Regulon — IL-SB-3502 · IL SB 3502 (AI Product Liability)

WHAT THIS BILL REGULATES · 3 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

Private right of action. Any person who suffers harm caused by a product (high-impact AI system or generative AI system) may bring a products liability action against the developer or deployer. The Attorney General may request AI data sheets and risk management policies. No designated agency enforcement mechanism beyond existing AG authority.

Private Right of Action

Private right of action.

Penalties

Tort-based damages for harm as defined in the Act, including property damage, personal physical/financial/reputational injury, illness, death, mental or psychological anguish, emotional harm, behavioral distortion offensive to a reasonable person, and loss of consortium or services. Comparative negligence applies — plaintiff's recovery is diminished proportionally to plaintiff's fault but is never barred. Developers and deployers may be held jointly and severally liable. No statutory minimum or maximum. No express provision for punitive damages or attorney's fees.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

Section 1

Short title

This Act may be cited as the Artificial Intelligence Design Requirements Act.

Establishes the short title of the Act as the Artificial Intelligence Design Requirements Act. No operative obligations are created.

Section 5

Legislative intent and findings

The General Assembly finds that artificial intelligence shifts decision-making power and responsibility away from persons to software-based systems, often without direct human oversight. While this technology offers significant benefits, its deployment has already caused measurable harm to individuals and businesses. The General Assembly also finds that developers of artificial intelligence have an obligation to make the systems safe when used in reasonably foreseeable ways. Deployers of these products also have an obligation to ensure that these products are used in a way that does not materially affect an individual's rights.

Sets forth the General Assembly's findings that AI shifts decision-making away from persons to software-based systems, often without direct human oversight, and that developers and deployers have obligations to make AI systems safe and to ensure they do not materially affect individuals' rights. These findings establish the policy basis for the liability framework in subsequent sections but create no independent compliance duties.

Section 10

Definitions

As used in this Act: "Artificial intelligence" has the meaning set forth in Section 2-101 of the Illinois Human Rights Act. "Consequential decision" means a decision that either has a legal or similarly significant effect on an individual's access to the criminal justice system, housing, employment, credit, education, health care, or insurance. "Deployer" means a person, including a developer, who uses or operates an artificial intelligence system for use by a deployer or for use by third parties. "Deployer" does not include an individual or business with fewer than 20 employees or less than 10,000 users of its product. "Design" means the intended or known physical and material characteristics of a product and shall include any intended or known formulation or content of the product and the usual result of the intended development or other process used to produce the product, which includes, but is not limited to, unexpected skills or behaviors that appear in a product. "Developer" means a person who designs, codes, produces, owns, or substantially modifies an artificial intelligence system for use by a developer or for use by a third party. "Developer" does not include a person who uses an open source artificial intelligence system but does not substantially modify the system. "Express warranty" means any material, positive statement, affirmation of fact, promise, or description relating to a product, including any sample or model of a product. "Harm" means: (1) damage to property other than the product itself; (2) personal physical, financial or reputational injury, illness, or death; (3) mental or psychological anguish, emotional harm, or distortion of a person's behavior that would be highly offensive to a reasonable person; or (4) any loss of consortium or services or other loss deriving from any type of harm described in this Act. "High-impact artificial intelligence system" means any artificial intelligence system, regardless of the number of parameters and supervision structure, that is: (1) used, reasonably foreseeable as being used, or is a controlling factor in making a consequential decision; (2) used, or reasonably foreseeable as being used, to categorize groups of persons by protected characteristics, such as race, ethnic origin, or religious belief; (3) used, or reasonably foreseeable as being used, in the direct management or operation of critical infrastructure; (4) used, or reasonably foreseeable as being used, in a vehicle, a medical device, or in the safety system of a vehicle or medical device; (5) used, or reasonably foreseeable as being used, to engage in a synthetic relationship; and (6) exhibits, or could be easily modified to exhibit, high levels of performance at tasks that pose a serious risk to economic security, public health or safety, or any combination of those matters. "Material fact" means any specific characteristic or quality of the product. "Material fact" does not include a general opinion about, or praise of, the product or its quality. "Method of development" includes, but is not limited to, the selection of training data for the product, and training, testing, auditing, and fine-tuning the product. "Person" means any individual, corporation, company, association, firm, partnership, society, joint stock company, or any other entity, including any government entity or unincorporated association of persons. "Product" means a high-impact artificial intelligence system or a generative artificial intelligence system. "Product release" means the specific way in which a product is integrated and made accessible within a production environment, including how it interacts with data sources, delivers predictions or results, and is accessed by users. "Synthetic relationship" means a series of interactions between an individual and an artificial intelligence system that mimics human interaction and emotional responses.

