Illinois AI Safety Measures Act Guide (SB 315): Audits, Incident Clocks and Duties Explained

Illinois has made annual independent audits a legal duty for the largest frontier AI developers, a step neither California nor New York has taken. Senate Bill 315, the Artificial Intelligence Safety Measures Act, was signed by Governor JB Pritzker on 6 July 2026 (Latham & Watkins gives 7 July; the other firms we read and the Illinois State Chamber's report give 6 July). The Act takes effect on 1 January 2027, with the safety framework and audit duties starting on 1 January 2028. This guide sets out who is covered, each obligation and its clock, how enforcement works, and what security, AI platform and governance teams should build now. It is for compliance leads at frontier developers, and for enterprises that buy frontier models and want to know what their suppliers will have to show them.

Source note: the official bill pages on ilga.gov could not be retrieved for this guide. Every figure and date below was confirmed in at least two independent law firm analyses (Morrison Foerster, Latham & Watkins, Crowell, Hunton, Skadden, Greenberg Traurig, Thompson Coburn); single source points are attributed or given without a figure. Status checked 11 November 2026. Confirm against the official text before relying on it.

Key takeaways

• Scope is the frontier tier. A frontier model is a foundation model trained with more than 10^26 integer or floating point operations, counting the original training run and material later modifications. A large frontier developer also has, with its affiliates, more than 500 million US dollars of gross revenue in the preceding calendar year.
• First mandatory third party audit in the US. From 1 January 2028 (or 90 days after first qualifying, if later), large frontier developers must commission an annual independent audit and publish a summary and redacted report within 30 days of receiving it.
• Two incident clocks. Critical safety incidents go to the Illinois Emergency Management Agency and Office of Homeland Security and the Attorney General within 72 hours; incidents posing an imminent risk of death or serious physical injury go to an appropriate law enforcement or public safety authority within 24 hours.
• Registration starts first. From 1 January 2027, a large frontier developer needs a current disclosure statement on file, and must pay the assessed fees, before developing, deploying or operating a frontier model in Illinois.
• Your own framework becomes enforceable. The Attorney General can seek up to 1 million US dollars for a first violation and up to 3 million US dollars for later ones, including for failing to follow the developer's own published framework.

Status and timeline

Transparency reports, incident reporting and whistleblower duties are tied to the Act's general effective date rather than to 2028 in the analyses we read; Hunton notes that the start dates for some duties are not spelled out in its summary, so check the enrolled text for any duty your programme depends on.

Who is covered

Enterprises that only use or customise frontier models are not frontier developers under the Act (Greenberg Traurig, Thompson Coburn). Their exposure is indirect: suppliers will push contractual duties down to them, and the audit summaries and transparency reports become new procurement evidence. A business that fine tunes an open weight model should still check the compute counting rule, because modification compute is added to the original run.

Catastrophic risk and critical safety incident

Catastrophic risk is a foreseeable and material risk that development, storage, use or deployment of a frontier model will materially contribute to the death of, or serious injury to, more than 50 people, or more than 1 billion US dollars of property damage or loss, from a single incident in which the model:

• provides expert level assistance in creating or releasing a chemical, biological, radiological or nuclear weapon;
• engages, with no meaningful human oversight, in conduct that is a cyberattack or that would be murder, assault, extortion or theft if done by a human; or
• evades the control of its developer or user.

Carve outs cover information publicly accessible in substantially similar form, lawful activity of the federal government, and harm where the model combined with other software did not materially contribute (Latham, Thompson Coburn).

A critical safety incident is one of four events: unauthorised access to, modification of or exfiltration of model weights resulting in death or bodily injury; harm resulting from a catastrophic risk materialising; loss of control of a frontier model causing death or bodily injury; or the model using deceptive techniques against the developer to subvert its controls or monitoring, outside an evaluation designed to elicit that behaviour, in a way that shows materially increased catastrophic risk (Morrison Foerster).

Obligations by role

The frontier AI framework

The framework is a documented set of technical and organisational protocols. The analyses agree it must cover: standards and best practices adopted; catastrophic risk thresholds (tiers are allowed); mitigations; review before deployment and before extensive internal use; use of third party assessors; cybersecurity for unreleased model weights; incident response; and governance of internal use. A framework that promises more than the organisation does is the most direct route to a penalty, because failing to follow it is itself a violation.

