Illinois Governor JB Pritzker signed SB 315 on July 6, making Illinois the first US state to require mandatory annual independent audits of frontier AI developers. The Artificial Intelligence Safety Measures Act puts OpenAI, Anthropic, Google DeepMind, Meta, and xAI directly in its sights. The law takes effect January 1, 2027, with full audit obligations beginning January 1, 2028 — and the Illinois Attorney General as enforcer, with civil penalties up to $3 million per violation.
This isn’t a framework or a set of principles. It’s a compliance deadline with teeth.
Who Illinois SB 315 Actually Targets #
Not every AI company is in scope. SB 315 applies to “large frontier developers” meeting both criteria simultaneously: annual gross revenues exceeding $500 million, and training models using more than 10^26 operations of computing power. That’s a narrow window — approximately a dozen companies globally. Developers at startups, mid-size AI firms, and application companies building on top of existing models fall outside the law entirely.
The companies squarely in scope are the ones you’d expect: OpenAI, Anthropic, Google DeepMind, Meta AI, xAI. Notably, both Anthropic and OpenAI publicly endorsed the law — an unusual stance for companies accepting new regulation. That endorsement signals something: they’d rather deal with a predictable Illinois framework than an unpredictable federal patchwork.
What Frontier AI Developers Must Build by 2028 #
According to the Mac Murray & Shuster legal analysis, covered developers must create four interconnected compliance pillars before the 2028 deadline. First, a documented “Frontier AI Framework” — a living governance document describing how the company identifies, assesses, and mitigates catastrophic risks, publicly disclosed and updated annually. Second, pre-deployment transparency reports: before releasing any covered model, companies publish a report covering intended uses, output types, capabilities, limitations, and catastrophic-risk assessments. Third, annual independent third-party audits starting 2028 with no financial conflicts of interest. Fourth, mandatory incident reporting within 24 hours for imminent threats to life and 72 hours for standard critical safety incidents.
That 72-hour incident window is the sharpest operational requirement. It mirrors existing bank breach reporting rules and will require dedicated safety teams and escalation processes that most AI companies don’t have formalized today.
Related:[FTC AI Accuracy Policy: What Developers Must Do by July 31]
How “Catastrophic Risk” Is Defined — Narrower Than You Think #
“Catastrophic risk” has a specific legal definition under SB 315, and it’s considerably narrower than the EU AI Act’s broad “high-risk” framing. The law covers scenarios where a model could materially contribute to: death or serious injury to 50 or more people or property damage exceeding $1 billion through CBRN weapons assistance; autonomous cyberattacks or serious crimes without meaningful human oversight; or loss of developer and user control over the model itself. The law explicitly excludes harms from publicly available information and situations where the model didn’t materially contribute to combined harm.
This narrow definition is a deliberate design choice. As Capitol News Illinois noted, the bill passed 110-0 in the House and 52-5 in the Senate — bipartisan margins achieved in part by keeping scope tight enough that most members didn’t see it as overreach. The Frontier AI Framework obligation exists regardless of whether a company believes its model poses catastrophic risk. You don’t get to grade your own homework.
This Won’t Stay in Illinois #
Illinois passed BIPA — the Biometric Information Privacy Act — in 2008. Industry critics dismissed it as parochial, unenforceable, and redundant. It became the most litigated privacy law in the United States, effectively set national standards for biometric data handling, and shaped federal discussions for fifteen years. Companies that assumed BIPA would stay local paid for that assumption with hundreds of class-action lawsuits.
SB 315 has structural advantages BIPA never had. The bipartisan 110-0 House vote makes it politically durable. Anthropic and OpenAI’s endorsements reduce the credibility of industry opposition. The law also includes a federal interoperability clause: companies complying with equivalent federal standards automatically satisfy Illinois requirements — a provision that simultaneously encourages federal action and blunts preemption arguments from the Trump administration.
Governor Pritzker was explicit about the ambition: “Illinois is stepping up to fill the gap” while Congress hasn’t acted. Other states are watching. If the White House voluntary framework currently under negotiation lacks enforcement teeth, expect SB 315-style laws in New York, California, and Texas to follow.
Key Takeaways #
- SB 315 targets approximately 12 companies globally — those with $500M+ revenue AND training compute above 10^26 operations. Startups and app builders are not affected.
- Covered companies need a documented Frontier AI Framework, pre-deployment transparency reports, 72-hour incident reporting, and annual independent audits by 2028.
- The law takes effect January 1, 2027, with audit obligations beginning January 1, 2028. The timeline to build compliance infrastructure starts now.
- Illinois BIPA became national de facto policy after being dismissed as “just a state law” in 2008. Dismissing SB 315 as local carries that same risk.
- The law’s federal interoperability clause makes it harder to preempt without replacing it with something comparable at the federal level.