Summary
Illinois Governor J.B. Pritzker signed the Artificial Intelligence Safety Measures Act (SB 315) into law on July 6, 2026, making Illinois the first state in the nation to mandate annual independent third-party audits of advanced AI models. The landmark legislation establishes safety standards and transparency requirements for developers of “frontier AI models” — defined as those generating over $500 million in annual revenue and trained using massive computing resources.
Under the new law, covered developers must publicly disclose their safety and security practices, maintain internal compliance programs, assess catastrophic risks, and report critical AI safety incidents within 72 hours — or within 24 hours if there is an imminent risk of death or serious physical injury. The audits must be performed by qualified experts free of financial conflicts of interest. The act also establishes confidential reporting channels and whistleblower protections for employees raising safety concerns. Violations carry civil penalties of up to $1 million for a first offense and $3 million for subsequent violations.
The legislation takes effect January 1, 2027, with full implementation by 2028. It received bipartisan support in the Illinois General Assembly and backing from major AI developers including OpenAI and Anthropic. Modeled after similar bills in California and New York, Illinois lawmakers estimate that these three states collectively account for roughly 40% of the U.S. AI market, positioning the law as a de facto national standard in the absence of comprehensive federal regulation.
Source
Capitol News Illinois — Pritzker Signs Landmark AI Regulation Bill That Aims to Mitigate Risks
WTTW — Pritzker Signs Landmark AI Regulation Bill
Commentary
The most significant detail here is that OpenAI and Anthropic both backed this legislation. When the industry’s leading labs are actively supporting regulation rather than fighting it, it suggests they see mandatory audits and disclosure as a competitive moat — smaller, less compliant competitors will face barriers to operating in major U.S. markets. The $500 million revenue threshold neatly excludes open-source projects and startups while capturing the frontier players.
The 72-hour incident reporting requirement (24 hours for imminent risk) mirrors the EU’s NIS2 Directive approach to critical infrastructure and signals that U.S. states are converging on European-style disclosure timelines. With California, New York, and Illinois representing 40% of the AI market, companies building frontier models effectively have no choice but to comply — making this the strongest de facto national standard until Congress acts. Whether federal preemption eventually overrides these state laws remains the open question.