Custom Software in New York: Which Rules Apply

Which rules reach custom software in New York depends less on your office address than on who your customers are and what the code does with their data. Licensing, residency, hiring and billing are the four facts that decide it: two lead to state rules, one to a city law and one to a sales-tax bulletin. Answer them in order and each rule lands where it belongs, in the brief, the contract or the invoice.

QalbIT builds from Ahmedabad and holds New York mornings open for calls, as our New York page sets out in detail. That changes nothing below, because a vendor in Brooklyn meets the same four rules. Read what follows as a checklist to take to counsel and to whoever handles your sales tax, not as legal or tax advice from us.

One fact about the business settles most of the four, so a single meeting can usually answer them. The figure shows where each answer leads.

Step 1: do the Department of Financial Services rules cover you?

The Department’s cybersecurity regulation, 23 NYCRR Part 500, applies to a “covered entity”: a person operating under, or required to operate under, a licence, registration, charter, certificate, permit or similar authorisation under the Banking Law, the Insurance Law or the Financial Services Law (section 500.1). Banks, insurers and other licensed firms are the usual cases. If that is you, the regulation reaches the software you commission.

Where the vendor comes in

Part 500 reaches your software supplier too. Section 500.1 defines a third-party service provider as a non-affiliate that provides services to the covered entity and maintains, processes or otherwise has access to its nonpublic information. Build a claims tool or an onboarding portal that touches customer records, and the builder is that provider. Section 500.11 then requires your firm to keep written policies for assessing such providers, with guidelines for due diligence or contractual protection on:

• the provider’s access controls, including multi-factor authentication;
• its encryption of nonpublic information in transit and at rest;
• notice to you of a cybersecurity event; and
• representations and warranties about its cybersecurity policies.

In practice, a questionnaire arrives before the scope document, and the contract grows an annex. The clock matters most. Under section 500.17 you must tell the superintendent as promptly as possible, and no later than 72 hours after determining that a cybersecurity incident occurred. That includes an incident at a third-party service provider. The 72 hours start with your firm’s determination, which can only follow what the vendor tells you. A contract that says “promptly” leaves that moment to the vendor; one that names a number of hours does not.

The phase-in is over

The Second Amendment took effect on November 1, 2023, with requirements arriving in stages. We counted the dates from the transitional periods in section 500.22:

Every date has passed, so your firm now judges a new vendor against the finished list. The November 2025 row changes a project most. The Department’s multi-factor authentication guidance says that from November 1, 2025 the requirement applies to anyone accessing any of the covered entity’s information systems, regardless of location or type of user. If your staging environment is one of your information systems, that reaches the vendor engineers who log in to deploy there. Your CISO can approve equivalent compensating controls in writing, but that is your firm’s call, not the vendor’s. The asset inventory means the systems we build and host for you should be on your list from the first week.

The small-firm exemption

Section 500.19(a) gives a limited exemption to the smallest firms: fewer than 20 employees and independent contractors, under $7.5 million in gross annual revenue in each of the last three fiscal years, or under $15 million in year-end total assets, each counted with affiliates. Meeting any one is enough, so a firm has to clear all three lines to lose it. An exempt firm drops several sections, among them governance, scanning, encryption and incident-response plans. It must still use multi-factor authentication for remote access, for cloud and other third-party applications that hold nonpublic information, and for privileged accounts.

Step 2: the SHIELD Act reaches almost everyone

If Step 1 was a no, this is the rule that still reaches custom software in New York. General Business Law section 899-bb asks any person or business that owns or licenses computerized data holding the private information of a New York resident to keep reasonable safeguards for its security, confidentiality and integrity, including disposal. The test is the resident, not the office. A company in Texas with New York customers is inside it.

“Private information” covers more than most product teams assume. Its list opens with Social Security and driver licence numbers and runs through account, medical and health insurance details and biometric data. It also covers a username or email address combined with a password or security question and answer (section 899-aa). A customer portal with logins therefore holds private information, in the statute’s sense, from launch day.

The statute lists what counts as reasonable, and three items bear directly on a software project: assessing risks in network and software design, detecting, preventing and responding to attacks or system failures, and selecting service providers capable of keeping appropriate safeguards and requiring them by contract. The list also includes disposing of private information within a reasonable time once it is no longer needed. A small business (under 50 employees, under $3 million in revenue in each of the last three years, or under $5 million in assets) needs safeguards appropriate for its size and complexity. Some firms get a shortcut. One that is subject to, and compliant with, the Gramm-Leach-Bliley Act rules, HIPAA and HITECH, Part 500 or another federal or New York data security rule is a “compliant regulated entity”. The section treats it as meeting the safeguards duty.

