Ahead of a scheduled October 5 hearing, New York City's Council secured commitments from OpenAI, Anthropic, Google and Meta to send representatives for sworn questioning about AI risks. The immediate issue was not another voluntary safety pledge: lawmakers were considering outside validation, whistleblower incentives, incident disclosures and legal remedies that would require identifiable evidence.
The planned Committee of the Whole session at City Hall, at 11 a.m., brought the matter before the 51-member Council rather than one standing committee. Its agenda listed an oversight item and nine legislative proposals. The package was proposed legislation, not a final vote or enacted law; the advance account contained no hearing minutes, completed testimony or resulting legislative decisions.
Attendance became an accountability dispute
Meta agreed to send a senior representative before the threat of compulsory process. OpenAI and Google agreed after a subpoena warning; Anthropic initially declined and then confirmed shortly before the threatened deadline. The Council described the planned session as the first public testimony under oath from the four companies on AI dangers and legislative responses. That is the Council's characterization, not a finding about what witnesses ultimately admitted.
Bloomberg reported that policy and safety officials, rather than chief executives, would represent the labs. Their authority to answer technical questions mattered as much as the company names. Publicly answering a question is different from granting access to the evidence needed to verify the answer.
Speaker Julie Menin also issued SpaceXAI a subpoena after it did not answer the initial invitation. The Council said noncompliance could lead to an enforcement request in New York State Supreme Court. A subsequent local account expected the company to participate; expectation should not be rewritten as confirmed completed testimony.
Former Anthropic researcher Jacob Coxon was also reported as a prospective witness, alongside former Google DeepMind researcher Alex Turner and former OpenAI researcher Daniel Kokotajlo, who leads the AI Futures Project. Coxon had reportedly worked on pretraining at OpenAI and Anthropic and left Anthropic in September. Pretraining is the large-scale learning stage before later refinement, relevant to the insider perspective he claimed.
Reports attributed to Coxon a warning that people building advanced AI believed it might kill humanity before the decade ended. This is an extraordinary attributed risk claim, not an established forecast. Reuters said it could not independently verify Bloomberg's report of his planned appearance; the Council separately cited his resignation in explaining the hearing. Those evidentiary distinctions matter just as much as scrutiny of company assurances.
Validation before offering a model
Agenda item T2026-2602 proposed barring marketing, sale or deployment of a covered AI model in the city without third-party validation, plus a technical capability for a human operator to shut it down. Task performance, disparate impact, privacy, safety and the shutdown mechanism's operation were among the evaluation areas.
Validators would disclose interests connected to the model and report whether it was validated or ready for deployment. Cyber Command would set implementation rules and evaluator qualifications. The proposal placed obligations on evaluators as well as developers: civil penalties could reach $25,000, including a fixed $25,000 per instance of offering or deploying without required validation and the same amount for falsified validation.
Outside review can challenge assumptions, compare vendors and test safety representations independently. It can also fail through inadequate access, skill or time. A developer-paid validator may face pressure to approve a client; disclosure of that relationship is useful but does not eliminate financial dependence. Compliance paperwork is not proof of reduced risk.
The proposed shutdown control similarly needs a defined boundary. A hosted provider can stop access to its service but cannot necessarily recall copied outputs, exported artifacts, customer integrations or downstream actions already triggered. Disabling a model service and containing an incident are different outcomes. Rules need to identify what is stopped, by whom and under which deployments.
Incentives, complaints and two reporting clocks
One proposal would let people complain about covered AI violations to the Department of Consumer and Worker Protection. It would generally investigate except frivolous, false or duplicative claims. A complainant could receive 25% of recovered proceeds when the city pursued a case using the alleged facts, rising to 50% if designated to serve a violation notice or bring a civil action.
The incentive addresses information that employees and contractors may possess but outsiders cannot see: evaluation design, ignored warnings or deployment decisions. Another bill would clarify protections for city employees and covered contractors reporting AI development or use they reasonably believe creates a substantial and specific public-safety risk. It should not be described as blanket protection for every private-sector worker.
Rewards also require eligibility rules, confidentiality, handling of sensitive evidence and a way to resolve competing claims to decisive facts. Weak or strategic complaints can consume agency capacity. Protecting credible disclosures must coexist with due process for companies challenging inaccurate allegations; publication must not become disclosure of personal information, exploitable weaknesses or protected technical material.
