier model"Frontier model" means either of the following: (a) an artificial intelligence model trained using greater than 10^26 computational operations (e.g., integer or floating-point operations), the compute cost of which exceeds one hundred million dollars; or (b) an artificial intelligence model produced by applying knowledge distillation to a frontier model as defined in paragraph (a) of this subdivision.Gen. Bus. Law § 1420(6) if doing so would create an unreasonable risk of critical harmCritical harm"Critical harm" means the death or serious injury of one hundred or more people or at least one billion dollars of damages to rights in money or property caused or materially enabled by a large developer's creation, use, storage, or release of a frontier model, through either of the following: (a) The creation or use of a chemical, biological, radiological, or nuclear weapon; or (b) An artificial intelligence model engaging in conduct that does both of the following: (i) Acts with limited human intervention; and (ii) Would, if committed by a human, constitute a crime specified in the penal law that requires intent, recklessness, or gross negligence, or the solicitation or aiding and abetting of such a crime. A harm inflicted by an intervening human actor shall not be deemed to result from a developer's activities unless such activities made it substantially easier or more likely for the actor to inflict such harm.Gen. Bus. Law § 1420(7).

3 3 A large developerLarge developer"Large developer" means a person that has trained at least one frontier model, the compute cost of which exceeds five million dollars, and has spent over one hundred million dollars in compute costs in aggregate in training frontier models. Accredited colleges and universities shall not be considered large developers under this article to the extent that such colleges and universities are engaging in academic research. If a person subsequently transfers full intellectual property rights of the frontier model to another person (including the right to resell the model) and retains none of those rights for themself, then the receiving person shall be considered the large developer and shall be subject to the responsibilities and requirements of this article after such transfer.Gen. Bus. Law § 1420(9) shall conduct an annual review of any safety and security protocolSafety and security protocol"Safety and security protocol" means documented technical and organizational protocols that: (a) Specify reasonable protections and procedures that, if successfully implemented would appropriately reduce the risk of critical harm; (b) Describe reasonable administrative, technical, and physical cybersecurity protections for frontier models within the large developer's control that, if successfully implemented, appropriately reduce the risk of unauthorized access to, or misuse of, the frontier models leading to critical harm, including by sophisticated actors; (c) Describe in detail the testing procedure to evaluate if the frontier model poses an unreasonable risk of critical harm; (d) Describe in detail how the testing procedure assesses whether the frontier model could be misused, be modified, be executed with increased computational resources, evade the control of its large developer or user, be combined with other software or be used to create another frontier model in a manner that would increase the risk of critical harm; (e) State compliance requirements with sufficient detail and specificity to allow the large developer or a third party to readily ascertain whether the requirements of the safety and security protocol have been followed; (f) Describe how the large developer will fulfill their obligations under this article, including with respect to any requirements, safeguards, or modifications; and (g) Designate senior personnel to be responsible for ensuring compliance.Gen. Bus. Law § 1420(12) required by this section to account for any changes to the capabilities of their frontier modelsFrontier model"Frontier model" means either of the following: (a) an artificial intelligence model trained using greater than 10^26 computational operations (e.g., integer or floating-point operations), the compute cost of which exceeds one hundred million dollars; or (b) an artificial intelligence model produced by applying knowledge distillation to a frontier model as defined in paragraph (a) of this subdivision.Gen. Bus. Law § 1420(6) and industry best practices and, if necessary, make modifications to such safety and security protocolSafety and security protocol"Safety and security protocol" means documented technical and organizational protocols that: (a) Specify reasonable protections and procedures that, if successfully implemented would appropriately reduce the risk of critical harm; (b) Describe reasonable administrative, technical, and physical cybersecurity protections for frontier models within the large developer's control that, if successfully implemented, appropriately reduce the risk of unauthorized access to, or misuse of, the frontier models leading to critical harm, including by sophisticated actors; (c) Describe in detail the testing procedure to evaluate if the frontier model poses an unreasonable risk of critical harm; (d) Describe in detail how the testing procedure assesses whether the frontier model could be misused, be modified, be executed with increased computational resources, evade the control of its large developer or user, be combined with other software or be used to create another frontier model in a manner that would increase the risk of critical harm; (e) State compliance requirements with sufficient detail and specificity to allow the large developer or a third party to readily ascertain whether the requirements of the safety and security protocol have been followed; (f) Describe how the large developer will fulfill their obligations under this article, including with respect to any requirements, safeguards, or modifications; and (g) Designate senior personnel to be responsible for ensuring compliance.Gen. Bus. Law § 1420(12). If any modifications are made, the large developerLarge developer"Large developer" means a person that has trained at least one frontier model, the compute cost of which exceeds five million dollars, and has spent over one hundred million dollars in compute costs in aggregate in training frontier models. Accredited colleges and universities shall not be considered large developers under this article to the extent that such colleges and universities are engaging in academic research. If a person subsequently transfers full intellectual property rights of the frontier model to another person (including the right to resell the model) and retains none of those rights for themself, then the receiving person shall be considered the large developer and shall be subject to the responsibilities and requirements of this article after such transfer.Gen. Bus. Law § 1420(9) shall publish the safety and security protocolSafety and security protocol"Safety and security protocol" means documented technical and organizational protocols that: (a) Specify reasonable protections and procedures that, if successfully implemented would appropriately reduce the risk of critical harm; (b) Describe reasonable administrative, technical, and physical cybersecurity protections for frontier models within the large developer's control that, if successfully implemented, appropriately reduce the risk of unauthorized access to, or misuse of, the frontier models leading to critical harm, including by sophisticated actors; (c) Describe in detail the testing procedure to evaluate if the frontier model poses an unreasonable risk of critical harm; (d) Describe in detail how the testing procedure assesses whether the frontier model could be misused, be modified, be executed with increased computational resources, evade the control of its large developer or user, be combined with other software or be used to create another frontier model in a manner that would increase the risk of critical harm; (e) State compliance requirements with sufficient detail and specificity to allow the large developer or a third party to readily ascertain whether the requirements of the safety and security protocol have been followed; (f) Describe how the large developer will fulfill their obligations under this article, including with respect to any requirements, safeguards, or modifications; and (g) Designate senior personnel to be responsible for ensuring compliance.Gen. Bus. Law § 1420(12) in the same manner as required pursuant to paragraph (c) of subdivision one of this section.

