Illinois SB 315 Explained: Who It Covers and What Devs Must Do by 2028

What SB 315 Actually Changes in U.S. AI Regulation

Illinois Senate Bill 315 — the Artificial Intelligence Safety Measures Act — is the first U.S. state law to mandate annual independent third-party audits of frontier AI safety practices. The Illinois House passed it unanimously, 110–0 , and the Senate cleared it 52–5 on May 20–21, 2026 . Governor J.B. Pritzker publicly committed to signing, citing the need for accountability for Big Tech . That near-unanimous political support — and the specific audit mandate — sets SB 315 apart from every prior U.S. state-level AI safety law.

Prior state frameworks — California's SB 53 (the Transparency in Frontier AI Act) and New York's RAISE Act, both passed in late 2025 — established disclosure and incident-reporting requirements but relied entirely on developer self-attestation . Critics described this as companies grading their own homework. Illinois ends that structure by requiring external verification of whatever safety claims developers publish. That single distinction is what analysts mean when they call SB 315 the strongest frontier AI law in the country.

SB 315 is one part of an eight-bill AI package the Illinois legislature advanced in the same session . The other seven bills target narrower domains — therapy chatbot restrictions, digital replica rights, and hiring algorithm disclosures — but SB 315 is the tier aimed at frontier model developers specifically. Illinois had already enacted an AI therapy ban in August 2025 , but this is the state's first measure regulating at the model-development tier itself.

The political context matters: a 110–0 House vote is unusually lopsided for tech legislation, which often fractures along party lines. The bill's sponsors framed it explicitly as precautionary guardrails on worst-case AI scenarios, rather than a general AI regulatory framework. Sen. Mary Edly-Allen (D-Lake County) led the bill in the Senate; Rep. Daniel Didech sponsored it on the House side. Both framed the objective narrowly — preventing catastrophic harms from frontier systems — which appears to have neutralized the partisan opposition that typically forms around tech bills.

"A roadmap for responsible innovation to prevent catastrophic risks." — Sen. Mary Edly-Allen, D-Lake County, lead Senate sponsor of SB 315 (source: Capitol News Illinois)

The $500M Revenue Threshold: Who Is In and Who Is Out

SB 315's compliance architecture is deliberately tiered. Full obligations — safety framework publication, annual third-party audits, pre-deployment disclosures, and incident reporting — apply only to frontier AI developers whose annual revenues exceed $500 million . Companies below that threshold are explicitly excluded from the audit mandate and most other provisions. If your AI company is below $500M in annual revenue, SB 315 imposes no direct compliance requirements on your development or deployment processes.

The threshold was calibrated to capture the largest labs currently deploying general-purpose frontier models. OpenAI, Anthropic, Google DeepMind, Meta, and xAI are squarely within scope . No startup or mid-size AI company currently operating near this revenue range faces the audit or safety framework obligations under the bill's current text.

One detail worth flagging for legal and compliance teams: the revenue test is tied to the developer entity's global annual revenue, not to Illinois-specific operations or Illinois-derived revenue . A company with $600M in global revenue but minimal Illinois business is still in scope. Conversely, a company earning $200M in Illinois from a $450M global base remains out of scope. The threshold applies to the developer entity as a whole, not to any jurisdictional revenue slice.

This structure creates a clean two-tier system, but it also bakes in an asymmetry: the companies best positioned to absorb compliance costs are the only ones required to absorb them. Challengers building toward frontier capabilities but currently below $500M face no obligations — until they cross the threshold. Whether that floor gets adjusted in future amendments, or whether it becomes the template other states adopt, is an open question. For now, the threshold is explicit, and the compliance burden it triggers is substantial.

Five Compliance Obligations for Covered Developers

For developers who clear the $500M threshold, SB 315 establishes five distinct obligations that together constitute the most comprehensive frontier AI compliance framework enacted by any U.S. state. Each obligation has a defined cadence, scope, and enforcement hook. Here is what each one means operationally.

