On July 6, 2026, Governor JB Pritzker signed Senate Bill 315, the Artificial Intelligence Safety Measures Act (the "Act"), into law. Illinois is now the third U.S. state, after California and New York, to impose comprehensive safety and transparency requirements on developers of the most powerful AI systems.
The Act's obligations fall on a narrow set of very large AI developers, not ordinary business users. But the downstream effects will be significant: new disclosure documents, mandatory audits, incident-reporting timelines, and whistleblower protections will reshape vendor contracts, procurement due diligence, and enterprise incident-response planning.
What Illinois Enacted
Illinois joins California (SB 53, signed September 2025) and New York (the RAISE Act, signed December 2025) [1] in building a state-level regulatory framework for frontier AI.
Illinois goes further than its peers in one critical respect: it is the first state to require annual independent third-party audits of covered developers' safety practices.
The Act passed the General Assembly with bipartisan support and drew backing from both AI safety advocates and industry stakeholders.
These frontier AI laws are distinct from the broader wave of state AI legislation targeting algorithmic decision-making. Colorado's AI Act (SB 24-205), signed in May 2024, was the first comprehensive AI governance law in the U.S., but it takes a different approach. Rather than regulating the largest model developers based on compute thresholds, Colorado imposes obligations on developers and deployers of "high-risk AI systems" used in consequential decisions affecting consumers (employment, housing, credit, insurance, and education). Business leaders should track both regulatory tracks: frontier AI governance (Illinois, California, New York) and algorithmic fairness and transparency (Colorado and likely more states to follow).[2]
Who Is Covered
The Act targets a narrow class of AI companies:
- Frontier Developers: Companies training AI models using more than 10²⁶ computing operations.
- Large Frontier Developers: Frontier developers (with affiliates) exceeding $500 million in annual gross revenue. These entities face the heaviest obligations.
Bottom line: Today, this likely covers only a handful of the largest foundation-model developers. But as computing costs decline and models scale, the thresholds may capture additional players.
Key Obligations at a Glance
| Requirement | Effective Date | Key Details |
| Frontier AI Framework | Jan. 1, 2028 | Publish and maintain a comprehensive safety framework addressing catastrophic-risk thresholds, mitigations, deployment review, cybersecurity protections for model weights, third-party evaluations, incident response, and internal governance. Must be reviewed annually; material updates within 30 days. |
| Transparency Reports | Jan. 1, 2028 | Filed before or concurrent with deployment of new or substantially modified frontier models. Includes intended uses, supported languages/modalities, points of contact, and (for large developers) catastrophic-risk assessment summaries. |
| Annual Independent Audits | Jan. 1, 2028 | Third-party audits of safety-framework compliance. Redacted summaries published; full reports shared with the Illinois Emergency Management Agency & Office of Homeland Security and the Attorney General. |
| Critical Safety Incident Reporting | Jan. 1, 2028 | Report to the Agency and AG within 72 hours; within 24 hours if imminent risk of death or serious bodily injury. |
| Whistleblower Protections | Jan. 1, 2028 | Large frontier developers must establish anonymous internal reporting channels; retaliation is prohibited. |
| Annual Disclosure Statements | Jan. 1, 2027 | Corporate identity, ownership, points of contact, and fee disclosures. |
| Prohibitions on False Statements | Jan. 1, 2027 | Material misrepresentations about catastrophic risk or framework compliance are prohibited. |
Enforcement: The Illinois Attorney General has exclusive civil enforcement authority; there is no private right of action. Penalties reach up to $1 million for initial violations and $3 million for subsequent violations.
Why This Matters for Your Business
Even if your organization is not a frontier developer, the Act will reshape AI procurement and governance:
- Vendor Contracts: Expect frontier AI vendors to revise service agreements. Procurement teams should negotiate for audit summaries, transparency reports, and timely incident notifications.
- M&A and Investment Due Diligence: For deals involving potential frontier developers, assess framework implementation, audit readiness, and incident-reporting procedures.
- Incident Response: The 72-hour (and 24-hour urgent) reporting windows require organizations to understand their AI provider's obligations and align internal escalation timelines.
- Security Standards: The Act's cybersecurity requirements for unreleased model weights set a floor that downstream customers should mirror in risk assessments.
- Multi-State Complexity: Illinois, California, and New York each impose overlapping but distinct requirements, demanding coordinated compliance mapping for national operations.
Your Action Plan
- Map your AI supply chain. Identify which vendors or partners could qualify as frontier developers under Illinois, California, or New York thresholds.
- Update procurement playbooks. Add contract provisions requiring vendors to certify compliance, provide transparency reports and audit summaries, and notify you of safety incidents within defined timelines.
- Refresh incident-response plans. Align your AI incident procedures with the Act's 72-hour and 24-hour reporting windows.
- Conduct a multi-state gap analysis. Compare Illinois SB 315, California SB 53, and the New York RAISE Act. Build a single compliance framework that satisfies all three.
- Prepare for M&A diligence shifts. Add frontier-developer classification, framework readiness, and enforcement exposure to your AI company diligence checklist.
- Brief leadership. Update boards and executives on the emerging frontier AI regulatory landscape and its implications for AI strategy, vendor risk, and compliance budgets.
- Monitor federal developments. Federal bills (see below) could preempt or supplement state requirements. Stay engaged with industry groups and counsel.
Pending Bills Watch List
State-level momentum is accelerating federal attention. Two bills introduced the same week the Illinois Act was signed deserve monitoring:
Federal FRONTIER Act (introduced July 23, 2026)
- Sponsors: Jay Obernolte (R-CA) and Lori Trahan (D-MA), with bipartisan cosponsors.
- Key provisions: Tiered obligations based on developer size; mandatory model cards, risk-management frameworks, independent audits, incident reporting, and a uniform national standard.
- Significance: Designed to prevent a patchwork of state regulations. Requires annual framework reviews and 24-hour critical incident reporting.
AI Kill Switch Act (introduced July 23, 2026)
- Sponsors: Ted Lieu (D-CA) and Nathaniel Moran (R-TX).
- Key provisions: Requires developers to maintain technical capability to throttle, suspend, or shut down models; authorizes DHS to order slowdown or shutdown of AI systems capable of catastrophic harm; mandates incident reporting and forensic record preservation.
- Significance: Goes beyond disclosure to mandate operational kill-switch capabilities—a significant escalation in the regulatory toolkit.
Great American AI Act (discussion draft, June 2026)
- Status: Bipartisan discussion draft for a broader federal AI framework. The FRONTIER Act appears to be the narrower introduced bill covering frontier oversight.
The frontier AI regulatory environment is evolving rapidly. Expect additional state proposals and federal preemption debates through 2027. The prudent approach: build adaptable governance frameworks now using the Illinois, California, and New York statutes as your baseline.
[1]California SB 53, Transparency in Frontier Artificial Intelligence Act (signed Sept. 29, 2025); New York RAISE Act (signed Dec. 2025, amended Mar. 27, 2026).
[2] Utah's Artificial Intelligence Policy Act (SB 149, signed Mar. 2024) requires disclosure when AI is used in regulated occupations and consumer interactions. Texas HB 2060 (2023) created an AI advisory council to study AI governance. Several other states have enacted sector-specific AI laws covering insurance underwriting, hiring tools, and other applications.