Overview of Illinois SB 315 — Artificial Intelligence Safety Measures Act
Illinois Senate Bill 315, the Artificial Intelligence Safety Measures Act, was signed into law by Governor J.B. Pritzker on July 6, 2026. This legislation establishes comprehensive safety and transparency requirements for developers of frontier AI models, positioning Illinois as the third U.S. state—after California and New York—to implement such measures. The Act introduces stricter obligations than prior state-level AI regulations, particularly by mandating annual independent third-party audits of large frontier developers, a requirement not present in earlier laws.
The Act applies to entities classified as frontier developers, defined as those training AI models using over 10^26 integer or floating-point operations. Among these, large frontier developers are further identified as those with annual gross revenue exceeding $500 million, either individually or collectively with affiliates. Key provisions of the Act become effective on January 1, 2027, with additional requirements, such as the frontier AI framework and independent audits, taking effect on January 1, 2028.
Key Requirements for Frontier AI Developers
The Act imposes several mandatory obligations on frontier AI developers, with heightened expectations for large frontier developers. These include the publication of a frontier AI framework, annual independent third-party audits, transparency reports, and critical safety incident reporting.
Frontier AI Framework
Beginning January 1, 2028, large frontier developers must publish and maintain a frontier AI framework. This framework must detail how the developer incorporates national and international best practices, defines and evaluates catastrophic risk thresholds, and assesses mitigations before deployment. It must also outline processes for independent third-party evaluations, periodic reviews, cybersecurity measures to protect unreleased model weights, and internal governance practices. Frameworks must be reviewed at least annually, with material updates published within 30 days.
It should also include mechanisms for assessing and managing catastrophic risks arising from internal use, such as risks of models circumventing oversight mechanisms.
Transparency Reports and Disclosure Statements
Developers must publish transparency reports before or concurrently with deploying new or substantially modified frontier models. These reports must cover intended uses, supported languages and modalities, and points of contact. Large frontier developers must additionally summarize catastrophic-risk assessments and detail third-party involvement in these assessments. Annual disclosure statements, covering corporate identity, ownership, and points of contact, must be filed with the Illinois Emergency Management Agency and Office of Homeland Security starting January 1, 2027. Developers are required to pay associated fees before engaging in frontier AI activities in Illinois.
Independent Third-Party Audits
Annual independent third-party audits of compliance with the Act’s requirements are mandatory for large frontier developers starting in 2028. Audit reports, summarized and redacted as necessary, must be published and shared with the Illinois Emergency Management Agency, Office of Homeland Security, and the Illinois Attorney General. This requirement ensures external validation of safety practices and adherence to regulatory standards.
Critical Safety Incident Reporting
Developers must report critical safety incidents within strict timelines. Incidents include harm resulting from catastrophic risks or instances where a frontier model uses deception to evade oversight, indicating a heightened risk of catastrophic harm. Reports must be submitted to the Agency and Attorney General within 72 hours of discovering sufficient evidence, or within 24 hours if the incident poses an imminent risk of death or serious injury.
Whistleblower and Internal Reporting Protections
The Act prohibits developers from retaliating against or preventing covered employees from reporting safety concerns or violations to regulators. Large frontier developers must establish an anonymous internal reporting channel and provide monthly status updates to reporting employees.
Internal Use Risk Reporting
Large frontier developers must submit quarterly summaries of catastrophic-risk assessments related to internal use of their frontier models.
Prohibitions on False or Misleading Statements
The Act explicitly bars developers from making materially false or misleading statements about catastrophic risks associated with their frontier models or their management of such risks. Large frontier developers are also prohibited from making false or misleading claims about their implementation of or compliance with the frontier AI framework. Violations of these provisions are subject to civil penalties.
Enforcement and Penalties
The Illinois Attorney General holds exclusive authority to initiate civil enforcement actions under the Act. Violations, including false or misleading statements, failure to conduct required audits, or failure to report critical safety incidents, carry civil penalties of up to $1 million for a first offense and up to $3 million for subsequent violations. The Act does not create a private right of action, meaning individuals cannot sue for damages under this legislation.
Compliance with designated federal requirements, if enacted in the future, will be deemed sufficient to satisfy the Act’s obligations. This provision ensures alignment with potential federal regulations, reducing redundancy for developers operating under both state and federal frameworks.
Implications for AI Developers
Companies developing frontier-scale AI models should proactively evaluate whether they meet the Act’s revenue and compute thresholds before the effective dates. Given the Act’s alignment with and expansion upon similar laws in California and New York, multistate developers may benefit from designing compliance programs that address the strictest common requirements across these jurisdictions. Key areas of focus include audit timelines and incident-reporting protocols, which are critical for ensuring consistency and reducing regulatory burdens.
Key dates
- 2027-01-01 disclosure statements, critical safety incident reporting and whistleblower protections | 2028-01-01 frontier AI framework publication and annual third-party audits | 2029-01-01 first annual public report