Illinois Enacts Frontier AI Safety Law

On June 26, 2026, the Illinois General Assembly enrolled and sent to the governor the Artificial Intelligence Safety Measures Act (SB 315), which will make Illinois the third state to impose comprehensive safety, transparency, and governance obligations on developers of frontier artificial intelligence models. The law closely mirrors the regulatory framework established by California's Transparency in Frontier Artificial Intelligence Act (SB 53), which we covered in our October 2025 alert, "California Enacts Broad AI Safety Measure Mandating Standardized Disclosure and Transparency Practices for Developers of Large AI Models," and New York's overhauled RAISE Act (S.8828), discussed in our April 2026 alert, "NY Overhauls Transparency and Governance Requirements for Frontier AI Developers." Like those laws, SB 315 applies to developers of "frontier models," which are foundation models trained using more than 1026 integer or floating-point operations, and imposes heightened obligations on "large frontier developers" with annual gross revenue exceeding $500 million. Illinois designates the Illinois Emergency Management Agency and Office of Homeland Security (in consultation with the attorney general) as the administering authority for SB 315. The law takes effect January 1, 2027, the same date as New York's amended RAISE Act.

Illinois adopts a "catastrophic risk" definition that is virtually identical to California's and New York's: a foreseeable and material risk that a frontier model's development, storage, use, or deployment will materially contribute to the death of, or serious injury to, more than 50 people, or more than $1 billion in property damage, arising from a single incident involving: chemical, biological, radiological, or nuclear (CBRN) weapons assistance; an unsupervised cyberattack, murder, assault, fraud, extortion, or theft; or a model evading its developer's or user's control. As in California and New York, that definition excludes harm from information that is already publicly available, lawful federal government activity, and harm caused in combination with other software if the frontier model did not materially contribute to the harm.

The Illinois law adopts substantially the same core requirements as California and New York: beginning January 1, 2028 large frontier developers must publish a "frontier AI framework" addressing ten specified governance and risk-management topics (including risk thresholds, pre-deployment review, cybersecurity protections for model weights, and incident response protocols); file transparency reports before deploying new or modified frontier models; report critical safety incidents to the state within 72 hours (or 24 hours where there is imminent risk of death or serious injury); maintain and file an ownership disclosure statement with the administering agency (renewed annually and when materially changed); and pay associated fees and assessments. Civil penalties mirror New York's structure: up to $1 million for a first violation and $3 million for subsequent violations, enforced by the attorney general. Materially false or misleading statements about catastrophic risk or framework compliance are prohibited, subject to a good-faith exception. No private right of action is created.

While the Illinois law follows the same structural template, it introduces several notable differentiators. First, and most significantly, Illinois is the only state of the three to require mandatory annual independent third-party audits of large frontier developer compliance, beginning January 1, 2028 (or 90 days after a developer first qualifies, whichever is later), with detailed requirements for auditor competence, conflict-of-interest screening, and report publication. Neither California nor New York requires independent audits. Second, Illinois enhances whistleblower protections beyond California's approach (and beyond New York, which lacks whistleblower provisions entirely) by requiring large frontier developers to maintain an anonymous internal reporting process with monthly status updates to reporting employees and quarterly disclosure summaries to officers and directors. Covered employees may also use the Illinois attorney general's Workplace Rights Hotline. Third, SB 315 invokes a home-rule preemption approach, declaring regulation of AI frontier models to be "an exclusive power and function of the State" under Article VII, Section 6(h) of the Illinois Constitution and prohibiting Illinois' cities or local governments from regulating AI. While California's law also expressly preempts local regulation of AI, New York is silent on local preemption.

With Illinois joining California and New York, frontier AI developers now face multistate compliance requirements built on a common regulatory template that has effectively become a national standard. Although the core obligations appear to be intentionally harmonized, the differences between administering agencies, audit mandates, and whistleblower requirements mean that developers operating across all three states will need to understand and plan for state-specific requirements. Illinois' safe-harbor provision, which, like California and New York, permits compliance via a designated substantially equivalent federal standard, notably adds a fourth condition requiring that any such federal standard also mandate third-party audits at least as rigorous as Illinois' requirements.

We will continue to monitor these developments, including any gubernatorial action and subsequent rulemaking, and will publish further guidance as appropriate.

Apurva Dharia is an associate and Michael Borgia is a partner in the Washington D.C., office of DWT. Andrew Lewis is counsel in the firm's San Francisco office. For questions or more insights, please reach out to the authors or another member of our artificial intelligence, technology + privacy & security, or communications teams and sign up for our alerts.