State Laws Affecting Frontier US AI Companies
Bill page: Illinois

Public Act 104-0538 · Artificial Intelligence Safety Measures Act

Enacted: effective 1 Jan 2027
A plain-language summary laid over the statute; the margin marks where Illinois departs from the California baseline.
Jay Kim

jay.ifp.automation@gmail.com·What this site got wrong

Version read
Enacted text
Bill
SB 315
Citation
PA 104-0538
Effective
2027-01-01 (Sec. 99); frontier AI framework duties begin 2028-01-01 (Sec. 10(a)); the independent-audit duty begins 2028-01-01 or 90 days after a developer first qualifies as a large frontier developer, whichever is later (Sec. 10(d))
Last verified
1 August 2026
Baseline
Cal. SB 53
Cite
Cite this page

Frontier State Law (frontierstatelaw.com), Illinois Public Act 104-0538: Artificial Intelligence Safety Measures Act, verified 1 August 2026. https://frontierstatelaw.com/states/il.html

@misc{frontierstatelaw-il,
  author  = {{Frontier State Law}},
  title   = {Illinois Public Act 104-0538: Artificial Intelligence Safety Measures Act},
  year    = {2026},
  url     = {https://frontierstatelaw.com/states/il.html},
  note    = {Verified 1 August 2026},
}

High-level summary

Ordered by novelty

An SB 53 copy, plus first-in-the-nation annual independent audits, plus a 72-hour incident clock.

No CA analogue
First in the nation Annual independent third-party audit of compliance.

California requires disclosure of third-party involvement; Illinois requires an annual independent audit.

Binds you if
Binds you if you are a large frontier developer: a frontier developer whose revenues, with affiliates, topped $500M last year.
Effective
2028-01-01, or 90 days after a developer first qualifies as a large frontier developer, whichever is later Ill. PA 104-0538, Sec. 10(d) ↗
Compared with CA
California has no audit to compare. Its nearest text is a disclosure duty about third-party involvement, and that gap is the whole provision. Illinois enforces the auditor's independence two ways: no financial interest running in either direction, and payment that may not be conditioned on the result.
Sec. 10(d) →
Eff. 1 Jan 2028
Summaries must be machine-readable to allow verification of model claims.
Binds you if
Binds you if you are a large frontier developer publishing the Sec. 10(c)(2) summaries.
Effective
2027-01-01 Ill. PA 104-0538, Sec. 99 (effective date) ↗
Compared with CA
California has no format requirement at all. The California text shown alongside is the paragraph in the same structural slot, which California uses to let a system card satisfy the duty; nothing in § 22757.12 fixes a format.
Sec. 10(c)(3) →
Eff. 1 Jan 2027
Public high-level audit summary within 30 days, redacted report to the Agency and the Attorney General.
Binds you if
Binds you if you are a large frontier developer that has received an audit report under Sec. 10(d).
Effective
2028-01-01, or 90 days after a developer first qualifies as a large frontier developer, whichever is later Ill. PA 104-0538, Sec. 10(d) ↗
Compared with CA
California has no audit, so it has no audit-publication duty either. The nearest California text is the one the audit row shows. Sec. 15(f)(3)-(4) exempts the unredacted report and the auditor's work papers from the Illinois Freedom of Information Act once the State holds them.
Sec. 10(d)(4)(A) →
Eff. 1 Jan 2028
Registration: no frontier model may be developed, deployed, or operated in Illinois without a filed disclosure statement and paid fee.
Binds you if
Binds you if you are a large frontier developer doing any of develop, deploy, or operate a frontier model wholly or partly in Illinois.
Effective
2027-01-01 Ill. PA 104-0538, Sec. 99 (effective date) ↗
Compared with CA
California has no filing, no registry, no fee and no gate on operating. Its nearest text is a self-published website-and-contact line inside the transparency report. Illinois adds all four, plus beneficial-ownership disclosure at 5% for private companies and 50% for public ones under Sec. 18(c)(3), a $1,000-per-day penalty for non-filing under Sec. 18(e)(1), and a proportional share of the Agency's administration costs. It bites earliest of any duty in the Act, on 2027-01-01, a year before the framework and audit duties, and it alone conditions market access.
Sec. 18(a) →
Eff. 1 Jan 2027
Frontier-model regulation is an exclusive State power: home-rule units preempted.
Binds you if
Binds Illinois municipalities and home-rule units, not developers.
Effective
2027-01-01 Ill. PA 104-0538, Sec. 99 (effective date) ↗
Sec. 35 →
Eff. 1 Jan 2027
Tightens CA
72-hour critical safety incident report to the Agency and the Attorney General.
Binds you if
Binds you if you are a frontier developer: no revenue floor; the reporting duty reaches every developer above the compute line.
Effective
2027-01-01 Ill. PA 104-0538, Sec. 99 (effective date) ↗
Compared with CA
Same duty, two tightenings. The clock is 72 hours against California's 15 days, and the enforcing authority, the Attorney General, is a direct recipient rather than learning secondhand. The clocks differ in kind as well: Illinois runs from 'learning facts sufficient to establish a reasonable belief', California from 'discovering'.
Sec. 15(c) →
Eff. 1 Jan 2027
Federal safe harbor opens only if the federal regime also requires third-party audits.
Binds you if
Binds the Agency's designation power; it decides whether a frontier developer can swap Illinois compliance for federal compliance under Sec. 17(b).
Effective
2027-01-01 Ill. PA 104-0538, Sec. 99 (effective date) ↗
Compared with CA
One more condition than California. California's designation conditions stop at incident-reporting equivalence and catastrophic-risk purpose; Illinois carries those forward and adds a fourth, that the federal regime must itself require substantially equivalent independent third-party audits. Illinois will not trade its strongest provision away for federal cover. California's designation also runs through adopted regulations, where Illinois runs through a website declaration process, which is faster and less reviewable.
Sec. 17(a) →
Eff. 1 Jan 2027
Civil penalty up to $1M first violation, $3M for subsequent violations: Attorney General only.
Binds you if
Binds you if you are a large frontier developer that misses a publication, transmittal, audit, or incident-report duty, or fails to follow your own framework.
Effective
2027-01-01 Ill. PA 104-0538, Sec. 99 (effective date) ↗
Compared with CA
Two changes to the penalty. Illinois adds a $3,000,000 repeat-violation tier, and adds 'fails to have a third party perform an independent audit' to the list of penalized failures, a violation California cannot have. Read the other way, California's $1,000,000 is per violation with no first-violation discount, so Illinois is not strictly harsher on a single first offense.
Sec. 25(a) →
Eff. 1 Jan 2027
Matches CA
10 provisions track the California baseline.
Sec. 5 → Sec. 10(a) → Sec. 10(c)(2) → Sec. 10(e) → Sec. 10(f)(1) → Sec. 15(a) → Sec. 15(c) → Sec. 20(a) → Sec. 20(e)(1) → Sec. 25(d) →
↑ Summary

The Act

Enacted text, verbatim · quoted in statute order
Sec. 5
Matches CA
Click to compare
Who is covered: 10^26 operations for the model, $500M revenue for the developer§
"Frontier model" [a broadly-trained general-purpose model trained on more than 10^26 integer or floating-point operations] means a foundation model that was trained using a quantity of computing power greater than 10^26 integer or floating-point operations. The quantity of computing power described in this definition shall include computing for the original training run and for any subsequent fine-tuning, reinforcement learning, or other material modifications the developer applies to a preceding foundation model. "Large frontier developer" [a frontier developer whose revenues with affiliates topped $500M last year (Sec. 5)] means a frontier developer [anyone who trains, or starts training, a model above the 10^26-operation compute line] that, together with its affiliates, collectively had annual gross revenues in excess of $500,000,000 in the preceding calendar year.
Effective
2027-01-01 Ill. PA 104-0538, Sec. 99 (effective date) ↗
Binds you if
Definitional: above 10^26 operations you are a frontier developer; above $500M in revenues with affiliates as well, you are a large frontier developer and pick up the framework, transparency, audit, and internal-use duties.
Goes to
n/a: definitional.
Compared with CA
California's compute line, adopted unchanged. Illinois counts 10^26 integer or floating-point operations across the original training run plus later fine-tuning. One real drafting difference: Illinois defines a frontier developer by computing power used ('using computing power that meets the technical specifications'), California by computing power used or intended to be used, which reaches a developer mid-training run.

Read Sec. 5 on ilga.gov ↗·Copy link

Sec. 10(a)
Matches CA
Click to compare
Publish a frontier AI framework: 10 topics§
(a) Beginning January 1, 2028, a large frontier developer [a frontier developer whose revenues with affiliates topped $500M last year (Sec. 5)] shall write, implement, comply with, and clearly and conspicuously publish on its website a frontier AI framework that applies to the large frontier developer's frontier models and describes how the large frontier developer approaches all of the following:
Effective
2028-01-01 Ill. PA 104-0538, Sec. 10(a) ↗
Binds you if
Binds you if you are a large frontier developer, from 2028-01-01, one year after the rest of the Act.
Goes to
The public, on the developer's own website; no filing with the State
Compared with CA
The same ten-topic template as California and New York, item for item. Sec. 10(a)(1)-(10) tracks § 22757.12(a)(1)-(10). Illinois is strongest here not because the template differs but because Sec. 10(d) puts an external check on it.

