Buyer 2 · enterprises, boards, auditors

Illinois SB 315 & AI audit readiness — a measured-current-state record

Disclosure lands 1 Jan 2027; the first-in-nation independent third-party audit lands 1 Jan 2028. Auditor procurement takes 6–12 months, so evidence rails get sourced through 2027. This page is the standing record: what we measure, how it's signed, and how an auditor reproduces it. Measurement, not certification.

The regulatory clock (verified dates)

11 Sep 2026 — EU CRA Art 14 reporting; fines up to €15M / 2.5% turnover
2 Dec 2026 — EU AI Act Art 50(2) watermarking grace for legacy generative systems expires (Digital Omnibus Reg (EU) 2026/1744)
1 Jan 2027 — Illinois SB 315 disclosure · NY RAISE Act · Colorado SB 26-189
2 Dec 2027 — EU AI Act high-risk Annex III obligations (deferred, not removed)
1 Jan 2028 — Illinois SB 315 independent third-party audit mandate ($1M first / $3M subsequent violations)
2 Aug 2028 — EU AI Act Annex I obligations

Full feed with penalty exposure: /api/regulation (19 deadlines, quarterly re-verified).

What a measured-current-state record contains

Component	What it is	How it's evidenced
Provision conformance MEASURED	Deterministic conformance of outputs to the frozen provision (e.g. Art 6 risk tier)	Signed card: exact_match on the 237-item bank, 95% CI, leader, separation
Market context REPORTED	Live market state reported alongside, own register	Never fused into conformance
Human + AI results REPORTED	Both scored vs measured ground truth	Never ranked for money (firewall)
Corrections ledger MEASURED	Appended, never edited — real self-caught corrections	Public, hash-chained
Signing spine MEASURED	Ed25519 + SHA-256 hash-chained 3KB cards (ML-DSA-65 roadmap)	did:web:csoai.org trust root; verify offline

For the 2028 Illinois audit regime, this is the evidence substrate an independent auditor walks: fetch card → fetch key → verify → re-run the metric. We never say "certified" — we say "measured-current-state," which is what the audit mandate needs.

How an auditor (or board) verifies it — offline, no account

1 Fetch a card — curl https://meok.ai/cards/h3k-2026-08-20T0422.json
2 Get the trust root — curl https://csoai.org/.well-known/did.json (Ed25519 keys)
3 Verify the signature — check sig_b64 over body_sha256; recompute the hash
4 Check the chain — prev links must be gapless
5 Reproduce a number — re-run the deterministic metric on the published bank

Or use the front door verify box — free, instant, same result.

What this is not

Not a certification. Not a governance platform (Credo, Holistic, LatticeFlow — occupied territory). Not an evaluation marketplace (Vals, LMArena). Not insurance (AIUC, Armilla, Munich Re — they bear the risk; we sign the evidence). We are the neutral rail beneath all of them: nobody ranked pays, humans never pay, deterministic predicates only.

Methodology DOI: 10.5281/zenodo.21991104 (cite the concept DOI — it always resolves to the latest version).