AI Safety Theater - What the RAISE Act Regulates - and What It Does Not

The talk examines New York's RAISE Act, signed in December 2025, which requires frontier AI developers to publish transparency information, keep safety plans, report incidents within 72 hours and undergo annual audits. The speaker approaches the law as a security target: mapping its scope, looking for ways around it, and asking whether the compliance burden matches the risk it removes.

The main gaps the speaker identifies are structural. The $500 million revenue floor can be managed through accounting choices and leaves out well-funded labs that have no revenue yet. The compute-based definition of a frontier model may miss smaller fine-tuned or distilled models that come from a larger one. The catastrophic-harm trigger of 100 deaths or a billion dollars means reporting only starts after severe damage. Because the law mainly requires disclosure rather than a halt, a compliant developer could keep running a system that causes serious harm below that level. The speaker also questions whether the state oversight office, which already audits banks, has the staff and training to take on the added work.

The closing argument is that other states are already drafting bills modeled on New York and California, so any flaws here could spread. The speaker urges security practitioners to engage with their legislators and comment on AI rules, treating policy work as part of their professional role.