Illinois signs the Artificial Intelligence Safety Measures Act (SB 315)

The Artificial Intelligence Safety Measures Act, Senate Bill 315, is an Illinois law that creates safety, transparency and audit obligations for developers of the largest frontier artificial intelligence models.

Governor JB Pritzker signed the bill into law at a ceremony in Chicago on July 6, 2026.

What it is

The law covers frontier AI models, defined by Capitol News Illinois as those developed by companies that generate more than $500 million in annual revenue and are trained using massive computing power.

The legislation mirrors frontier-safety bills already enacted in California and New York, and its sponsors say it establishes a new national benchmark for AI oversight.

What it requires

The Act requires large frontier developers to create, implement, publish, and annually update a frontier AI framework addressing catastrophic-risk assessment, mitigations, cybersecurity, internal governance, third-party evaluations, and risks from internal use of frontier models.

Covered developers must also issue transparency reports before deploying new or substantially modified frontier models and complete annual independent third-party audits.

Developers must report critical safety incidents within 72 hours of identifying them, or within 24 hours if there is imminent risk of death or serious physical injury.

The law also adds whistleblower protections and internal reporting processes for covered employees, and it establishes civil penalties for violations while creating no private right of action.

The legislative record for the bill states it contains home rule limitations and severability provisions and is effective January 1, 2027.

What security leaders should do

CISOs at large model developers should map their AI stack against the catastrophic-risk categories the Act names, since it directs the Illinois Emergency Management Agency and Office of Homeland Security, in consultation with the Attorney General, to administer reporting mechanisms tied to those categories.

Security and compliance teams should build the 72-hour and 24-hour incident-reporting clocks into existing incident-response playbooks well before the January 1, 2027 effective date, and prepare evidentiary trails for the mandated annual independent third-party audits so the audit process does not become a scramble against the reporting deadlines the Act sets.