These developments signal a growing trend: states are stepping up with ambitious, enforceable rules focused on transparency, risk management, and protecting vulnerable users — especially children.
Illinois: The Strictest Frontier AI Transparency Law Yet?
Illinois is poised to enact one of the most comprehensive AI transparency bills in the country with Senate Bill 315. The legislation, which has passed both chambers and awaits Governor JB Pritzker’s signature, introduces rigorous requirements for high-risk “frontier” AI models.
Key Provisions of SB 315:
- Annual third-party audits
- Mandatory governance and risk mitigation programs
- Cybersecurity requirements
- Pre-deployment reports detailing model capabilities, intended uses, and risk disclosures
The bill defines “catastrophic risk” as models capable of causing mass harm or damages exceeding $1 billion. State Rep. Daniel Didech emphasized the need for guardrails while acknowledging the preference for a federal solution. Once signed, the law will take effect on January 1, 2027.
Notably, major AI developers including OpenAI and Anthropic have publicly supported the measure, calling it a “new standard” for responsible AI development.
Connecticut: Strengthening Data Broker Rules and Broad AI Oversight
Governor Ned Lamont recently signed two significant bills that expand Connecticut’s already progressive privacy and AI framework.
Senate Bill 4 – Data Broker Accountability
This bill introduces mandatory registration for data brokers, bans the sale of precise geolocation data, and adds new protections around facial recognition technology. It also creates a consumer-friendly opt-out and deletion system modeled after California’s successful Delete Act platform.
Senate Bill 5 – Comprehensive AI Regulation
After years of negotiation, SB 5 establishes requirements for frontier AI models, automated decision-making tools (ADMT), and AI companions. It includes whistleblower-style reporting mechanisms for employees, anti-discrimination safeguards, and restrictions on minors’ access to AI companions under age 18.
The bill also creates an innovation-friendly regulatory sandbox set to launch by January 2028, balancing protection with economic growth.
New York: Protecting Children with the Safe By Design Act
Governor Kathy Hochul has embedded the Safe By Design Act into New York’s FY 2027 budget. This landmark children’s online safety legislation targets social media, gaming, and messaging platforms with strong default protections:
- Restrictions on adult-minor interactions
- Geolocation data protections
- Parental consent requirements for users under 13
- Default safety settings for minors under 17
- AI companions turned off by default for minors
The move comes as New York Attorney General Letitia James and 43 other state AGs oppose the federal KIDS Act, arguing it could undermine stronger state-level protections.
What This Means for Businesses and the Future of AI Governance
These three bills reflect a maturing state-level approach to AI regulation — one that emphasizes transparency, accountability, and child safety without completely stifling innovation. Companies operating nationally should prepare for a patchwork of requirements that may soon become the de facto standard across the U.S.
Key Takeaways:
- Third-party audits and risk reporting are becoming mainstream expectations
- States are prioritizing child protection in both data privacy and AI design
- Collaboration between industry and lawmakers (as seen in Illinois and Connecticut) can lead to more balanced outcomes
As AI capabilities continue to advance, expect more states to follow suit in 2027 and beyond. Organizations that proactively build strong governance, transparency, and risk management frameworks will be best positioned to thrive in this new regulatory landscape.
