Skip to content

Session Expired

Your session has expired. Please sign in again to continue where you left off.

Sign In Again

NY A06656: Requires certain companies which utilize artificial intelligence to file responsible capability scaling policies with the chief information officer.

In Committee New York · 2025–2026 session

Last verified Oct 29, 2026 · official bill text

A06656 · where it stands

1 of 5 steps complete
  1. Introduced In committee
  2. Passed first chamber
  3. Passed both chambers
  4. Enacted
  5. Effective
What do these statuses mean?
Introduced
Filed in the legislature; may be waiting for a committee hearing.
Passed a chamber
Approved by one or both chambers; awaiting further action.
Enacted
Signed into law, or became law without a signature or over a veto.
Effective date
The date the law says it takes effect. Once it has passed, the page shows "Effective" and the date. A court order can still block a law; if we know of one, the summary says so.
Dead / vetoed
Vetoed, failed, or the session ended without action.

In one paragraph

New York's A 6656 would add General Business Law § 390-f requiring every person or entity "doing business or offering products to consumers in New York State" to develop a responsible capability scaling policy for its use and development of AI and to file an annual certification of compliance with the chief information officer. The Attorney General could audit filed policies. Would take effect on the 90th day after it becomes law. Introduced March 6, 2025 and referred to the Consumer Affairs and Protection Committee (again January 7, 2026); it has not passed either chamber.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

None yet: the bill is pending. If enacted, businesses offering products to New York consumers would have to adopt an AI risk policy and certify compliance annually, and could be audited by the Attorney General.

Key provisions

  1. GBL § 390-f: covered entities must develop a "responsible capability scaling policy" ("a set of best practices that identify, monitor, and rectify or mitigate risk of harm") for their AI use and development
  2. Must file an annual certification of compliance with the chief information officer
  3. The chief information officer may issue waivers or designate covered or exempt categories, to be posted on the Secretary of State's website
  4. The Attorney General, in consultation with the chief information officer, may audit filed policies; entities also filing cybersecurity certifications with DFS are to file jointly
  5. The chief information officer must promulgate implementing rules; the text states no penalty or private right of action
  6. Would take effect on the 90th day after it becomes law; referred to Consumer Affairs and Protection, with no further action

Latest legislative action

Jan 7, 2026. referred to consumer affairs and protection

Sponsors

NameRoleDistrict
D Sponsor HD-038

Topics and industries

Affected industries

This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error