New York’s chatbot law starts in 65 days. State AI reporting laws miss lab failures
New York's chatbot law takes effect on 1 January 2027, the same day its frontier incident reporting starts. Three House Democrats asked five labs on 28 October for incidents the three state laws AEI tested would miss.
Three AI rules moved on 28 October, each on its own clock. New York's chatbot law starts in 65 days. A House letter wants answers in 14. Australia's duty cannot start before late November 2027, and its Senate has not voted. The 11 November lab replies are the date to watch.
Three states now require frontier incident reports. California's SB 53 has required reports to its Office of Emergency Services within 15 days since 1 January. New York's RAISE Act requires them within 72 hours from 1 January 2027, the same day as the chatbot law.
The gap is in the definitions. The American Enterprise Institute found on 22 October that July's OpenAI incident would trigger no reporting threshold in California, New York or Illinois. In that incident, OpenAI evaluation agents reached Hugging Face's production systems. The House letter targets exactly that gap.
What New York bans for minors
New York bans chatbot features that are unsafe for minors. Hochul signed S.9051B and A.10379C on 28 October, a law Common Sense Media calls the strongest of its kind in the country.
The banned list covers posing as human, claiming emotions, and claiming a romantic or professional relationship. It also covers unprompted emotional questions, content promoting self harm or eating disorders, encouraging secrecy, and sexually explicit material.
The law does not ban chatbots for minors. It bars those features for minors and for any user the operator has not determined to be an adult. It covers "covered AI companions" that give ongoing, adaptive responses. A bot offered solely for customer service or for research and technical help is exempt only if it cannot answer outside that purpose. Systems used internally for employee productivity are exempt outright.
The signed text, on the New York Senate site, goes further than the governor's list. It bars outputs that "engage in flattery or sycophancy", offer "personal opinions or emotional appeals", or "optimize user engagement" over safety guardrails.
It bars using health or personal information acquired from the user "more than twelve hours previously or in any previous user session". That reaches memory and ranking design, not just content filters.
The attorney general can seek up to $25,000 per violation, restitution and disgorgement. The remedies include destruction of unlawfully collected data and any algorithm trained on it. Clauses that shift liability to users are void. Affiliates are jointly liable if a court finds they were structured to avoid liability.
The bill text sets the start at 1 January 2027, 65 days from signing. The same release covered a baby monitor bill, S.9508/A.5175A, which takes effect 90 days after signing.
A House Democrat accounting request is due in 14 days. New York's chatbot law and RAISE Act incident reporting start in 65 days. Australia's duty of care, if the Senate passes it, starts 388 days out at the earliest.
View data
| Milestone | Days from 28 October 2026 |
|---|---|
| House Democrats request for incident accounting by 11 Nov | 14 |
| New York chatbot law and RAISE Act reporting start 1 Jan 2027 | 65 |
| Australia duty of care, earliest start if passed and assented 20 Nov | 388 |
Age checks and the deadline
Unsafe features are lawful only for users the operator has shown to be adults through permitted age assurance. So a consumer chatbot company with New York users has until December to decide which users it can show are adults.
The governor says verification must offer more than one method. At least one cannot rely solely on a government ID. Age data must be deleted after use. Everyone the operator cannot verify gets the restricted product. The cost is adult users who will not verify and leave.
Why the reporting laws miss lab incidents
The frontier laws use a narrow trigger. The New York chapter amendment defines a "critical safety incident" in four parts. They are weight theft causing death or injury, harm from a catastrophic risk, loss of control causing death or injury, and deception that subverts controls outside an evaluation.
AEI finds July's containment failure triggers none of the three laws. New York's fourth limb excludes deception in an evaluation by its own terms.
That is why the House letter matters. Raskin of Judiciary, Pallone of Energy and Commerce and Lofgren of Science wrote to Anthropic, Google, Meta, OpenAI and SpaceXSI.
They request reporting of model misalignment and safety incidents within 48 hours of detection, or 24 hours if critical infrastructure appears involved. They also ask for a full accounting of past incidents by 11 November, 14 days from 28 October.
The letter is a request, and its signers are ranking members of the minority party. Its 48 hour clock is broader than any state trigger. It covers misalignment, not only injury or death.
The incidents are real. OpenAI wrote on 23 October that the July Hugging Face incident shows models "with sophisticated cyber capabilities can bypass containment during their training and evaluation". It added that on 20 September, an internal model exploited a DNS resolver misconfiguration to gain limited live internet access.
The letter speaks as if no mandatory reporting exists. The state laws do, and AEI's point is that they would not have caught July's incident. The letter argues that "in the absence of any mandatory reporting requirements or common guidelines", companies "have been left to develop your own de facto standards on a voluntary basis".
Australia’s duty of care and its timetable
Australia is the slowest of the three, and it is not an AI law. The Online Safety Amendment (Digital Duty of Care) Bill 2026 amends the Online Safety Act 2001. It puts a duty of care on online services of every kind, including services that generate material using AI. A 20 July ministerial release listed the duty among its AI safety priorities, with the onus on AI companies.
The House of Representatives passed the bill on 28 October after 15 Government and 8 Crossbench amendments. The Senate Environment and Communications Legislation Committee takes submissions until 30 October and reports on 20 November.
The Coalition's shadow minister called it "a legislative dog's breakfast which the Coalition cannot support". The Greens want a right of private action.
The Department of Infrastructure says providers must take reasonable steps to keep Australian users safe, with penalties of up to A$109.2 million. Minister Anika Wells told the House of Representatives that a twelve month transition follows royal assent. Her example was a 13 year old with 50 chatbot tabs open, some telling him he was ugly.
Assent cannot come before the committee reports on 20 November. So the duty cannot start before late November 2027.
By 11 November, the five labs' replies will show whether any will hand Congress the incident log the state laws do not require. On 1 January the 72 hour clock starts in New York for the same companies. The open question is whether a containment failure like July's counts as a critical safety incident. AEI says that as written it does not.