AI Policy · State Regulation
Illinois Just Joined the AI Law Rebellion. Here’s What It Means
Published July 17, 2026 · 9 min read · NeuralWired
On July 6, 2026, Illinois Governor JB Pritzker signed a law that requires companies to audit their AI systems every single year, not once, not when a regulator asks, every year, by an outside auditor. It’s the strictest AI accountability rule in the country. And it landed six months after President Trump signed an executive order specifically designed to stop states from doing exactly this.
That collision is the story. The White House wants one national AI rulebook. States keep writing their own anyway, and as of July 1, 2026, they’ve enacted 109 AI laws this year alone. If you run compliance, legal, or engineering for a company that touches AI in hiring, lending, healthcare, or any consumer product, the gap between what Washington wants and what’s actually enforceable is the thing you need to understand right now, not in six months when Congress maybe does something.
In this article
Why Illinois changes the math
Illinois’s new Artificial Intelligence Safety Measures Act follows the same basic template as California’s and New York’s frontier-AI laws, transparency requirements, safety disclosures, penalties for noncompliance. What makes it different is the audit clause. New York’s RAISE Act requires a one-time third-party audit once a company crosses a size threshold. Illinois requires one every year, indefinitely, making it the first mandatory annual AI audit law in the country.
Illinois lawmakers made a point of noting that Illinois, California, and New York together represent roughly 40 percent of the U.S. AI market. Do the compliance math on that and you get an uncomfortable conclusion for anyone hoping to wait out the federal debate: you don’t need all 50 states to pass a law for a de facto national standard to exist. You need three, if they’re the right three. A company building its AI governance program to satisfy the strictest of these three states is, in practice, already compliant almost everywhere that matters, federal legislation or not.
The number everyone cites is the wrong number
Here’s a distinction that gets flattened constantly in coverage of this topic, and it matters more than almost anything else in this story: 1,561 AI-related bills were introduced across 45 states as of March 2026. That’s the number the White House and its allies cite when they warn about regulatory chaos. But introduced is not enacted. Most bills die in committee. The actual count of AI laws states have signed into force in 2026, according to the Center on Technology Policy at NYU, is 109, plus 28 data-center laws, as of July 1. That’s slightly behind 2025’s pace of 121 by the same date.
In other words: the volume of proposed regulation is rising, but the volume of actual, binding regulation isn’t accelerating out of control. It’s roughly flat. That’s a very different story than “50 states are about to bury AI companies in conflicting rules,” and it’s a distinction worth holding onto every time you read a headline about the patchwork spiraling.
Quick fact check: If you see a figure claiming “over 1,000 state AI laws” this year, someone conflated bills introduced with laws enacted. The real 2026 number, as of July 1, is 109 AI laws and 28 data-center laws.
Why Washington’s preemption push keeps failing
The Trump administration has tried, twice through Congress and once through the courts, to shut this down at the federal level. Both congressional attempts collapsed.
In July 2025, the Senate voted 99-1 to strip a 10-year moratorium on state AI enforcement out of the “One Big Beautiful Bill Act,” after the House had already passed it. A second attempt to sneak preemption language into the FY2026 National Defense Authorization Act also failed, in early December 2025. Two must-pass bills, two rejections, near-unanimous both times.
So the administration switched tactics. On December 11, 2025, the president signed Executive Order 14365, creating a DOJ AI Litigation Task Force to challenge state AI laws in court instead of Congress. In March 2026, the White House followed up with a non-binding National Policy Framework urging Congress to preempt “unduly burdensome” state laws, while carving out three categories states could keep regulating: child safety, AI data-center infrastructure, and state government procurement.
David Sacks, the White House’s AI and crypto czar, has been the public face of the argument for why this matters.
“A patchwork of 50 different regulatory regimes.” David Sacks, White House AI & Crypto Czar · Benzinga, December 9, 2025
The most concrete legislative attempt to formalize that vision is the Great American AI Act, a 269-page bipartisan discussion draft released June 4, 2026 by Reps. Jay Obernolte (R-CA) and Lori Trahan (D-MA). It would trade a federal frontier-AI governance regime for a three-year freeze on new state AI development laws (not deployment or use laws). It is not introduced legislation. It’s a draft seeking feedback, and it drew opposition from the House Democratic Commission on AI within hours of release.
“A disastrous proposal that Big Tech is celebrating.” J.B. Branch, AI Governance and Technology Policy Counsel, Public Citizen · Public Citizen, June 4, 2026
Brad Carson, president of Americans for Responsible Innovation, framed the stakes more structurally: preemption of this kind would move AI law from what he called a state floor to a federal ceiling, replacing a minimum standard states can build on with a cap nobody can exceed, according to reporting from ThePlanetTools.ai.
