On Monday, Illinois Governor JB Pritzker signed the Artificial Intelligence Safety Measures Act, and with a single signature the map of American AI regulation shifted again. Illinois now joins California and New York in a small but deliberate bloc of states writing safety rules for the most powerful AI models, while Congress does nothing. The three states hold only about a fifth of the US population, but by lawmakers' own reckoning they account for roughly 40 percent of the American AI market. That, they argue, is enough to set a de facto national standard whether Washington likes it or not.
The Illinois law, Senate Bill 315, borrows its shape from California's SB 53 and New York's Responsible AI Safety and Education Act, both signed late last year. It targets only the largest developers, those pulling in more than 500 million dollars a year and training on enormous compute, and asks them to publish how they assess "catastrophic risk," defined as an incident that could kill or seriously injure more than 50 people or cause a million dollars in damage. Companies must report dangerous incidents to the state within 72 hours, or 24 if lives are at imminent risk. Then Illinois adds something no other state has required: a mandatory annual third-party audit.
That audit requirement is the tell. New York asked for a single independent check when a developer first grows large enough to qualify; Illinois wants one every year, from an outside party. Industry groups pushed back hard. TechNet warned the state would be forcing private auditors to make "highly subjective determinations" about safety with no national standards to lean on. Notably, the biggest labs did not fight it. OpenAI and Anthropic both backed the bill, and Anthropic sent representatives to the signing. For companies that would prefer one federal rulebook to a growing patchwork, endorsing the strongest state versions may be the closest thing to shaping the standard they can get.
There is a reason states feel the urgency. Pritzker was blunt: "We are not willing to wait for Congress." But the same week's news shows how fragile these laws remain. California's AI Transparency Act, with its first deadlines arriving in August, keeps expanding its reach, yet elsewhere state AI rules are under siege. Colorado already gutted its own anti-discrimination law under federal pressure, and the Justice Department has intervened in court to attack state AI statutes as unconstitutional. Even Microsoft's Brad Smith, no champion of heavy regulation, told Fortune that Washington's approach amounts to "regulation without transparent or complete rules." "Without rules," he said, "businesses can't plan."
So the real story is not one law in one state. It is a widening gap between how AI is governed in practice and who is supposed to be doing the governing. States are legislating because the federal government will not, and companies are cautiously helping them because a predictable patchwork beats no rules at all. Yet everything the states build sits under a legal cloud, exposed to a federal challenge or a future preemption fight. Illinois's law does not take effect until January 2028. Between now and then, the question is not whether America will regulate frontier AI, but whether the states doing it will be allowed to.