Three States Write the Rules on Powerful AI Before Washington Does
Illinois, New York and California have passed disclosure laws covering the most advanced AI systems. The patchwork will cost companies money and leave ordinary users with questions nobody has answered yet.
Key points
- Illinois Governor JB Pritzker signed Senate Bill 315, the Artificial Intelligence Safety Measures Act, which takes effect in January 2027 and covers AI developers earning more than $500 million a year from frontier AI.
- New York's RAISE Act (Responsible AI Safety and Education Act), signed in December 2024, takes effect on January 1 2027 and creates an oversight office inside the state's Department of Financial Services.
- California Governor Gavin Newsom signed the Frontier Artificial Intelligence Act last September, giving that state the earliest framework of the three.
- Illinois and New York require companies to report critical safety incidents within 72 hours of discovery, California allows 15 days; both windows shrink to 24 hours if lives are at immediate risk.
- The White House has published only a voluntary framework so far, with no binding federal regulation in place.
For most of the past three years, the companies building the world's most powerful AI systems answered to nobody in particular. That's starting to change, state by state.
Illinois, New York and California have each passed laws putting new obligations on developers of what regulators call "frontier" AI, meaning the most advanced, most capable models available. Think the systems behind ChatGPT, or the tools major banks and hospitals are quietly folding into daily operations.
The Illinois law requires any developer earning more than $500 million a year from frontier AI to build a detailed safety framework covering catastrophic-risk assessment, cybersecurity controls and third-party evaluations, and to publish transparency reports before deploying any new or substantially modified model. New York's law stands up a dedicated oversight office. California's act, signed first, set the template the others built on. New York Governor Kathy Hochul noted at signing that the RAISE Act builds on California's framework to create a national benchmark where the federal government has not acted.
All three take effect in January 2027. None covers the federal government, which has offered only a voluntary framework with no penalties.
Why does this matter to people who don't work in tech?
These laws target systems already woven into services ordinary people depend on. Payroll software, hospital scheduling tools, customer-support lines: many run on frontier AI, sometimes several models at once, and the businesses using them may not know which ones.
Recently, one security report cited what researchers described as the first AI-executed ransomware attack, where ransomware is malicious software that locks an organisation's files until a payment is made. Separately, a model called Mythos has been shown able to find and exploit zero-day vulnerabilities, meaning software flaws the maker hasn't yet discovered or patched. These aren't hypothetical risks.
Sachin Jade, chief product officer at security firm Cyware, told Dark Reading the laws are a necessary start but leave a real gap: they apply to big developers, not to the businesses or individuals who use what those developers build. If a company has woven a frontier model into its payroll system, or a developer has modified an open-source model for their own product, the new rules offer little clear guidance on what happens next. "What if I've engrained this model into my ecosystem or my workflow? What do I do?" Jade told Dark Reading. "Laws don't address that yet."
For businesses using AI tools now, Jade's advice is straightforward: know which models your vendors are running inside the software you pay for, keep an audit trail of what each AI tool is authorised to do, and build a risk registry. Visibility, the ability to see what's happening inside your systems, is the foundation. Our 13 July story on what organisations are actually missing from their AI risk registers makes the same point in harder terms: documenting risks is easy; knowing who can shut the system down is not.
Should you expect this patchwork to get tidied up?
Not soon. The three laws aren't identical on third-party audits, disclosure timelines or scope, so companies operating across state lines will produce separate compliance reports for each jurisdiction. "There's no standardization at the moment, but it is a start," Jade told Dark Reading. That's about as optimistic as the situation warrants.
