Illinois Wants AI Audit Reports. Anyone Can Sign Them
Illinois is the first state to require independent audits of AI companies. But the law doesn’t require the auditors to be auditors - not the sort of auditors we accountants think of, anyway.
Starting in 2028, the big AI developers have to hire an outside party every year to check whether they followed their own safety plans. That party signs off on the conclusion.
The Chicago Tribune covered the bill. Two founders of an AI assurance company then pointed out the gap in a Tribune op-ed, and David Leary and I dug into it on Episode 508 of The Accounting Podcast.
The auditors have to follow generally accepted auditing standards. Sounds reasonable so far.
But auditors don’t need to be CPAs. The law asks for “demonstrated competence” in AI safety and no financial ties to the company. Who decides what counts as competent? The company doing the hiring.
The law creates no license, certification, registry, accrediting board, or disciplinary body for these auditors.
The signature is the product
An audit report is a trust product. The procedures are essential, but the public doesn’t see those. To investors and other stakeholders, it’s the signature on the opinion that really matters.
When a CPA signs an audit opinion, they put their license on the line. A state board can take it away. That professional accountability is the reason people value that opinion.
Without a license requirement, anyone can sign one.
AI companies will get audited, the press will pick up the story, and the public will feel better about AI safety. But nobody will be any safer.
A false sense of security might be worse than none.
Why OpenAI and Anthropic like this bill
OpenAI and Anthropic both support the legislation. But nobody likes getting audited. So why sign up for it? Look at the industry’s track record.
In Episode 508, we also covered OpenAI’s disclosure that two of its models escaped a sandboxed test environment and broke into Hugging Face’s production database.
Hugging Face’s servers weren’t part of the test. The same models were trying to cheat on a benchmark.
Backing an audit law is a cheap way to answer bad press.
A clean report gives them something to point to when bad news breaks. And since nobody oversees the auditors, the companies still control who checks their work.
This is our job
This is work built for CPAs. We already have licensure, independence rules, and boards that can revoke your license.
That’s what makes an audit mean something.
Fixing this takes three things:
The state has to say who is qualified to sign
They have to prove they’re competent, and someone has to verify they’re independent of the company they audit
Someone needs the power to pull their credentials when they fail
That’s a short list, and the accounting profession already has every item on it.
The audit requirement doesn’t start until 2028. That leaves about a year to push for a licensed-auditor requirement before the first audits.
The AICPA and state CPA societies should treat this as their fight now.
If you’re in Illinois, call the Illinois CPA Society and tell them so. If you’re not, call yours.
