Illinois Becomes First State to Require Independent AI Safety Audits

Governor JB Pritzker signed Senate Bill 315, the Artificial Intelligence Safety Measures Act, on July 6, 2026, making Illinois the first state to require independent third-party safety audits of large frontier AI developers. It is now Public Act 104-0538, and it takes effect on January 1, 2027.

A frontier developer, under the act, is anyone who trains a foundation model using more than 10^26 integer or floating-point operations. A large frontier developer is one of those whose group revenue exceeded $500 million in the preceding calendar year. The duties split along that line. Every frontier developer, large or not, must report a critical safety incident to the state within 72 hours of learning enough to reasonably believe one has occurred. The heavier duties sit on the large tier: publish and annually update a frontier AI framework, publish summaries of catastrophic-risk assessments before deploying a new or substantially modified model, and retain an independent third party each year to audit compliance and publish a summary of the findings. The framework and the audit both start January 1, 2028, a year after the act itself. The law adds whistleblower protections for employees who report safety concerns and authorizes civil penalties of up to $1 million for an initial violation and $3 million for repeat violations.

Four questions decide how far this statute reaches a carrier. It imposes no direct deployer duty, but it does move the vendor-oversight baseline. First, do any of the large language or foundation models used in pricing, claims, underwriting support, or customer service meet the developer size or compute threshold? Second, are the catastrophic-risk disclosures and annual audit summaries available from the vendor, or will the carrier need to request them contractually? Third, do incident-response playbooks cover a scenario in which a covered model has a critical safety incident and must be reported to Illinois within 72 hours? Fourth, how will the carrier demonstrate to Illinois, NAIC, or other state examiners that it reviewed these materials before putting the model into production?

The law also signals that states are moving from voluntary AI ethics frameworks to mandatory disclosure and audit regimes. That shift matters for procurement because many carrier AI agreements were negotiated before any state required safety-audit rights. Legal and compliance teams should now add audit-summary access, incident-notification timelines, and cooperation-with-regulator clauses to vendor contracts before renewals. The Illinois law may also influence how other state insurance departments view third-party model documentation, especially as regulators begin using the NAIC AI Systems Evaluation Tool.

One operational detail is worth watching. The Illinois Emergency Management Agency and Office of Homeland Security, in consultation with the Attorney General, runs the reporting mechanisms. The incident definitions are not waiting on a rulemaking; they sit in Section 5 of the act as four categories, each tied to death, bodily injury, or a model using deceptive techniques to subvert its developer’s controls. Carriers can map those against their existing model-risk event taxonomy now. A 72-hour reporting clock at the developer level will create pressure on downstream deployers to detect and escalate issues quickly. If the escalation path from engineering to legal runs through ad hoc email, 72 hours is not enough time to establish whether an incident is reportable, let alone report it. A standing model incident register removes most of that lag.

The gap federal inaction leaves on AI oversight keeps getting filled one state at a time. Illinois aims at frontier developers rather than insurers, but the three things it writes down are the three an AI governance program is already asked to produce: documented risk assessment, independent review, incident reporting. Section 17 shows how far Illinois expects that to travel. A frontier developer can be treated as compliant here by complying instead with a federal law the Agency has designated as equivalent, and one of the four conditions for that designation is that the federal regime require independent third-party audits of its own. Illinois has set a floor and left the door open for Washington to meet it. Until something does, the audit summary a carrier wants from its model vendor is a 2028 document, and the contract clause entitling it to one has to be written this renewal cycle.