Defines the key terms used throughout the Act, including Developer, Deployer, Product (covering both high-impact AI systems and generative AI systems), Harm (broadly defined to include financial, reputational, emotional, and behavioral injuries), and Design (notably inclusive of unexpected emergent behaviors). The Deployer definition excludes individuals or businesses with fewer than 20 employees or fewer than 10,000 users.

Section 15

Developer accountability for harm to consumers or businesses

Developer

(a) 1 In any products liability action, a developer shall be liable to a plaintiff only if the plaintiff establishes: (1) that the developer failed to exercise reasonable care with respect to the design of the product and the failure to exercise reasonable care was a proximate cause of harm to the plaintiff; (2) that the developer failed to exercise reasonable care with respect to providing adequate instructions or warnings applicable to the product that allegedly caused the harm that is the subject of the complaint and the failure to provide adequate instructions or warnings was a proximate cause of harm to the plaintiff; and (3) that the developer failed to exercise reasonable care with respect to providing an express warranty applicable to the product that allegedly caused the harm that is the subject of the complaint; the product failed to conform to the warranty; and the failure of the product to conform to the warranty caused harm to the plaintiff.

(b) 1 In any action alleging that a product is unreasonably dangerous because of a defective design, the plaintiff shall prove by a preponderance of the evidence that, at the time the product left the developer's control: (1) the developer knew or, in light of then-existing scientific and technical knowledge, reasonably should have known of the danger that caused the plaintiff's harm; (2) the developer accounted for both intended uses and reasonably foreseeable unintended uses of their systems; and (3) there existed a technologically feasible and practical alternative design, including, but not limited to, product release and the method of development, that would have reduced or avoided a foreseeable risk of harm without significantly impairing the usefulness of the product to the group of persons who are the intended and legitimate users of the product.

(c) 2 In any action alleging that a product is defective because it failed to contain adequate instructions or warnings: (1) An adequate warning or instruction is one that a reasonably prudent person in the same or similar circumstances would have provided with respect to the danger and communicates sufficient information on the dangers and safe use of the product, taking into account the characteristics of, and the ordinary knowledge common to an ordinary consumer who uses the product. (2) The plaintiff shall prove by a preponderance of the evidence that, at the time the product left the developer's control, the developer knew or, in light of then-existing scientific and technical knowledge, reasonably should have known of the danger that caused the plaintiff's harm. (3) A developer shall not be liable for failure to instruct or warn about a danger that is known or open and obvious to the user or consumer of the product, or should have been known or open and obvious to the user or consumer of the product, taking into account the characteristics of, and the ordinary knowledge common to, the persons who ordinarily use or consume the product. A danger is presumed to not be open and obvious to a user or consumer of the product under 17 years old.

(d) 3 A product may be unreasonably dangerous because it did not conform to an express warranty only if the plaintiff proves by a preponderance of the evidence that: (1) the plaintiff reasonably relied on an express warranty made by the developer about a material fact concerning the safety of the product; (2) this express warranty proved to be untrue; and (3) the plaintiff would not have been harmed if the representation had been true.

Establishes a negligence-based products liability framework for developers of AI products (high-impact AI systems and generative AI systems). Liability attaches under three alternative theories: defective design, failure to provide adequate instructions or warnings, or failure to conform to an express warranty. Each theory requires the plaintiff to show that the developer failed to exercise reasonable care and that the failure proximately caused harm.

For defective-design claims, the plaintiff must show (1) the developer knew or should have known of the danger, (2) the developer accounted for intended and reasonably foreseeable unintended uses, and (3) a technologically feasible alternative design existed — including alternative product release configurations or methods of development — that would have reduced or avoided foreseeable harm without significantly impairing usefulness. For failure-to-warn claims, the bill codifies the open-and-obvious danger defense but creates a presumption that dangers are not open and obvious to users under 17 years old.

Compliance actions 3 items

Developers must exercise reasonable care in the design of AI products, including accounting for intended and reasonably foreseeable unintended uses and adopting technologically feasible alternative designs that would reduce foreseeable risk of harm without significantly impairing product usefulness.

S-01.1

Developers must provide adequate instructions or warnings about known or foreseeable dangers of the AI product, communicating sufficient information on dangers and safe use to an ordinary consumer. Developers are not liable for open-and-obvious dangers, but dangers are presumed not to be open and obvious to users under 17.

S-02.10

Developers face liability when a product does not conform to an express warranty about a material fact concerning safety, the plaintiff reasonably relied on the warranty, and the plaintiff would not have been harmed if the warranty had been true.

—

Section 20

Deployer accountability for harm to consumer or business

Deployer

(a) 4 A deployer shall be deemed to be liable as a developer under Section 15 for harm caused by a product if: (1) the deployer makes material and substantial change to the product; or (2) the deployer intentionally misuses the product contrary to the express warranty and that use was the proximate cause of harm to the plaintiff.

