Illinois just mandated independent AI audits. Not yours — and that's exactly why it matters.

Who is covered. The Act applies to "frontier developers" — entities that train frontier models above a defined compute threshold — with its core obligations reserved for "large frontier developers": those with more than $500 million in annual gross revenue. In practice, that is a handful of companies: the OpenAI and Anthropic tier. The jurisdictional hook attaches when a covered developer develops, deploys, or operates a frontier model in Illinois, even in part.

What they must do, effective January 1, 2027:

• Publish and annually update a frontier AI framework covering catastrophic-risk assessment, mitigations, cybersecurity practices, internal governance, third-party evaluations, and risks from internal use of their own models.
• Publish transparency reports before deploying a new or substantially modified frontier model — intended uses, modalities, and restrictions (a system or model card can satisfy this).
• Report critical safety incidents to Illinois authorities within 72 hours of identification — 24 hours where there is imminent risk of death or serious physical injury.
• Undergo an annual independent third-party audit of compliance with their own published framework, submitted to the Illinois Emergency Management Agency and Office of Homeland Security and the Attorney General. This is the first such mandate in any U.S. state law, and its auditors must be qualified experts free of financial conflicts of interest.
• Maintain whistleblower protections and internal reporting channels for employees raising safety concerns, backed by amendments to the Illinois Whistleblower Act.
• File disclosure statements and pay proportional administrative fees.

Enforcement. Exclusively by the Illinois Attorney General — there is no private right of action — with civil penalties up to $1 million for a first violation and $3 million for subsequent violations. The Act includes a federal interoperability provision, positioning it as a stopgap pending federal standards.

The WOPR Act (HB 1806) — behavioral health AI, in force since August 2025

The Wellness and Oversight for Psychological Resources Act restricts AI in therapy and psychotherapy services delivered to clients located in Illinois. AI may not make independent therapeutic decisions, engage in direct therapeutic communication with clients, generate treatment recommendations without licensed-professional review, or perform emotion detection. Permitted uses are limited to administrative support (scheduling, billing) and supplementary support (records, anonymized analysis) — and AI use in recorded or transcribed sessions requires documented informed consent. Enforcement sits with the Illinois Department of Financial and Professional Regulation, at up to $10,000 per violation.

Why this matters to safety-net providers specifically: integrated behavioral health is core to the FQHC model. A community health center deploying an ambient documentation tool in a behavioral health encounter, or piloting AI-assisted care coordination that touches therapy content, is operating directly inside WOPR's perimeter — consent protocols, scope restrictions, and all. This is not hypothetical exposure; it has been enforceable law for nearly a year.

HB 3773 — AI in employment decisions, in force since January 1, 2026

Amendments to the Illinois Human Rights Act prohibit employers from using AI in recruitment, hiring, promotion, discipline, discharge, or other employment decisions in a manner that produces discriminatory effects on protected classes — and specifically ban using zip codes as a proxy for protected characteristics. Employers using AI for covered decisions must provide notice. Every healthcare provider is an employer; any organization using AI-assisted résumé screening, scheduling optimization, or workforce analytics in Illinois is covered.

And the trajectory continues

In the same season SB 315 was signed, Illinois enacted a ban on bot-driven ticket purchasing, advanced a bill restricting algorithmic rent-price coordination, and debated (without yet passing) measures on AI suicide-risk detection referral duties and sensitive-data sale opt-outs. The direction is unambiguous: Illinois legislates AI early, across domains, and with enforcement teeth.

• GOVERN — know what you're running. Maintain a complete AI inventory with model provenance: which products, built on which foundation models, from which developers. When your vendor's underlying model comes from an SB 315-covered developer, that developer's published framework and audit results belong in your governance file.
• MAP — classify by regulatory surface. Flag every use case touching behavioral health content (WOPR), employment decisions (HB 3773), or patient-facing communication. Multi-state organizations: the trigger is where the client or employee is, not where you are.
• MEASURE — collect the artifacts. Add SB 315 transparency documents to procurement questionnaires and renewal reviews. A vendor that cannot tell you whether its foundation model comes from a covered developer has answered your diligence question already.
• MANAGE — align your incident clock. Build internal AI-incident detection and escalation capable of meeting a 72-hour external notification rhythm, because that number is becoming the industry's default expectation whether or not a statute names you.