{"resourceId":"csg-midwest-illinois-iowa-nebraska-ai-laws-20261002","versions":[{"version":"external-57e6cd9715be6f8557e97b525eb39144cb281fe10380f174321e296bf40c5614","resource":{"id":"csg-midwest-illinois-iowa-nebraska-ai-laws-20261002","title":"CSG Midwest (Oct 2): Illinois SB 315 requires annual frontier AI developer audits; Iowa/Nebraska add chatbot user safeguards","organization":"The Council of State Governments Midwestern Office (Stateline Midwest / Tim Anderson)","sector":"State legislature AI safety statutes / frontier developer audits / conversational chatbot consumer protections","geography":"Illinois statewide (SB 315); Iowa (SF 2417, HF 2635); Nebraska (LB 525); Midwest comparative","publishedAt":"2026-10-02","publicationDate":"2026-10-02","eventDate":"2026-10-02","sourceName":"CSG Midwest","sourceLabel":"Illinois has first-in-nation law on AI safety; Iowa, Nebraska have new protections for chatbot users","sourceUrl":"https://csgmidwest.org/2026/10/02/illinois-has-first-in-nation-law-on-ai-safety-iowa-nebraska-have-new-protections-for-chatbot-users/","evidenceClass":"independent-reporting","outcomeClass":"cautionary","topics":["governance-procurement","data-security","accessibility-workforce","operating-model"],"finding":"CSG Midwest’s Oct 2 Stateline piece reports Illinois’ Artificial Intelligence Safety Measures Act (SB 315) as a first-in-nation requirement that frontier AI developers undergo annual, independent third-party audits of safety frameworks, with public disclosure of safety practices, significant-incident reporting, whistleblower protections, and catastrophic-risk definitions (>50 serious injuries/deaths or >$1B property damage); the Act “takes effect in January.” The same article catalogs Midwest chatbot and consumer controls: Nebraska LB 525 (and Iowa SF 2417) require disclosing AI identity to young users, shielding them from sexually explicit content, and routing self-harm prompts to crisis referrals; Iowa HF 2635 bars AI-only prior-authorization denials; Illinois adds human review before claim downcoding (SB 3114).","sledRelevance":"Freshest post-2026-10-01 multi-state control signal for SLED: contrasts an enacted Illinois developer-audit mandate with chatbot user-safety statutes in Iowa/Nebraska. Why now: Oct 2 publication; Illinois Act PDF was previously archived, but this CSG synthesis tying SB 315 to IA/NE chatbot laws and catastrophic-risk thresholds is new and unarchived.","evidence":"Opened the CSG Midwest HTTPS article via curl (UA SLED-research-bot/1.0); confirmed Oct 2 dateline, SB 315 annual independent third-party audit language, January effective timing, catastrophic-risk thresholds, Nebraska LB 525 / Iowa SF 2417 chatbot safeguards, and Transparency Coalition 27-state/84-law first-half-2026 context.","architectureImplications":"Frontier-developer audit mandates and chatbot disclosure/crisis-routing rules are policy/compliance controls—not a state-hosted model architecture. SLED engineering should map which products are “frontier” under Illinois definitions versus ordinary agency copilots/chatbots covered by IA/NE user-safety rules.","governanceImplications":"Separates developer-side annual independent audits (Illinois SB 315) from deployer/operator chatbot UX and crisis protocols (IA/NE). Procurement and counsel need statute-specific checklists rather than a single “AI safety” checkbox.","securityPrivacyImplications":"Catastrophic-risk framing and incident reporting for frontier developers differ from conversational self-harm referral duties; neither substitutes for agency data-handling and logging controls on state-operated assistants.","caveats":"Secondary association reporting citing NYU Stern Transparency Coalition analyses—not the enrolled bill PDFs themselves; “takes effect in January” lacks an explicit year in the lead sentence (context is 2026 legislation); Illinois Act text was previously archived separately; chatbot provisions summarized at high level without implementation metrics.","streamIds":["state-government"],"roles":{"sales":"Frame CSG Midwest’s Oct 2 package as the post-CART control wave: Illinois SB 315’s annual independent frontier-developer audits plus Iowa/Nebraska chatbot identity and crisis-referral statutes. Open with discovery on whether the prospect’s stack includes frontier-model contracts versus citizen chatbots. Value is compliance scoping and RFP language—not a guaranteed risk reduction. Unsupported: claiming Illinois audits already cover every state copilot, or that IA/NE youth disclosure rules prove chatbot ROI.","engineering":"Fit is statute-to-control mapping: classify systems as frontier-developer obligations versus conversational assistants needing disclosure, content filters, and crisis-routing hooks. Integrate audit evidence intake and incident-reporting contacts for frontier vendors; for chatbots, enforce age-aware UX and referral workflows. Constraints: article is secondary; confirm enrolled text and effective dates before locking architecture. Proof of value: gap analysis against SB 315 / LB 525 / SF 2417 checklists on one in-scope product.","delivery":"Delivery work is a cross-functional compliance sprint: legal extracts duties, procurement updates vendor questionnaires, product adds disclosure/crisis paths, and security defines incident contacts. Acceptance criteria: documented owner per statute family and evidence pack for one frontier vendor and one chatbot. Risks: over-applying Illinois developer audits to ordinary agency GenAI, or shipping chatbots without crisis-referral testing."