AI Safety Measures Act (SB 315)

Requires the largest "frontier" AI developers to publish a catastrophic-risk safety framework, submit to first-in-the-nation annual independent third-party audits, and report critical safety incidents to the State within 72 hours.

The second of the governor-sent bills to be signed, and the one with national implications. SB 315 does not regulate a use case — it regulates the developers of the most capable models themselves. A large frontier developer (an affiliated group above $500 million in prior-year revenue that trains a model past the 10^26-operation line) must publish a catastrophic-risk safety framework, file a transparency report before shipping a new or substantially modified frontier model, and — first in the nation — submit those safety practices to an independent third-party audit every year.

The compliance clock is real but staged: the Act takes effect January 1, 2027, and the substantive developer obligations phase in toward January 1, 2028. The enforcement teeth belong to the Attorney General alone — up to $1 million for a first violation and $3 million for each one after — with no private right of action. The sharpest operational duty is speed: a critical safety incident must reach the Illinois Emergency Management Agency and the Attorney General within 72 hours, and within 24 hours where there is an imminent risk of death or serious injury. Gov. Pritzker signed it over a NetChoice veto request, making Illinois the first state to put frontier-model safety practices under an independent audit.

What it requires

Create, publish, and at least annually update a frontier AI safety framework covering catastrophic-risk assessment, mitigations, cybersecurity, internal governance, and third-party evaluation.

Publish a transparency report before deploying a new or substantially modified frontier model.

Undergo an annual independent third-party audit of frontier-model safety practices — the first such requirement in any U.S. state.

Report a critical safety incident to the Illinois Emergency Management Agency and the Attorney General within 72 hours — within 24 hours, and to law enforcement, where there is an imminent risk of death or serious physical injury.

Maintain whistleblower protections for employees who disclose safety concerns.

Who is covered

"Large frontier developers" — a developer, together with its affiliates, with more than $500 million in gross revenue in the prior calendar year that trains a frontier model using more than 10^26 integer or floating-point operations. In practice this reaches the largest model developers (OpenAI, Anthropic, Google, Meta, xAI); it does not reach startups or academic labs below the revenue and compute thresholds.

What the exposure is

Up to $1M first violation, $3M each after

Civil penalties of up to $1 million for a first violation and up to $3 million for each subsequent violation, enforced exclusively by the Illinois Attorney General. There is no private right of action. The substantive developer obligations phase in toward January 1, 2028.

If this applies to you

Determine whether your organization crosses the $500M-revenue and 10^26-operation thresholds that define a "large frontier developer."

Stand up and publish a frontier AI safety framework, and schedule the annual independent third-party audit.

Build a 72-hour (24-hour for imminent-harm) critical-safety-incident reporting pipeline to IEMA and the Attorney General.

Put whistleblower protections and internal escalation channels in place ahead of the 2027–2028 phase-in.

AI Safety Measures Act

What it requires

Who is covered

What the exposure is

Key dates

If this applies to you

Related

Primary sources 3