The third obligation — annual third-party audits — is the provision with no precedent in U.S. state law . The statute does not name specific auditors or define accreditation requirements. Analysts expect Big Four accounting firms (Deloitte, EY, KPMG, PwC) and specialized AI evaluators — METR, Transluce, and AVERI (members of the AI Evaluator Forum) — to compete for these mandates. IEMA is expected to issue guidance on auditor qualifications before the 2028 effective date. The audit market for frontier AI is currently nascent, and those standards will need to be built from near-zero over the next 18 months.

The safety framework requirement has structural teeth because it is anchored directly to the audit: auditors verify compliance against the company's own published safety claims . This creates a legal incentive to make published claims accurate rather than aspirational. A company that publishes an ambitious safety framework and then fails to substantiate it in an audit is in a materially worse position than one that published modest claims and met them.

Pre-deployment disclosures apply to new frontier models and "substantially modified" existing models . The definition of "substantially modified" is not fully specified in the bill text and will require IEMA rulemaking to operationalize. For companies running continuous fine-tuning or incremental capability expansion on existing models, this is the highest-ambiguity obligation in the bill — the one where early engagement with IEMA's rulemaking process will pay dividends.

The whistleblower provisions codify formal internal reporting channels into Illinois statute, not just company policy. Employees at covered companies who raise safety concerns through proper channels receive statutory protections against retaliation . This is a structural governance requirement that interacts with the audit: auditors can assess whether internal reporting infrastructure exists and functions, independently of whether anyone has actually used it.

The 2028 Effective Date: What Extended the Timeline

SB 315 carries a 2028 effective date — a one-year extension from the bill's original 2027 target. The extension was negotiated during the legislative process to give covered companies sufficient time to select auditors, publish initial safety frameworks, and build incident reporting pipelines that meet the statute's requirements . Assuming Governor Pritzker signs in mid-2026, the practical compliance window is approximately 18 to 24 months .

That window is tighter than it sounds. Audit procurement at large organizations — sourcing vendors, issuing RFPs, negotiating scope and fees, executing agreements — typically takes 6 to 12 months for a novel compliance regime. Safety framework drafting requires cross-functional input from legal, security, engineering, and policy teams, followed by internal review and public publication. Companies that wait until 2027 to begin auditor procurement may find evaluator capacity constrained, especially if multiple covered firms are simultaneously competing for the same specialized evaluators.

"Put up some guardrails and make sure we have some safeguards in place to protect against some of the worst catastrophic risks." — Rep. Daniel Didech, House sponsor of SB 315 (source: NBC News)

No retroactive compliance is required for models deployed before the 2028 effective date. But any frontier model that undergoes substantial modification after the effective date triggers the pre-deployment disclosure requirement, regardless of when the underlying model was first released . For labs running continuous capability expansion on production models, this is operationally significant: the update cadence that currently feels like routine development will need a legal review layer post-2028.

The timeline also mirrors the adoption curves seen in NIST AI Risk Management Framework rollouts at large enterprises. Organizations that went through NIST AI RMF adoption in regulated industries consistently reported that internal governance alignment — getting engineering, legal, and risk teams to agree on shared risk definitions — took longer than anticipated. SB 315's compliance cycle will surface the same organizational friction. Covered companies that treat this as a documentation exercise rather than an infrastructure build will likely struggle in their first audit cycles.

Enforcement: IEMA, Civil Penalties, No Private Lawsuits

Enforcement of SB 315 runs through two state bodies: the Illinois Emergency Management Agency (IEMA) and the Office of Homeland Security. IEMA owns the primary oversight functions — receiving incident reports, issuing implementing guidance, and publishing the annual public compliance reports mandated by the statute . Civil penalties apply for violations; the statute does not specify penalty amounts in the current text, leaving the penalty schedule to IEMA rulemaking.