Read Sec. 10(a) on ilga.gov ↗·Copy link

Sec. 10(c)(2)
Matches CA
Click to compare
Pre-deployment transparency report: risk assessments, results, third-party involvement§
(2) Before, or concurrently with, deploying a new frontier model or a substantially modified version of an existing frontier model, a large frontier developer [a frontier developer whose revenues with affiliates topped $500M last year (Sec. 5)] shall include in the transparency report required by paragraph (1) of this subsection (c) summaries of all of the following: (A) assessments of catastrophic risks from the frontier model conducted pursuant to the large frontier developer's frontier AI framework; (B) the results of the assessments under subparagraph (A); (C) the extent to which third-party evaluators were involved; and (D) other steps taken to fulfill the requirements of the frontier AI framework with respect to the frontier model.
Effective
2027-01-01 Ill. PA 104-0538, Sec. 99 (effective date) ↗
Binds you if
Binds you if you are a large frontier developer deploying a new or substantially modified frontier model.
Goes to
The public, on the developer's own website, at or before deployment
Compared with CA
Materially identical to California's four required summaries. The base transparency report at Sec. 10(c)(1), covering website, contact, release date, languages, modalities, intended uses and restrictions, likewise tracks § 22757.12(c)(1), and it binds every frontier developer rather than only large ones.

Read Sec. 10(c)(2) on ilga.gov ↗·Copy link

Sec. 10(c)(3)
No CA analogue
Click to compare
Summaries must be machine-readable to allow verification of model claims§
(3) All summaries required under paragraph (2) shall be provided in a machine-readable format to facilitate verification of model claims.
Effective
2027-01-01 Ill. PA 104-0538, Sec. 99 (effective date) ↗
Binds you if
Binds you if you are a large frontier developer publishing the Sec. 10(c)(2) summaries.
Goes to
The public: the format requirement exists so third parties can check the claims at scale
Compared with CA
California has no format requirement at all. The California text shown alongside is the paragraph in the same structural slot, which California uses to let a system card satisfy the duty; nothing in § 22757.12 fixes a format.

Read Sec. 10(c)(3) on ilga.gov ↗·Copy link

Sec. 10(d)
First in the nation
No CA analogue
Click to compare
Annual independent third-party audit of compliance§
(d) Beginning on January 1, 2028 or 90 days after a developer first qualifies as a large frontier developer, whichever is later, a large frontier developer [a frontier developer whose revenues with affiliates topped $500M last year (Sec. 5)] shall annually retain a third party to perform an independent audit of compliance with the requirements of this Section. The third party shall conduct audits consistent with generally accepted auditing standards and best practices and shall possess demonstrated competence to perform the audit, including experience employing or contracting with individuals who possess technical expertise in the safety of frontier models. A large frontier developer shall not retain a third party if either the large frontier developer or the third party has a financial interest in the other party. A large frontier developer may compensate a third party for its services but shall not condition any payment or the amount of any payment on the results of the third party's audit.
California requires disclosure of third-party involvement; Illinois requires an annual independent audit.
Effective
2028-01-01, or 90 days after a developer first qualifies as a large frontier developer, whichever is later Ill. PA 104-0538, Sec. 10(d) ↗
Binds you if
Binds you if you are a large frontier developer: a frontier developer whose revenues, with affiliates, topped $500M last year.
Goes to
An independent third-party auditor retained and paid by the developer; the report itself goes no further under this subsection
First in the nation
skadden.com ↗
Compared with CA
California has no audit to compare. Its nearest text is a disclosure duty about third-party involvement, and that gap is the whole provision. Illinois enforces the auditor's independence two ways: no financial interest running in either direction, and payment that may not be conditioned on the result.

Read Sec. 10(d) on ilga.gov ↗·Copy link

Sec. 10(d)(4)(A)
No CA analogue
Click to compare
Public high-level audit summary within 30 days, redacted report to the Agency and the Attorney General§
(4)(A) No later than 30 days after receiving the audit report, the large frontier developer [a frontier developer whose revenues with affiliates topped $500M last year (Sec. 5)] shall conspicuously publish on its website a high-level summary of the audit findings and a copy of the third party's report with appropriate redactions and transmit a copy of the redacted report to the Agency [the Illinois Emergency Management Agency and Office of Homeland Security] and the Attorney General.
Effective
2028-01-01, or 90 days after a developer first qualifies as a large frontier developer, whichever is later Ill. PA 104-0538, Sec. 10(d) ↗
Binds you if
Binds you if you are a large frontier developer that has received an audit report under Sec. 10(d).
Goes to
The public (high-level summary plus redacted report on the developer's website) and the Agency and the Attorney General (redacted report)
Compared with CA
California has no audit, so it has no audit-publication duty either. The nearest California text is the one the audit row shows. Sec. 15(f)(3)-(4) exempts the unredacted report and the auditor's work papers from the Illinois Freedom of Information Act once the State holds them.

