AI for HR: what employee data you can put into ChatGPT

AI for HR is two questions, not one. The first is what employee and candidate data you can put into ChatGPT, Claude or Copilot when you ask for help with a review or an email. The second is what the law asks when software helps decide who gets hired, promoted or let go, and that one has moved fast since 2025.

The short answer to the first: send the task, not the identity. A performance review reads the same with placeholders where the names were, and medical notes, Social Security numbers and background reports should not go in at all. The short answer to the second depends on where your people work: Illinois, New York City, California, Colorado and now Connecticut each have rules, with different dates.

This page covers both, nationally. State detail lives on separate pages: the Illinois AI hiring law, California and Colorado.

AI for HR starts with the data you put in

Most HR teams meet AI as a writing assistant long before they buy a hiring tool. Someone asks Claude to tighten a warning letter, asks ChatGPT to summarize ten resumes, or asks Copilot to turn interview notes into a scorecard. Each request carries a person’s name and, often, details the law treats as sensitive.

The vendor’s plan decides what happens to that text. Consumer accounts may keep conversations and use them to improve models unless you opt out, and business plans usually do not train on your data. What Claude keeps and what Copilot keeps are set out plan by plan in our other guides.

The plan does not settle the HR question, though. Even on an enterprise account, an employee’s medical note sent to a chatbot has left the file where federal law says it must stay, and a resume is still a resume. That is why the useful line runs through the document, not the product.

What HR can and cannot put into ChatGPT

Here is how the common HR documents sort out, from the ones that can go in after a light edit to the ones that should stay out.

Document	Into a chatbot?	Why
Job description, policy draft	Yes	No one is named
Resume or application	Only without name, contact details and photo	Candidate data; screening rules may apply
Performance review, warning letter	Only with placeholders for names	Judgments about an identified person
Interview notes	Only with placeholders	May record protected traits or health remarks
Medical note, leave or accommodation request	No	ADA confidential medical record
Background check report	No	FCRA consumer report, used for a set purpose
SSN, I-9 documents, bank details	No	Identity theft risk; breach notice if exposed

Sorted by the federal rules described on this page. State laws add to it.

The middle rows are where most of the work is. A review or a set of interview notes can be edited by hand before pasting, which is slow, or with a tool that swaps names for placeholders and puts them back in the reply. Our list of what to remove before AI goes field by field.

Resumes, reviews and investigation notes

A resume carries a name, an address, a phone number and often a photo or a graduation year, which hints at age. Removing those before asking for a summary costs nothing in quality. It also keeps a recruiter’s prompt from becoming a record that shows the model saw the candidate’s protected traits.

Performance reviews and investigation notes are harder, because the facts matter and the people do not. Replace each name with a consistent placeholder, so “the manager” stays the manager across the document, and keep the dates and events. Redacting names in Excel covers the spreadsheet version of the same job.

Here is what that looks like on one line of a fictional review, with the details a chatbot needs kept and the ones it does not taken out.

Field	As written	As sent
Employee	Jordan Example	Employee A
Manager	Casey Sample	Manager B
SSN in the footer	000-00-0000	removed
Event	Missed three deadlines in Q2	Missed three deadlines in Q2
Leave reference	Out on medical leave in May	removed

A made up example. The SSN shown is an impossible number, not a real one.

The last row is the one people miss. A sentence that explains a performance dip by a medical leave carries health information into the prompt even with every name gone, and the review rarely needs it to be rewritten well.

Medical notes, leave requests and Social Security numbers

These are the documents that should not reach a chatbot, even edited. A doctor’s note, a leave request or an accommodation file is the ADA’s territory, set out in the next section. A Social Security number has no job to do in a prompt, and our SSN guide shows how to strip it from a document that has to go somewhere else.

Federal law: Title VII, the ADA and the FCRA

There is no federal statute about AI in employment. What applies is the same set of laws that applied to paper tests and phone screens, and in 2025 the federal government changed how it enforces one of them. An HR team needs the statutes, not the press coverage, because the statutes are what plaintiffs sue under.

Title VII and the ADA cover employers with 15 or more employees for each working day in 20 or more calendar weeks of the current or preceding year. Smaller employers are outside them, but not necessarily outside state law: Illinois’s civil rights law starts at one employee. Our national privacy guide covers the federal privacy side.

Disparate impact is still in Title VII

Title VII has two routes to liability. Disparate treatment is intentional. Disparate impact, written into 42 U.S.C. 2000e-2(k) by the Civil Rights Act of 1991, is a practice that falls harder on a protected group and that the employer cannot show is job related and consistent with business necessity. A screening algorithm is a practice like any other.

On April 23, 2025, Executive Order 14281 told federal agencies to deprioritize enforcement of disparate impact and directed the attorney general and the chair of the EEOC to review pending matters that rely on it. That changes what the federal government pursues. It does not change the statute, and an applicant can still bring a claim under it.