},"roleDetails":{"sales":{"customerProblem":"States face a patchwork of frontier-developer audit mandates and chatbot user-safety statutes without a single compliance map.","stakeholders":["CIO/CISO","General counsel","Procurement","Citizen-services product owners","Legislative affairs"],"discoveryQuestions":["Which systems meet Illinois-style frontier definitions?","Do citizen chatbots serve IA/NE or similar youth audiences?","Who owns vendor audit evidence intake?","Are crisis-referral paths tested for self-harm prompts?"],"valueHypothesis":"A statute-scoped controls workshop can prevent over-buying generic 'AI safety' add-ons while closing real IL/IA/NE gaps.","potentialEngagement":"2–3 week Midwest AI-statute gap assessment for one frontier contract and one public chatbot.","unsupportedClaims":["Guaranteed catastrophic-risk reduction","Illinois audits cover all GenAI copilots","Chatbot disclosure equals measured call deflection","CSG summary replaces enrolled bill review"]},"engineering":{"fit":"Policy/compliance control design for frontier vendor assurance and conversational safety UX—not a new model deployment.","architectureIntegration":"Add vendor audit-evidence vault and incident webhook/contacts for frontier providers; chatbot gateway for identity disclosure, content filters, and crisis referral.","prerequisites":["Inventory of frontier vs ordinary GenAI systems","Access to enrolled IL/IA/NE texts","Chatbot prompt/response logging","Legal interpretation of effective dates"],"constraints":["Secondary reporting only","January effective date year must be confirmed","Catastrophic-risk thresholds are developer-side","Jurisdictional limits outside IL/IA/NE"],"security":"Separate frontier incident reporting from agency SOC playbooks; do not send crisis-referral chat logs to vendors by default.","proofOfValue":["Completed control matrix for one frontier vendor","Chatbot test cases for disclosure and self-harm referral","Documented owners and evidence locations"]},"delivery":{"work":"Run statute gap workshop, update vendor questionnaire and chatbot UX stories, and produce an evidence checklist.","dependencies":["Counsel bill-text review","Procurement RFP edits","Product/UX for disclosure","Vendor cooperation"],"ownership":"AI governance lead with counsel and citizen-services product co-owners.","skillsAdoption":"Train chatbot operators on crisis-referral scripts; brief procurement on SB 315 audit questions.","governanceCheckpoints":["Counsel sign-off on duty map","Procurement questionnaire approval","Pre-prod chatbot safety test review"],"acceptanceCriteria":["Written IL/IA/NE duty map","One frontier vendor evidence request issued","Chatbot disclosure/crisis tests passed in staging"],"risks":["Misclassifying copilots as frontier systems","Shipping without crisis-referral QA","Relying on CSG paraphrase over statute text"]}},"retrievedAt":"2026-10-03T22:21:24-05:00","enrichedAt":"2026-10-03T22:21:24-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Chatbot identity disclosure and crisis-referral requirements protect vulnerable users; workforce impact is mainly compliance/training for operators of conversational systems, not a measured staffing change.","procurementImplications":"Ask frontier-model vendors how they will evidence annual independent audits and incident reporting if serving Illinois-covered contexts; for citizen chatbots in IA/NE, require disclosure, youth protections, and crisis-routing in statements of work.","operatingModelImplications":"Treat Midwest AI statutes as a portfolio: developer assurance (IL) versus conversational safety UX (IA/NE) versus insurer human-in-the-loop (IA/IL)—assign different owners in legal, procurement, and service design.","sourceVerification":{"responseId":"curl-csg-midwest-il-ia-ne-20261003","openedUrl":"https://csgmidwest.org/2026/10/02/illinois-has-first-in-nation-law-on-ai-safety-iowa-nebraska-have-new-protections-for-chatbot-users/","referenceExcerpt":"Illinois has adopted a first-in-the-nation requirement for the developers of advanced AI systems: undergo annual, independent third-party audits","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}