On July 6, 2026, Illinois signed the Artificial Intelligence Safety Measures Act into law. It is the first statute in the United States to require that artificial intelligence be independently audited by an outside party, rather than merely explained by the company that built it. The law names a narrow target: the largest frontier developers, the handful of firms building the most powerful models. Health plans are not on that list. Neither are pharmacy benefit managers, medical groups, or the management services organizations that increasingly run the administrative machinery of American healthcare.

That is precisely why every executive in those organizations should be paying attention. Regulation of this kind does not stay where it is written. It travels downstream through contracts, through boards, and through the simple fact that once independent audit becomes the standard by which the powerful are judged, self-attestation stops being credible for everyone else. The organizations that deploy artificial intelligence to decide what care is covered, what is authorized, how risk is scored, and how members are spoken to will be asked to show the same discipline the law now demands of the companies whose models they license. The only real question is whether they will be ready when the question arrives.

The Problem: A standard set for the few becomes an expectation for the many

The Illinois law follows two earlier statutes, in California and in New York, that required the largest developers to publish safety frameworks and be transparent about how their most capable models behave. Illinois added the piece the others left out. It is not enough, under the new law, to describe your safety practices. An independent third party must examine them, every year, and verify that the description matches reality. Critical incidents must be reported within seventy-two hours, and faster when a life is at risk. Whistleblowers are protected. The penalties reach into the millions.

The sponsors have been candid that Illinois is meant to be a template, one they expect other states and eventually Congress to follow. And a second force is widening the map. In June of 2026, Florida sued a major AI developer under consumer protection law over alleged harms to vulnerable users, which means the pressure on artificial intelligence is no longer confined to states with a particular political complexion. It is becoming a bipartisan expectation that someone independent is checking the machine.

For a health plan, the exposure is not theoretical. Artificial intelligence already sits inside coverage determinations, prior authorization, risk adjustment, utilization management, and member communication. Much of it is supplied by vendors who are themselves about to be audited. When those vendors publish their frameworks and submit to review, the obligations flow downstream in the contract language, and the plan is left holding a question it cannot yet answer: who has independently verified that the artificial intelligence making decisions about our members is safe, explainable, and defensible?

Board Advice: What a board should be asking management now

A board does not need to understand the mathematics of a model to govern it well. It needs to ask the questions that expose whether management is prepared, and to recognize when the answers are thin. The audit era rewards boards that treat artificial intelligence as an enterprise risk with a named owner, not as a technical curiosity delegated to the people who bought the software.

• Who owns AI risk on the executive team, and can that person produce, on request, a complete inventory of every model in use across coverage, authorization, risk, and member contact, including the ones our vendors operate on our behalf?
• If a regulator or a plaintiff asked us to explain a denial that artificial intelligence influenced, could we produce a defensible record of how that decision was reached, or would we be reconstructing it after the fact?
• Has anyone independent of the vendor and independent of our own team examined these systems, or are we relying on the assurances of the people who built and bought them?
• Are we ready to detect and report a critical AI incident within seventy-two hours, and do we know what would even count as one?

A board that asks these four questions and receives confident, evidenced answers is governing well. A board that receives hesitation has found its priority for 2027.

Executive Team and Compliance Actions: What your ELT will be held accountable for by January 1, 2028

The operational provisions of these laws point to a planning horizon of 2028. That is the date by which an executive team should be able to produce audit-ready evidence, whether or not a specific mandate has yet been written in its own state. The work is not exotic. It is the disciplined assembly of things most organizations have in fragments and few have in order.

• A living AI inventory. Every model in use, its purpose, its owner, its data lineage, and its limitations, refreshed as the estate changes and inclusive of vendor-operated systems.
• A governance framework on paper and in practice. A charter, a named accountable executive, and documented evidence that AI risk is actually weighed in deployment decisions, not merely described in a policy binder.
• Incident detection and reporting readiness. The ability to identify, document, and escalate a critical safety event inside seventy-two hours, with a faster path where member safety is at stake.
• Member-facing safety. For any AI that speaks to members, the capacity to detect risk signals, including indicators of self-harm, and to route to a human and to appropriate resources. A provision to this effect narrowly failed in Illinois this session and is widely expected to return.
• Vendor and contractual alignment. A review of vendor agreements for the audit, disclosure, and incident-cooperation obligations that will arrive as those vendors are audited themselves.
• Protected internal reporting. A channel through which an employee can raise an AI-safety concern without fear, and a documented commitment against retaliation.

For the compliance officer, the shift is philosophical as much as procedural. The discipline that governs artificial intelligence is not a new silo bolted onto the compliance function. It is the same accountability the function already owns, extended to a new class of decision-maker that happens to be a model rather than a person. Stars, risk, and cost were never three separate functions. AI oversight is not a vendor feature. It is one discipline, and it belongs to the people already accountable for how the organization behaves.

Selecting an Independent AI Auditor: The difference between a checkbox and a defense

As the requirement for independent review settles into healthcare, a market of auditors will rise to meet it, and not all of them will be equal to the task. The wrong auditor produces a certificate that satisfies no one under scrutiny. The right one produces a record a board can stand behind and a regulator will respect. A few criteria separate the two.

• Genuine independence. An auditor with a model to sell or a vendor allegiance to protect is not performing assurance. Independence from both the technology and the team is the entire point.
• Payer-native expertise. Healthcare AI does not fail like generic enterprise software. It fails in risk adjustment exposure, in denial defensibility, in Stars and quality distortion. An auditor who does not understand payer economics will audit the wrong things well.
• A defensible methodology. Bias, drift, and explainability are not marketing words. Ask how each is tested, and whether the resulting documentation would survive litigation and a regulator’s file request.
• Deliverables built for the people who must act on them. A board-ready and regulator-ready report with a prioritized remediation path is worth more than a technical appendix no executive will read.

Read those criteria as a buyer’s checklist, because that is what they are. The organization that knows what to demand of an auditor is already most of the way to being audit-ready itself.

Cadence of Implementation for Your State: Your timeline depends on where you operate

There is no single national clock, which means the right pace of preparation depends on the states in which an organization is domiciled and does business. It helps to place your footprint in one of three tiers and to plan accordingly.

• Tier One, Move Now. Enacted-law states: Illinois, California, New York. The standard is already law or its transparency foundation is. Begin the inventory and governance work immediately and treat 2027 as the year to reach audit readiness.
• Tier Two, Prepare Deliberately. Likely-next states: Colorado, Washington, Massachusetts, New Jersey, Connecticut, Minnesota. Build the foundation on a measured timeline so a mandate, when it comes, is a formality rather than a fire drill.
• Tier Three, Watch and Ready. Enforcement-pressure states: Florida and others acting through litigation. Even without an audit statute, consumer protection enforcement is creating real exposure now.

The instinct to wait for a mandate in one’s own state is understandable and, in this case, mistaken. The vendors are being audited regardless of geography. The boards are asking regardless of geography. And the organization that prepares before it is compelled will find the exercise a source of confidence rather than a scramble for compliance. The era of unaudited artificial intelligence in healthcare is drawing to a close. The advantage belongs to those who prepare while preparation is still a choice.