The EEOC’s AI guidance is no longer on eeoc.gov

The EEOC had published two technical assistance documents on AI in hiring: one on the ADA, one on assessing adverse impact under Title VII. Both addresses returned page not found when we checked on October 13, 2026. Articles that still quote them as current EEOC guidance are out of date, and so is any vendor deck that cites them as a safe harbor.

15 employees

The ADA and the medical note in the HR inbox

The ADA limits medical questions and protects what employers learn. Information from a post offer medical exam must be kept on separate forms, in separate medical files, and treated as a confidential medical record, under 42 U.S.C. 12112(d)(3)(B). The same rule covers medical information from voluntary programs and permitted inquiries of current employees, under 12112(d)(4)(C).

The statute names who may see it: supervisors for work restrictions and accommodations, first aid and safety staff, and government investigators. A chatbot vendor is not on the list. Where HIPAA starts and stops for health information is set out in our HIPAA guide; for the note in the HR inbox, the ADA rule above is the one to plan around.

Background checks under the FCRA

A background report from a screening company is a consumer report. Under 15 U.S.C. 1681b(b), an employer may get one only after a clear written disclosure, in a document consisting solely of that disclosure, and the candidate’s written authorization. Before taking adverse action based on the report, the employer must give the candidate a copy and a summary of their rights.

None of that contemplates feeding the report into a general chatbot to “summarize the red flags”. The report was obtained for a defined employment purpose, and the employer certified to the agency that it would not use it in violation of equal employment laws. Keep it out, or work from the decision criteria rather than the document.

Illinois: notice and no ZIP codes since January 1, 2026

Illinois’s rule reaches unusually far, because it sits inside a civil rights law that covers any employer with one or more employees in the state during 20 or more calendar weeks. Public Act 103-0804, House Bill 3773, added subdivision (L) to Section 2-102 of the Illinois Human Rights Act with effect from January 1, 2026.

It makes two things a civil rights violation. One is using AI, in recruitment, hiring, promotion, discharge, discipline or the terms of employment, that has the effect of discriminating on a protected basis, or using ZIP codes as a proxy for a protected class. The other is failing to tell employees that AI is used for those purposes.

The Act’s definition of AI includes generative AI, so a chatbot is not outside it by being general purpose. The Illinois Department of Human Rights was told to write rules on when and how notice is given, and it has not adopted any. The detail, plus the AI Video Interview Act and the biometrics law, is on our Illinois page.

What Illinois adds that federal law does not

Three things set it apart. The trigger is effect, so an employer that never meant to discriminate is still exposed if the tool’s results do. The notice duty stands on its own, so an employer can violate the law with a perfectly fair tool by not telling anyone.

And the ZIP code ban names a specific input, which gives an employer something concrete to ask a vendor about: does the model use location, and at what level of detail? How Illinois sits among the other states is mapped in our state by state overview.

New York City: Local Law 144 bias audits

New York City regulates the tool rather than the outcome. Local Law 144 of 2021, in effect since January 1, 2023 and enforced since July 5, 2023, bars employers and employment agencies from using an automated employment decision tool unless it has had a bias audit within the past year, a summary of the results is public, and candidates have been notified.

An automated employment decision tool, in the city’s own FAQ, uses machine learning, statistical modeling, data analytics or AI, helps make employment decisions, and substantially assists or replaces discretionary decision making. It covers screening at any stage of hiring or promotion, but not scanning a resume bank or inviting applications from people who have not applied.

The law reaches tools used “in the city”, which the FAQ reads as a job located at a New York City office at least part time, a fully remote job associated with such an office, or an employment agency located in the city. An employer headquartered in New Jersey that hires for a Manhattan office is in scope; one hiring in Buffalo is not.

Who owes the audit and the notice

The employer does, not the vendor. A vendor may commission an independent audit of its own tool, and employers can rely on it under conditions, but the city says the employer is ultimately responsible. The audit must calculate selection or scoring rates and impact ratios across sex, race and ethnicity, and intersectional categories.

The employer then publishes a summary on the employment section of its website, or links to one. The FAQ lists what the summary must contain:

Item in the published summary	Note
Date of the most recent bias audit	Valid for one year
Source and explanation of the data	Including why test data was used, if it was
Number of people in an unknown category	Demographics cannot be inferred or imputed
Applicants, selection or scoring rates, impact ratios	For every category
Distribution date of the tool	When the employer began using it

DCWP, Automated Employment Decision Tools FAQ, June 29, 2023.

10 business days

The notice goes to candidates and employees who live in New York City, says that the tool is used and which qualifications it assesses, and explains how to request an accommodation. The law requires the audit but not any particular action on its results. Discrimination claims go to the city’s Commission on Human Rights. Agencies that place staff with city employers are covered too, which matters to CPA firms and law firms that recruit through them.