4(a)–(e) 4 Beginning on the effective date of this article, or ninety days after a developer first qualifies as a large developerLarge developer"Large developer" means a person that has trained at least one frontier model, the compute cost of which exceeds five million dollars, and has spent over one hundred million dollars in compute costs in aggregate in training frontier models. Accredited colleges and universities shall not be considered large developers under this article to the extent that such colleges and universities are engaging in academic research. If a person subsequently transfers full intellectual property rights of the frontier model to another person (including the right to resell the model) and retains none of those rights for themself, then the receiving person shall be considered the large developer and shall be subject to the responsibilities and requirements of this article after such transfer.Gen. Bus. Law § 1420(9), whichever is later, a large developerLarge developer"Large developer" means a person that has trained at least one frontier model, the compute cost of which exceeds five million dollars, and has spent over one hundred million dollars in compute costs in aggregate in training frontier models. Accredited colleges and universities shall not be considered large developers under this article to the extent that such colleges and universities are engaging in academic research. If a person subsequently transfers full intellectual property rights of the frontier model to another person (including the right to resell the model) and retains none of those rights for themself, then the receiving person shall be considered the large developer and shall be subject to the responsibilities and requirements of this article after such transfer.Gen. Bus. Law § 1420(9) shall annually retain a third party to perform an independent audit of compliance with the requirements of this section. Such third party shall conduct audits consistent with best practices. (b) The third party shall be granted access to unredacted materials as necessary to comply with the third party's obligations under this subdivision. (c) The third party shall produce a report including all of the following: (i) A detailed assessment of the large developerLarge developer"Large developer" means a person that has trained at least one frontier model, the compute cost of which exceeds five million dollars, and has spent over one hundred million dollars in compute costs in aggregate in training frontier models. Accredited colleges and universities shall not be considered large developers under this article to the extent that such colleges and universities are engaging in academic research. If a person subsequently transfers full intellectual property rights of the frontier model to another person (including the right to resell the model) and retains none of those rights for themself, then the receiving person shall be considered the large developer and shall be subject to the responsibilities and requirements of this article after such transfer.Gen. Bus. Law § 1420(9)'s steps to comply with the requirements of this section; (ii) If applicable, any identified instances of noncompliance with the requirements of this section, and any recommendations for how the developer can improve its policies and processes for ensuring compliance with the requirements of this section; (iii) A detailed assessment of the large developerLarge developer"Large developer" means a person that has trained at least one frontier model, the compute cost of which exceeds five million dollars, and has spent over one hundred million dollars in compute costs in aggregate in training frontier models. Accredited colleges and universities shall not be considered large developers under this article to the extent that such colleges and universities are engaging in academic research. If a person subsequently transfers full intellectual property rights of the frontier model to another person (including the right to resell the model) and retains none of those rights for themself, then the receiving person shall be considered the large developer and shall be subject to the responsibilities and requirements of this article after such transfer.Gen. Bus. Law § 1420(9)'s internal controls, including its designation and empowerment of senior personnel responsible for ensuring compliance by the large developerLarge developer"Large developer" means a person that has trained at least one frontier model, the compute cost of which exceeds five million dollars, and has spent over one hundred million dollars in compute costs in aggregate in training frontier models. Accredited colleges and universities shall not be considered large developers under this article to the extent that such colleges and universities are engaging in academic research. If a person subsequently transfers full intellectual property rights of the frontier model to another person (including the right to resell the model) and retains none of those rights for themself, then the receiving person shall be considered the large developer and shall be subject to the responsibilities and requirements of this article after such transfer.Gen. Bus. Law § 1420(9), its employeesEmployee"Employee" has the same meaning as defined in subdivision five of section two of the labor law and includes both of the following: (i) Contractors or subcontractors and unpaid advisors involved with assessing, managing, or addressing the risk of critical harm from frontier models; and (ii) Corporate officers.Gen. Bus. Law § 1422(5)(a), and its contractors; and (iv) The signature of the lead auditor certifying the results of the audit. (d) The large developerLarge developer"Large developer" means a person that has trained at least one frontier model, the compute cost of which exceeds five million dollars, and has spent over one hundred million dollars in compute costs in aggregate in training frontier models. Accredited colleges and universities shall not be considered large developers under this article to the extent that such colleges and universities are engaging in academic research. If a person subsequently transfers full intellectual property rights of the frontier model to another person (including the right to resell the model) and retains none of those rights for themself, then the receiving person shall be considered the large developer and shall be subject to the responsibilities and requirements of this article after such transfer.Gen. Bus. Law § 1420(9) shall retain an unredacted copy of the report for as long as a frontier modelFrontier model"Frontier model" means either of the following: (a) an artificial intelligence model trained using greater than 10^26 computational operations (e.g., integer or floating-point operations), the compute cost of which exceeds one hundred million dollars; or (b) an artificial intelligence model produced by applying knowledge distillation to a frontier model as defined in paragraph (a) of this subdivision.Gen. Bus. Law § 1420(6) is deployed plus five years. (e) (i) The large developerLarge developer"Large developer" means a person that has trained at least one frontier model, the compute cost of which exceeds five million dollars, and has spent over one hundred million dollars in compute costs in aggregate in training frontier models. Accredited colleges and universities shall not be considered large developers under this article to the extent that such colleges and universities are engaging in academic research. If a person subsequently transfers full intellectual property rights of the frontier model to another person (including the right to resell the model) and retains none of those rights for themself, then the receiving person shall be considered the large developer and shall be subject to the responsibilities and requirements of this article after such transfer.Gen. Bus. Law § 1420(9) shall conspicuously publish a copy of the third party's report with appropriate redactionsAppropriate redactions"Appropriate redactions" means redactions to a safety and security protocol or audit report that a developer may make when necessary to: (a) protect public safety to the extent the developer can reasonably predict such risks; (b) protect trade secrets; (c) prevent the release of confidential information as required by state or federal law; (d) protect employee or customer privacy; or (e) prevent the release of information otherwise controlled by state or federal law.Gen. Bus. Law § 1420(1) and transmit a copy of such redacted report to the division of homeland security and emergency services. (ii) The large developerLarge developer"Large developer" means a person that has trained at least one frontier model, the compute cost of which exceeds five million dollars, and has spent over one hundred million dollars in compute costs in aggregate in training frontier models. Accredited colleges and universities shall not be considered large developers under this article to the extent that such colleges and universities are engaging in academic research. If a person subsequently transfers full intellectual property rights of the frontier model to another person (including the right to resell the model) and retains none of those rights for themself, then the receiving person shall be considered the large developer and shall be subject to the responsibilities and requirements of this article after such transfer.Gen. Bus. Law § 1420(9) shall grant the division of homeland security and emergency services or the attorney general access to the third party's report, with redactions only to the extent required by federal law, upon request.

