Illinois did something this week that the federal government keeps circling without quite landing. SB0315, now the Artificial Intelligence Safety Measures Act, has passed both houses of the state legislature. The Senate passed it 52-5 on 21 May, the House passed it 110-0 on 27 May, and the bill status page recorded "Passed Both Houses" on Friday. Governor JB Pritzker has said he looks forward to signing it, which is not the same as a signature, but it is close enough to change the argument everyone else has been having.

The bill matters because it turns the soft language around frontier AI safety into paperwork with a counterparty. A "large frontier developer" is defined as a company with annual gross revenue over $500 million, and a "frontier model" means a model trained with more than 10^26 operations. The companies in scope have to create and publish safety frameworks, update them every year, file transparency reports, report critical safety incidents, protect whistleblowers, and submit to annual independent third-party audits. The full text gives the phrase "catastrophic risk" a shape too: death or serious injury to more than 50 people, or more than $1 billion in property loss.

That is a strange threshold to see in a state bill, partly because it sounds like it belongs in a federal agency document with grey margins and a decade of committee scar tissue. Instead it is coming out of Springfield. The old Washington posture was a voluntary review window, an opt-in arrangement that already looked like the compromise position before it stalled. Illinois is doing the less elegant thing: telling the labs that outside review is not a favour they extend when the calendar is convenient.

This is why the preemption fight now feels less abstract. The Washington Post framed the bill as raising the stakes for Congress, because a serious state law creates pressure on both sides at once. Labs do not want fifty versions of frontier-model compliance. Safety advocates do not want federal preemption that sweeps state rules away and replaces them with nothing sharp enough to matter. Everyone says they want one national standard until a state writes a standard with teeth.

The audit piece is the part I keep measuring against the last few months of AI politics. METR's frontier-risk evaluation showed how much serious assessment depends on access that outsiders usually do not get: internal models, monitoring set-ups, deployment detail, the messy bits companies would rather summarise. Illinois is not recreating that work, and the law will depend heavily on what auditors can actually see. But it moves the fight from "trust us, we test" to "show the framework, file the report, let someone independent look."

There are weak points. A revenue threshold can miss smaller labs doing dangerous work. Compute thresholds age badly. A bad audit can become theatre with letterhead. Also, the law takes effect on 1 January 2027, which gives Congress, lobbyists, and the covered companies plenty of time to sand down the edges if they can. Still, I would rather argue over audit quality than keep pretending that corporate safety documents are public accountability by another name.

The unnerving thing about frontier AI regulation is how quickly the vocabulary has become normal. Catastrophic risk. Third-party audits. Whistleblower protections. Safety incident reporting. Five years ago those phrases would have sounded like a speculative appendix to a policy paper. Now NBC is putting an Illinois representative on television to talk about a bill regulating AI companies, and the official state page is where the argument is being written down.

Sources: