Law / United States / 
Illinois
Artificial Intelligence Safety Measures Act
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force in 100 days, effective 1 January 2027.
An AI governance rule binding private bodies.
As of 20 September 2026.
What it requires
- This law does not take effect until 2027-01-01; what follows is what a frontier AI developer must do once it is in force. A frontier developer is one that trains, or initiates the training of, a frontier model using more than 10^26 integer or floating-point operations of computing power; a large frontier developer is a frontier developer whose group had annual gross revenues over $500,000,000 in the preceding calendar year, and carries four of the duties below that the rest do not.
- Before or when you deploy a new or substantially modified frontier model, publish on your website a transparency report giving your website, a way for a person to reach you, the model's release date, its supported languages and output modalities, its intended uses, and any generally applicable restrictions on its use.
- If you are a large frontier developer, add to that transparency report summaries of your catastrophic-risk assessments for the model, their results, the extent of any third-party evaluator involvement, and the other steps you took to meet your frontier AI framework for it.
- If you are a large frontier developer, from 2028-01-01 write, implement, comply with and publish on your website a frontier AI framework covering catastrophic-risk assessment, mitigations, cybersecurity, internal governance, third-party evaluations, and risks from your own internal use of your frontier models.
- If you are a large frontier developer, obtain an annual independent third-party audit of your compliance, and meet the Act's access, retention, and publication requirements for the audit results.
- Report a critical safety incident to the Agency, the Illinois Emergency Management Agency and Office of Homeland Security, and to the Attorney General within 72 hours of learning facts sufficient to establish a reasonable belief that a critical safety incident has occurred.
- Within 24 hours of discovering that a critical safety incident poses an imminent risk of death or serious physical injury, disclose it to an appropriate authority, including a law enforcement or public safety agency with jurisdiction over it.
- Do not adopt or enforce a rule, policy or contract that stops a covered employee disclosing, and do not retaliate against a covered employee for disclosing, information they have reasonable cause to believe shows that your activities pose a specific and substantial danger to public health or safety from a catastrophic risk, or that you violated the Act.
- If you are a large frontier developer, provide a reasonable internal process through which a covered employee can disclose that kind of information to you anonymously, and give that employee a monthly update on your investigation and on what you did in response.
If you get it wrong
Private right of actionNo
What it reaches
Obligation class
Governance, Reporting, Disclosure
What it makes you log
Who may demand the log
Regulator, Auditor or notified body, Public
What the log must hold
Event time, System identity, Human involvement
Log retention
This is the retention period for unredacted information a developer withheld from a published compliance document under a permitted redaction. The retained copy of a third-party audit report itself carries a longer, deployment-linked floor: for as long as the audited frontier model remains deployed, plus five years after that.
- Unit
- Years
- As of
- 21 September 2026
- Basis
- Fixed
- Minimum value
- 5
Logging duty
A large frontier developer must write and publish a documented frontier AI framework and a pre-deployment transparency report, and must retain an annual independent third-party audit report and grant the Agency and the Attorney General access to it on request. Every frontier developer must separately report a critical safety incident within 72 hours, giving the date, the reasons the incident qualifies, and a plain-language description, with an accelerated 24-hour disclosure where the incident poses an imminent risk of death or serious injury. None of these provisions names a log, record, or audit trail directly; each requires the developer to document, retain, or produce something that cannot be shown without a record, so the duty is implicit. The Agency and the Attorney General review submitted incident reports. Section 18 conditions a large frontier developer's separate disclosure-statement filing on developing, deploying, or operating a frontier model in this State, the Act's only territorial clause, but that clause is confined to Section 18's own filing duty and does not extend to the framework, transparency-report, audit, or incident-reporting duties in Sections 10 and 15, none of which carries a territorial qualifier of its own. A critical safety incident report and an unredacted audit report are themselves exempt from public disclosure under the Freedom of Information Act; only the published transparency report and the audit summary are public.
- Kind
- Implicit
- As of
- 21 September 2026
- Provision
- Section 10(a) (frontier AI framework), 10(c) (transparency report), 10(d) (independent third-party audit) and 15(c) (critical safety incident report)
Who checks it
Audit expectation
periodic
Who audits it
Independent third party
Where the report goes
Kept, Filed with regulator, Produced on request, Published summary, Published
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
The Artificial Intelligence Safety Measures Act splits its duties across two classes of developer. A frontier developer is one that trains, or initiates the training of, a frontier model using more than 10^26 integer or floating-point operations of computing power. A large frontier developer is a frontier developer whose group had annual gross revenues over $500,000,000 in the preceding calendar year.
Every frontier developer must publish a transparency report on its website before or when it deploys a new or substantially modified frontier model. Every frontier developer must also report a critical safety incident to the Illinois Emergency Management Agency and Office of Homeland Security and to the Attorney General within 72 hours of learning facts sufficient to establish a reasonable belief that one has occurred.
Where it discovers that a critical safety incident poses an imminent risk of death or serious physical injury, it must separately disclose that incident within 24 hours to an appropriate law enforcement or public safety authority. No frontier developer may retaliate against a covered employee who discloses, with reasonable cause, a specific and substantial danger to public health or safety from a catastrophic risk, or a violation of the Act.
A large frontier developer carries four further duties. It must write, implement and publish a frontier AI framework from January 1, 2028. It must add summaries of its catastrophic-risk assessments to that transparency report. It must obtain an annual independent third-party audit and meet the Act's access, retention and publication requirements for the results.
And it must provide a reasonable internal process through which a covered employee can disclose that kind of information to it anonymously. The Act establishes civil penalties for violations and expressly creates no private right of action, and takes effect January 1, 2027. The bill (as Senate Floor Amendment No. 2, further narrowed by Amendments No. 3 and No. 4) was approved by the Governor on July 6, 2026.
When LexLint raises it
trains_models
Read the law
enacted text of Public Act 104-0538, Illinois General Assembly (ilga.gov)
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.