The annual public compliance reports are an underappreciated enforcement layer. When IEMA publishes a report identifying which covered companies met audit requirements and which did not, that information becomes public market data. Investors, enterprise customers, and partners will have access to a state-curated compliance record. This reputational dimension operates alongside formal civil penalties — a company that fails its first audit faces both a fine and a public disclosure of that failure in IEMA's annual report.

"All liability and no standards." — Chamber of Progress, representing members including Google, Apple, Amazon, and Andreessen Horowitz, in formal opposition to SB 315 (source: DNYUZ)

The most consequential structural feature of the enforcement model is what it omits: SB 315 explicitly does not create a private right of action . No individual, no competing company, and no advocacy organization can bring a lawsuit against a covered company under this statute. Enforcement is entirely state-initiated through IEMA.

For Illinois developers and compliance teams already familiar with the state's privacy enforcement landscape, this is a significant departure. Illinois BIPA (Biometric Information Privacy Act) and California CCPA are primarily enforced through plaintiff litigation — the threat of class-action suits is the primary driver of compliance investment in those regimes. SB 315's state-only enforcement model means the compliance risk profile is different: exposure comes from IEMA findings, not from plaintiff attorneys. Whether that makes SB 315 weaker or more predictable than BIPA enforcement depends entirely on how aggressively IEMA pursues violations — a question that won't be answered until the first compliance cycle completes in 2028 or 2029.

SB 315 vs. California SB 53 vs. New York RAISE Act

Three U.S. state laws now address frontier AI safety — Illinois SB 315, California SB 53 (Transparency in Frontier AI Act), and New York's RAISE Act — and they diverge in ways that matter for companies operating across state lines. All three require some form of safety disclosure and incident reporting. The structural split is on verification: Illinois mandates independent external audits of those disclosures; California and New York rely on developer self-attestation .

The practical gap between a self-attested disclosure and an audited one is significant in practice. California SB 53 requires AI developers to publish safety protocols — but there is no external check on whether those protocols are actually implemented . New York's RAISE Act follows the same structure. Companies subject to SB 315 face a substantively higher compliance bar: an external auditor, not the company itself, certifies that published safety claims are backed by real practices.

For companies already subject to California SB 53 — which includes most of the same $500M+ labs — Illinois adds a verification layer on top of the disclosure layer. The compliance work is not simply duplicated: safety framework documentation prepared for California publication can feed into the Illinois audit process, but the audit itself requires additional coordination — auditor selection, scope negotiation, document production — that the California process does not. Compliance teams should plan for Illinois as an additive workload, not a reuse of California compliance artifacts.

A multi-state patchwork is now clearly forming. The three frameworks use different enforcement bodies, penalty structures, and scope definitions. A company subject to all three jurisdictions needs separate compliance tracks for each law, at minimum until a federal framework emerges or states begin harmonizing their requirements. IEMA's annual public compliance reports, beginning in 2028, will add a layer of publicly accessible data that other states and federal regulators will reference when designing subsequent frameworks.

Why OpenAI and Anthropic Formally Backed This Bill

OpenAI and Anthropic both formally supported SB 315 throughout the Illinois legislative process — an unusual posture for major AI developers endorsing direct regulation of their own operations . Understanding why requires thinking about the structural incentives, not the press statements.

The strategic logic is straightforward: companies with existing internal safety programs — structured red-teaming, documented risk frameworks, internal governance with real staffing — absorb compliance costs more cheaply than companies building these structures from scratch. If SB 315's audit requirements are real and uniformly applied, the compliance cost becomes a moat. Smaller competitors or new entrants that reach $500M in revenue face audit infrastructure costs that the incumbents have already amortized into existing safety operations. The regulation benefits those who helped design the compliance architecture.

