New York’s AI Safety Law Puts Banks’ Vendor Plans to the Test

New York is introducing an AI safety law that will require large model developers to register and comply with new regulations starting in November. The law, known as the RAISE Act, imposes requirements such as the implementation of public safety protocols, regular reporting, and the notification of critical incidents within 72 hours.

Banks and Financial Technology companies using these AI models will need to consider the practical implications of a critical incident occurring. When such an event happens, the AI provider is obligated to investigate, alter the model's behavior, or change access while the bank's customers continue to use the service. The law allows the attorney general to seek civil penalties for failures to submit required reports or make false statements, with penalties reaching up to $1 million for a first violation and $3 million for subsequent violations.

Financial institutions should ask vendors about the impact of a reportable incident on customers, services, and staff. The key concern is determining how quickly they would learn about the incident and which services might be affected. Institutions also need to understand whether staff can suspend the model's access to sensitive data or its authority to take an action while maintaining the rest of the workflow.

This information is crucial when AI is used for tasks beyond simple text generation. Some institutions might need to have a fallback plan in place, such as testing a different model or switching to a manual process. Although the RAISE Act does not currently require "kill switches," New York Governor Kathy Hochul has hinted at the possibility of such a measure in the future.

Banks can start by limiting or suspending AI tools within their own operations before a provider's incident forces them to do so.