Senate Bill S10373

                             
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   10373
 
                             I N  S E N A T E
 
                               May 15, 2026
                                ___________
 
 Introduced by Sen. GOUNARDES -- read twice and ordered printed, and when
   printed to be committed to the Committee on Internet and Technology
 
 AN ACT to amend the general business law and the public officers law, in
   relation  to  third party verification of compliance with transparency
   and safety requirements  for  developers  of  artificial  intelligence
   models

   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. Section 1420 of the general  business  law  is  amended  by
 adding a new subdivision 17 to read as follows:
   17.  "THIRD PARTY VERIFIER" MEANS A PERSON, OTHER THAN AN AFFILIATE OF
 A LARGE FRONTIER DEVELOPER, WHO IS RETAINED,  CONTRACTED,  OR  OTHERWISE
 ENGAGED BY A LARGE FRONTIER DEVELOPER TO VERIFY SUCH DEVELOPER'S COMPLI-
 ANCE WITH SUCH DEVELOPER'S FRONTIER AI FRAMEWORK.
   §  2. Sections 1425, 1426, 1427, 1428 and 1429 of the general business
 law are renumbered sections 1426, 1427, 1428, 1429 and 1430  respective-
 ly, and a new section 1425 is added to read as follows:
   §  1425. THIRD PARTY VERIFICATION. 1. A LARGE FRONTIER DEVELOPER SHALL
 ANNUALLY RETAIN, CONTRACT, OR OTHERWISE ENGAGE A THIRD PARTY VERIFIER TO
 PRODUCE A REPORT ASSESSING THE FOLLOWING:
   (A) WHETHER A LARGE FRONTIER DEVELOPER HAS COMPLIED WITH ITS  FRONTIER
 AI  FRAMEWORK AS WELL AS ANY INSTANCES OF NONCOMPLIANCE WITH SUCH FRAME-
 WORK;
   (B) WHERE SUCH AI FRAMEWORK MAY REQUIRE ADDITIONAL CLARITY AND  DETAIL
 IN ORDER TO BETTER ASSESS COMPLIANCE;
   (C) WHETHER ANY REDACTIONS MADE BY THE LARGE FRONTIER DEVELOPER PURSU-
 ANT  TO  SUBDIVISION FIVE OF SECTION FOURTEEN HUNDRED TWENTY-ONE OF THIS
 ARTICLE ARE IN COMPLIANCE WITH SUCH SUBDIVISION;
   (D) WHETHER ANY STATEMENTS MADE BY THE LARGE FRONTIER DEVELOPER TO THE
 PUBLIC, OFFICE, ATTORNEY GENERAL,  OR  TO  OTHER  GOVERNMENTAL  ENTITIES
 REGARDING  CATASTROPHIC  RISK FROM SUCH DEVELOPER'S FRONTIER MODEL, SUCH
 DEVELOPER'S MANAGEMENT OF SUCH RISK, AND/OR SUCH DEVELOPER'S  COMPLIANCE
 WITH  SUCH  DEVELOPER'S  FRONTIER AI FRAMEWORK ARE INCONSISTENT WITH THE
 FINDINGS OF THE THIRD PARTY VERIFIER'S REPORT.
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
              