Read Sec. 10(d)(4)(A) on ilga.gov ↗·Copy link

Sec. 10(e)
Matches CA
Click to compare
Quarterly summary of catastrophic risk from the developer's own internal use§
(e) A large frontier developer [a frontier developer whose revenues with affiliates topped $500M last year (Sec. 5)] shall transmit to the Agency [the Illinois Emergency Management Agency and Office of Homeland Security] a summary of any assessment of catastrophic risk [foreseeable, material risk that the model materially contributes to 50+ deaths or serious injuries, or $1B+ in property damage, in a single incident] resulting from internal use of its frontier models every 3 months or pursuant to another reasonable schedule specified by the large frontier developer and communicated in writing to the Agency and the Attorney General with written updates, as appropriate and agreed upon by the Agency.
Effective
2027-01-01 Ill. PA 104-0538, Sec. 99 (effective date) ↗
Binds you if
Binds you if you are a large frontier developer, whether or not you ever deploy the model publicly.
Goes to
The Agency (with the schedule communicated to the Agency and the Attorney General); confidential: exempt from the Illinois Freedom of Information Act under Sec. 15(f)(2) and submitted through a confidential channel the Agency must build under Sec. 15(b)(1)
Compared with CA
Copied from California, every-3-months default and escape hatch included. The developer may still specify another reasonable schedule, with two small Illinois changes: the alternate schedule must be communicated to the Attorney General as well, and updates are 'agreed upon by the Agency' rather than left to the developer. California is strongest here on the strength of that standing clock, which Illinois matches, and the framework-topic route at Sec. 10(a)(4) and (a)(10) exists in Illinois too.

Read Sec. 10(e) on ilga.gov ↗·Copy link

Sec. 10(f)(1)
Matches CA
Click to compare
No materially false or misleading statements about catastrophic risk or framework compliance§
(f)(1) A frontier developer [anyone who trains, or starts training, a model above the 10^26-operation compute line] shall not make a materially false or misleading statement about catastrophic risk [foreseeable, material risk that the model materially contributes to 50+ deaths or serious injuries, or $1B+ in property damage, in a single incident] from its frontier models or its management of catastrophic risk. A large frontier developer [a frontier developer whose revenues with affiliates topped $500M last year (Sec. 5)] shall not make a materially false or misleading statement about its implementation of, or compliance with, its frontier AI framework.
Effective
2027-01-01 Ill. PA 104-0538, Sec. 99 (effective date) ↗
Binds you if
Binds every frontier developer as to catastrophic-risk statements, and large frontier developers additionally as to framework-compliance statements. There is no deployment bar and no quality floor: this is the Act's only substantive prohibition.
Goes to
n/a: enforced by the Attorney General under Sec. 25(a)
Compared with CA
Illinois sets no minimum standard for shipping a model. The Act's only substantive 'shall not' about model risk governs statements, not shipping, which is what the quoted span shows. Across the Public Act text, 'unreasonable risk', 'shall not deploy', 'critical harm' and 'reasonable care' appear nowhere, and Sec. 25(a)'s list of penalized failures is exhaustive and carries no deployment-related violation. The claim is negative, so it rests on that reading rather than on any quoted sentence.

Read Sec. 10(f)(1) on ilga.gov ↗·Copy link

Sec. 15(a)
Matches CA
Click to compare
State-run reporting channel open to developers and to the public§
(a) The Agency, [the Illinois Emergency Management Agency and Office of Homeland Security] in consultation with the Attorney General, shall establish a mechanism to be used by a frontier developer [anyone who trains, or starts training, a model above the 10^26-operation compute line] or a member of the public to report a critical safety incident [weight theft causing death or injury, realized catastrophic risk, loss of control causing death or injury, or a model deceiving its developer to subvert controls] that includes all of the following: (1) the date of the critical safety incident; (2) the reasons the incident qualifies as a critical safety incident; (3) a short and plain statement describing the critical safety incident; and (4) whether the incident was associated with internal use of a frontier model.
Effective
2027-01-01 Ill. PA 104-0538, Sec. 99 (effective date) ↗
Binds you if
Binds the Agency, not developers; it is what any member of the public uses to report an incident.
Goes to
The Agency, in consultation with the Attorney General
Duty
rulemaking
Compared with CA
Same four data points as California. Illinois adds the Attorney General as a consulting party and routes the mechanism to a different agency.

Read Sec. 15(a) on ilga.gov ↗·Copy link

Sec. 15(c)
Tightens CA
Click to compare
72-hour critical safety incident report to the Agency and the Attorney General§
(c) A frontier developer [anyone who trains, or starts training, a model above the 10^26-operation compute line] shall report any critical safety incident [weight theft causing death or injury, realized catastrophic risk, loss of control causing death or injury, or a model deceiving its developer to subvert controls] pertaining to one or more of its frontier models to the Agency [the Illinois Emergency Management Agency and Office of Homeland Security] and the Attorney General within 72 hours of the frontier developer learning facts sufficient to establish a reasonable belief that a critical safety incident has occurred. The disclosure shall include: (i) the date of the critical safety incident; (ii) the reasons the incident qualifies as a critical safety incident as defined in this Act; and (iii) a short and plain statement describing the critical safety incident.
Effective
2027-01-01 Ill. PA 104-0538, Sec. 99 (effective date) ↗
Binds you if
Binds you if you are a frontier developer: no revenue floor; the reporting duty reaches every developer above the compute line.
Goes to
The Agency and the Attorney General; reports are exempt from the Illinois Freedom of Information Act under Sec. 15(f)(1), so they are not public
Compared with CA
Same duty, two tightenings. The clock is 72 hours against California's 15 days, and the enforcing authority, the Attorney General, is a direct recipient rather than learning secondhand. The clocks differ in kind as well: Illinois runs from 'learning facts sufficient to establish a reasonable belief', California from 'discovering'.