5 5 A large developerLarge developer"Large developer" means a person that has trained at least one frontier model, the compute cost of which exceeds five million dollars, and has spent over one hundred million dollars in compute costs in aggregate in training frontier models. Accredited colleges and universities shall not be considered large developers under this article to the extent that such colleges and universities are engaging in academic research. If a person subsequently transfers full intellectual property rights of the frontier model to another person (including the right to resell the model) and retains none of those rights for themself, then the receiving person shall be considered the large developer and shall be subject to the responsibilities and requirements of this article after such transfer.Gen. Bus. Law § 1420(9) shall disclose each safety incidentSafety incident"Safety incident" means an incident of the following kinds that occurs in such a way that it provides demonstrable evidence of an increased risk of critical harm: (a) A frontier model autonomously engaging in behavior other than at the request of a user; (b) Theft, misappropriation, malicious use, inadvertent release, unauthorized access, or escape of the model weights of a frontier model; (c) The critical failure of any technical or administrative controls, including controls limiting the ability to modify a frontier model; or (d) Unauthorized use of a frontier model.Gen. Bus. Law § 1420(13) affecting the frontier modelFrontier model"Frontier model" means either of the following: (a) an artificial intelligence model trained using greater than 10^26 computational operations (e.g., integer or floating-point operations), the compute cost of which exceeds one hundred million dollars; or (b) an artificial intelligence model produced by applying knowledge distillation to a frontier model as defined in paragraph (a) of this subdivision.Gen. Bus. Law § 1420(6) to the division of homeland security and emergency services within seventy-two hours of the large developerLarge developer"Large developer" means a person that has trained at least one frontier model, the compute cost of which exceeds five million dollars, and has spent over one hundred million dollars in compute costs in aggregate in training frontier models. Accredited colleges and universities shall not be considered large developers under this article to the extent that such colleges and universities are engaging in academic research. If a person subsequently transfers full intellectual property rights of the frontier model to another person (including the right to resell the model) and retains none of those rights for themself, then the receiving person shall be considered the large developer and shall be subject to the responsibilities and requirements of this article after such transfer.Gen. Bus. Law § 1420(9) learning of the safety incidentSafety incident"Safety incident" means an incident of the following kinds that occurs in such a way that it provides demonstrable evidence of an increased risk of critical harm: (a) A frontier model autonomously engaging in behavior other than at the request of a user; (b) Theft, misappropriation, malicious use, inadvertent release, unauthorized access, or escape of the model weights of a frontier model; (c) The critical failure of any technical or administrative controls, including controls limiting the ability to modify a frontier model; or (d) Unauthorized use of a frontier model.Gen. Bus. Law § 1420(13) or within seventy-two hours of the large developerLarge developer"Large developer" means a person that has trained at least one frontier model, the compute cost of which exceeds five million dollars, and has spent over one hundred million dollars in compute costs in aggregate in training frontier models. Accredited colleges and universities shall not be considered large developers under this article to the extent that such colleges and universities are engaging in academic research. If a person subsequently transfers full intellectual property rights of the frontier model to another person (including the right to resell the model) and retains none of those rights for themself, then the receiving person shall be considered the large developer and shall be subject to the responsibilities and requirements of this article after such transfer.Gen. Bus. Law § 1420(9) learning facts sufficient to establish a reasonable belief that a safety incidentSafety incident"Safety incident" means an incident of the following kinds that occurs in such a way that it provides demonstrable evidence of an increased risk of critical harm: (a) A frontier model autonomously engaging in behavior other than at the request of a user; (b) Theft, misappropriation, malicious use, inadvertent release, unauthorized access, or escape of the model weights of a frontier model; (c) The critical failure of any technical or administrative controls, including controls limiting the ability to modify a frontier model; or (d) Unauthorized use of a frontier model.Gen. Bus. Law § 1420(13) has occurred. Such disclosure shall include: (a) the date of the safety incidentSafety incident"Safety incident" means an incident of the following kinds that occurs in such a way that it provides demonstrable evidence of an increased risk of critical harm: (a) A frontier model autonomously engaging in behavior other than at the request of a user; (b) Theft, misappropriation, malicious use, inadvertent release, unauthorized access, or escape of the model weights of a frontier model; (c) The critical failure of any technical or administrative controls, including controls limiting the ability to modify a frontier model; or (d) Unauthorized use of a frontier model.Gen. Bus. Law § 1420(13); (b) the reasons the incident qualifies as a safety incidentSafety incident"Safety incident" means an incident of the following kinds that occurs in such a way that it provides demonstrable evidence of an increased risk of critical harm: (a) A frontier model autonomously engaging in behavior other than at the request of a user; (b) Theft, misappropriation, malicious use, inadvertent release, unauthorized access, or escape of the model weights of a frontier model; (c) The critical failure of any technical or administrative controls, including controls limiting the ability to modify a frontier model; or (d) Unauthorized use of a frontier model.Gen. Bus. Law § 1420(13) as defined in subdivision thirteen of section fourteen hundred twenty of this article; and (c) a short and plain statement describing the safety incidentSafety incident"Safety incident" means an incident of the following kinds that occurs in such a way that it provides demonstrable evidence of an increased risk of critical harm: (a) A frontier model autonomously engaging in behavior other than at the request of a user; (b) Theft, misappropriation, malicious use, inadvertent release, unauthorized access, or escape of the model weights of a frontier model; (c) The critical failure of any technical or administrative controls, including controls limiting the ability to modify a frontier model; or (d) Unauthorized use of a frontier model.Gen. Bus. Law § 1420(13).