When a breach happens

Since a December 2024 amendment, the business must tell affected residents within 30 days of discovering the breach. It also notifies the Attorney General, the Department of State and the State Police, and the Department of Financial Services as well if it is a Part 500 covered entity. A vendor holding data it does not own must tell the owner immediately, and no later than 30 days after discovery. Only the Attorney General can enforce the safeguards duty, and the section creates no private right of action. For the build, that means a trail of reads: who opened which record, and when, so a notice reaches the right people.

Step 3: software that screens candidates for New York City jobs

Skip this step unless your product ranks, scores or shortlists people for hiring or promotion. If it does, Local Law 144 matters. It forbids employers and employment agencies from using an automated employment decision tool in the city unless they have had a bias audit done and sent the required notices. The city’s consumer and worker protection department defines such a tool as computer-based, built on machine learning, statistical modelling, data analytics or artificial intelligence, and one that substantially assists or replaces discretionary decision-making.

The obligations land on the employer, not the builder, but they set what the software must do:

• An independent auditor must repeat the audit every year, using historical data from the tool’s own use. So the software must keep the scoring records an auditor will ask for.
• The employer must tell candidates and employees who live in the city, with instructions for requesting a reasonable accommodation, 10 business days before using the tool. For applicants, a notice on the careers section of the employer’s website will do.
• A vendor is not responsible for the audit, but may commission one or help gather the data. The employer remains answerable for it.

Put the audit date, the notice wording and the data export into the scope, or the first hiring season finds them missing.

Step 4: how the tax code treats custom software in New York

The Tax Department’s Tax Bulletin ST-128, issued on August 5, 2014 and last reviewed on March 31, 2026, sets out the rule. Prewritten software is taxable as tangible personal property however it reaches the buyer: on disk, by download or by remote access. Software designed and developed to the specifications of a particular purchaser is custom software, and that is not taxable.

Three details change how you contract:

• Resale. If custom software is later sold or transferred to someone other than the person it was built for, it becomes taxable, with a narrow exemption for transfers inside an affiliated group of companies. A founder who commissions a tool and later turns it into a product should ask an adviser first.
• Modified packages. Prewritten software modified to your specifications is taxable, but a reasonable charge for the modification, separately stated on the invoice, is not. Services such as training, consulting, installing and programming are exempt on the same condition when they accompany a prewritten sale.
• Subscriptions. The bulletin treats a licence to remotely access software over the internet as a taxable sale, sourced to where the customer uses it. If you plan to sell the product as a subscription, its billing has to collect that tax.

The Tax Department attaches a caution to every bulletin: later changes in law or interpretation may affect it. Have your adviser go through the statement of work before the first invoice goes out.

Putting the steps together for custom software in New York

Buyers of custom software in New York meet different combinations, depending on the business. This table shows the common ones.

HIPAA is federal law and outside this post, with one link worth knowing: a business subject to and compliant with HIPAA counts as a compliant regulated entity under section 899-bb, so HIPAA compliance satisfies the safeguards duty. Breach notice sits in a different section, so have counsel check that part separately.

A remote team for custom software in New York

Eastern hours are the easy part. Our teams are live with New York 08:00-12:00 ET, every working day. That is 17:30-21:30 in Ahmedabad during the summer and an hour later in winter, because India keeps no daylight saving. Written handovers carry the rest. If your compliance office needs a workshop with an engineer, it lands in your morning.

The harder question is evidence. A New York buyer, especially a regulated one, will ask who has access to what. The proposal names the engineers who will write the code, and we pass nothing to a third party. We open accounts and repositories under your company’s name at the outset, so they sit on your asset list from the start. Before you sign with any vendor, agree these in writing: the number of hours within which they tell you about a suspected incident, multi-factor authentication on every account that touches your systems, where the vendor stores data, and how it deletes that data when the work ends.

On price, fixed-scope projects start at $6,500 and name what they exclude, and a dedicated engineer starts from $3,200 a month. Ask for compliance items such as audit logging, an MFA rollout or an auditor’s data export as separate lines, so each one’s cost is visible; our pricing models guide sets fixed, hourly and dedicated contracts side by side. For the wider vendor checks, see our guide to choosing a product development company. Then put one question to every shortlisted firm: which of the four steps did its last New York project have to clear? Specific answers, with section numbers, tell you more than a capabilities deck.