Illinois Mandates Third-Party AI Audits in New Frontier Model Law

Illinois breaks ground with annual AI audit requirement

Governor JB Pritzker signed comprehensive artificial intelligence regulation into law Monday, establishing Illinois as the first state to mandate annual independent third-party audits of large AI developers. The legislation targets frontier AI models that generate more than $500 million in annual revenue and are trained using massive computing power.

The Artificial Intelligence Safety Measures Act (Senate Bill 315) follows similar measures enacted in California and New York in late 2025. Together, the three states represent approximately 40% of the U.S. AI market despite accounting for only 20% of the national population, effectively establishing a multi-state standard in the absence of federal regulation.

"Congress and the president ought to be passing similar legislation, but they've so far been unwilling, because many are captive to special interests that profit from the industry having no regulation," Pritzker said at the signing ceremony.

What the law requires

The legislation compels covered AI developers to publish frameworks detailing how they identify and assess "catastrophic risk" — defined as incidents that could cause death or serious injury to more than 50 people or exceed $1 million in property damage. Developers must report potential harm incidents to the state within 72 hours of identification, or within 24 hours if the risk is imminent.

Illinois distinguishes itself from California and New York by requiring annual independent audits rather than a single review when companies first meet the threshold. This provision drew concern from TechNet, a technology industry coalition, whose representative Ninia Linero warned about "requiring private actors to make highly subjective determinations requiring AI safety compliance without established national standards."

Despite industry reservations, both OpenAI and Anthropic supported the bill. Caitlin Niedermeyer of OpenAI's Global Affairs told state lawmakers that while the company prefers federal leadership, it sees value in "aligned frameworks" across Illinois, California, and New York that "can absolutely help create a de facto national direction of travel."

Enforcement and future scope

Violations carry civil penalties of up to $1 million for first offenses and $3 million for subsequent violations, enforced by the attorney general's office. The law takes effect January 1, 2028.

House sponsor Representative Daniel Didech pointed to real-world harms already occurring, including what he described as the first AI-inspired mass shooting and AI systems used to attack municipal infrastructure. He referenced Anthropic's decision to withhold its Mythos model from public release due to cybersecurity concerns.

Lawmakers indicated this legislation represents an initial step. Didech identified medical care and education as areas requiring future AI safety evaluation. Scott Wisor, policy director for Secure AI, noted that while the current law verifies compliance with safety frameworks, it doesn't independently assess whether those frameworks adequately address risk.

Why it matters

The coordinated approach among three major AI market states creates practical national standards without federal action. By requiring ongoing independent audits rather than one-time reviews, Illinois establishes a precedent for continuous oversight of rapidly evolving AI systems. The legislation demonstrates how states can drive technology policy when federal lawmakers remain gridlocked, potentially influencing how AI companies design safety protocols nationwide.

The bill passed with broad bipartisan support — only five Republican senators opposed it, while the House approved it unanimously. Details of the legislation were first reported by Capitol News Illinois.