6 6 A large developerLarge developer"Large developer" means a person that has trained at least one frontier model, the compute cost of which exceeds five million dollars, and has spent over one hundred million dollars in compute costs in aggregate in training frontier models. Accredited colleges and universities shall not be considered large developers under this article to the extent that such colleges and universities are engaging in academic research. If a person subsequently transfers full intellectual property rights of the frontier model to another person (including the right to resell the model) and retains none of those rights for themself, then the receiving person shall be considered the large developer and shall be subject to the responsibilities and requirements of this article after such transfer.Gen. Bus. Law § 1420(9) shall not knowingly make false or materially misleading statements or omissions in or regarding documents produced pursuant to this section.

7(a)–(b) 7 Any personPerson"Person" means an individual, proprietorship, firm, partnership, joint venture, syndicate, business trust, company, corporation, limited liability company, association, committee, or any other nongovernmental organization or group of persons acting in concert.Gen. Bus. Law § 1420(11) who is not a large developerLarge developer"Large developer" means a person that has trained at least one frontier model, the compute cost of which exceeds five million dollars, and has spent over one hundred million dollars in compute costs in aggregate in training frontier models. Accredited colleges and universities shall not be considered large developers under this article to the extent that such colleges and universities are engaging in academic research. If a person subsequently transfers full intellectual property rights of the frontier model to another person (including the right to resell the model) and retains none of those rights for themself, then the receiving person shall be considered the large developer and shall be subject to the responsibilities and requirements of this article after such transfer.Gen. Bus. Law § 1420(9), but who sets out to train a frontier modelFrontier model"Frontier model" means either of the following: (a) an artificial intelligence model trained using greater than 10^26 computational operations (e.g., integer or floating-point operations), the compute cost of which exceeds one hundred million dollars; or (b) an artificial intelligence model produced by applying knowledge distillation to a frontier model as defined in paragraph (a) of this subdivision.Gen. Bus. Law § 1420(6) that if completed as planned would qualify such personPerson"Person" means an individual, proprietorship, firm, partnership, joint venture, syndicate, business trust, company, corporation, limited liability company, association, committee, or any other nongovernmental organization or group of persons acting in concert.Gen. Bus. Law § 1420(11) as a large developerLarge developer"Large developer" means a person that has trained at least one frontier model, the compute cost of which exceeds five million dollars, and has spent over one hundred million dollars in compute costs in aggregate in training frontier models. Accredited colleges and universities shall not be considered large developers under this article to the extent that such colleges and universities are engaging in academic research. If a person subsequently transfers full intellectual property rights of the frontier model to another person (including the right to resell the model) and retains none of those rights for themself, then the receiving person shall be considered the large developer and shall be subject to the responsibilities and requirements of this article after such transfer.Gen. Bus. Law § 1420(9) (i.e. at the end of the training, such personPerson"Person" means an individual, proprietorship, firm, partnership, joint venture, syndicate, business trust, company, corporation, limited liability company, association, committee, or any other nongovernmental organization or group of persons acting in concert.Gen. Bus. Law § 1420(11) will have spent five million dollars in compute costsCompute cost"Compute cost" means the cost incurred to pay for compute used in training a model when calculated using the average published market prices of cloud compute in the United States at the start of training such model as reasonably assessed by the person doing the training.Gen. Bus. Law § 1420(4) on one frontier modelFrontier model"Frontier model" means either of the following: (a) an artificial intelligence model trained using greater than 10^26 computational operations (e.g., integer