From the journal

Illinois Enacts Artificial Intelligence Safety Measures Act for Frontier AI Developers, USA, July 2026

On 6 July 2026, Illinois Governor JB Pritzker signed Senate Bill 315, the Artificial Intelligence Safety Measures Act (AISMA), into law, making Illinois the third US state to pass frontier AI legislation and the first to require mandatory independent third-party safety audits. The Act imposes safety auditing, governance, and transparency obligations on developers of frontier AI models meeting defined capability thresholds.

2 min read

On 6 July 2026, Illinois Governor JB Pritzker signed Senate Bill 315, the Artificial Intelligence Safety Measures Act (AISMA), into law. Illinois becomes the third US state to pass frontier AI legislation and the first to require independent third-party safety audits as a statutory condition for frontier model deployment. The Act takes effect on a phased schedule, with certain provisions contingent on further rulemaking by designated state agencies.

AISMA applies to developers of frontier AI models meeting capability thresholds defined in the Act. Key statutory obligations include conducting and publishing independent third-party safety audits before deploying a covered model, implementing and maintaining an AI safety programme, disclosing specified technical information about covered models to the Illinois Attorney General, and reporting safety incidents to designated state authorities. AISMA is the first US state law to impose mandatory independent third-party audits as a statutory condition for frontier model deployment.

Developers of large-scale AI models marketed or deployed with Illinois users face direct compliance costs, including third-party audit expenditures and disclosure obligations to the Attorney General. Technology companies, AI foundation model providers, and enterprise AI deployers now face a patchwork of state-level frontier AI obligations, with AISMA joining similar legislation in Colorado. Legal counsel advising AI clients on Illinois-nexus transactions must account for AISMA requirements in due diligence, licensing, and contractual risk allocations.

AISMA includes a safe-harbour for developers who have conducted audits in compliance with specified standards and reported safety incidents in good faith. The Act conditions enforcement on a right to cure and vests the Illinois Attorney General with primary enforcement authority. Open questions include the exact capability thresholds that will trigger coverage, which the Act delegates to agency rulemaking.

Licentium advises AI developers and operators on US state AI regulation, safety programme design, and audit readiness. For questions about AISMA compliance or the broader US state AI regulatory environment, contact us. Work we undertake includes frontier AI regulatory gap analysis, safety programme governance design, third-party audit preparation, multi-state compliance strategy, and AI policy advisory.

Source: Governor Pritzker Signs Artificial Intelligence Safety Measures Act (SB 315), Illinois.gov, 6 July 2026

AI Regulatory

More from the journal

See all

Earned wage access regulation for a Philippine app entering the UK

A hypothetical Philippine fintech supplies an app through which UK employees request part of their accrued net wages before payday. Employers provide time-worked and payroll data, and the next payroll run reconciles payments and charges. Which arrangements remain a payroll feature, which create regulated credit or payment services, and which structure should the company launch? The proposed first employer is in England and Wales; the financial-services analysis addresses UK entry, with Philippine obligations assessed separately by activity.

EU Digital Identity Wallet KYC through a UAE fintech app

A UAE technology company plans to use credentials from European Digital Identity Wallets when customers apply for accounts supplied by an EU financial institution. This hypothetical uses a mainland Dubai company, a German-authorised electronic-money institution and an initial service for adults resident in Germany. Three variants are compared: the institution requests credentials and returns a result, the UAE firm seeks its own relying-party status, or an identity vendor verifies for both organisations. The account provider retains its onboarding responsibility in each arrangement.

CARF crypto reporting and DAC8 crypto duties for one international platform

A UK-based crypto group serves customers resident in the European Union and Brazil through one app and several affiliated companies. This hypothetical case study follows the group’s 2026 reporting decisions under the EU’s DAC8 rules, national CARF implementation and Brazil’s DeCripto requirements. The central question is which legal entity must collect information and report each activity, and when a filing can discharge another obligation.