"Illinois lawmakers just passed America's strongest AI safety bill" — Transparency Coalition AI, an advocacy organization that tracked the bill through the legislature (source: Transparency Coalition AI)

There is a related concern worth naming directly: regulatory capture through credentialing. An externally credentialed "audit passed" label can function as a marketing signal as much as an accountability mechanism. If IEMA's auditor qualification standards are shaped primarily by the companies being audited, or if audit scope is narrow enough to avoid surfacing real failures, the audit label could become a reputational asset that obscures rather than reveals actual safety practices. The bill's accountability depends almost entirely on the independence and rigor of the audit standard IEMA develops — a standard that does not yet exist.

The $500M threshold structurally encodes incumbent advantage into the law. OpenAI, Anthropic, Google DeepMind, Meta, and xAI absorb audit costs as a budget line item. Most challengers — open-source model developers, fast-scaling AI infrastructure companies, research labs approaching frontier capabilities — sit below the threshold and face no obligations. If the policy goal is uniform safety standards across all frontier model developers, the threshold creates a structural gap. If the goal is proving out a compliance regime with the organizations most capable of sustaining it in year one, the threshold is a defensible starting point.

Formal opposition came from the Chamber of Progress — representing Google, Apple, Amazon, and Andreessen Horowitz — which called the bill "all liability and no standards" . The American Innovators Network, TechNet, and NetChoice also raised concerns about auditing clarity and cost burden . Those objections did not move the 110-0 House vote. They will, however, shape the lobbying activity during IEMA's rulemaking — which is where the operational details that determine whether this law has teeth will actually be decided.

What Comes Next: Federal Preemption Risk and the Remaining Seven Bills

SB 315 is the highest-profile element of an eight-bill AI package the Illinois legislature advanced simultaneously . The other seven bills target narrower domains: AI therapy chatbot restrictions, digital replica rights enforcement, hiring algorithm disclosure requirements, and related consumer protection provisions. Together they establish Illinois as one of the most active state-level AI regulatory environments in the U.S., even as federal action remains limited.

The federal preemption question is the biggest variable in SB 315's long-term relevance. No enacted federal AI safety law with equivalent audit requirements exists as of May 2026 . If Congress passes a federal AI framework before 2028, it could preempt state laws — either superseding SB 315 entirely or establishing a floor that state laws must meet. Given the current pace of federal AI legislation, state frameworks are likely to operate as the primary compliance environment through the near term, which means SB 315's audit model may function as the de facto national standard.

Illinois is the third-largest U.S. state economy, and large AI companies do substantial business there . IEMA's annual public compliance reports, required starting in 2028, will produce publicly accessible data that other states and federal regulators will cite when designing subsequent frameworks — echoing how Illinois BIPA became a de facto national biometric data standard before most states had enacted their own laws. Developers building for enterprise and regulated markets should track whether additional states adopt the audit-mandate model ahead of any federal consolidation.

The audit infrastructure that SB 315 requires does not exist at scale today. The firms, standards, and accreditation processes that emerge over the next 18 months will define what compliance actually looks like in the first cycle. Engagement with IEMA's rulemaking process — and with the specialized evaluators who will compete for audit mandates — is higher-leverage than waiting for final rules to arrive.

Frequently Asked Questions

Does Illinois SB 315 apply to my AI startup?

Almost certainly not. SB 315's compliance obligations — safety framework publication, annual third-party audits, pre-deployment disclosures, and critical incident reporting — apply only to frontier AI developers with annual revenues exceeding $500 million . Startups and mid-size AI companies below that threshold are explicitly excluded from the audit mandate and most other provisions. The $500M figure is based on global annual revenue of the developer entity as a whole, not Illinois-specific operations. If your company is below that revenue threshold, SB 315 imposes no direct compliance requirements on your AI development or deployment processes under the current bill text.

What qualifies as a 'catastrophic risk' under SB 315?

The bill requires covered companies to define and assess catastrophic risks in their published safety frameworks — it does not provide an exhaustive statutory definition. Based on the bill's legislative record and the broader frontier AI risk literature, the expected scope covers cyberattacks that could enable mass harm, autonomous AI capabilities that exceed human oversight and control, and large-scale misuse scenarios enabled by frontier models. The key structural point is that companies define their own risk scope, and auditors then verify that the assessment is credible and that the described mitigations are actually implemented. This creates an incentive for accurate rather than aspirational risk characterization: overpromising in a published safety framework creates audit exposure.

