Illinois enacts landmark AI safety law with mandatory third-party audits

Illinois enacts landmark AI safety law with mandatory third-party audits

On July 1, 2026, Illinois Governor JB Pritzker signed the Artificial Intelligence Safety Measures Act. The law makes Illinois the first US state to require third-party safety audits and incident reporting for frontier AI systems. It applies to any organization that develops or deploys AI models trained using at least 10^26 floating-point operations. Regulators can also expand coverage to additional systems through review.

Covered developers must submit to independent audits before deploying a model, and then annually after that. Auditors check whether models pose risks to public safety, national security, or individual rights.

Developers also have to report any safety incidents that lead to physical harm, substantial economic injury, or critical infrastructure disruption. Those reports go to the newly created Illinois AI Safety Office, which runs a public incident database.

Penalties for non-compliance are steep. Serious or repeat violations carry fines up to 2% of global annual revenue. Courts can order deployment suspensions, corrective actions, and hold corporate officers personally liable for knowing and willful violations. That last part has corporate legal teams paying close attention.

What this means for AI regulation

Federal AI regulation in the US has stalled. The Illinois Act is the first attempt to fill that gap with enforceable rules instead of voluntary industry principles. It follows California's proposed but unpassed SB 1047, which critics said was too vague. It also sits alongside the EU AI Act, which is now entering phased enforcement.

The law breaks new ground in several ways.

Audits come from outside, not from inside. Companies cannot pick their own auditor. The AI Safety Office must approve auditing firms, and auditors owe duties to both the state and the public. This addresses a known weakness in the EU AI Act, where internal compliance teams run self-assessments.

There is a hard computational threshold. The 10^26 FLOP cutoff provides an objective measure of which models fall under the Act. Critics argue it is easy to evade by training several smaller models instead of one large one. The Act includes a mechanism for the Safety Office to designate additional systems.

Executives face personal risk. The personal liability provision makes it harder for executives to look the other way. Few people want to face personal legal exposure over their organization's compliance failures.

What businesses should know

For most businesses deploying AI, the immediate effect is limited. The Illinois Act covers only frontier systems from the largest developers. But the state-level precedent matters. If other states follow, the patchwork of regulation could create real compliance burdens for companies operating nationally. The Act also creates a template that federal legislation could adopt.

Teams building on frontier model APIs should track audit results as they become public through the incident database.

Legal teams should note the extraterritorial reach. The Act applies to any covered model deployed in Illinois, regardless of where the developer is based. That jurisdictional hook mirrors the EU AI Act.