Exploring State AI Governance in AGORA #3: Frontier AI Laws

⭐️ Overview

In our second edition of the AGORA state AI governance blog series, we covered common elements of state AI regulatory sandboxes, specifically programs established in Utah and Texas that test AI systems in controlled environments to inform regulatory experimentation. This edition compares the governance strategies of three enacted state frontier AI laws: California's Senate Bill 53 (SB 53), also known as the Transparency in Frontier AI Act; New York's Responsible AI Safety and Education Act (RAISE Act); and Illinois's Senate Bill 315 (SB 315), also known as the AI Safety Measures Act. As of writing, no other state has enacted a law primarily focused on governing frontier AI, although Connecticut has passed a law that creates obligations for frontier AI developers while also addressing many other non-frontier AI issues and states such as Utah have frontier AI bills pending. Frontier AI is generally defined as "highly capable general-purpose AI models that can perform a wide variety of tasks and match or exceed the capabilities present in today's most advanced models."

Recent AI hacking events have demonstrated that frontier AI models can escape testing environments and behave in ways that contravene developer intent, raising concerns about the U.S. government's readiness to address challenges associated with highly capable AI systems. Although President Trump signed an executive order in June that directs the creation of a process for AI developers to submit their models to the federal government for pre-deployment testing, the testing process is voluntary and its details are not publicly available. Frontier AI companies have stepped up calls for the government to manage risks from advanced AI models, but neither the administration nor Congressional leaders have been quick to act. In contrast, several states have already enacted laws governing powerful AI systems, providing a useful reference for both state and federal decisionmakers seeking to establish guardrails for frontier AI.

This blog analyzes governance strategies across SB 53, the RAISE Act, and SB 315 using CSET's ETO AGORA. We find that all three laws require disclosures such as incident reports and public safety frameworks alongside government studies or reports, highlighting transparency measures as a first-order strategy for governing frontier AI. However, only California and Illinois codify whistleblower protections that shield employees who report on frontier AI risks from retaliation. California also addresses capacity-building by convening a multi-stakeholder consortium to develop a framework for a public cloud computing cluster (CalCompute), whereas New York and Illinois condition market access on registration with a state regulator. Illinois implements the strictest oversight mechanism by mandating the only independent third-party compliance audit among the laws. Taken together, these transparency and oversight-oriented strategies offer decisionmakers a working menu of available governance approaches for frontier AI.

⚖️ Background

California enacted SB 53, the first frontier AI law in the nation, in September 2025 following the veto of its more stringent predecessor SB 1047. The law imposes transparency obligations for frontier AI developers by requiring them to publish frontier AI frameworks, transparency reports, critical safety incident reports, and other documentation pertaining to how developers manage frontier AI risks. It also mandates the creation of a consortium to establish CalCompute, a state computing cluster.

New York followed California's lead in December 2025 by enacting the RAISE Act. The Act was amended in March 2026 to align with California's revenue thresholds defining large frontier developers and the size of civil penalties for non-compliance. It passed only after industry negotiation stripped a third-party audit requirement from the original version, a provision that was later included in Illinois.

Illinois moved third, enacting SB 315 in July 2026. SB 315 was modeled openly on California and New York: it mandates the publication of frontier AI frameworks, transparency reports, and critical safety incident reporting. However, SB 315 diverges from SB 53 and the RAISE Act in that it mandates the first third-party compliance audit found in any state frontier AI law.

🏫 Governance Strategies: How states govern frontier AI

Governance strategies refer to the approaches used in legislation and other documents to tackle different policy issues. Table 1 shows a subset of governance strategies employed across the three state frontier AI laws, and Table 2 defines each strategy.

