Executive Summary
- What’s new: On July 6, 2026, Illinois Gov. JB Pritzker signed the Artificial Intelligence Safety Measures Act into law, making Illinois the third state — after California and New York — to impose transparency, safety and reporting obligations on large AI developers. The Illinois act also goes a significant step further than those other states’ laws by requiring developers to retain an independent third party to audit their compliance annually.
- Why it matters: The Illinois law adds to an emerging patchwork of state-specific AI laws with which developers must comply. It was enacted despite strong opposition by the Trump administration to any state laws that regulate AI developers.
- What to do next: The act takes effect on January 1, 2027, with certain obligations, including the annual audit requirement, not going into effect until January 1, 2028. This gives developers some time to build out compliance programs to adhere to the Illinois law, and to determine how such programs can be integrated into compliance programs that may exist for the California and New York laws.
__________
Overview
On July 6, 2026, Illinois Gov. JB Pritzker signed the Artificial Intelligence Safety Measures Act1 (the Act) into law, making Illinois the third state, after California and New York, to impose transparency, safety and reporting obligations on large AI developers. The Illinois Act also goes a significant step further than those other states’ laws by requiring developers to retain an independent third party to audit their compliance annually.
Scope and Applicability
The scope of the Act is centered on three key terms:
- “Frontier models”: AI foundation models trained using more than 1026 integer or floating-point operations. The California and New York laws use the same quantitative measures, although the New York law requires more than $100 million in compute costs.
- “Large frontier developers”: Frontier developers that, together with their affiliates, had annual gross revenue exceeding $500 million in the preceding calendar year. This threshold is also used in the California and new York laws.
- “Catastrophic risk”: A foreseeable and material risk that a frontier developer’s development, storage, use or deployment of a frontier model will materially contribute to the death of, or serious injury to, more than 50 people, or more than $1 billion in damage to or loss of property, arising from a single incident. This is the same measure used by California, while New York adopted a 100-person threshold. And, as with California and New York, catastrophic risk is limited to a frontier model doing any of the following:
- Providing expert-level assistance in creating a chemical, biological, radiological or nuclear weapon.
- Engaging, without meaningful human oversight, in a cyberattack or in conduct that would constitute murder, assault, extortion or theft if committed by a human.
- Evading the control of its developer or user.
Frontier AI Framework
Beginning January 1, 2028, a large frontier developer must write, implement, comply with and conspicuously publish on its website a frontier AI framework describing its approach to catastrophic-risk management.
The framework must address, among other matters:
- The thresholds used by developers to identify whether a model has capabilities that could pose a catastrophic risk, and the mitigations applied to address those risks.
- Its practice for securing unreleased model weights against unauthorized modification or transfer.
- Its practices to ensure the framework is actually implemented.
The developer must review the framework at least annually and must publish any material modification, together with a justification, within 30 days.
Before or concurrently with deploying a new or substantially modified frontier model, a developer must publish a transparency report that summarizes the developer’s catastrophic-risk assessments and the extent of any involvement by third-party evaluators.
Independent Third-Party Audit Requirement
While the Illinois Act generally tracks the California and New York AI regimes, Illinois is unique in requiring an independent audit for large frontier developers. Beginning on the later of January 1, 2028, or 90 days after a developer first qualifies as a large frontier developer, the developer must retain an independent third party to perform an annual audit of the developer’s compliance with the Act’s obligations and an assessment of its internal controls for compliance.
The auditor must conduct the audit consistent with generally accepted auditing standards and best practices, and must possess demonstrated competence, including technical expertise in the safety of frontier models. The resulting audit report must describe whether the developer has substantially complied with the Act, and if not, an explanation of each deviation and recommendations for improvement.
Within 30 days after receiving the report, the developer must publish a redacted copy (with a summary) and transmit it to the Illinois Emergency Management Agency and Office of Homeland Security (the Agency) and the Office of the Illinois Attorney General (AG). The developer must retain the audit report for the life of the model plus five years.
Incident Reporting
A frontier developer must report any critical safety incident to the Agency and the AG within 72 hours of learning facts sufficient to establish a reasonable belief that the incident occurred. If an incident poses an imminent risk of death or serious physical injury, the developer must disclose it within 24 hours to an appropriate law enforcement or public safety authority.
Illinois’ 72-hour window matches that of New York’s AI Act, and is considerably shorter than California’s 15-day window for such disclosure.
Disclosure Statements and Fees
Beginning January 1, 2027, large frontier developers must file a disclosure statement with the Agency that provides certain identifying information about the developer, including designated points of contact. Developers must renew this information annually and upon any transfer of model ownership or a material change to the reported information.
The Agency is authorized to assess fees, allocated pro rata among large frontier developers, to cover the costs of administering the Act.
Enforcement and Penalties
The AG has exclusive authority to enforce the Act through civil actions. A large frontier developer is subject to civil penalties of up to $1 million for an initial violation and up to $3 million for each subsequent violation, including if it fails to publish or transmit a compliant document required under the Act; fails to have a third-party perform the required audit; or fails to report a critical safety incident.
Whistleblower Protections
The Act prohibits developers from adopting or enforcing rules, policies or contracts that prevent or retaliate against a covered employee’s disclosure regarding activities that violate the Act. Large frontier developers must also provide a reasonable, anonymous internal reporting process.
Looking Ahead
Although model developers have time to comply with the most burdensome aspects of the Illinois Act, including the requirement to implement an AI framework and conduct an annual audit, developers that offer models within the Act’s scope — or plan to do so — will want to begin building compliance programs and audit regimes that minimize disruption to their business and existing compliance operations. Developers may also consider conducting a trial audit before one is legally required to identify and address any issues that may arise during in the process.
____________________
1 S.B. 315, 104th Gen. Assemb., Reg. Sess. (Ill. 2025) (enrolled).
This memorandum is provided by Skadden, Arps, Slate, Meagher & Flom LLP and its affiliates for educational and informational purposes only and is not intended and should not be construed as legal advice. This memorandum is considered advertising under applicable state laws.