(b) 4 For the purposes of this Section, a use of a product that is intended by the developer of the product does not constitute a misuse or material or substantial change of the product. If a developer does not specify an intended use for the product, intended use shall be inferred by the targeted market and manner of distribution.

(c) Any deployer licensing a product shall not be liable to a plaintiff for violations subsection (a) of Section 15 by another solely by reason of ownership or use of the product.

Extends developer-level liability to deployers under two circumstances: (1) when the deployer makes a material and substantial change to the product, or (2) when the deployer intentionally misuses the product contrary to the express warranty and that misuse proximately causes harm. A safe harbor protects deployers who merely license a product — they are not liable solely by reason of ownership or use. The section also clarifies that a use intended by the developer does not constitute misuse or material modification by the deployer.

Compliance actions 1 item

Deployers who make a material and substantial change to an AI product, or who intentionally misuse the product contrary to the express warranty causing harm, are liable as developers under Section 15. Developer-intended uses do not constitute misuse or material modification.

—

Section 25

Applicability and enforcement

DeployerDeveloper

(a) This Act shall supplement any common law tort liability and any product liability laws of this State. This Act does not prohibit any product liability cause of action involving a generative artificial intelligence system or a high-impact artificial intelligence system brought under a different claim pursuant to product liability common law or statute. This Section does not supersede any product liability cause of action under State law except to the extent that the law would directly conflict with the provisions of this Act.

(b) Products used strictly for peer-reviewed scientific research are exempt from this Act.

(c) In a liability action brought under this Act, the court shall apply a comparative negligence standard, whereby a plaintiff's recovery shall be diminished in proportion to the percentage of fault attributable to the plaintiff, but the recovery shall not be barred regardless of the plaintiff's degree of fault, and developers and deployers may be held jointly and severally liable for the portion of harm that contributed to the plaintiff's injury. In a liability action brought under this Act, the damages for which a deployer is otherwise liable shall be reduced by the percentage of responsibility for the plaintiff's harm attributable to violations of Section 15 by any person if the defendant establishes that the percentage of the plaintiff's harm was proximately caused by a violation under Section 15.

(d) 5 In any products liability action brought under this Act, a court shall recognize a rebuttable presumption that a product is not defective if and only if that deployer: (1) has conducted a documented testing, evaluation, verification, validation, and auditing of that system consistent with industry best practices, such as the latest version of the National Institute of Standards and Technology Artificial Intelligence Risk Management Framework; (2) has mitigated foreseeable risks to the extent possible and has considered alternatives; (3) has disclosed foreseeable risks and mitigation tactics directly to deployers and consumers using the product; (4) has maintained and made available upon request by the Attorney General an artificial intelligence data sheet that includes, at a minimum, the following information: (A) information on the intended contexts and uses of the artificial intelligence model in accordance with the map guidelines articulated in the National Institute of Standards and Technology's latest Artificial Intelligence Risk Management Framework; (B) information regarding the datasets upon which the artificial intelligence was trained, including sources, volume, whether the dataset is proprietary, and how the datasets further the intended purpose of the product; (C) information accounting for foreseeable risks identified in the management guidelines of the National Institute of Standards and Technology's latest Artificial Intelligence Risk Management Framework and information about steps taken to manage those risks; and (D) information concerning the results of red-teaming testing and steps taken to mitigate identified risks, based on guidance developed by the National Institute of Standards and Technology; (5) has, if the product is designed for or is reasonably likely to be used by individuals under 17 years old, documented assessments of use of the product's impact on cognitive and emotional development, implemented age-gating or content restrictions for a product that poses foreseeable risks, and provided to deployers and direct consumers and their guardians clear, accessible disclosures about potential risks; and (6) has prominently included in the terms and conditions of a product the information included in an artificial intelligence data sheet, that deployers of the product may rely upon when making fit-for-use and deployment decisions.

(e) 6 In any products liability action brought under this Act, a court shall recognize a rebuttable presumption that a product is not defective if and only if that deployer has designed and implemented a risk management policy that: (1) specifies the principles, processes, and personnel that the deployer shall use in maintaining the risk management policy to identify, mitigate, and document any risk, especially those impacting individuals under 17 years old, that is a reasonably foreseeable consequence of deploying or using the system; (2) is consistent with industry best practices, such as the latest version of the National Institute of Standards and Technology Artificial Intelligence Risk Management Framework; (3) is reasonable considering: (A) the size and complexity of the deployer; (B) the nature and scope of the system, including the intended uses and unintended uses and the modifications made to the system by the deployer; and (C) the data that the system, once deployed, processes as inputs; and (4) is electronically available to its employees and to the Attorney General upon request.