or floating-point operations), the compute cost of which exceeds one hundred million dollars; or (b) an artificial intelligence model produced by applying knowledge distillation to a frontier model as defined in paragraph (a) of this subdivision.Gen. Bus. Law § 1420(6) and one hundred million dollars in compute costsCompute cost"Compute cost" means the cost incurred to pay for compute used in training a model when calculated using the average published market prices of cloud compute in the United States at the start of training such model as reasonably assessed by the person doing the training.Gen. Bus. Law § 1420(4) in aggregate in training frontier modelsFrontier model"Frontier model" means either of the following: (a) an artificial intelligence model trained using greater than 10^26 computational operations (e.g., integer or floating-point operations), the compute cost of which exceeds one hundred million dollars; or (b) an artificial intelligence model produced by applying knowledge distillation to a frontier model as defined in paragraph (a) of this subdivision.Gen. Bus. Law § 1420(6), excluding accredited colleges and universities to the extent such colleges and universities are engaging in academic research) shall, before training such model: (a) Implement a written safety and security protocolSafety and security protocol"Safety and security protocol" means documented technical and organizational protocols that: (a) Specify reasonable protections and procedures that, if successfully implemented would appropriately reduce the risk of critical harm; (b) Describe reasonable administrative, technical, and physical cybersecurity protections for frontier models within the large developer's control that, if successfully implemented, appropriately reduce the risk of unauthorized access to, or misuse of, the frontier models leading to critical harm, including by sophisticated actors; (c) Describe in detail the testing procedure to evaluate if the frontier model poses an unreasonable risk of critical harm; (d) Describe in detail how the testing procedure assesses whether the frontier model could be misused, be modified, be executed with increased computational resources, evade the control of its large developer or user, be combined with other software or be used to create another frontier model in a manner that would increase the risk of critical harm; (e) State compliance requirements with sufficient detail and specificity to allow the large developer or a third party to readily ascertain whether the requirements of the safety and security protocol have been followed; (f) Describe how the large developer will fulfill their obligations under this article, including with respect to any requirements, safeguards, or modifications; and (g) Designate senior personnel to be responsible for ensuring compliance.Gen. Bus. Law § 1420(12), excluding the requirements described in paragraphs (c) and (d) of subdivision twelve of section fourteen hundred twenty of this article; and (b) Transmit a copy of an appropriately redacted safety and security protocolSafety and security protocol"Safety and security protocol" means documented technical and organizational protocols that: (a) Specify reasonable protections and procedures that, if successfully implemented would appropriately reduce the risk of critical harm; (b) Describe reasonable administrative, technical, and physical cybersecurity protections for frontier models within the large developer's control that, if successfully implemented, appropriately reduce the risk of unauthorized access to, or misuse of, the frontier models leading to critical harm, including by sophisticated actors; (c) Describe in detail the testing procedure to evaluate if the frontier model poses an unreasonable risk of critical harm; (d) Describe in detail how the testing procedure assesses whether the frontier model could be misused, be modified, be executed with increased computational resources, evade the control of its large developer or user, be combined with other software or be used to create another frontier model in a manner that would increase the risk of critical harm; (e) State compliance requirements with sufficient detail and specificity to allow the large developer or a third party to readily ascertain whether the requirements of the safety and security protocol have been followed; (f) Describe how the large developer will fulfill their obligations under this article, including with respect to any requirements, safeguards, or modifications; and (g) Designate senior personnel to be responsible for ensuring compliance.Gen. Bus. Law § 1420(12) to the division of homeland security and emergency services.

