Illinois Law Requires Annual Frontier AI Audits Starting in 2028

The statute defines a frontier model as a foundation model trained using more than 10^26 integer or floating-point operations, including the original training run and later fine-tuning, reinforcement learning, or other material modifications. A large frontier developer is one whose combined annual gross revenue with affiliates exceeded $500 million in the preceding calendar year.

Beginning in 2028, covered developers must publish and follow a frontier AI framework addressing catastrophic-risk assessment, mitigations, model-weight security, incident response, governance, and the use of third parties. The law also requires model disclosures, critical-safety-incident reporting, and protections for workers who raise safety concerns.

The statute provides more detail than a general instruction to hire an auditor. The third party must use generally accepted auditing standards and best practices, demonstrate competence that includes access to frontier-model safety expertise, and have no financial interest in the developer. Payment cannot depend on the audit result.

Auditors must receive materials reasonably necessary for the review and assess both compliance and the developer's internal controls. Their report must explain whether the developer substantially complied, describe deviations, and recommend improvements. The developer must publish a redacted report and summary within 30 days, send them to Illinois authorities, and retain the report for the life of the model plus five years.

The law does not name a single frontier-AI audit framework or a government-approved auditor roster. That leaves room for implementing guidance and professional practice to shape evidence formats, testing depth, and how technical safety expertise is demonstrated. But the statute already establishes baseline standards for competence, independence, access, reporting, and retention.

The January 2027 effective date starts with disclosure obligations, while the more extensive framework and audit duties begin in 2028. Teams likely to cross the compute and revenue thresholds will need traceable model inventories, training-compute records, risk evaluations, incident processes, internal controls, and evidence that published safety statements match operational practice.

Illinois can impose civil penalties of up to $1 million for a first violation and up to $3 million for later violations. The practical question is now implementation: whether regulators, developers, and audit providers converge on review methods that are technically credible and consistent across the overlapping Illinois, California, and New York regimes.