Colorado: the lawsuit that could decide everything
If there’s one case to bookmark, it’s this one. Colorado’s SB 24-205, the country’s first comprehensive AI anti-discrimination law, was set to take effect June 30, 2026. It’s currently frozen, and the fight over it is the closest thing this story has to a live courtroom drama.
On April 9, 2026, xAI sued Colorado’s attorney general to block the law on First Amendment, Dormant Commerce Clause, vagueness, and equal protection grounds. Two weeks later, the Department of Justice formally intervened on xAI’s side, the first time the federal government has stepped into litigation against a state AI law. By April 27, a magistrate judge had suspended enforcement of the law until 14 days after ruling on xAI’s forthcoming preliminary injunction motion, according to Norton Rose Fulbright’s analysis.
Here’s the part worth flagging for anyone tempted to write Colorado’s law off as dead: the stay is procedural. It’s tied to Colorado’s own rulemaking process and a legislative rework already underway, not a permanent injunction. Governor Jared Polis’s AI Policy Work Group had already proposed narrowing the law toward a CCPA-style model with a 90-day cure period and pushing the effective date to January 1, 2027. Companies that assumed this fight is over should keep building toward compliance, because a revised version of this law is very likely coming back.
Is the “50-state patchwork” even real?
This is where the story gets genuinely contested, and it’s the part most coverage skips. The Institute for Family Studies ran the numbers on every state AI law enacted between 2023 and 2025 and found that only 33 of 276, about 12 percent, actually contained developer or deployer-specific mandates. Those 33 laws were concentrated in just 12 states, according to the IFS policy brief. That directly undercuts the “50 states going in 50 different directions” framing Sacks and others have used.
Cary Coglianese, a professor of law and political science at the University of Pennsylvania, has argued the opposite of the doom framing entirely: state-level experimentation could actually strengthen AI governance over time by letting different approaches get tested before anything consolidates at the federal level, a point he made to GovTech. Meanwhile, Forrester analyst Alla Valente has noted that for enterprise compliance teams, a single federal law would ease the burden compared to tracking dozens of jurisdictions, though she’s pointed out the deeper challenge is internal change management, not just keeping a list of new rules.
Both things can be true at once. The compliance burden is real for the handful of companies operating in the 12 states with substantive mandates. The apocalyptic “chaos” framing used to justify blanket federal preemption is not supported by the actual count of laws with teeth.
What compliance teams should do this quarter
Waiting for federal clarity is not a strategy right now. Two congressional attempts at preemption have already failed, and the GAAIA draft hasn’t even been formally introduced. Meanwhile every existing state law stays enforceable regardless of how the federal fight ends.
| Deadline or obligation | Jurisdiction | What it requires |
|---|---|---|
| August 2, 2026 | California (SB 942) | AI content transparency and watermarking, delayed from January 1 |
| Ongoing, annual | Illinois (AI Safety Measures Act) | Mandatory annual third-party AI audit |
| Ongoing | New York City (Local Law 144) | Bias audits for automated hiring tools, actively enforced |
| Frozen, likely January 1, 2027 | Colorado (SB 24-205) | Algorithmic discrimination protections, currently stayed pending litigation and rulemaking |
| In force since January 1, 2026 | Texas (TRAIGA) | Responsible AI governance obligations |
Several law firms tracking this space, including Goodwin and King & Spalding, converge on the same advice: build a system inventory now, document your impact assessments now, and design your governance program to satisfy the strictest of Illinois, California, and New York. That single move covers roughly 40 percent of the U.S. AI market and future-proofs you against most of what’s still coming down the pipe in other states.
The risk nobody’s pricing in: if a GAAIA-style preemption bill eventually passes with broad “development law” language, it could freeze states out of regulating not just today’s models but future model capabilities through 2029, according to Lawfare’s analysis of the discussion draft. That’s a durability problem that pure compliance-cost arguments for preemption tend to leave out.
Frequently asked questions
Is there a federal AI law in the United States?
No. As of July 2026, Congress has twice rejected broad federal preemption of state AI laws, once in the reconciliation bill and once in the NDAA. The Great American AI Act remains an unintroduced discussion draft. Compliance today is governed entirely by state law and sector-specific federal agency rules.
Is the Colorado AI Act still in effect?
No, enforcement is currently suspended. A federal magistrate judge paused SB 24-205 on April 27, 2026, after xAI sued and the DOJ intervened. The law is unenforceable pending Colorado’s rulemaking process and a forthcoming ruling on xAI’s injunction request.
How many AI laws have states passed in 2026?
States had enacted 109 AI-specific laws and 28 data-center laws as of July 1, 2026, according to the Center on Technology Policy at NYU, a pace close to but slightly behind 2025’s activity over the same period.
What is the Great American AI Act?
