Effective Jan. 1, 2027, the AI Safety Measures Act is the first state law to compel annual third party audits of the largest, most powerful AI systems.
Illinois just became the first state in the country to give outside auditors legal authority to look inside a frontier AI model rather than merely read the company's self-reported safety paperwork.
Gov. JB Pritzker signed the Artificial Intelligence Safety Measures Act, SB 315, in Chicago. The law takes effect Jan. 1, 2027. Independent auditors will receive access to unredacted versions of the model, according to Illinois Attorney General Kwame Raoul's statement on the bill. Illinois is the first state in the country to couple regulation of large AI developers with recurring third-party audits of the model itself.
The statute applies to "large frontier developers": companies whose AI models are trained using very large amounts of computing power and whose corporate family reports more than $500 million in annual revenue. A frontier-AI model, in shorthand, is a large general-purpose system trained at the current ceiling of capability and cost.
Auditors under SB 315 inspect unredacted models and review whether the developer is handling catastrophic risks across three areas defined by statute: cybersecurity threats, the creation or release of certain kinds of weapons, and the potential for an AI system to evade control of its developer or user. The audits are annual and run independently of the company's own safety disclosures.
Covered companies must publish a catastrophic-risk plan, update it annually, and report serious safety incidents within 72 hours. The reporting window drops to 24 hours if there is imminent risk of death or serious physical harm. The law also creates confidential channels and protections for employees who raise safety concerns.
Civil penalties, enforced by the attorney general's office, can reach up to $1 million for a first violation and up to $3 million for subsequent ones.
The bill passed the legislature with bipartisan support: 110-0 in the House and 52-5 in the Senate, where Democratic State Sen. Mary Edly-Allen sponsored the measure.
Illinois, California, and New York together represent roughly 40 percent of the American market, per Edly-Allen. For a company shipping AI products at scale across the United States, maintaining separate compliance regimes in each of those jurisdictions is impractical. SB 315's audit regime has effective reach past the state's borders.
"Where the federal government has been unwilling to step up, states must venture once more unto the breach," Pritzker said at the signing.
How wide the law reaches in practice is still a rulemaking question. The $500 million corporate-family-revenue threshold and computing-power test are statutory, but the attorney general's office, which enforces the law, has not yet published the covered-developer list or audit-scope rulemaking. That rulemaking will determine how many companies SB 315 actually reaches.