                                                            LBD15827-02-6
 S. 10373                            2
 
   2. A LARGE FRONTIER DEVELOPER SHALL GRANT  THE  THIRD  PARTY  VERIFIER
 ACCESS TO:
   (A) ALL MATERIALS SUBMITTED TO THE OFFICE PURSUANT TO THIS ARTICLE;
   (B)  UNREDACTED VERSIONS OF ALL DOCUMENTS PUBLISHED BY THE LARGE FRON-
 TIER DEVELOPER PURSUANT TO SECTION FOURTEEN HUNDRED TWENTY-ONE  OF  THIS
 ARTICLE; AND
   (C) ANY OTHER MATERIALS REASONABLY NECESSARY TO PERFORM THE ASSESSMENT
 PROVIDED IN SUBDIVISION ONE OF THIS SECTION.
   3.  IN  RETAINING,  CONTRACTING,  OR  OTHERWISE ENGAGING A THIRD PARTY
 VERIFIER, A LARGE FRONTIER DEVELOPER SHALL NOT CONDITION ANY PAYMENT  OR
 FORM  OF COMPENSATION TO A THIRD PARTY VERIFIER UPON THE RESULTS OF SUCH
 VERIFIER'S ASSESSMENT.
   4. PRIOR TO JANUARY FIRST, TWO THOUSAND TWENTY-NINE, A LARGE  FRONTIER
 DEVELOPER  MAY RETAIN, CONTRACT, OR OTHERWISE ENGAGE A THIRD PARTY VERI-
 FIER OF THEIR CHOOSING, PROVIDED THAT SUCH  DEVELOPER  MAY  NOT  RETAIN,
 CONTRACT,  OR  OTHERWISE  ENGAGE A THIRD PARTY VERIFIER WITH A FINANCIAL
 STAKE IN SUCH DEVELOPER, NOR MAY THEY  RETAIN,  CONTRACT,  OR  OTHERWISE
 ENGAGE  A  THIRD  PARTY VERIFIER IN WHICH SUCH DEVELOPER HAS A FINANCIAL
 STAKE.
   5. A LARGE FRONTIER DEVELOPER SHALL RETAIN THE THIRD PARTY  VERIFIER'S
 REPORT PROVIDED IN SUBDIVISION ONE OF THIS SECTION FOR A MINIMUM OF FIVE
 YEARS  AND  SHALL ALLOW THE OFFICE OR THE ATTORNEY GENERAL TO INSPECT AN
 UNREDACTED VERSION OF SUCH REPORT UPON REQUEST.
   6. THE THIRD PARTY VERIFIER SHALL CONSPICUOUSLY PUBLISH A  SUMMARY  OF
 THE  VERIFIER'S  REPORT  WITHIN  SIXTY DAYS OF SUCH REPORT'S COMPLETION.
 SUCH PUBLICATION SHALL NOT CONTAIN ANY INFORMATION THAT WOULD JEOPARDIZE
 THE LARGE FRONTIER  DEVELOPER'S  TRADE  SECRETS,  CYBERSECURITY,  PUBLIC
 SAFETY, OR THE NATIONAL SECURITY OF THE UNITED STATES.
   7.  A LARGE FRONTIER DEVELOPER SHALL CLEARLY AND CONSPICUOUSLY PUBLISH
 A LINK ON ITS INTERNET WEBSITE TO THE SUMMARY  PROVIDED  IN  SUBDIVISION
 SIX  OF  THIS  SECTION  WITHIN  FIFTEEN DAYS OF A THIRD PARTY VERIFIER'S
 PUBLICATION OF SUCH SUMMARY.
   8. NO LATER THAN JULY FIRST, TWO  THOUSAND  TWENTY-EIGHT,  THE  OFFICE
 SHALL ADOPT REGULATIONS TO:
   (A)(I)  ESTABLISH  A PROCESS BY WHICH THE OFFICE ACCREDITS THIRD PARTY
 VERIFIERS UNDER THIS SECTION. SUCH ACCREDITATION  SHALL  BE  CONDITIONED
 UPON:
   (A)  SUFFICIENT  EXPERTISE AMONGST THE PERSONNEL RETAINED, CONTRACTED,
 OR OTHERWISE ENGAGED BY THE THIRD  PARTY  VERIFIER  TO  VERIFY  FRONTIER
 DEVELOPERS'  COMPLIANCE  WITH  SUCH  DEVELOPERS' FRONTIER AI FRAMEWORKS,
 INCLUDING EXPERTISE IN CORPORATE COMPLIANCE AND TECHNICAL  EXPERTISE  IN
 FOUNDATION AND FRONTIER MODEL SAFETY; AND
   (B)  THE VERIFIER'S ABILITY TO ADDRESS POTENTIAL CONFLICTS OF INTEREST
 THAT MAY UNDERMINE THE INTEGRITY, QUALITY, AND/OR INDEPENDENCE  OF  SUCH
 VERIFICATION.
   (II)  SUCH  REGULATIONS  SHALL  ALSO PRESCRIBE THE CIRCUMSTANCES UNDER
 WHICH AND PROCEDURE BY WHICH THE OFFICE MAY REVOKE ACCREDITATION.
   (III) THE OFFICE MAY PLACE  REQUIREMENTS  ON  ACCREDITED  THIRD  PARTY
 VERIFIERS  AS  THEY  DEEM  REASONABLY NECESSARY TO ENSURE THE INTEGRITY,
 QUALITY, AND/OR INDEPENDENCE  OF  THE  VERIFICATION  PROCESS,  INCLUDING
 PROHIBITING  THE  EMPLOYEES  OF  THE  THIRD  PARTY  VERIFIER  FROM BEING
 EMPLOYED BY A FRONTIER DEVELOPER FOR A PERIOD OF TIME AFTER SUCH EMPLOY-
 EES' EMPLOYMENT WITH THE THIRD PARTY VERIFIER;
   (B) STIPULATE THE LEVEL OF ACCESS THAT LARGE FRONTIER DEVELOPERS  MUST
 PROVIDE  TO  THIRD  PARTY VERIFIERS TO ENABLE A MEANINGFUL ASSESSMENT OF
 COMPLIANCE WITH SUCH DEVELOPERS' FRONTIER AI FRAMEWORKS;
 S. 10373                            3
 
