With new Democratic Congress incoming, Pritzker calls for federal AI regulations

CHICAGO — In his suggested 200-point national agenda for the new incoming Democratic Congress, Illinois Gov. JB Pritzker called for a comprehensive federal digital protection framework that addresses privacy, Artificial Intelligence safety and data centers.

Pritzker’s plan includes three action points: Strengthening digital privacy through durable federal privacy laws, establishing federal requirements for AI risk assessment, testing and monitoring, and promoting digital infrastructure by requiring data centers to be energy- and water-efficient.

Pritzker also mentioned that any federal action should build on state leadership and not override what Illinois and other states have already done on these topics. In July, Illinois joined New York and California to become the third state to pass frontier artificial intelligence regulatory legislation, aimed at the most advanced AI models that generate more than $500 million in annual revenue.

It is uncertain what Congress will do and whether President Donald Trump, who has taken a laissez-faire approach toward AI, would have any interest in signing it.

Senate Bill 0315, Illinois’ AI regulatory framework that Pritzker signed into law this year, aims to increase transparency and prevent catastrophic risk, defined as a foreseeable material risk that will lead to the death or serious injury of over 50 people or more than $1 million in property damage from a single incident.

Currently, no comprehensive federal regulatory framework exists. Trump signed an executive order in September to rename AI “Super Intelligence” and created a White House accord on Super Intelligence with the leaders of OpenAI, Anthropic, Meta, Google, XAI and Nvidia.

The accord, a voluntary, nonbinding pledge, asks companies to self-regulate, establish internal capability-monitoring and oversight teams, use independent external audits, and have a board-of-directors committee oversee both internal and external reports.

State Rep. Daniel Didech told Capitol News Illinois a robust federal AI catastrophic-risk regulation would be preferable to a patchwork of 50 different state laws.

“The reality is that with the federal government, at least at this point in time, not taking any meaningful steps to protect against these harms, states have been left with no choice but to try to fill in the gaps,” Didech said.

A big concern of leaving it up to the states is the adoption of conflicting laws, not just on frontier models, but on chatbots and specific uses like education or therapy, Megan Stokes, the state director at the Computer and Communications Industry Association, told Capitol News Illinois.

“When state laws start to conflict, and then you have this really like costly compliance landscape that’s going to hurt startups,” Stokes said. “It’s going to weaken our competitiveness.”

Stokes said ensuring a company stays compliant across states with varied regulatory frameworks is one reason the CCIA has pushed for a federal solution to AI legislation.

Why is AI regulation needed?

In September, a former Anthropic and OpenAI researcher alleged that AI companies are building a tool that could threaten human existence by the end of the decade.

This month, Anthropic registered for its initial public offering, but almost a third of its securities filing to potential investors focused on the routine and extraordinary risks the company’s models could pose.

Scott Wisor, policy director at the Secure AI Project, said the risks fall into two buckets: malicious use by users who know how to ask AI a question and use it to do harm, and systems not acting the way developers intended.

The companies themselves have internal guardrails on malicious information, but there are ways to “trick the system,” Wisor said. One example Wisor gave was that, instead of asking the model directly how to build a weapon, users could say they were writing a novel in which a character planned to build one.

Wisor said companies are currently taking three steps to prevent this. One is a classifier that blocks things from leaving a system; the second is avoiding training the system on potentially harmful information; and the third is only giving systems without guardrails to trusted partners.

However, a balance in restricting information is needed to prevent censorship.

“If you have a billion users, then you really have the opportunity to shape the information that people have access to, and so you don’t want it to be the case that the companies have their thumb on the scale of the issues that are being discussed,” Wisor said.

AI models have also shown they’re willing to ignore human instruction. In the now-infamous Hugging Face hack this summer, OpenAI models took independent action and communicated through an unauthorized channel to gain internet access and compromise Hugging Face – an open-source platform and community for machine learning and AI.

“A lot of the most advanced things the systems can do are not a single chatbot corresponding with the user, but they’re a coordinated set of activities from this group of agents that can do a lot in the world,” Wisor said.

Although AI can drive scientific breakthroughs, such as OpenAI proposing a solution to a mathematical problem that had gone unsolved for decades — the Navier-Stokes existence and smoothness problem — Wisor said that alignment with human values and control of these systems should be ensured.

“People should take really seriously that you want to be in a position of really fully, completely controlling the system and having 100% confidence in that it is going to operate in the way that you intend before you build versions that are out of your control,” Wisor said.

And although it isn’t too late to regulate AI, Wisor said, improvements in the systems’ capabilities are no longer hypothetical.

“We’re a little bit behind, but there’s a lot of opportunity to still steer things in the right direction, and we are very fortunate that a lot of elected officials are currently stepping up, especially in Illinois,” Wisor said. “It’s like the eighth inning of a baseball game or something. It’d be a good time to hit some home runs.”

What AI regulation could look like

Didech said individuals, companies and governments need to think together about cybersecurity with a focus on transparency.

“The best course of action is being as honest as possible, as direct as possible, about what the potential harms are, what the probabilities are, and what we are doing, and what individuals can be doing to meaningfully mitigate some of those risks,” Didech said.

Illinois also pioneered a mandatory annual third-party audit of frontier AI models as part of its Artificial Intelligence Safety Measures Act to ensure companies abide by the other provisions of the legislation.

Didech said independent parties need to review these developers to “ensure they’re not creating their own work,” because companies both create the models’ plans and decide whether they are sufficient.

“In any realm where there is a technology this powerful, be it automobiles or human flights or nuclear weapons, there’s an independent agency or government that has a really important role to make sure that the companies are acting in accordance with best practices for public safety, and AI is no different,” Didech said.

But Stokes, of the Computer and Communications Industry Association, said the organization is concerned because this type of audit has not been done before.

The concerns stem from what kind of training potential auditors would have, how they would protect industry secrets and maintain independence, how they would protect whistleblowers, and what the auditing model would look like.

“I worry about it being a security blanket for people to say, ‘OK, this has the seal of approval,’ but it’s not necessarily looked at in the way that people think it is,” Stokes said.

Bamshad Mobasher, a professor and director of the Center for Web Intelligence at DePaul University, said regulations also need to protect users from undue surveillance, discrimination, and leaking of private data.

“Even in some of the state legislations, including Illinois, the focus is really on these bigger companies, and not necessarily the downstream kind of applications and potential harm,” Mobasher said.

Pritzker also noted this in his agenda for the Democratic Party, including a federal privacy law that protects Americans’ personal data while preserving economic development.

Didech, on the other hand, said regulation is a logical conclusion.

“Nobody thinks that because we require oxygen masks and seat belts and inspections and training for the pilots and air traffic controllers that the air travel is overregulated and it’s bad for business,” Didech said.

Another issue regulators may run into as they are developing these guidelines is timeliness, said Volodymyr Kindratenko, a professor at the University of Illinois Urbana-Champaign.

“The problem is with the technology that it moves so fast that whatever you can think of today may not be relevant tomorrow because the technology will evolve in the direction that we didn’t anticipate today,” Kindratenko said.

Even before Pritzker announced his agenda, Stokes said she expected more proposals, discussions and oversight on both the federal and state levels in 2027.

“I think you’re going to see a very active 2027 around AI,” said Stokes. “It’s a conversation that has moved away from AI in general and has been more specific, and I think that’s probably for the best when you’re looking at regulating.”

Capitol News Illinois is a nonprofit, nonpartisan news service that distributes state government coverage to hundreds of news outlets statewide. It is funded primarily by the Illinois Press Foundation and the Robert R. McCormick Foundation.