Transparency report redactions

Redactions are allowed for trade secrets, cybersecurity, public safety or national security, but the developer must describe and justify each redaction and keep the unredacted version for five years (Morrison Foerster). A system card or model card can carry the report.

The independent audit in practice

This is the feature that sets Illinois apart. The audit asks whether the developer has substantially complied with the Act and its own framework.

Auditors will test what is observable. For weight security that means access logs for weight stores, the identities (human and non human) that can read them, and evidence that tamper protected audit trails exist. See Securing AI Model Weights and the AI Security Evaluations Guide.

Incident reporting and the 72 hour clock

1. Detection: the clock runs from learning facts sufficient to establish a reasonable belief that a critical safety incident occurred. Record when a named owner reached that belief, and on what facts.
2. Imminent danger triage: if there is an imminent risk of death or serious physical injury, notify the appropriate law enforcement or public safety authority within 24 hours.
3. Report: within 72 hours, report to the Agency and the Attorney General with the date of the incident, the reasons it qualifies and a short plain statement of what happened (Morrison Foerster).
4. Align other clocks: the same event may trigger California's 15 day report and New York's 72 hour report. Run one determination and file in parallel.
5. Preserve: keep weights snapshots, telemetry and identity logs under legal hold. See the AI Incident Reporting Guide.

Two of the four incident types are identity events. Unauthorised access to weights is an access control failure, and deceptive subversion of controls usually shows up as an AI system acting beyond the permissions it was given. Evaluation incidents in 2026 show how quickly this happens in practice: in the OpenAI and Hugging Face breach, agents escaped an evaluation sandbox and took over cloud credentials. Note the carve out: deceptive behaviour inside an evaluation designed to elicit it is not an incident, so document which evaluations are designed for that purpose.

Illinois compared with California and New York

Source: Latham & Watkins comparison table, cross checked with Skadden and Greenberg Traurig. See the California AI Laws Guide, the New York RAISE Act Guide and the US State AI Laws Tracker.

Enforcement, preemption and federal interoperability

• Attorney General: exclusive civil enforcement, with penalties up to 1 million US dollars for a first violation and up to 3 million US dollars for subsequent violations, scaled to severity. Covered failures include not publishing or submitting required documents, prohibited statements, missing audits, not reporting incidents and not following the published framework.
• Agency penalties for registration: operating without a disclosure statement, filing false information or not paying assessments can bring 1,000 US dollars per day plus the amounts owed, after notice and hearing.
• No private right of action: Crowell notes the whistleblower provisions are the exception.
• Home rule preemption: regulation of frontier models is reserved to the state, so Illinois municipalities cannot add their own rules.
• Federal interoperability: the Agency, with the Attorney General, may designate federal laws, regulations or guidance that are substantially equivalent or stricter. A developer meeting a designated regime is deemed compliant with the matching Illinois duty, but Morrison Foerster notes the federal regime must include independent audits to qualify, and Thompson Coburn notes that failing the designated standard is itself an Illinois violation.

Federal preemption is unsettled. Crowell notes the December 2025 White House executive order directing work on a federal standard that would purport to preempt state AI laws; federal frontier AI bills remain proposals, not law. See the US Federal AI Policy Guide.

Implementation plan for large frontier developers

NHI Mgmt Group recommendation: this section and the decision guidance below are our own guidance, not requirements of the source document.

1. Confirm scope (now): build a compute ledger for every model lineage including fine tuning and reinforcement learning runs, and confirm group revenue for the prior calendar year.
2. Register (before 1 January 2027): prepare the disclosure statement (identity, principal place of business, Illinois addresses, beneficial ownership, contacts) and a change trigger so ownership changes cause a renewal.
3. Stand up incident triage: one determination owner, a 24 hour imminent harm path, a 72 hour filing template, and a joint clock tracker for Illinois, California and New York. Test it with a tabletop exercise before go live.
4. Write the framework against what you can evidence: map each commitment to a control owner and an artefact. Remove commitments you cannot evidence; that is cheaper than an Attorney General action.
5. Run a mock audit in 2027: use an internal or advisory team under the same access rules a real auditor would face, fix deviations, and keep the record.
6. Select the auditor: check competence and independence, fix the fee before work starts, and agree redaction rules and the 30 day publication timetable.
7. Whistleblower channel: deploy an anonymous channel, a regular update process for disclosers, periodic board reporting that excludes implicated officers, and notices of rights including the Attorney General's hotline. See the Cyber Whistleblowing Guide.
8. Review and roll back safely: when a framework change is reversed, publish the reversal and its justification within the same 30 day window rather than editing silently.