When does SB 315 take effect and what triggers the compliance clock?

The effective date is 2028, extended from an earlier 2027 target during legislative negotiations . Governor Pritzker's publicly committed signing in 2026 starts the practical compliance clock. Covered companies have approximately 18 to 24 months from signing to select auditors, publish initial safety frameworks, and build incident reporting infrastructure. Given that auditor procurement alone typically takes 6 to 12 months at large organizations, companies in scope should begin that process in 2026 to avoid calendar pressure. No retroactive compliance is required for models already deployed before 2028 — but substantially modified models post-2028 trigger pre-deployment disclosure requirements regardless of when the underlying model was first released.

Can individuals or other companies sue under SB 315?

No. SB 315 explicitly does not create a private right of action . No individual, competing company, or advocacy organization can file a lawsuit against a covered company under this statute. Enforcement is entirely state-initiated through IEMA and the Office of Homeland Security, with civil penalties for violations. This is a meaningful structural distinction from Illinois BIPA or California CCPA, where private lawsuits — including class actions — are the primary compliance driver. SB 315's enforcement model means compliance risk flows from IEMA findings and annual public reports, not from plaintiff litigation. Whether that makes enforcement weaker or more predictable than BIPA depends on IEMA's posture in the first audit cycle.

Which firms are expected to conduct the mandatory audits?

The statute does not name specific auditors or define formal accreditation requirements. IEMA is expected to issue auditor qualification guidance before the 2028 effective date. Analysts expect two categories of firms to compete for these mandates: Big Four accounting firms (Deloitte, EY, KPMG, PwC) with established compliance audit infrastructure, and specialized AI evaluators — METR, Transluce, and AVERI (members of the AI Evaluator Forum) — with domain-specific technical expertise in frontier model evaluation . The frontier AI audit market is currently nascent; standards, scope definitions, and auditor qualifications will take shape through IEMA rulemaking and early audit cycles. Covered companies that engage with potential auditors early will have more ability to influence how audit scope is defined in practice.

What SB 315 Means for Developers Building on the Frontier Stack

Illinois SB 315 is not a broad AI regulation — it is a targeted compliance framework aimed at the five or six organizations deploying the largest general-purpose frontier models. For the developers who build on top of those models rather than develop them, the direct compliance burden under current bill text is zero. But the downstream effects will be felt across the ecosystem: how audited safety frameworks constrain what APIs expose, how incident reporting interacts with model update cadences, how the annual audit cycle affects model release timelines at the major labs.

The law's practical impact depends almost entirely on what IEMA does in the rulemaking phase between now and 2028. The audit standards, auditor qualifications, and definition of "substantially modified" that emerge from that process will determine whether SB 315 produces meaningful accountability or generates an audit industry around compliance theater. The companies that engage with that rulemaking process — covered labs, specialized evaluators, and the enterprise customers who depend on audited AI systems — will shape those outcomes more than the bill text itself.

For anyone tracking AI regulation with an eye toward compliance planning, the Illinois IEMA annual public reports starting in 2028 are the data source to watch. They will be the first state-produced, audit-verified compliance records on frontier AI safety practices in U.S. history. Other states, federal regulators, and international bodies will cite them. The audit ecosystem, the standards it develops, and the findings it produces will define what "responsible AI deployment" means in practice for the regulated enterprise market — independent of what any lab's marketing materials say about safety.

Last updated: 2026-05-28. This article reflects the bill's passage by the Illinois General Assembly on May 27–28, 2026. Governor Pritzker's signature was publicly committed but had not yet been formally recorded as of publication. IEMA implementing rules, auditor qualification guidance, and penalty schedules have not yet been issued.