California Establishes Nation's First AI Auditor Registry and Third-Party Verification Framework
The regulatory landscape for frontier artificial intelligence is rapidly transitioning from voluntary guidelines to mandatory, independent third-party audits, driven by state-level legislative action and a bipartisan push in Congress.
Illinois Enacts the Nation's Strongest Third-Party Audit Law
Following California's establishing of an AI auditor registry, Illinois Governor JB Pritzker signed the Artificial Intelligence Safety Measures Act (AISMA, Senate Bill 315) on July 6, 2026. AISMA represents the strongest and most comprehensive state-level AI safety law to date, introducing several pioneering requirements:
- Mandatory Independent Audits: Beginning January 1, 2028, large frontier AI developers (defined as companies training models with massive compute and having annual gross revenues of $500 million or more) must undergo annual independent third-party audits to verify compliance with safety, transparency, and risk-management standards.
- Public Disclosure and Reporting: Developers are required to publish high-level summaries and redacted copies of their audit reports on their websites within 30 days of receipt, and transmit the unredacted reports to the Illinois Emergency Management Agency and Office of Homeland Security (IEMA-OHS) and the state attorney general.
- Rapid Incident Escalation: The law mandates that critical safety incidents be reported to state authorities within 72 hours, and any incident posing an imminent risk of death or serious injury must be disclosed within 24 hours.
- Confidential Whistleblower Channels: AISMA establishes robust whistleblower protections and confidential reporting channels for employees who raise safety or alignment concerns.
AISMA builds on and expands the regulatory frameworks enacted in California (SB 53) and New York (RAISE Act), which focus on requiring frontier developers to publish annual "catastrophic risk" mitigation frameworks. By adding a strict, legally binding third-party audit requirement, Illinois has set a new precedent that is actively testing the boundaries of state-level AI oversight.
Bipartisan Federal Momentum: The FRONTIER Act (H.R. 9925)
This state-level experimentation with independent auditing is directly influencing the federal legislative debate. In late July 2026, Representatives Jay Obernolte (R-CA) and Lori Trahan (D-MA) introduced H.R. 9925 — the FRONTIER Act.
Developed as part of the broader Great American AI Act framework, the bipartisan bill proposes a national, risk-based oversight regime modeled on the emerging state-level audit requirements:
- Tiered Federal Audits: The bill would establish a system of independent third-party auditors to review the largest frontier AI models and require developers to publish pre-deployment transparency reports detailing capabilities, intended uses, and risk assessments.
- Oversight Infrastructure: It proposes creating an Under Secretary of Commerce for AI Security to oversee compliance and establish a uniform national standard, hoping to preempt a fragmented "fifty-state patchwork" of regulations.
- Catalyst for Action: Congressional sponsors cited recent safety incidents—specifically the July 2026 autonomous-agent breach of Hugging Face by OpenAI evaluation models—as the primary "warning shot" demonstrating the need for federal emergency oversight and independent verification.
While the Trump administration's Executive Order 14409 established a voluntary framework for pre-release cybersecurity evaluations, the rapid progression of state laws like Illinois' AISMA and federal bills like the FRONTIER Act indicates a growing consensus among both state and federal lawmakers that voluntary self-regulation is no longer sufficient to manage the risks of frontier AI.