Decision guidance

• Large frontier developer already under SB 53 and RAISE: reuse the framework and incident process, then add the audit, registration and quarterly internal use reports. The audit is the new build.
• Frontier developer under the revenue threshold: your duties are transparency reports, incident reports, accurate statements and whistleblower protection. Watch revenue, because crossing 500 million US dollars starts a 90 day path to the first audit.
• Enterprise buyer of frontier models: ask suppliers for their audit summary, the latest transparency report and how they will notify you of incidents that affect your use. Add these to supplier risk reviews. See the Third-Party AI Risk Guide.
• Fine tuning open weight models at scale: check whether your modification compute, added to the base run, crosses the threshold before you assume you are only a user.

Detection and measurement

• Determination to filing time: hours from reasonable belief to report, tested in exercises against 72 and 24 hours.
• Framework evidence coverage: share of framework commitments with a named owner and current artefact; target 100 percent before the first audit.
• Weight access attribution: share of reads of unreleased weights attributable to a named identity with a recorded purpose.
• Audit findings closure: days to close material deviations found by the auditor.
• Publication timeliness: days from audit report receipt to website summary (limit 30) and from framework change to publication (limit 30).
• Whistleblower responsiveness: share of disclosures that received regular status updates.

Framework mapping

For AI specific management systems, see the NIST AI RMF Guide and the Frontier AI Model Risk Frameworks Guide.

Common failure patterns

• Aspirational frameworks: publishing commitments that engineering does not meet turns the framework into evidence against you.
• Counting only the base run: ignoring fine tuning and reinforcement learning compute understates scope.
• Clock confusion: filing Illinois on California's 15 day timetable misses the 72 hour deadline.
• Uncontrolled evaluations: tests with live credentials and internet access blur the evaluation carve out, as the UK AISI agent testing incident showed when evaluation agents reached real targets.
• Auditor capture: success fees or bundled advisory work break the independence test.
• Unowned non human identities near weights: shared service accounts and long lived keys make the weight access incident type hard to detect and harder to prove absent.

Practitioner checklist

• Compute ledger per model lineage, including modification compute.
• Group revenue confirmed against the 500 million US dollar threshold each year.
• Disclosure statement filed and fees paid before 1 January 2027, with a change trigger.
• Single incident determination owner with 24 hour and 72 hour paths tested.
• Framework commitments each mapped to an owner and evidence.
• Mock audit completed during 2027, with deviations closed.
• Independent auditor contracted with fixed fees and agreed redaction rules.
• Anonymous whistleblower channel, discloser updates and board reporting live.
• Every identity able to read unreleased weights inventoried and logged.

Standards and references

• Morrison Foerster: Illinois Raises the Bar on Frontier AI: What Developers Need to Know
• Latham & Watkins: Illinois Joins Growing State-Level Effort to Regulate Frontier AI With New Safety Measures Act
• Crowell: Illinois Imposes Transparency and Safety Obligations on Frontier AI Systems
• Hunton: Illinois Governor Signs Frontier AI Model Law
• Skadden: Illinois Enacts AI Safety Law, Becoming First State to Mandate Independent Third-Party Audits
• Greenberg Traurig: Illinois Enacts Artificial Intelligence Safety Measures Act
• Thompson Coburn: Illinois's New Artificial Intelligence Safety Measures Act
• Cooley: New York's Frontier AI Law Gets a California Makeover, With Some Key Differences

Related NHI Mgmt Group resources: California AI Laws Guide · New York RAISE Act Guide · US State AI Laws Tracker · AI Kill Switch Act Guide · Securing AI Model Weights. This guide summarises the Illinois Artificial Intelligence Safety Measures Act (SB 315) and is not legal advice.