Read Sec. 15(c) on ilga.gov ↗·Copy link

Sec. 15(c)
Matches CA
Click to compare
24-hour disclosure where death or serious physical injury is imminent§
If a frontier developer discovers that a critical safety incident [weight theft causing death or injury, realized catastrophic risk, loss of control causing death or injury, or a model deceiving its developer to subvert controls] poses an imminent risk of death or serious physical injury, the frontier developer [anyone who trains, or starts training, a model above the 10^26-operation compute line] shall disclose that incident within 24 hours to an authority, including any law enforcement agency or public safety agency with jurisdiction, that is appropriate based on the nature of that incident and as required by law.
Effective
2027-01-01 Ill. PA 104-0538, Sec. 99 (effective date) ↗
Binds you if
Binds you if you are a frontier developer and a critical safety incident poses an imminent risk of death or serious physical injury.
Goes to
An authority with jurisdiction appropriate to the incident (including any law enforcement or public safety agency), not the Agency and the Attorney General; the 72-hour report is the one that goes to them
Compared with CA
Word-for-word the California clause. The 24-hour report is sometimes described as going to the Agency and the Attorney General; it does not. It goes to whatever authority has jurisdiction, appropriate to the nature of the incident.

Read Sec. 15(c) on ilga.gov ↗·Copy link

Sec. 17(a)
Tightens CA
Click to compare
Federal safe harbor opens only if the federal regime also requires third-party audits§
(a) The Agency, [the Illinois Emergency Management Agency and Office of Homeland Security] in consultation with the Attorney General, shall designate on its website a declaration process and one or more federal laws, regulations, or guidance documents that meet all of the following conditions for the purposes of subsection (b): (1) the law, regulation, or guidance document imposes or states standards or requirements for critical safety incident reporting that are substantially equivalent to, or stricter than, those required by this Act; (2) the law, regulation, or guidance document described in paragraph (1) does not need to require critical safety incident reporting to the State of Illinois; (3) the law, regulation, or guidance document is intended to assess, detect, or mitigate the catastrophic risk [foreseeable, material risk that the model materially contributes to 50+ deaths or serious injuries, or $1B+ in property damage, in a single incident] in ways that are substantially equivalent to this Act; and (4) the law, regulation, or guidance document requires the large frontier developer [a frontier developer whose revenues with affiliates topped $500M last year (Sec. 5)] to undergo independent third-party audits of its assessment of catastrophic risks and critical safety incident reporting with requirements that are substantially equivalent to, or stricter than, those required by this Act.
Effective
2027-01-01 Ill. PA 104-0538, Sec. 99 (effective date) ↗
Binds you if
Binds the Agency's designation power; it decides whether a frontier developer can swap Illinois compliance for federal compliance under Sec. 17(b).
Goes to
The Agency, in consultation with the Attorney General, which designates qualifying federal regimes on its website
Duty
rulemaking
Compared with CA
One more condition than California. California's designation conditions stop at incident-reporting equivalence and catastrophic-risk purpose; Illinois carries those forward and adds a fourth, that the federal regime must itself require substantially equivalent independent third-party audits. Illinois will not trade its strongest provision away for federal cover. California's designation also runs through adopted regulations, where Illinois runs through a website declaration process, which is faster and less reviewable.

Read Sec. 17(a) on ilga.gov ↗·Copy link

Sec. 18(a)
No CA analogue
Click to compare
Registration: no frontier model may be developed, deployed, or operated in Illinois without a filed disclosure statement and paid fee§
(a) Except as otherwise provided in this Section, beginning January 1, 2027, no large frontier developer [a frontier developer whose revenues with affiliates topped $500M last year (Sec. 5)] may develop, deploy, or operate a frontier model, [a broadly-trained general-purpose model trained on more than 10^26 integer or floating-point operations] in whole or in part in this State, without having a current disclosure statement filed with the Agency [the Illinois Emergency Management Agency and Office of Homeland Security] and paying the required fee.
Effective
2027-01-01 Ill. PA 104-0538, Sec. 99 (effective date) ↗
Binds you if
Binds you if you are a large frontier developer doing any of develop, deploy, or operate a frontier model wholly or partly in Illinois.
Goes to
The Agency, which publishes a list of large frontier developers that have filed (Sec. 18(f)), minus their contact details
Compared with CA
California has no filing, no registry, no fee and no gate on operating. Its nearest text is a self-published website-and-contact line inside the transparency report. Illinois adds all four, plus beneficial-ownership disclosure at 5% for private companies and 50% for public ones under Sec. 18(c)(3), a $1,000-per-day penalty for non-filing under Sec. 18(e)(1), and a proportional share of the Agency's administration costs. It bites earliest of any duty in the Act, on 2027-01-01, a year before the framework and audit duties, and it alone conditions market access.