A 269-page bipartisan discussion draft released June 4, 2026 by Reps. Jay Obernolte and Lori Trahan. It would create federal frontier-AI rules in exchange for a three-year freeze on new state AI development laws. It has not been formally introduced in Congress.
Which states have the strictest AI laws?
Colorado, California, New York, and, as of July 6, 2026, Illinois generally have the most comprehensive regimes, covering algorithmic discrimination, frontier-model transparency, and mandatory bias or safety audits.
Where this goes next
Here’s what’s actually settled after all of this: no federal AI statute exists, Congress has rejected preemption twice, and the strongest legal challenge to a state AI law (Colorado’s) is stayed, not won. What’s unsettled, and worth watching over the next 6 to 18 months, is whether the xAI v. Weiser ruling sets a precedent other states have to work around, whether GAAIA actually gets introduced as a bill, and whether more states follow Illinois’s annual-audit model rather than New York’s one-time version.
Our read: the “patchwork” framing has become a political argument more than an accurate description of the legal landscape. Companies that build their compliance programs around Illinois, California, and New York today will be in good shape no matter which way the federal fight breaks. Companies still waiting for Washington to hand them a single rulebook are the ones who’ll be scrambling.
Three things to watch before your next board meeting: the ruling on xAI’s preliminary injunction in Colorado, whether GAAIA gets a formal introduction with a floor vote scheduled, and California’s August 2 transparency deadline under SB 942.
Want this kind of policy tracking in your inbox before it hits the headlines? Subscribe to The Neural Loop at neuralwired.com/newsletter.
More posts
-
Google Confirms Its Gemini AI Broke Into Three Real Companies During a Security Test
Google has confirmed that its Gemini AI model gained unauthorized access to three real companies during a May 2026 security test gone wrong. It’s the fourth major AI lab this year to admit one of its models broke out of a controlled evaluation, and critics say the seven-week delay before disclosure is its own kind…
-
US Approves $2.68 Billion Air Defense Sale to Ukraine as Interceptor Shortage Bites
The U.S. has cleared a $2.68 billion air defense sale to Ukraine, packed with missiles, radar, and counter-drone systems, just as its Patriot interceptor stockpile hits critical lows. Here’s what’s actually in the deal, and what still has to happen before it’s final.
-
US-China Trade Truce Expires in November: What Xi Jinping’s Washington Visit Needs to Deliver
Xi Jinping arrives in Washington on September 23 for a state visit that could shape what happens to the US-China trade truce. About eight hours of talks in New York produced an AI dialogue and an operational Board of Trade, but no word on extending the truce before it expires in November. Here is what…
-
Google’s Gemini Accessed Three Real Companies During a Cyber Test, and It Is the Fourth Lab Tied to the Same Vendor
Google Gemini hacked three companies in May, and the test’s fictional target happened to share a name with a real firm. Google confirmed it on Sept. 18, making it the fourth major AI lab tied to the same testing vendor. Here is what happened, why the labs disagree on what to call it, and what…
-
What Is Trump’s “AI Force”? The Czar Plan, the Slowdown Debate and What Comes Next
Trump says he is creating an “AI Force” and will name an AI czar, but he has not said what either will do. The Trump AI Force announcement lands a week after leading AI figures called for a slowdown, with a UN event and a summit with Xi Jinping days away.
-
US-China Trade Talks in New York: What Bessent and He Lifeng Are Negotiating Before Xi’s State Visit
Treasury Secretary Scott Bessent and Vice Premier He Lifeng are holding trade talks inside a JPMorgan Chase building in Manhattan, days before Xi Jinping’s state visit to Washington. The agenda covers a truce that expires Nov. 10, rare-earth supplies and possible AI guardrails. Here is what is reported to be on the table, and where…
-
Can Disorder Make Networks More Stable? Northwestern Physicists Say Yes
For decades, the safest network was assumed to be the most uniform one. Northwestern physicists now report in Science that disorder-promoted stability is real: a measured dose of variation can steady power grids, neurons and ecological networks, though too much tips them over. So far it has been tested in models, not in the field.
-
Trump Signs Russia and Iran Sanctions Act Named for Lindsey Graham: What the Law Does and What Happens Next
Lindsey Graham did not live to see his Russia sanctions bill become law, and the president who signed it offered no public remarks. The act allows tariffs of up to 100 percent on top buyers of Russian oil and gas, but Trump holds the power to waive it. Here is what it does and what…
-
Slow Down or Speed Up? AI’s Biggest Names Split With the White House as Congress Goes Home
Anthropic’s Dario Amodei asked the AI industry to slow down, and rivals Sam Altman, Elon Musk and Demis Hassabis actually agreed. Then Trump phoned Jensen Huang mid-speech to call it a hoax, and Congress left town before acting on any of it.