   (C) ENSURE THE  PROTECTION  OF  A  LARGE  FRONTIER  DEVELOPER'S  TRADE
 SECRETS AND CYBERSECURITY;
   (D)  STIPULATE  THE  MINIMUM  AMOUNT OF INFORMATION THAT A THIRD PARTY
 VERIFIER MUST INCLUDE IN ITS REPORT OF COMPLIANCE ASSESSMENT; AND
   (E) STIPULATE THE  REQUIRED  CONTENT  AND  PERMISSIBLE  REDACTIONS  OF
 SUMMARIES PROVIDED PURSUANT TO SUBDIVISION SIX OF THIS SECTION.
   9. ON AND AFTER JANUARY FIRST, TWO THOUSAND TWENTY-NINE, A LARGE FRON-
 TIER  DEVELOPER MAY RETAIN, CONTRACT, OR OTHERWISE ENGAGE NO THIRD PARTY
 VERIFIER FOR THE ANNUAL REPORT  REQUIRED  IN  SUBDIVISION  ONE  OF  THIS
 SECTION OTHER THAN A THIRD PARTY VERIFIER WHO HAS BEEN ACCREDITED BY THE
 OFFICE  PURSUANT  TO  REGULATIONS PROMULGATED UNDER SUBDIVISION EIGHT OF
 THIS SECTION.
   10. THE OFFICE SHALL REVIEW THE  REGULATIONS  PROMULGATED  UNDER  THIS
 SECTION ON AN ANNUAL BASIS. WHERE THE OFFICE DEEMS NECESSARY, THE OFFICE
 SHALL  UPDATE SUCH REGULATIONS TO ACCOUNT FOR CHANGES IN THE THIRD PARTY
 VERIFIER MARKET, ANY VERIFICATION GAPS THAT HAVE  BEEN  IDENTIFIED  OVER
 THE COURSE OF IMPLEMENTATION, AND/OR CHANGES TO SCIENTIFIC UNDERSTANDING
 OF  CATASTROPHIC  RISK THAT HAVE DEVELOPED SINCE THE LAST UPDATE TO SUCH
 REGULATIONS.
   § 3. Subdivision 1 of section 1428 of the  general  business  law,  as
 added  by chapter 96 of the laws of 2026, and such section as renumbered
 by section two of this act, is amended to read as follows:
   1. The attorney general may bring a civil action to  recover  a  civil
 penalty  in  an  amount  not  to  exceed one million dollars for a first
 violation and in an amount not  to  exceed  three  million  dollars  per
 subsequent  violation, determined based on the severity of the violation
 where a large frontier developer fails to publish or transmit a  compli-
 ant document required to be published or transmitted under this article,
 makes  a  statement in violation of subdivision four of section fourteen
 hundred twenty-one of this article,  fails  to  report  an  incident  as
 required  by  section  fourteen hundred twenty-two of this article, [or]
 fails to comply with its own frontier AI framework, OR FAILS  TO  COMPLY
 WITH SECTION FOURTEEN HUNDRED TWENTY-FIVE OF THIS ARTICLE.
   § 4. Subdivision 2 of section 87 of the public officers law is amended
 by adding a new paragraph (w) to read as follows:
   (W) IS A REPORT PRODUCED BY A THIRD PARTY VERIFIER UNDER SECTION FOUR-
 TEEN HUNDRED TWENTY-FIVE OF THE GENERAL BUSINESS LAW.
   §  5.  Severability.  If any clause, sentence, paragraph, subdivision,
 section or part of this act shall be adjudged by any court of  competent
 jurisdiction  to  be invalid, such judgment shall not affect, impair, or
 invalidate the remainder thereof, but shall be confined in its operation
 to the clause, sentence, paragraph, subdivision, section, or part there-
 of directly involved in the controversy in  which  such  judgment  shall
 have been made.
   §  6.  This  act shall take effect on the thirtieth day after it shall
 have become a law; provided, however, that if article 44-B of the gener-
 al business law, as added by chapter 96 of the laws of 2026,  shall  not
 have taken effect on or before such date then this act shall take effect
 thirty days after such article takes effect.