Read Sec. 18(a) on ilga.gov ↗·Copy link

Sec. 20(a)
Matches CA
Click to compare
No rule, policy, or contract may block or punish a covered employee's disclosure§
(a) A frontier developer [anyone who trains, or starts training, a model above the 10^26-operation compute line] shall not make, adopt, enforce, or enter into a rule, regulation, policy, or contract that prevents a covered employee [an employee responsible for assessing, managing, or addressing the risk of critical safety incidents] from disclosing, or retaliates against a covered employee for disclosing, information to the Agency, [the Illinois Emergency Management Agency and Office of Homeland Security] Attorney General, a federal authority, a person with authority over the covered employee, or another covered employee who has authority to investigate, discover, or correct the reported issue, if the covered employee has reasonable cause to believe that the information discloses that: (1) the frontier developer's activities pose a specific and substantial danger to the public health or safety resulting from a catastrophic risk; [foreseeable, material risk that the model materially contributes to 50+ deaths or serious injuries, or $1B+ in property damage, in a single incident] or (2) the frontier developer has violated this Act.
Effective
2027-01-01 Ill. PA 104-0538, Sec. 99 (effective date) ↗
Binds you if
Binds you if you are a frontier developer; protects covered employees: those responsible for assessing, managing, or addressing critical-safety-incident risk.
Goes to
The Agency, the Attorney General, a federal authority, or an internal person with authority over or able to correct the issue; a covered employee may also use the Attorney General's Workplace Rights Hotline (Sec. 20(c))
Compared with CA
Same protection, a longer recipient list. Illinois adds the Agency to California's set, and the substantive trigger is identical wording. Read against the whole section, California is still the stronger whistleblower regime: § 1107.1(f)-(i) gives attorney's fees, contributing-factor burden shifting onto the developer, and injunctive relief that is not stayed on appeal, where PA 104-0538 Sec. 20 has no comparable remedies clause.

Read Sec. 20(a) on ilga.gov ↗·Copy link

Sec. 20(e)(1)
Matches CA
Click to compare
Anonymous internal channel with monthly updates and quarterly reporting to officers§
(e)(1) A large frontier developer [a frontier developer whose revenues with affiliates topped $500M last year (Sec. 5)] shall provide a reasonable internal process through which a covered employee [an employee responsible for assessing, managing, or addressing the risk of critical safety incidents] may anonymously disclose information to the large frontier developer if the covered employee believes in good faith that the information indicates that the large frontier developer's activities present a specific and substantial danger to the public health or safety resulting from a catastrophic risk [foreseeable, material risk that the model materially contributes to 50+ deaths or serious injuries, or $1B+ in property damage, in a single incident] or that the large frontier developer violated this Act, including a monthly update to the person who made the disclosure regarding the status of the large frontier developer's investigation of the disclosure and the actions taken by the large frontier developer in response to the disclosure.
Effective
2027-01-01 Ill. PA 104-0538, Sec. 99 (effective date) ↗
Binds you if
Binds you if you are a large frontier developer.
Goes to
The developer itself, anonymously; disclosures and responses go to officers and directors at least quarterly under Sec. 20(e)(2)(A), unless the allegation is against that officer or director
Compared with CA
Copied from California, monthly-update cadence included. Four features are sometimes described as Illinois additions: the anonymous channel, monthly updates, quarterly officer summaries and an Attorney General hotline. All four are already in the enacted California text at § 1107.1(c) and (e). The real Illinois addition is the Agency as a protected external recipient (Sec. 20(a)), not the internal machinery.

Read Sec. 20(e)(1) on ilga.gov ↗·Copy link

Sec. 25(a)
Tightens CA
Click to compare
Civil penalty up to $1M first violation, $3M for subsequent violations: Attorney General only§
(a) A large frontier developer [a frontier developer whose revenues with affiliates topped $500M last year (Sec. 5)] that fails to publish or transmit a compliant document required to be published or transmitted under this Act, makes a statement in violation of subsection (f) of Section 10, fails to have a third party perform an independent audit of compliance as required by subsection (d) of Section 10, fails to report a critical safety incident as required by Section 15, or fails to comply with its own frontier AI framework shall be subject to a civil penalty in an amount dependent upon the severity of the violation that does not exceed $1,000,000 for the first violation. For a subsequent violation, the civil penalty may not exceed $3,000,000 per violation.
Effective
2027-01-01 Ill. PA 104-0538, Sec. 99 (effective date) ↗
Binds you if
Binds you if you are a large frontier developer that misses a publication, transmittal, audit, or incident-report duty, or fails to follow your own framework.
Goes to
The Attorney General, exclusively (Sec. 25(b)); collections go to the Attorney General Court Ordered and Voluntary Compliance Payment Projects Fund
Compared with CA
Two changes to the penalty. Illinois adds a $3,000,000 repeat-violation tier, and adds 'fails to have a third party perform an independent audit' to the list of penalized failures, a violation California cannot have. Read the other way, California's $1,000,000 is per violation with no first-violation discount, so Illinois is not strictly harsher on a single first offense.

