What AI Companies Need To Know About NY AG’s Whistleblower Push

Overview

New York Attorney General Letitia James has issued an industry-wide alert encouraging workers with knowledge of unsafe or illegal conduct at artificial intelligence (AI) companies to file confidential whistleblower complaints through the Office of the Attorney General’s (OAG) secure portal. This development signals a significant escalation in regulatory scrutiny of the AI sector and should be carefully considered by any company developing or deploying AI technology that has a nexus to New York.

Key Takeaways

• The OAG is actively soliciting insider information about potential legal violations at AI companies/developers and has opened a secure, confidential whistleblower portal for this purpose.
• Attorney General James has cited cybersecurity, economic, and broader safety risks associated with emerging AI technology as the impetus for this action.
• Multiple legal frameworks are available to the OAG to pursue enforcement action, including statutes already in force and new legislation taking effect in 2027.
• AI companies and AI developers should expect increased investigative activity and should take proactive steps to assess their legal exposure now.

Applicable Legal Framework

The OAG has identified several legal bases under which it may pursue action against AI companies and AI developers:

1. New York RAISE Act (Effective January 1, 2027)

New York’s Responsible AI Safety and Education (RAISE) Act — drafted with direct support from the OAG — will require large AI developers to do the following:

• Publicly disclose their safety measures.
• Promptly report security and safety incidents.

The Attorney General will have express authority under the RAISE Act to bring legal action against noncompliant companies. Although the act does not take effect until January 1, 2027, companies should begin assessing their compliance posture immediately, as the lead time for implementing robust safety disclosure and incident reporting frameworks can be substantial.

2. New York SHIELD Act

The OAG already has enforcement authority under New York’s Stop Hacks and Improve Electronic Data Security (SHIELD) Act, which requires companies to maintain reasonable data security practices designed to prevent data breaches. AI companies that handle personal data of New York residents — which will encompass a broad range of businesses — must ensure that their data security programs are adequate and defensible.

3. Federal Computer Fraud and Abuse Act (CFAA)

The OAG has indicated it will pursue civil remedies under federal law, including the Computer Fraud and Abuse Act, to address hacking and other unauthorized access to computer systems. AI companies should be mindful that conduct related to training data acquisition, model access, or system security vulnerabilities may trigger exposure under the CFAA.

4. Broad OAG Civil Authority

Beyond the specific statutes identified above, the OAG retains broad civil enforcement authority to protect New Yorkers’ privacy and address violations of law more generally. This authority provides the OAG with significant flexibility to investigate and act on a wide range of conduct in the AI sector.

What This Means for AI Companies

The Attorney General’s alert has several immediate practical implications:

• Increased whistleblower activity is likely. The OAG’s public solicitation of complaints will encourage current and former employees, contractors, and others with insider knowledge to come forward. Companies should anticipate that internal concerns — whether well-founded or not — may find their way to the OAG.
• Internal investigations may be warranted. Companies should consider whether to proactively review their AI development practices, data security protocols, and incident reporting procedures to identify and remediate potential legal exposure before a complaint is filed.
• Document preservation obligations may be triggered. If a company reasonably anticipates OAG investigation or litigation, litigation hold obligations may arise. Companies should consult with counsel promptly.
• RAISE Act compliance planning should begin now. With the RAISE Act taking effect on January 1, 2027, companies should not wait to develop compliant safety disclosure and incident reporting frameworks.
• Employment and whistleblower retaliation risks. OAG’s alert underscores the importance of robust anti-retaliation policies and training. Any adverse action taken against an employee who has filed or may be considering filing a whistleblower complaint carries significant legal risk.

Recommended Actions

We recommend that AI companies take the following steps considering this development:

1. Assess current practices against the requirements of the RAISE Act, SHIELD Act, and applicable federal law.
2. Review and strengthen data security and incident response programs.
3. Audit internal reporting channels to ensure employees have meaningful avenues to raise safety and legal concerns internally before seeking external remedies.
4. Train management on whistleblower protections and anti-retaliation obligations.
5. Engage counsel to evaluate legal exposure and develop a compliance roadmap.