1 8 A large developerLarge developer"Large developer" means a person that has trained at least one frontier model, the compute cost of which exceeds five million dollars, and has spent over one hundred million dollars in compute costs in aggregate in training frontier models. Accredited colleges and universities shall not be considered large developers under this article to the extent that such colleges and universities are engaging in academic research. If a person subsequently transfers full intellectual property rights of the frontier model to another person (including the right to resell the model) and retains none of those rights for themself, then the receiving person shall be considered the large developer and shall be subject to the responsibilities and requirements of this article after such transfer.Gen. Bus. Law § 1420(9) or a contractor or subcontractor of a large developerLarge developer"Large developer" means a person that has trained at least one frontier model, the compute cost of which exceeds five million dollars, and has spent over one hundred million dollars in compute costs in aggregate in training frontier models. Accredited colleges and universities shall not be considered large developers under this article to the extent that such colleges and universities are engaging in academic research. If a person subsequently transfers full intellectual property rights of the frontier model to another person (including the right to resell the model) and retains none of those rights for themself, then the receiving person shall be considered the large developer and shall be subject to the responsibilities and requirements of this article after such transfer.Gen. Bus. Law § 1420(9) shall not prevent an employeeEmployee"Employee" has the same meaning as defined in subdivision five of section two of the labor law and includes both of the following: (i) Contractors or subcontractors and unpaid advisors involved with assessing, managing, or addressing the risk of critical harm from frontier models; and (ii) Corporate officers.Gen. Bus. Law § 1422(5)(a) from disclosing, or threatening to disclose, or retaliate against an employeeEmployee"Employee" has the same meaning as defined in subdivision five of section two of the labor law and includes both of the following: (i) Contractors or subcontractors and unpaid advisors involved with assessing, managing, or addressing the risk of critical harm from frontier models; and (ii) Corporate officers.Gen. Bus. Law § 1422(5)(a) for disclosing or threatening to disclose, information to the large developerLarge developer"Large developer" means a person that has trained at least one frontier model, the compute cost of which exceeds five million dollars, and has spent over one hundred million dollars in compute costs in aggregate in training frontier models. Accredited colleges and universities shall not be considered large developers under this article to the extent that such colleges and universities are engaging in academic research. If a person subsequently transfers full intellectual property rights of the frontier model to another person (including the right to resell the model) and retains none of those rights for themself, then the receiving person shall be considered the large developer and shall be subject to the responsibilities and requirements of this article after such transfer.Gen. Bus. Law § 1420(9) or the attorney general, if the employeeEmployee"Employee" has the same meaning as defined in subdivision five of section two of the labor law and includes both of the following: (i) Contractors or subcontractors and unpaid advisors involved with assessing, managing, or addressing the risk of critical harm from frontier models; and (ii) Corporate officers.Gen. Bus. Law § 1422(5)(a) has reasonable cause to believe that the large developerLarge developer"Large developer" means a person that has trained at least one frontier model, the compute cost of which exceeds five million dollars, and has spent over one hundred million dollars in compute costs in aggregate in training frontier models. Accredited colleges and universities shall not be considered large developers under this article to the extent that such colleges and universities are engaging in academic research. If a person subsequently transfers full intellectual property rights of the frontier model to another person (including the right to resell the model) and retains none of those rights for themself, then the receiving person shall be considered the large developer and shall be subject to the responsibilities and requirements of this article after such transfer.Gen. Bus. Law § 1420(9)'s activities pose an unreasonable or substantial risk of critical harmCritical harm"Critical harm" means the death or serious injury of one hundred or more people or at least one billion dollars of damages to rights in money or property caused or materially enabled by a large developer's creation, use, storage, or release of a frontier model, through either of the following: (a) The creation or use of a chemical, biological, radiological, or nuclear weapon; or (b) An artificial intelligence model engaging in conduct that does both of the following: (i) Acts with limited human intervention; and (ii) Would, if committed by a human, constitute a crime specified in the penal law that requires intent, recklessness, or gross negligence, or the solicitation or aiding and abetting of such a crime. A harm inflicted by an intervening human actor shall not be deemed to result from a developer's activities unless such activities made it substantially easier or more likely for the actor to inflict such harm.Gen. Bus. Law § 1420(7), regardless of the employer's compliance with applicable law.

2 8 An employeeEmployee"Employee" has the same meaning as defined in subdivision five of section two of the labor law and includes both of the following: (i) Contractors or subcontractors and unpaid advisors involved with assessing, managing, or addressing the risk of critical harm from frontier models; and (ii) Corporate officers.Gen. Bus. Law § 1422(5)(a) harmed by a violation of this section may petition a court for appropriate temporary or preliminary injunctive relief.

3 9 A large developerLarge developer"Large developer" means a person that has trained at least one frontier model, the compute cost of which exceeds five million dollars, and has spent over one hundred million dollars in compute costs in aggregate in training frontier models. Accredited colleges and universities shall not be considered large developers under this article to the extent that such colleges and universities are engaging in academic research. If a person subsequently transfers full intellectual property rights of the frontier model to another person (including the right to resell the model) and retains none of those rights for themself, then the receiving person shall be considered the large developer and shall be subject to the responsibilities and requirements of this article after such transfer.Gen. Bus. Law § 1420(9) shall inform employees of their protections, rights and obligations under this article within ninety days of the effective date of this article or of becoming a large developerLarge developer"Large developer" means a person that has trained at least one frontier model, the compute cost of which exceeds five million dollars, and has spent over one hundred million dollars in compute costs in aggregate in training frontier models. Accredited colleges and universities shall not be considered large developers under this article to the extent that such colleges and universities are engaging in academic research. If a person subsequently transfers full intellectual property rights of the frontier model to another person (including the right to resell the model) and retains none of those rights for themself, then the receiving person shall be considered the large developer and shall be subject to the responsibilities and requirements of this article after such transfer.Gen. Bus. Law § 1420(9), whichever is later, upon commencement of employment, and by posting a notice thereof. Such notice shall be posted conspicuously in easily accessible and well-lighted places customarily frequented by employeesEmployee"Employee" has the same meaning as defined in subdivision five of section two of the labor law and includes both of the following: (i) Contractors or subcontractors and unpaid advisors involved with assessing, managing, or addressing the risk of critical harm from frontier models; and (ii) Corporate officers.Gen. Bus. Law § 1422(5)(a).