Read Sec. 25(a) on ilga.gov ↗·Copy link

Sec. 25(d)
Matches CA
Click to compare
No private right of action§
(d) Nothing in this Act shall be construed to establish a private right of action associated with violations of this Act.
Effective
2027-01-01 Ill. PA 104-0538, Sec. 99 (effective date) ↗
Binds you if
Applies to everyone: nobody but the Attorney General can bring an action under this Act.
Goes to
n/a: this provision removes a route rather than creating one
Compared with CA
Same result, said out loud. California gets there by making a suit by the Attorney General the exclusive vehicle rather than by an express disclaimer; Illinois says both, at Sec. 25(b) ('exclusively by the Attorney General') and Sec. 25(d).

Read Sec. 25(d) on ilga.gov ↗·Copy link

Sec. 35
No CA analogue
Source →
Frontier-model regulation is an exclusive State power: home-rule units preempted§
Section 35. Home rule. The regulation of artificial intelligence frontier models is an exclusive power and function of the State. This Section is a denial and limitation of home rule powers and functions under subsection (h) of Section 6 of Article VII of the Illinois Constitution.
Effective
2027-01-01 Ill. PA 104-0538, Sec. 99 (effective date) ↗
Binds you if
Binds Illinois municipalities and home-rule units, not developers.
Goes to
n/a: allocates authority between the State and its localities

Read Sec. 35 on ilga.gov ↗·Copy link

Full text ↗

Every quote above is checked against the archived official text. This page covers the frontier-model duties only: read the whole act on ilga.gov ↗.

