Illinois Governor JB Pritzker on Monday signed the Artificial Intelligence Safety Measures Act into law, imposing risk-mitigation and independent audit requirements on the largest AI developers. The legislation creates state-level enforcement authority with fines reaching $3 million for repeat violations, filling a gap left by the absence of federal rules.
"AI is the most significant technological innovation and development of the modern age," Governor Pritzker said. "When managed properly, it can foster tremendous growth, productivity and innovation across the economy and vastly improve our quality of life. But with that transformative potential comes catastrophic risk, much of which isn't fully understood yet."
Attorney General Kwame Raoul, who will enforce the law, cited concrete threats from advanced systems. "They have the potential for many good things, but due to their massive computing power, they also could be causing catastrophic events, such as cyberattacks, the creation or release of certain kinds of weapons or the potential of evading control of the developer or user amongst other possible threats," he said.
How the law will be enforced
The Illinois attorney general can fine violators up to $1 million for a first offense and up to $3 million for each additional violation. The bill passed the state House 110-0 and drew support from OpenAI and Anthropic. Legislators designed the measure using 2025 New York and California laws as models, aiming to establish a consistent approach across states.
Transparency and audit requirements
The law targets the most capable models from companies that meet two thresholds - at least $500 million in revenue and a massive computing measurement. Covered developers must publish a transparency framework detailing how they apply industry standards, assess model capabilities and catastrophic risk, and identify and respond to safety incidents. They must also hire third-party auditors to verify compliance, a provision that remains contested by industry groups including TechNet.
Why this matters for IT and development teams
The law directly affects teams building or deploying large-scale AI models at high-revenue organizations. Developers may need to implement processes for measuring catastrophic risk, documenting safety incidents, and supporting external audits. For security and risk-management professionals, the act formalizes what counts as a reportable AI safety event, including cyberattack and weaponization scenarios. Because the regulations are modeled on existing laws in other states, they could set de facto national expectations even without a federal framework - making early preparation a practical priority for engineering and compliance leads.
Your membership also unlocks:
