Regulon — IL-SB-3590 · IL SB 3590 (AI Product Liability)

WHAT THIS BILL REGULATES · 2 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

Private right of action. No designated agency enforcer for ongoing compliance. Any person who suffers harm as defined in the Act may bring a products liability action against a developer or deployer. The Attorney General may request production of AI data sheets and risk management policies. Comparative negligence applies; plaintiff's recovery is diminished in proportion to plaintiff's fault but never barred.

Private Right of Action

Private right of action.

Penalties

Damages follow general tort product liability principles — compensatory damages for property damage, personal physical, financial, or reputational injury, illness, death, mental or psychological anguish, emotional harm, distortion of behavior, and loss of consortium or services. No statutory minimum or maximum. Comparative negligence standard applies; developers and deployers may be held jointly and severally liable for their portion of harm. A deployer's damages may be reduced by the percentage of harm attributable to developer violations under Section 15. No express provision for punitive damages or attorney's fees.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

Section 1

Short title

This Act may be cited as the Artificial Intelligence Product Liability Act.

Establishes the short title of the Act as the Artificial Intelligence Product Liability Act. No substantive obligations.

Section 5

Legislative intent and findings

The General Assembly finds that artificial intelligence shifts decision-making power and responsibility away from persons to software-based systems, often without direct human oversight. While this technology offers significant benefits, its deployment has already caused measurable harm to individuals and businesses. The General Assembly also finds that developers of artificial intelligence have an obligation to make the systems safe when used in reasonably foreseeable ways. Deployers of these products also have an obligation to ensure that these products are used in a way that does not materially affect an individual's rights.

States the General Assembly's findings that AI shifts decision-making power away from persons to software-based systems, often without direct human oversight, and that developers and deployers have obligations to ensure safety and protect individual rights. This is a purpose statement with no independent compliance obligation.

Section 10

Definitions

As used in this Act: "Artificial intelligence" has the meaning set forth in Section 2-101 of the Illinois Human Rights Act. "Consequential decision" means a decision that either has a legal or similarly significant effect on an individual's access to the criminal justice system, housing, employment, credit, education, health care, or insurance. "Deployer" means a person, including a developer, who uses or operates an artificial intelligence system for use by a deployer or for use by third parties. "Deployer" does not include an individual or business with fewer than 20 employees or less than 10,000 users of its product. "Design" means the intended or known physical and material characteristics of a product and shall include any intended or known formulation or content of the product and the usual result of the intended development or other process used to produce the product, which includes, but is not limited to, unexpected skills or behaviors that appear in a product. "Developer" means a person who designs, codes, produces, owns, or substantially modifies an artificial intelligence system for use by a developer or for use by a third party. "Developer" does not include a person who uses an open source artificial intelligence system but does not substantially modify the system. "Express warranty" means any material, positive statement, affirmation of fact, promise, or description relating to a product, including any sample or model of a product. "Harm" means: (1) damage to property other than the product itself; (2) personal physical, financial or reputational injury, illness, or death; (3) mental or psychological anguish, emotional harm, or distortion of a person's behavior that would be highly offensive to a reasonable person; or (4) any loss of consortium or services or other loss deriving from any type of harm described in this Act. "High-impact artificial intelligence system" means any artificial intelligence system, regardless of the number of parameters and supervision structure, that is: (1) used, reasonably foreseeable as being used, or is a controlling factor in making a consequential decision; (2) used, or reasonably foreseeable as being used, to categorize groups of persons by protected characteristics, such as race, ethnic origin, or religious belief; (3) used, or reasonably foreseeable as being used, in the direct management or operation of critical infrastructure; (4) used, or reasonably foreseeable as being used, in a vehicle, a medical device, or in the safety system of a vehicle or medical device; (5) used, or reasonably foreseeable as being used, to engage in a synthetic relationship; and (6) exhibits, or could be easily modified to exhibit, high levels of performance at tasks that pose a serious risk to economic security, public health or safety, or any combination of those matters. "Material fact" means any specific characteristic or quality of the product. "Material fact" does not include a general opinion about, or praise of, the product or its quality. "Method of development" includes, but is not limited to, the selection of training data for the product, and training, testing, auditing, and fine-tuning the product. "Person" means any individual, corporation, company, association, firm, partnership, society, joint stock company, or any other entity, including any government entity or unincorporated association of persons. "Product" means a high-impact artificial intelligence system or a generative artificial intelligence system. "Product release" means the specific way in which a product is integrated and made accessible within a production environment, including how it interacts with data sources, delivers predictions or results, and is accessed by users. "Synthetic relationship" means a series of interactions between an individual and an artificial intelligence system that mimics human interaction and emotional responses.

Defines the key terms used throughout the Act. Notable features include the broad definition of harm, which extends beyond physical injury to cover financial, reputational, and psychological harm, as well as behavioral distortion. The definition of design explicitly captures emergent capabilities — unexpected skills or behaviors that appear in a product — making developers responsible for emergent properties under the defective-design theory. The deployer definition includes a small-business carve-out for entities with fewer than 20 employees or fewer than 10,000 users.

Section 15

Developer accountability for harm to consumers or businesses

Developer

(a) 1 In any products liability action, a developer shall be liable to a plaintiff only if the plaintiff establishes: (1) that the developer failed to exercise reasonable care with respect to the design of the product and the failure to exercise reasonable care was a proximate cause of harm to the plaintiff; (2) that the developer failed to exercise reasonable care with respect to providing adequate instructions or warnings applicable to the product that allegedly caused the harm that is the subject of the complaint and the failure to provide adequate instructions or warnings was a proximate cause of harm to the plaintiff; and (3) that the developer failed to exercise reasonable care with respect to providing an express warranty applicable to the product that allegedly caused the harm that is the subject of the complaint; the product failed to conform to the warranty; and the failure of the product to conform to the warranty caused harm to the plaintiff.

(b) 2 In any action alleging that a product is unreasonably dangerous because of a defective design, the plaintiff shall prove by a preponderance of the evidence that, at the time the product left the developer's control: (1) the developer knew or, in light of then-existing scientific and technical knowledge, reasonably should have known of the danger that caused the plaintiff's harm; (2) the developer accounted for both intended uses and reasonably foreseeable unintended uses of their systems; and (3) there existed a technologically feasible and practical alternative design, including, but not limited to, product release and the method of development, that would have reduced or avoided a foreseeable risk of harm without significantly impairing the usefulness of the product to the group of persons who are the intended and legitimate users of the product.

(c) 3 In any action alleging that a product is defective because it failed to contain adequate instructions or warnings: (1) An adequate warning or instruction is one that a reasonably prudent person in the same or similar circumstances would have provided with respect to the danger and communicates sufficient information on the dangers and safe use of the product, taking into account the characteristics of, and the ordinary knowledge common to an ordinary consumer who uses the product. (2) The plaintiff shall prove by a preponderance of the evidence that, at the time the product left the developer's control, the developer knew or, in light of then-existing scientific and technical knowledge, reasonably should have known of the danger that caused the plaintiff's harm. (3) A developer shall not be liable for failure to instruct or warn about a danger that is known or open and obvious to the user or consumer of the product, or should have been known or open and obvious to the user or consumer of the product, taking into account the characteristics of, and the ordinary knowledge common to, the persons who ordinarily use or consume the product. A danger is presumed to not be open and obvious to a user or consumer of the product under 17 years old.

(d) 4 A product may be unreasonably dangerous because it did not conform to an express warranty only if the plaintiff proves by a preponderance of the evidence that: (1) the plaintiff reasonably relied on an express warranty made by the developer about a material fact concerning the safety of the product; (2) this express warranty proved to be untrue; and (3) the plaintiff would not have been harmed if the representation had been true.

Establishes the three theories of developer liability: defective design, failure to provide adequate instructions or warnings, and breach of express warranty. Each theory is grounded in negligence (reasonable care), not strict liability, and requires proof of proximate causation. For defective-design claims, the plaintiff must show the developer knew or should have known of the danger, accounted for both intended and reasonably foreseeable unintended uses, and that a technologically feasible alternative design — including alternative product releases and methods of development — existed that would have reduced the foreseeable risk without significantly impairing the product's usefulness.

The failure-to-warn theory includes an open-and-obvious-danger defense, but creates a rebuttable presumption that no danger is open and obvious to users under 17 years old, effectively eliminating the defense for minor users. The express-warranty theory requires proof that the plaintiff reasonably relied on a material-fact warranty about safety, that it proved untrue, and that the untruth was the but-for cause of harm.

Compliance actions 4 items

Developers must exercise reasonable care in the design of their AI product, in providing adequate instructions or warnings, and in conforming to any express warranty about the product's safety, or face product liability for resulting harm.

—

Developers must account for both intended uses and reasonably foreseeable unintended uses of their AI systems at the time the product leaves the developer's control, and ensure no technologically feasible and practical alternative design existed that would have reduced foreseeable risk of harm without significantly impairing the product's usefulness.

—

Developers must provide adequate instructions or warnings about dangers of the AI product that a reasonably prudent person would have communicated, based on what the developer knew or should have known at the time the product left the developer's control. The open-and-obvious-danger defense is presumed unavailable for users under 17 years old.

—

Developers face liability when a plaintiff reasonably relied on an express warranty about a material fact concerning the product's safety, the warranty proved untrue, and the plaintiff would not have been harmed if it had been true.

—

Section 20

Deployer accountability for harm to consumer or business

Deployer

(a) 5 A deployer shall be deemed to be liable as a developer under Section 15 for harm caused by a product if: (1) the deployer makes material and substantial change to the product; or (2) the deployer intentionally misuses the product contrary to the express warranty and that use was the proximate cause of harm to the plaintiff.

(b) 5 For the purposes of this Section, a use of a product that is intended by the developer of the product does not constitute a misuse or material or substantial change of the product. If a developer does not specify an intended use for the product, intended use shall be inferred by the targeted market and manner of distribution.

(c) 5 Any deployer licensing a product shall not be liable to a plaintiff for violations subsection (a) of Section 15 by another solely by reason of ownership or use of the product.

Extends developer-level liability to deployers under two limited circumstances: when the deployer makes a material and substantial change to the product, or when the deployer intentionally misuses the product contrary to the express warranty and that misuse was the proximate cause of harm. A safe harbor clarifies that developer-intended uses do not constitute misuse or material change. When no intended use is specified, intended use is inferred from the targeted market and manner of distribution. A deployer licensing a product is not vicariously liable for developer violations under Section 15(a) solely by reason of ownership or use.

Compliance actions 1 item

Deployers who make material and substantial changes to an AI product, or who intentionally misuse the product contrary to the express warranty and that misuse proximately causes harm, are deemed liable as developers under Section 15. Deployers licensing a product are not vicariously liable for developer violations solely by reason of product ownership or use.

—

Section 25

Applicability and enforcement

DeployerDeveloper

(a) This Act shall supplement any common law tort liability and any product liability laws of this State. This Act does not prohibit any product liability cause of action involving a generative artificial intelligence system or a high-impact artificial intelligence system brought under a different claim pursuant to product liability common law or statute. This Section does not supersede any product liability cause of action under State law except to the extent that the law would directly conflict with the provisions of this Act.

(b) Products used strictly for peer-reviewed scientific research are exempt from this Act.

(c) In a liability action brought under this Act, the court shall apply a comparative negligence standard, whereby a plaintiff's recovery shall be diminished in proportion to the percentage of fault attributable to the plaintiff, but the recovery shall not be barred regardless of the plaintiff's degree of fault, and developers and deployers may be held jointly and severally liable for the portion of harm that contributed to the plaintiff's injury. In a liability action brought under this Act, the damages for which a deployer is otherwise liable shall be reduced by the percentage of responsibility for the plaintiff's harm attributable to violations of Section 15 by any person if the defendant establishes that the percentage of the plaintiff's harm was proximately caused by a violation under Section 15.

(d) 6 In any products liability action brought under this Act, a court shall recognize a rebuttable presumption that a product is not defective if and only if that deployer: (1) has conducted a documented testing, evaluation, verification, validation, and auditing of that system consistent with industry best practices, such as the latest version of the National Institute of Standards and Technology Artificial Intelligence Risk Management Framework; (2) has mitigated foreseeable risks to the extent possible and has considered alternatives; (3) has disclosed foreseeable risks and mitigation tactics directly to deployers and consumers using the product; (4) has maintained and made available upon request by the Attorney General an artificial intelligence data sheet that includes, at a minimum, the following information: (A) information on the intended contexts and uses of the artificial intelligence model in accordance with the map guidelines articulated in the National Institute of Standards and Technology's latest Artificial Intelligence Risk Management Framework; (B) information regarding the datasets upon which the artificial intelligence was trained, including sources, volume, whether the dataset is proprietary, and how the datasets further the intended purpose of the product; (C) information accounting for foreseeable risks identified in the management guidelines of the National Institute of Standards and Technology's latest Artificial Intelligence Risk Management Framework and information about steps taken to manage those risks; and (D) information concerning the results of red-teaming testing and steps taken to mitigate identified risks, based on guidance developed by the National Institute of Standards and Technology; (5) has, if the product is designed for or is reasonably likely to be used by individuals under 17 years old, documented assessments of use of the product's impact on cognitive and emotional development, implemented age-gating or content restrictions for a product that poses foreseeable risks, and provided to deployers and direct consumers and their guardians clear, accessible disclosures about potential risks; and (6) has prominently included in the terms and conditions of a product the information included in an artificial intelligence data sheet, that deployers of the product may rely upon when making fit-for-use and deployment decisions.

(e) 7 In any products liability action brought under this Act, a court shall recognize a rebuttable presumption that a product is not defective if and only if that deployer has designed and implemented a risk management policy that: (1) specifies the principles, processes, and personnel that the deployer shall use in maintaining the risk management policy to identify, mitigate, and document any risk, especially those impacting individuals under 17 years old, that is a reasonably foreseeable consequence of deploying or using the system; (2) is consistent with industry best practices, such as the latest version of the National Institute of Standards and Technology Artificial Intelligence Risk Management Framework; (3) is reasonable considering: (A) the size and complexity of the deployer; (B) the nature and scope of the system, including the intended uses and unintended uses and the modifications made to the system by the deployer; and (C) the data that the system, once deployed, processes as inputs; and (4) is electronically available to its employees and to the Attorney General upon request.

(f) This Act applies with respect to any action commenced on or after the effective date of this Act without regard to whether the harm that is the subject of the action or the conduct that caused the harm occurred before that date.

Section 25 addresses the Act's relationship to existing law, the research exemption, the comparative negligence framework, and two rebuttable presumptions of non-defectiveness — one for developers who comply with a six-factor safe harbor (NIST-aligned testing, risk mitigation, risk disclosure, AI data sheet availability to the Attorney General, minor-impact assessments, and terms-of-use inclusion) and one for deployers who implement a qualifying risk management policy.

The safe harbor for developers under subsection (d) is notable because it effectively creates prospective compliance obligations whose satisfaction earns the rebuttable presumption: maintaining NIST AI RMF-aligned testing documentation, an AI data sheet with specified content available to the Attorney General, foreseeable-risk disclosures to deployers and consumers, and — for products accessible to minors under 17 — documented cognitive and emotional development impact assessments and age-gating. The deployer safe harbor in subsection (e) requires a risk management policy consistent with NIST AI RMF, tailored to the deployer's size and system scope, and electronically available to employees and the Attorney General.

Compliance actions 2 items

Developers may earn a rebuttable presumption of non-defectiveness by: (1) conducting documented NIST AI RMF-aligned testing, evaluation, verification, validation, and auditing; (2) mitigating foreseeable risks and considering alternatives; (3) disclosing foreseeable risks and mitigation tactics to deployers and consumers; (4) maintaining an AI data sheet — covering intended uses, training data, foreseeable risks, and red-teaming results per NIST guidance — available to the Attorney General on request; (5) for products accessible to minors under 17, documenting cognitive/emotional impact assessments, implementing age-gating, and disclosing risks to consumers and guardians; and (6) prominently including AI data sheet information in product terms and conditions.

S-01.1

Deployers may earn a rebuttable presumption of non-defectiveness by designing and implementing a risk management policy that (1) specifies principles, processes, and personnel for identifying, mitigating, and documenting foreseeable risks — with particular attention to impacts on individuals under 17; (2) is consistent with NIST AI RMF; (3) is proportionate to the deployer's size, system scope, and data inputs; and (4) is electronically available to employees and the Attorney General on request.

G-01.1

Section 97

Severability

The provisions of this Act are severable under Section 1.31 of the Statute on Statutes.

Standard severability clause incorporating Section 1.31 of the Illinois Statute on Statutes. No substantive obligation.

Safety Harmful content prevention · self-harm escalation

1 item

S-01.1

Governance Risk management · accountability programs

1 item

G-01.1

—

Other

5 items

—

Passage Likelihood

Low

Status Introduced

Chamber No passage

Committee No action

Majority party Yes

Bipartisan No

Prior session None

Legislative History

2026-02-05 Filed with Secretary by Sen. Mary Edly-Allen

2026-02-05 First Reading

2026-02-05 Referred to Assignments

2026-02-17 Assigned to Executive

2026-02-18 To AI and Social Media

2026-03-13 Rule 2-10 Committee Deadline Established As March 27, 2026

2026-03-27 Rule 2-10 Committee Deadline Established As April 24, 2026

2026-04-24 Rule 2-10 Committee/3rd Reading Deadline Established As May 15, 2026

2026-05-15 Rule 2-10 Committee/3rd Reading Deadline Established As May 22, 2026

2026-05-22 Rule 3-9(a) / Re-referred to Assignments

Sources

Full Text ↗

Entry Last Reviewed

2026-06-01

AI generated