On July 6, Gov. JB Pritzker signed the Artificial Intelligence Safety Measures Act, which passed with overwhelming legislative support in the General Assembly. Anthropic backed it. So did OpenAI. The companies being regulated stood alongside the legislators regulating them, which is rare enough to be worth pausing over.
California and New York had already required the largest AI developers to publish safety frameworks and report serious incidents. Illinois added the thing neither had: Beginning in 2028, those companies must submit to an annual independent audit. Every year, an outside party must examine whether the company actually did what its safety plan said, and sign its name to the answer.
This is the first time any American government has required that an AI company’s safety claims be checked by someone other than the AI company. Illinois deserves the credit it is receiving.
Now the question the statute has left unanswered: Who performs these audits?
The law says the third-party auditor must work consistent with generally accepted auditing standards and must have demonstrated competence, including experience with people who possess technical expertise in frontier model safety. The developer may not retain an auditor with whom it shares a financial interest.
That is the entire qualification standard. No license, certification, registry or board that admits practitioners or disciplines them when they fall short. The statute requires an audit and, in the same breath, describes a profession that does not exist.
Look at who might do this work today. The large accounting firms know how to audit an organization against a stated control framework, which is precisely the form the law demands. Their difficulty is not hiring technical talent; they will hire it. It is integrating frontier-model expertise into an assurance methodology that satisfies both independence and generally accepted auditing standards. The specialized AI evaluation labs have the technical depth in abundance, but they conduct model testing rather than compliance attestation, and many hold research relationships with the very companies they would examine. That is the one arrangement the statute forbids. Standards bodies supply methodology. They do not sit as anyone’s auditor of record.
None of this is a flaw in the law. It is a description of where we are, and it is not unprecedented. It is the oldest pattern in the history of American commerce.
In 1894, an insurance investigator opened a laboratory in Chicago to test a technology nobody understood and everybody feared. Electricity was burning down buildings, and manufacturers insisted their products were safe. Underwriters Laboratories, known as UL, was founded on the premise that a manufacturer’s assurance about its own product is not evidence. Someone independent has to look.
Decades earlier, the Chicago Board of Trade faced a related problem. Grain arrived in wagons of varying quality, and every trade required the buyer to inspect the load and trust the seller about the rest. The board’s answer was standardized grading: Define the categories, inspect against them and let a receipt mean the same thing to everyone. That single act of measurement turned a haggle into a market.
Then, nationally, the crash. The Securities Acts of 1933 and 1934 did not test companies. They built a profession around them, with independence rules, documented methodology and an engagement partner that signs. Congress did not decide which companies were sound; it decided who was qualified to look.
The sequence never varies: A technology arrives, then someone devises a way to measure it. Eventually, a profession forms around the measurement, and only then does a market treat the measurement as real.
AI has reached that point. What Illinois has called for is not merely a class of auditors but an assurance profession: methodology, evidence protocols, independence standards, peer review, accreditation and the means to hold a professional accountable when judgment proves wrong. Whether the governing standards ultimately emerge from Springfield, from Washington, from professional bodies or from the market itself, they will require institutions capable of producing assurance that is trusted and repeatable.
Every mature assurance profession eventually converges on the same architecture: independence from the assessed, criteria that are measurable rather than narrative, documentation another professional can reproduce, results comparable across organizations and providers that stand behind their conclusions. AI will be no exception.
Illinois has done the difficult political work. It required that someone check.
Laws can require independent assurance. Only institutions can produce the professionals worthy of providing it. Chicago has built such institutions twice. It would be fitting to build the next one here.
James E. Malackowski is chief intellectual property officer of J.S. Held and co-founder and chairman of AIQA Global, an artificial intelligence governance and assurance company. Chase J. Malackowski is co-founder and chief technology officer of AIQA Global.
Submit a letter, of no more than 400 words, to the editor here or email letters@chicagotribune.com.
