Illinois Becomes First State to Require Independent AI Safety Audits
Governor JB Pritzker signed Senate Bill 315, the Artificial Intelligence Safety Measures Act, on July 6, 2026, making Illinois the first state to require independent third-party safety audits of large frontier AI developers. The law takes effect on January 1, 2027.
The act applies to developers with more than $500 million in annual gross revenue that train or operate frontier AI models. Covered developers must publish catastrophic-risk assessments, disclose how they identify and respond to critical safety incidents, and report those incidents to the state within 72 hours once they have reason to believe one has occurred. They must also retain an independent third party each year to audit their safety practices and publish a summary of the audit results. The law adds whistleblower protections for employees who report safety concerns and authorizes civil penalties of up to $1 million for an initial violation and $3 million for repeat violations.
For insurers, the statute does not create direct compliance duties as a deployer. But it does create a new baseline for vendor oversight. Carriers should start with four questions. First, do any of the large language or foundation models used in pricing, claims, underwriting support, or customer service meet the developer size or compute threshold? Second, are the catastrophic-risk disclosures and annual audit summaries available from the vendor, or will the carrier need to request them contractually? Third, do incident-response playbooks cover a scenario in which a covered model has a critical safety incident and must be reported to Illinois within 72 hours? Fourth, how will the carrier demonstrate to Illinois, NAIC, or other state examiners that it reviewed these materials before putting the model into production?
The law also signals that states are moving from voluntary AI ethics frameworks to mandatory disclosure and audit regimes. That shift matters for procurement because many carrier AI agreements were negotiated before any state required safety-audit rights. Legal and compliance teams should now add audit-summary access, incident-notification timelines, and cooperation-with-regulator clauses to vendor contracts before renewals. The Illinois law may also influence how other state insurance departments view third-party model documentation, especially as regulators begin using the NAIC AI Systems Evaluation Tool.
One operational detail is worth watching. The Illinois Attorney General and Emergency Management Agency will administer the reporting mechanisms and issue guidance. Once that guidance is released, carriers should map any Illinois-specific incident definitions against their existing model-risk event taxonomy. A 72-hour reporting clock at the developer level will create pressure on downstream deployers to detect and escalate issues quickly. Insurers that already have a model incident register and a clear escalation path from engineering to legal will be in a stronger position than those still relying on ad hoc email chains.
This is the latest example of state legislatures filling the gap left by federal inaction on AI oversight. While Illinois focuses on frontier developers, the underlying expectation (documented risk assessment, independent review, and incident reporting) is the same direction regulators are taking in insurance-specific rules like the NAIC AI Systems Evaluation Tool. For a broader view of how to build an AI governance program that can absorb these overlapping requirements, see our guide on AI governance in insurance.