4 Nothing in this section shall be deemed to diminish the rights, privileges, or remedies of any employeeEmployee"Employee" has the same meaning as defined in subdivision five of section two of the labor law and includes both of the following: (i) Contractors or subcontractors and unpaid advisors involved with assessing, managing, or addressing the risk of critical harm from frontier models; and (ii) Corporate officers.Gen. Bus. Law § 1422(5)(a) under any other law or regulation or under any collective bargaining agreement or employment contract.

5(a)–(b) As used in this section, the following terms shall have the following meanings: (a) "EmployeeEmployee"Employee" has the same meaning as defined in subdivision five of section two of the labor law and includes both of the following: (i) Contractors or subcontractors and unpaid advisors involved with assessing, managing, or addressing the risk of critical harm from frontier models; and (ii) Corporate officers.Gen. Bus. Law § 1422(5)(a)" has the same meaning as defined in subdivision five of section two of the labor law and includes both of the following: (i) Contractors or subcontractors and unpaid advisors involved with assessing, managing, or addressing the risk of critical harmCritical harm"Critical harm" means the death or serious injury of one hundred or more people or at least one billion dollars of damages to rights in money or property caused or materially enabled by a large developer's creation, use, storage, or release of a frontier model, through either of the following: (a) The creation or use of a chemical, biological, radiological, or nuclear weapon; or (b) An artificial intelligence model engaging in conduct that does both of the following: (i) Acts with limited human intervention; and (ii) Would, if committed by a human, constitute a crime specified in the penal law that requires intent, recklessness, or gross negligence, or the solicitation or aiding and abetting of such a crime. A harm inflicted by an intervening human actor shall not be deemed to result from a developer's activities unless such activities made it substantially easier or more likely for the actor to inflict such harm.Gen. Bus. Law § 1420(7) from frontier modelsFrontier model"Frontier model" means either of the following: (a) an artificial intelligence model trained using greater than 10^26 computational operations (e.g., integer or floating-point operations), the compute cost of which exceeds one hundred million dollars; or (b) an artificial intelligence model produced by applying knowledge distillation to a frontier model as defined in paragraph (a) of this subdivision.Gen. Bus. Law § 1420(6); and (ii) Corporate officers. (b) "Contractor or subcontractorContractor or subcontractor"Contractor or subcontractor" means any person, sole proprietor, partnership, firm, corporation, limited liability company, association or other legal entity who by oneself or through others offers to undertake, or holds oneself out as being able to undertake, or does undertake work assessing, managing, or addressing the risk of critical harm from frontier models on behalf of the large developer.Gen. Bus. Law § 1422(5)(b)" means any personPerson"Person" means an individual, proprietorship, firm, partnership, joint venture, syndicate, business trust, company, corporation, limited liability company, association, committee, or any other nongovernmental organization or group of persons acting in concert.Gen. Bus. Law § 1420(11), sole proprietor, partnership, firm, corporation, limited liability company, association or other legal entity who by oneself or through others offers to undertake, or holds oneself out as being able to undertake, or does undertake work assessing, managing, or addressing the risk of critical harmCritical harm"Critical harm" means the death or serious injury of one hundred or more people or at least one billion dollars of damages to rights in money or property caused or materially enabled by a large developer's creation, use, storage, or release of a frontier model, through either of the following: (a) The creation or use of a chemical, biological, radiological, or nuclear weapon; or (b) An artificial intelligence model engaging in conduct that does both of the following: (i) Acts with limited human intervention; and (ii) Would, if committed by a human, constitute a crime specified in the penal law that requires intent, recklessness, or gross negligence, or the solicitation or aiding and abetting of such a crime. A harm inflicted by an intervening human actor shall not be deemed to result from a developer's activities unless such activities made it substantially easier or more likely for the actor to inflict such harm.Gen. Bus. Law § 1420(7) from frontier modelsFrontier model"Frontier model" means either of the following: (a) an artificial intelligence model trained using greater than 10^26 computational operations (e.g., integer or floating-point operations), the compute cost of which exceeds one hundred million dollars; or (b) an artificial intelligence model produced by applying knowledge distillation to a frontier model as defined in paragraph (a) of this subdivision.Gen. Bus. Law § 1420(6) on behalf of the large developerLarge developer"Large developer" means a person that has trained at least one frontier model, the compute cost of which exceeds five million dollars, and has spent over one hundred million dollars in compute costs in aggregate in training frontier models. Accredited colleges and universities shall not be considered large developers under this article to the extent that such colleges and universities are engaging in academic research. If a person subsequently transfers full intellectual property rights of the frontier model to another person (including the right to resell the model) and retains none of those rights for themself, then the receiving person shall be considered the large developer and shall be subject to the responsibilities and requirements of this article after such transfer.Gen. Bus. Law § 1420(9).