All three laws rely on disclosures as a primary AI governance strategy. These disclosures take many different forms and vary based on the annual revenue of the AI developer. Each law places heavier disclosure obligations on large frontier developers, defined as earning more than $500 million in gross annual revenue, compared to regular frontier developers. Large frontier developers must publish both a frontier AI framework and a transparency report on their websites. Other frontier developers are only required to publish a transparency report. The frontier AI framework discloses how large developers mitigate models' catastrophic risks, including the role of third party evaluators. The transparency report documents model details such as allowed and restricted uses; for large developers, it must also summarize their catastrophic risk assessments. Incident reporting is another type of disclosure requirement. All three laws require frontier developers to report any critical safety incidents pertaining to their models to specified government offices, though the timelines differ: California allows 15 days, while New York and Illinois require 72 hours.

In addition to disclosures, the three laws share two related governance strategies. The first is governance development, specifically the development of AI governance documents that directly guide behavior. Each law not only requires large frontier developers to publish their frontier AI frameworks, but to also comply with them or risk facing civil penalties. Once published, the framework binds the developer to its own commitments and guards against backsliding under competitive market pressure, functioning as a new governance document that shapes behavior around AI. SB 53 uses this strategy in two other ways: first, it requires California's Department of Technology to prepare formal recommendations to the legislature on whether and how to revise the law's governing definitions; and second, it tasks a consortium with developing a governing framework for CalCompute, thereby requiring the creation of new governance documents. The second strategy is government study or report. The laws require agencies receiving incident reports from frontier developers to produce an anonymous, aggregate report for the General Assembly and Governor of their state.

While all three laws require developers to make disclosures about AI evaluations, SB 315 is the only law that requires an evaluation to actually be carried out. California and New York require frontier AI developers to disclose the extent to which third-party evaluators were involved in assessing catastrophic risks, which in principle could be none. However, Illinois requires every large frontier AI developer to annually retain an independent third party to audit its compliance with the law's requirements. Even though the audit does not evaluate the frontier models themselves, it counts as an evaluation because it assesses processes into which the AI system is directly integrated—here, the developer's own processes for managing catastrophic risk. SB 315 also sets auditor-independence rules and specifies the content of the audit report to be prepared by the third party, published by the developer, and transmitted to the state.

SB 53's creation of a new institution and use of convening differentiates it from the other two laws. SB 53 creates a new institution by establishing a consortium within the Government Operations Agency to draft a framework for the creation of CalCompute. CalCompute, a public cloud computing cluster, has dual aims of advancing the ethical development and deployment of AI and enabling equitable innovation by expanding access to computational resources. By calling for fourteen members drawn from different stakeholder groups to form the consortium, SB 53 also uses convening as a governance strategy to bring together different stakeholders to participate in the development or deployment of AI.

On the other hand, the RAISE Act and SB 315 adopt licensing, registration, and certification as a governance strategy. Both laws require large frontier developers to file a disclosure statement identifying the company and all names it does business under, its principal and in-state offices, its significant beneficial owners, and designated points of contact for regulator inquiries. Large frontier developers must also pay a fee before developing, deploying, or operating a frontier model in the states. In contrast, California only requires its large frontier AI developers to publish their safety frameworks and transparency reports to their websites; they are not required to submit information to a regulator as a condition of operating.

Finally, whistleblower protections that bar retaliation against employees for reporting catastrophic risk concerns and require notifying employees of their rights appear in SB 53 and SB 315 but not the RAISE Act. Although AGORA's taxonomy does not specifically cover whistleblower protections, we highlight them because they preserve critical channels through which AI risks are shared with the public.

📝 Conclusion

California's SB 53, New York's RAISE Act, and Illinois's SB 315 govern frontier AI through disclosures and government reports but diverge in their adoption of other governance strategies. California invests in public capacity, and both California and Illinois establish whistleblower protections. New York and Illinois condition market access on registration, but only Illinois mandates independent external audits. These laws provide a working menu of AI governance strategies for both state and federal policymakers that provide alternatives to AI governance proposals emerging from industry and other pockets of the AI community.

✉️ Get in Touch

As always, we're glad to help you get the most out of AGORA and our other resources. Visit ETO's support hub to contact us, book live support with an ETO staff member, or access the latest documentation for our tools and data. 👋