For covered city contracts, agencies and contractors would notify Cyber Command within 24 hours after discovering a reportable AI safety incident. Cyber Command would then publicly disclose the reported event within another 24-hour period. These are sequential clocks, not a universal duty for every chatbot mistake or an assertion that every incident must become public within 24 hours of occurrence.
Liability and marketing reach beyond model labs
T2026-2600 proposed a private right to sue when a commercially available model caused harm through malicious or improper third-party use. The claim required foreseeable harm and inadequate safeguards connected to misuse. It did not make every bad output automatic developer liability.
Foreseeability is the contested boundary. Developers cannot prevent every malicious instruction or modification, but predictable abuse does not become unforeseeable merely because someone else supplied the final request. Evaluation results, abuse forecasts, warnings and release decisions would become evidence rather than remain internal policy arguments.
Other proposals addressed chatbot privacy, security, transparency and user access. Providers could not imply advice equivalent to a licensed professional. Model advertising would disclose third-party-validation status, and materially false or misleading safety claims could face penalties up to $25,000. Emergency planning was another part of the package, alongside severe-failure shutdown concerns.
These duties would reach validators, distributors, deployers, city contractors, agencies, advertisers and buyers—not only four prominent labs. The base developer supplies capability, application builders define workflows and customers grant data and tool access. A chat model connected to email, databases, payments or code repositories has a different risk surface from an isolated chat interface.
The hiring-audit precedent is narrower
Local Law 144 already limits use of covered automated employment decision tools by employers and employment agencies without a recent bias audit and required notices. Enforcement began in July 2023. It created a local external-audit precedent, not proof that the much broader model-validation proposal would be straightforward.
An employment tool has a defined task, users and decisions. A general-purpose model can support coding, legal drafting, research, customer service and agent actions; risk changes with each integration. The new proposal's references to marketing, sale and deployment raise questions about models versus applications, updates versus new releases, and responsibility across the supply chain.
A model trained elsewhere, hosted in another state, delivered through an intermediary and used by a New Yorker presents difficult local-jurisdiction questions. Cities have consumer, procurement and business authority, and New York's market can influence vendors beyond its borders. Influence does not itself establish enforceability or control over national research, chip exports and every external deployment.
Weak standards might rubber-stamp misleading assurances. Vague expansive standards might deter useful services and favor large firms able to absorb compliance costs. The Council's pro-innovation/pro-safety framing therefore depends on definitions, renewal rules and technically workable obligations, not the slogan.
Testable evidence matters on both sides
Former employees' catastrophic forecasts should be separated from documented findings about particular systems, capabilities and decisions. Company claims about safety culture likewise do not show that adversarial tests were meaningful or that an employee could stop a release under commercial pressure. The same evidentiary standard should apply to warnings and reassurances.
Useful questioning would identify who can delay deployment, who can reverse that decision, which records survive disagreement, what access an independent evaluator receives and how validation changes after updates. Companies have different operating models: OpenAI and Anthropic emphasize frontier development and safety research, Google integrates search/cloud/productivity/consumer products, and Meta combines models with platforms and advertising. Common duties still need context-specific implementation.
The proposed complaint and disclosure systems also need investigators, technical expertise, confidentiality controls and resources. Cyber Command and consumer-protection officials cannot enforce a broad mandate through company assurances alone. Detecting unvalidated deployments and distinguishing small changes from new systems are operational tasks, not self-executing legal language.
For organizations buying AI, meaningful artifacts include model versions, test cases, evaluation logs, access controls, incident decisions and changes to safeguards. A searchable knowledge base can preserve context but does not replace independent testing, permissions or response. Without records, accountability becomes a dispute over memory.
What would make the hearing consequential
The advance plan created three tests: concrete sworn evidence, meaningful revisions to the bills and a credible enforcement path. Specific evaluation methods, escalation rules and release thresholds would be more useful than generic responsibility statements; specific insider mechanisms would be more useful than catastrophe alone.
Definitions of covered models, deployment, validation renewal, human shutdown, reasonable safeguards and whistleblower eligibility would determine whether obligations become workable. Agency staff, access, rulemaking and investigation would determine whether they are enforceable. None of those results could be inferred from an agreement to attend.
The Council's initiative made a real accountability question visible: what evidence exists, who can inspect it and what follows an ignored warning? Its pre-hearing proposals should be judged on that basis—not reported as enacted duties or as evidence that the companies had already answered them.
Sources and related reading
Council hearing agenda · Reported Coxon appearance and verification caveat · Council legislative proposals · Existing hiring-audit rules · Knowledge-base governance · Council company-testimony plan · Original Bloomberg report