1(a)–(c) The attorney general may bring a civil action for a violation of this article and to recover all of the following: (a) For a violation of section fourteen hundred twenty-one of this article, a civil penalty in an amount not exceeding ten million dollars for a first violation and in an amount not exceeding thirty million dollars for any subsequent violation. (b) For a violation of section fourteen hundred twenty-two of this article, a civil penalty in an amount not exceeding ten thousand dollars per employeeEmployee"Employee" has the same meaning as defined in subdivision five of section two of the labor law and includes both of the following: (i) Contractors or subcontractors and unpaid advisors involved with assessing, managing, or addressing the risk of critical harm from frontier models; and (ii) Corporate officers.Gen. Bus. Law § 1422(5)(a) for each violation of such section to be awarded to the employeeEmployee"Employee" has the same meaning as defined in subdivision five of section two of the labor law and includes both of the following: (i) Contractors or subcontractors and unpaid advisors involved with assessing, managing, or addressing the risk of critical harm from frontier models; and (ii) Corporate officers.Gen. Bus. Law § 1422(5)(a) who was retaliated against. (c) For a violation of section fourteen hundred twenty-one or fourteen hundred twenty-two of this article, injunctive or declaratory relief.

2(a)–(b) A provision within a contract or agreement that seeks to waive, preclude, or burden the enforcement of a liability arising from a violation of this article, or to shift that liability to any personPerson"Person" means an individual, proprietorship, firm, partnership, joint venture, syndicate, business trust, company, corporation, limited liability company, association, committee, or any other nongovernmental organization or group of persons acting in concert.Gen. Bus. Law § 1420(11) or entity in exchange for their use or access of, or right to use or access, a large developerLarge developer"Large developer" means a person that has trained at least one frontier model, the compute cost of which exceeds five million dollars, and has spent over one hundred million dollars in compute costs in aggregate in training frontier models. Accredited colleges and universities shall not be considered large developers under this article to the extent that such colleges and universities are engaging in academic research. If a person subsequently transfers full intellectual property rights of the frontier model to another person (including the right to resell the model) and retains none of those rights for themself, then the receiving person shall be considered the large developer and shall be subject to the responsibilities and requirements of this article after such transfer.Gen. Bus. Law § 1420(9)'s products or services, including by means of a contract of adhesion, is void as a matter of public policy. (b) A court shall disregard corporate formalities and impose joint and several liability on affiliated entities for purposes of effectuating the intent of this section to the maximum extent allowed by law if the court concludes that both of the following are true: (i) The affiliated entities, in the development of the corporate structure among the affiliated entities, took steps to purposely and unreasonably limit or avoid liability; and (ii) As the result of the steps described in subparagraph (i) of this paragraph, the corporate structure of the large developerLarge developer"Large developer" means a person that has trained at least one frontier model, the compute cost of which exceeds five million dollars, and has spent over one hundred million dollars in compute costs in aggregate in training frontier models. Accredited colleges and universities shall not be considered large developers under this article to the extent that such colleges and universities are engaging in academic research. If a person subsequently transfers full intellectual property rights of the frontier model to another person (including the right to resell the model) and retains none of those rights for themself, then the receiving person shall be considered the large developer and shall be subject to the responsibilities and requirements of this article after such transfer.Gen. Bus. Law § 1420(9) or affiliated entities would frustrate recovery of penalties, damages, or injunctive relief under this section.

3 The division of homeland security and emergency services shall make any critical safety incidentSafety incident"Safety incident" means an incident of the following kinds that occurs in such a way that it provides demonstrable evidence of an increased risk of critical harm: (a) A frontier model autonomously engaging in behavior other than at the request of a user; (b) Theft, misappropriation, malicious use, inadvertent release, unauthorized access, or escape of the model weights of a frontier model; (c) The critical failure of any technical or administrative controls, including controls limiting the ability to modify a frontier model; or (d) Unauthorized use of a frontier model.Gen. Bus. Law § 1420(13) disclosure available to the attorney general upon request.

4 This section does not limit the application of other laws.

The duties and obligations imposed by this article are cumulative with any other duties or obligations imposed under other law and shall not be construed to relieve any party from any duties or obligations imposed under other law and do not limit any rights or remedies under existing law.

This article shall only apply to frontier modelsFrontier model"Frontier model" means either of the following: (a) an artificial intelligence model trained using greater than 10^26 computational operations (e.g., integer or floating-point operations), the compute cost of which exceeds one hundred million dollars; or (b) an artificial intelligence model produced by applying knowledge distillation to a frontier model as defined in paragraph (a) of this subdivision.Gen. Bus. Law § 1420(6) that are developed, deployed, or operating in whole or in part in New York state.

If any clause, sentence, paragraph, subdivision, section or part of this article shall be adjudged by any court of competent jurisdiction to be invalid, such judgment shall not affect, impair, or invalidate the remainder thereof, but shall be confined in its operation to the clause, sentence, paragraph, subdivision, section, or part thereof directly involved in the controversy in which such judgment shall have been made.