Illinois Becomes First US State to Require Annual Third-Party Audits of Frontier AI Models

Illinois has become the first US state to mandate independent, third-party safety audits for the developers of the world's most powerful artificial intelligence models. Governor JB Pritzker signed the Artificial Intelligence Safety Measures Act (SB 315) into law on Monday, establishing a new compliance floor for the AI industry in the absence of federal regulation.[1]

The legislation targets "large frontier developers"—companies that generate more than $500 million in annual revenue and train their AI systems using massive computing power. Under the new law, developers of advanced models like ChatGPT and Claude must publish comprehensive safety frameworks detailing how they assess and mitigate catastrophic risks before those models are released to the public.[2][3]

While California and New York passed similar transparency laws in 2025, Illinois is the first to require that companies open their hoods to outside verification. Beginning in 2028, covered developers must retain independent auditors to evaluate their compliance with their own safety frameworks. These auditors must be granted access to unredacted versions of the AI models and cannot have a financial conflict of interest with the developer.[5]

The law defines catastrophic risks as severe threats to public safety, including the potential for an AI model to assist in the creation of biological weapons, execute large-scale cyberattacks, or evade human control. If a critical safety incident occurs, developers are required to report it to the Illinois Emergency Management Agency and the Attorney General's office within 72 hours. If the incident poses an imminent risk of death or serious physical injury, the reporting window shrinks to just 24 hours.[1]

Enforcement lies exclusively with the Illinois Attorney General, who can seek civil penalties of up to $1 million for a first violation and $3 million for subsequent offenses. The legislation also establishes confidential reporting channels and robust whistleblower protections for tech employees who raise internal concerns about AI safety or regulatory violations.

The bill's passage reflects a rare moment of political consensus on technology regulation. It cleared the Illinois House of Representatives by a unanimous 110-0 vote and passed the Senate 52-5. Governor Pritzker framed the state-level action as a necessary intervention, citing a "glaring, but not surprising lack of leadership" from the federal government on AI safety.[3]

Unusually for tech regulation, the bill received public backing from the industry's leading players. Both OpenAI and Anthropic supported the legislation throughout the drafting process. Anthropic's head of state and local government relations, Cesar Fernandez, praised the bill for pairing transparency with independent verification, calling it an important step toward accountability that establishes a baseline for the industry.[2]

However, the third-party audit provision faced pushback from other corners of the tech sector. TechNet, a coalition of technology executives, opposed the audit mandate during committee hearings. The group argued that the law forces private auditors to make highly subjective determinations about AI safety compliance without the benefit of established national standards or clear regulatory guardrails.[1][4]

Legal analysts view the Illinois law as a pragmatic, incremental approach designed to survive constitutional scrutiny. By focusing on mandatory disclosures and process audits rather than attempting to dictate what an AI model can or cannot output, the state avoids the legal landmines that have derailed more aggressive attempts to regulate tech platforms' speech and content.

The practical impact of the law will extend far beyond Illinois's borders. Because frontier AI models are deployed globally and cannot be easily geofenced by state lines, a strict compliance requirement in a major US market effectively sets a national operational standard. Any developer crossing the $500 million revenue threshold will now need to build audit-ready governance structures into their development pipelines.[4]

The law's core transparency and reporting requirements take effect on January 1, 2027, giving the industry an 18-month runway to prepare. As the 2028 deadline for the first round of third-party audits approaches, the legislation is expected to spur the rapid growth of a specialized AI assurance industry equipped to evaluate the world's most complex neural networks.