Customer support AI becomes a regulated system of record, with incident logs and audit-ready controls

Customer Support AI Becomes a Regulated System of Record

Illinois turned service AI governance into enforceable compliance on July 6, 2026, with the Artificial Intelligence Safety Measures Act (SB 315). The law covers large frontier AI developers behind chatbots and agentic customer-service tools and requires an AI safety framework, critical-incident reporting within 72 hours — or 24 hours if serious harm is imminent — and annual independent third-party audits. Most obligations begin January 1, 2028, after the statute takes effect on January 1, 2027.

The operational gap is already visible. In a Sumsub–Singapore FinTech Association survey, 94% of firms said they were using or piloting agentic AI, but only 29% could produce an audit trail for AI-driven decisions. Technical complexity, platform integration, and difficulty tracking external AI tools were the main blockers. Walmart’s Illinois BIPA lawsuit adds a sharper warning: phone AI that captures voiceprints can trigger consent and retention obligations, not just product risk.

For support teams, the job is shifting from deploying automation to proving control. Audit logs, escalation records, vendor traceability, and biometric-data handling are becoming day-to-day responsibilities. Teams that can explain what an agent did, why it did it, and what data it touched will move faster with less legal friction.