AI product management · Industry brief

Illinois Governor JB Pritzker signed Senate Bill 315, the Artificial Intelligence Safety Measures Act, into law on July 6, 2026, making Illinois the third U.S. state after California and New York to impose comprehensive safety and transparency requirements on frontier AI developers. The Act targets companies training models using more than 10^26 computing operations, with enhanced obligations for those exceeding $500 million in annual revenue. Key requirements effective January 1, 2028 include publishing comprehensive safety frameworks, filing transparency reports before model deployment, undergoing annual independent third-party audits (a first among states), reporting critical safety incidents within 72 hours (24 hours for imminent risks), and establishing whistleblower protections. The Illinois Attorney General has exclusive enforcement authority with penalties up to $1 million for initial violations and $3 million for subsequent violations. Illinois's requirement for annual independent audits distinguishes it from California's SB 53 and New York's RAISE Act. The Act will reshape vendor contracts, M&A due diligence, and incident-response planning for organizations working with frontier developers. Concurrently, two federal bills were introduced: the FRONTIER Act (July 23, 2026, sponsored by Jay Obernolte and Lori Trahan) proposing tiered obligations, mandatory model cards, independent audits, and 24-hour critical incident reporting to establish national standards; and the AI Kill Switch Act (July 23, 2026, sponsored by Ted Lieu and Nathaniel Moran) requiring developers to maintain technical shutdown capabilities and authorizing DHS to order slowdown or suspension of systems capable of catastrophic harm. Source: National Law Review.

This article from Dentons addresses AI governance and risk assessment in cross-border Canada-US M&A transactions, providing a practical framework for due diligence rather than discussing regulatory changes or industry developments. It outlines how buyers should evaluate AI governance before closing, build AI system inventories, assess data provenance, review documentation, and distinguish between proprietary and third-party AI risks. The piece emphasizes that AI regulation in Canada and the US lacks a single cross-border framework, with risks arising through existing privacy, consumer-protection, employment, and biometric laws rather than omnibus AI legislation. It recommends AI-specific representations, interim covenants, and indemnities in purchase agreements, and notes that integration planning should begin during diligence. The article references the National Institute of Standards and Technology's AI Risk Management Framework as a practical tool for establishing consistent governance across jurisdictions.

Agentic AI systems in healthcare are now autonomously managing patient outreach decisions at machine speed, creating governance gaps that traditional GRC frameworks cannot address. The core risk is "deterministic drift"—where autonomous agents gradually operate outside legal guardrails as they optimize for goals and encounter edge cases their designers didn't anticipate, potentially generating thousands of compliance violations before detection. The FCC has confirmed AI-generated voice calls fall under the Telephone Consumer Protection Act, requiring the same consent compliance as prerecorded campaigns, layered with HIPAA and state regulations. Healthcare organizations are addressing this by embedding real-time governance layers that validate consent, eligibility, timing, and channel permissions at the moment each agent acts, applying identical rules to human and AI outreach with complete audit logging, moving compliance enforcement from periodic audits to per-interaction validation at machine speed.