✕
CACompared with: Sec. 5
Cal. SB 53
Cal. Bus. & Prof. Code § 22757.11(i)-(j)·leginfo.legislature.ca.gov, official text ↗
(i) (1) “Frontier model” means a foundation model that was trained using a quantity of computing power greater than 10^26 integer or floating-point operations. (2) The quantity of computing power described in paragraph (1) shall include computing for the original training run and for any subsequent fine-tuning, reinforcement learning, or other material modifications the developer applies to a preceding foundation model. (j) “Large frontier developer” means a frontier developer that together with its affiliates collectively had annual gross revenues in excess of five hundred million dollars ($500,000,000) in the preceding calendar year.
✕
CACompared with: Sec. 10(a)
Cal. SB 53
Cal. Bus. & Prof. Code § 22757.12(a)·leginfo.legislature.ca.gov, official text ↗
(a) A large frontier developer shall write, implement, comply with, and clearly and conspicuously publish on its internet website a frontier AI framework that applies to the large frontier developer’s frontier models and describes how the large frontier developer approaches all of the following:
✕
CACompared with: Sec. 10(c)(2)
Cal. SB 53
Cal. Bus. & Prof. Code § 22757.12(c)(2)·leginfo.legislature.ca.gov, official text ↗
(2) Before, or concurrently with, deploying a new frontier model or a substantially modified version of an existing frontier model, a large frontier developer shall include in the transparency report required by paragraph (1) summaries of all of the following: (A) Assessments of catastrophic risks from the frontier model conducted pursuant to the large frontier developer’s frontier AI framework. (B) The results of those assessments. (C) The extent to which third-party evaluators were involved. (D) Other steps taken to fulfill the requirements of the frontier AI framework with respect to the frontier model.
✕
CACompared with: Sec. 10(c)(3)
Cal. SB 53
Cal. Bus. & Prof. Code § 22757.12(c)(3)·leginfo.legislature.ca.gov, official text ↗
(3) A frontier developer that publishes the information described in paragraph (1) or (2) as part of a larger document, including a system card or model card, shall be deemed in compliance with the applicable paragraph.
✕
CACompared with: Sec. 10(d)
Cal. SB 53
Cal. Bus. & Prof. Code § 22757.12(c)(2)(C)·leginfo.legislature.ca.gov, official text ↗
(C) The extent to which third-party evaluators were involved.
✕
CACompared with: Sec. 10(d)(4)(A)
Cal. SB 53
Cal. Bus. & Prof. Code § 22757.12(c)(2)(C)·leginfo.legislature.ca.gov, official text ↗
(C) The extent to which third-party evaluators were involved.
✕
CACompared with: Sec. 10(e)
Cal. SB 53
Cal. Bus. & Prof. Code § 22757.12(d)·leginfo.legislature.ca.gov, official text ↗
(d) A large frontier developer shall transmit to the Office of Emergency Services a summary of any assessment of catastrophic risk resulting from internal use of its frontier models every three months or pursuant to another reasonable schedule specified by the large frontier developer and communicated in writing to the Office of Emergency Services with written updates, as appropriate.
✕
CACompared with: Sec. 10(f)(1)
Cal. SB 53
Cal. Bus. & Prof. Code § 22757.12(e)(1)·leginfo.legislature.ca.gov, official text ↗
(e) (1) (A) A frontier developer shall not make a materially false or misleading statement about catastrophic risk from its frontier models or its management of catastrophic risk. (B) A large frontier developer shall not make a materially false or misleading statement about its implementation of, or compliance with, its frontier AI framework.
✕
CACompared with: Sec. 15(a)
Cal. SB 53
Cal. Bus. & Prof. Code § 22757.13(a)·leginfo.legislature.ca.gov, official text ↗
(a) The Office of Emergency Services shall establish a mechanism to be used by a frontier developer or a member of the public to report a critical safety incident that includes all of the following: (1) The date of the critical safety incident. (2) The reasons the incident qualifies as a critical safety incident. (3) A short and plain statement describing the critical safety incident. (4) Whether the incident was associated with internal use of a frontier model.
✕
CACompared with: Sec. 15(c)
Cal. SB 53
Cal. Bus. & Prof. Code § 22757.13(c)(1)·leginfo.legislature.ca.gov, official text ↗
(c) (1) Subject to paragraph (2), a frontier developer shall report any critical safety incident pertaining to one or more of its frontier models to the Office of Emergency Services within 15 days of discovering the critical safety incident.
✕
CACompared with: Sec. 15(c)
Cal. SB 53
Cal. Bus. & Prof. Code § 22757.13(c)(2)·leginfo.legislature.ca.gov, official text ↗
(2) If a frontier developer discovers that a critical safety incident poses an imminent risk of death or serious physical injury, the frontier developer shall disclose that incident within 24 hours to an authority, including any law enforcement agency or public safety agency with jurisdiction, that is appropriate based on the nature of that incident and as required by law.
✕
CACompared with: Sec. 17(a)
Cal. SB 53
Cal. Bus. & Prof. Code § 22757.13(h)·leginfo.legislature.ca.gov, official text ↗
(h) The Office of Emergency Services may adopt regulations designating one or more federal laws, regulations, or guidance documents that meet all of the following conditions for the purposes of subdivision (i): (1) (A) The law, regulation, or guidance document imposes or states standards or requirements for critical safety incident reporting that are substantially equivalent to, or stricter than, those required by this section. (B) The law, regulation, or guidance document described in subparagraph (A) does not need to require critical safety incident reporting to the State of California. (2) The law, regulation, or guidance document is intended to assess, detect, or mitigate the catastrophic risk.
✕
CACompared with: Sec. 18(a)
Cal. SB 53
Cal. Bus. & Prof. Code § 22757.12(c)(1)(A)-(B)·leginfo.legislature.ca.gov, official text ↗
(A) The internet website of the frontier developer. (B) A mechanism that enables a natural person to communicate with the frontier developer.
✕
CACompared with: Sec. 20(a)
Cal. SB 53
Cal. Lab. Code § 1107.1(a)·leginfo.legislature.ca.gov, official text ↗
(a) A frontier developer shall not make, adopt, enforce, or enter into a rule, regulation, policy, or contract that prevents a covered employee from disclosing, or retaliates against a covered employee for disclosing, information to the Attorney General, a federal authority, a person with authority over the covered employee, or another covered employee who has authority to investigate, discover, or correct the reported issue, if the covered employee has reasonable cause to believe that the information discloses either of the following: (1) The frontier developer’s activities pose a specific and substantial danger to the public health or safety resulting from a catastrophic risk. (2) The frontier developer has violated Chapter 25.1 (commencing with Section 22757.10) of Division 8 of the Business and Professions Code.
✕
CACompared with: Sec. 20(e)(1)
Cal. SB 53
Cal. Lab. Code § 1107.1(e)(1)·leginfo.legislature.ca.gov, official text ↗
(e) (1) A large frontier developer shall provide a reasonable internal process through which a covered employee may anonymously disclose information to the large frontier developer if the covered employee believes in good faith that the information indicates that the large frontier developer’s activities present a specific and substantial danger to the public health or safety resulting from a catastrophic risk or that the large frontier developer violated Chapter 25.1 (commencing with Section 22757.10) of Division 8 of the Business and Professions Code, including a monthly update to the person who made the disclosure regarding the status of the large frontier developer’s investigation of the disclosure and the actions taken by the large frontier developer in response to the disclosure.
✕
CACompared with: Sec. 25(a)
Cal. SB 53
Cal. Bus. & Prof. Code § 22757.15(a)·leginfo.legislature.ca.gov, official text ↗
(a) A large frontier developer that fails to publish or transmit a compliant document required to be published or transmitted under this chapter, makes a statement in violation of subdivision (e) of Section 22757.12, fails to report an incident as required by Section 22757.13, or fails to comply with its own frontier AI framework shall be subject to a civil penalty in an amount dependent upon the severity of the violation that does not exceed one million dollars ($1,000,000) per violation.
✕
CACompared with: Sec. 25(d)
Cal. SB 53
Cal. Bus. & Prof. Code § 22757.15(b)·leginfo.legislature.ca.gov, official text ↗
(b) A civil penalty described in this section shall be recovered in a civil action brought only by the Attorney General.
✕
ILSource text: Sec. 35
Illinois SB 315
Sec. 35·ilga.gov, official text ↗
Section 35. Home rule. The regulation of artificial intelligence frontier models is an exclusive power and function of the State. This Section is a denial and limitation of home rule powers and functions under subsection (h) of Section 6 of Article VII of the Illinois Constitution.