California: FEHA rules on automated decision systems

California’s Civil Rights Council took a different route: it amended the regulations under the Fair Employment and Housing Act rather than passing a new statute. The Office of Administrative Law approved them on June 27, 2025, and they took effect on October 1, 2025.

The Civil Rights Department’s own summary lists what they do. Using an automated decision system can violate California law if it harms applicants or employees on a protected basis such as gender, race or disability. Employment records, including automated decision data, must be kept for at least four years. And an assessment, test, question or puzzle game that draws out information about a disability may be an unlawful medical inquiry.

California employees are also privacy law consumers

California is the one state where the general privacy law covers staff. The CCPA’s exemption for job applicants, employees and contractors became inoperative on January 1, 2023, so an HR file is personal information like any customer record. From January 1, 2027, CalPrivacy’s rules on automated decisionmaking technology add notice and opt out rights for significant decisions, employment included. Our California page covers both layers.

Texas is the opposite case. Its privacy law defines a consumer as a resident acting in an individual or household context and leaves out anyone acting in an employment context, as our Texas page explains. Before assuming a state privacy law protects your staff, check its definition of consumer.

Colorado: employment is a consequential decision from 2027

Colorado’s first AI law, SB 24-205, has never been enforced: its start was pushed to June 30, 2026, and a federal court order of April 27, 2026 pauses enforcement. SB 26-189, signed on May 14, 2026, repeals and reenacts it from January 1, 2027 as a law on automated decision technology used in consequential decisions, and employment is on the list alongside education, housing, lending, insurance, health care and government services.

From January 1, 2027, a deployer, which includes an employer using such a tool, must give clear and conspicuous notice at the point of interaction, explain in plain language the technology’s role within 30 days after an adverse outcome, let people see and correct the personal data used, and offer meaningful human review. Records are kept three years. Developers owe deployers documentation of intended uses and known limitations.

The attorney general enforces it as a deceptive trade practice, with a 60 day cure period, where a cure is possible, until January 1, 2030, and there is no new private right of action. Rules on the adverse outcome disclosures are due by January 1, 2027. What is pending and what is final is tracked on our Colorado AI Act page, and how the law fits with the rest of US privacy law is in our national guide.

Oct 1, 2025California FEHA rules on automated decision systems

Jan 1, 2026Illinois notice duty and ZIP code ban

Jan 1, 2027Colorado SB 26-189 and California ADMT rules

Where these laws apply, side by side

These regimes ask different things of the same tool, and a company hiring in several places meets all of them at once. The table compresses what each asks; the pages linked above carry the detail, and the state by state overview lists the privacy laws around them.

Where	What triggers it	What it asks
Illinois	AI used in recruitment, hiring, discipline, discharge or terms of employment	Notice; no discriminatory effect; no ZIP code proxies
New York City	A tool that substantially assists or replaces the hiring or promotion decision	Annual bias audit, public summary, notice 10 business days ahead
California	Any automated decision system in employment	No discriminatory harm; records kept four years
Colorado	Technology that materially influences an employment decision	Notice, adverse outcome explanation, data correction, human review, from 2027
Connecticut	Automated employment decision technology	No defense to a discrimination claim; notices for tools deployed from October 2027

Public Act 103-0804; DCWP FAQ; California Civil Rights Department; leg.colorado.gov SB 26-189; Connecticut Public Act 26-15. Read October 13, 2026.

Connecticut joined the list in 2026. Its CART Act, Public Act 26-15, says that since October 1, 2026 using an automated employment decision tool is no defense to a discrimination complaint, and for tools deployed on or after October 1, 2027 it requires telling employees and applicants they are dealing with one and, before a decision the tool substantially informs, a written notice. Our Connecticut page has the detail.

The common thread is that a person who reviews and decides counts. NYC’s test asks whether the tool substantially assists or replaces discretion, and Colorado’s asks whether it materially influences the decision. Illinois draws no such line in the statute, which is one reason a written AI policy should say which HR uses are allowed.

Interview recordings, transcripts and video AI

Interviews now produce data by default: a recording, an automatic transcript, sometimes a score from software that watched the video. Each is a record about a candidate, and the transcript is the one most likely to end up pasted into a chatbot for a summary.

Transcripts carry what people say off the script. A candidate who mentions a pregnancy, a disability or a religious holiday has put protected information into the record, and a summary request sends it on. Reading the transcript before it goes anywhere, and cutting those passages, is the same job as editing a review.