(f) This Act applies with respect to any action commenced on or after the effective date of this Act without regard to whether the harm that is the subject of the action or the conduct that caused the harm occurred before that date.

Establishes that the Act supplements rather than displaces existing common law tort and product liability law. A research exemption excludes products used strictly for peer-reviewed scientific research. The section specifies that comparative negligence applies — plaintiff fault reduces but never bars recovery — and that developers and deployers may be held jointly and severally liable. A deployer's damages may be reduced by the percentage of harm attributable to developer violations under Section 15.

The bill's most significant safe-harbor mechanism appears in subsections (d) and (e), which create rebuttable presumptions of non-defectiveness. Developers earn the presumption by satisfying six conditions: NIST AI RMF-aligned testing, foreseeable risk mitigation, risk disclosure, maintaining an AI data sheet available to the Attorney General, documented minor-impact assessments with age-gating for minor-facing products, and prominent inclusion of data-sheet information in product terms and conditions. Deployers earn a separate presumption by implementing a risk management policy that specifies identification and mitigation principles, is NIST-aligned, is reasonable in light of the deployer's size and the system's scope, and is electronically available to employees and the Attorney General. The Act applies retroactively to pre-enactment harm for actions commenced after the effective date.

Compliance actions 2 items

Developers earn a rebuttable presumption of non-defectiveness by (1) conducting documented NIST AI RMF-aligned testing, evaluation, verification, validation, and auditing; (2) mitigating foreseeable risks and considering alternatives; (3) disclosing foreseeable risks and mitigation tactics to deployers and consumers; (4) maintaining an AI data sheet — covering intended uses, training data, risk management, and red-teaming results — available to the Attorney General on request; (5) for products accessible to users under 17, documenting cognitive/emotional development impact assessments, implementing age-gating or content restrictions, and disclosing potential risks to deployers, consumers, and guardians; and (6) prominently including data-sheet information in product terms and conditions.

S-01.1

Deployers earn a rebuttable presumption of non-defectiveness by designing and implementing a risk management policy that (1) specifies principles, processes, and personnel for identifying, mitigating, and documenting foreseeable risks (especially to users under 17); (2) is consistent with NIST AI RMF; (3) is reasonable given the deployer's size, the system's scope and inputs, and modifications made by the deployer; and (4) is electronically available to employees and to the Attorney General upon request.

G-01.1

Section 97

Severability

The provisions of this Act are severable under Section 1.31 of the Statute on Statutes.

Standard severability provision incorporating Section 1.31 of the Statute on Statutes. Creates no new compliance obligations.

Safety Harmful content prevention · self-harm escalation

3 items

S-01.1

S-02.10

S-01.1

Governance Risk management · accountability programs

1 item

G-01.1

—

Other

2 items

—

Passage Likelihood

Low

Status Introduced

Chamber No passage

Committee No action

Majority party Yes

Bipartisan No

Prior session None

Legislative History

2026-02-05 Filed with Secretary by Sen. Rachel Ventura

2026-02-05 First Reading

2026-02-05 Referred to Assignments

2026-02-17 Assigned to Executive

2026-02-18 To AI and Social Media

2026-02-19 Added as Chief Co-Sponsor Sen. Mary Edly-Allen

2026-02-19 Added as Co-Sponsor Sen. Michael W. Halpin

2026-02-19 Added as Co-Sponsor Sen. Mike Simmons

2026-03-13 Rule 2-10 Committee Deadline Established As March 27, 2026

2026-03-27 Rule 2-10 Committee Deadline Established As April 24, 2026

2026-04-14 Added as Co-Sponsor Sen. Karina Villa

2026-04-14 Added as Co-Sponsor Sen. Graciela Guzmán

2026-04-14 Added as Co-Sponsor Sen. Emil Jones, III

2026-04-24 Rule 2-10 Committee/3rd Reading Deadline Established As May 15, 2026

2026-04-28 Added as Co-Sponsor Sen. David Koehler

2026-04-28 Added as Co-Sponsor Sen. Mattie Hunter

2026-04-28 Added as Co-Sponsor Sen. Lakesia Collins

2026-04-28 Added as Co-Sponsor Sen. Celina Villanueva

2026-04-28 Added as Co-Sponsor Sen. Mark L. Walker

2026-04-28 Added as Co-Sponsor Sen. Christopher Belt

2026-04-28 Added as Co-Sponsor Sen. Mike Porfirio

2026-04-28 Added as Chief Co-Sponsor Sen. Christopher Belt

2026-04-30 Added as Co-Sponsor Sen. Willie Preston

2026-05-15 Rule 2-10 Committee/3rd Reading Deadline Established As May 22, 2026

2026-05-22 Rule 3-9(a) / Re-referred to Assignments

Sources

Full Text ↗

Entry Last Reviewed

2026-06-01

AI generated