When software analyzes the video

Illinois has regulated this since January 1, 2020. Its AI Video Interview Act requires an employer that uses AI to analyze recorded interviews for Illinois based positions to notify the applicant, explain how the AI works and what it evaluates, and get consent before the interview. Videos may be shared only with those whose expertise is needed, and must be deleted within 30 days of an applicant’s request, backups included.

30 days

A tool that measures facial geometry can also bring in Illinois’s biometrics law, which requires a written release before collection and a published retention schedule, and lets any person aggrieved sue. Outside Illinois, the general rules still apply: a video assessment that draws out disability information can be an unlawful medical inquiry under California’s regulations. Removing metadata helps when a recording or still is shared further, and the Illinois specifics are on our Illinois page.

A writing assistant or a hiring tool?

The same chatbot can sit on either side. Asking Claude to rewrite a job ad is a writing task. Asking it to rank 40 applicants and then interviewing the top five is screening, and in New York City a ranking the recruiter follows can make the chatbot an automated employment decision tool.

The question to ask of each HR workflow is what the output does. If a person reads it as one input among several and decides, the risk is mostly the data that went in. If the output sorts, scores or rejects people before a human looks, the hiring laws above apply, and the data question comes on top. Our anonymization guide explains why removing names does not turn a ranking into something else.

ZIP codes, photos and the proxies that creep in

Illinois banned ZIP codes as a proxy because a model that never sees race can learn it from an address. The same logic applies to graduation years and age, or to a photo. Stripping those fields before a resume reaches any AI tool is cheap insurance. The same goes for identity documents collected at onboarding, where redacting a driver’s license copy removes the date of birth and address a scan would otherwise carry.

An HR checklist for AI at work

Most of what this page describes comes down to a few habits and a few documents. In the order a small or midsize HR team can work through them:

1. List the AI uses. Writing help, summaries, screening, scheduling: write down which tools touch candidates or employees, and on which plan.
2. Mark the decisions. Any use that sorts, scores or rejects people is a hiring tool for Illinois, and may be one for New York City and Colorado.
3. Send the task, not the identity. Names, contact details, photos and ID numbers come out before a resume or review goes into a chatbot.
4. Keep medical files closed. Doctor’s notes, leave and accommodation requests stay in the separate medical file the ADA requires.
5. Keep background reports out. An FCRA report was obtained for one purpose, with the candidate’s written authorization; summarizing it in a chatbot is not that purpose.
6. Write the notice. Illinois requires one now, NYC 10 business days before a covered tool is used, Colorado from 2027, Connecticut for tools deployed from October 1, 2027.
7. Keep the records. California asks four years for employment records including automated decision data, Colorado three.

Item 3 is where most of the daily risk sits, and the PDF redaction guide covers the documents that arrive as scans. Item 6 belongs in your US AI policy.

Nonimo for HR teams

Nonimo is an app for Mac and Windows that works on the text before it reaches ChatGPT, Claude or Copilot. Whoever is drafting highlights the passage and presses one key, and the names, Social Security numbers and other identifiers it recognizes become placeholders on that computer. When the answer comes back, the real details go back in on the same machine.

For HR that means a review, a warning letter or a set of interview notes can go to the chatbot with the people replaced by placeholders, and come back with their names in place. It does not decide anything, so it is not a hiring tool, and it does not replace the notice, the audit or the medical file.

The conversation is saved on the computer, encrypted, so the names can be put back, and what leaves the machine is a daily count with no text, as set out on the security page. Start from Nonimo for US teams, or watermark a Social Security card copy before it goes to payroll.

Sources

Read October 13, 2026 unless another date is given.

• US Code via govinfo, 42 U.S.C. 2000e and 2000e-2: Title VII employer of 15 or more employees; disparate impact in 2000e-2(k).
• US Code via govinfo, 42 U.S.C. 12111 and 12112: ADA employer threshold; separate medical files and confidential medical record, 12112(d)(3)(B) and (d)(4)(C).
• US Code via govinfo, 15 U.S.C. 1681b: FCRA disclosure, written authorization, certification and pre adverse action copy, 1681b(b).
• Federal Register, Executive Order 14281, Restoring Equality of Opportunity and Meritocracy, signed April 23, 2025: deprioritizing disparate impact enforcement; review by the attorney general and the EEOC chair.
• EEOC, technical assistance documents on the ADA and AI in hiring and on assessing adverse impact under Title VII, at their former eeoc.gov addresses under /laws/guidance/: both returned page not found on October 13, 2026.
• Illinois General Assembly, Public Act 103-0804: Illinois Human Rights Act 2-101(B) employer, (M) and (N) AI definitions, 2-102(L), effective January 1, 2026. Read through the Internet Archive copy of September 10, 2026, because ilga.gov refused connections from our location.
• NYC Department of Consumer and Worker Protection, AEDT page and AEDT FAQ of June 29, 2023: Local Law 144 of 2021, effective January 1, 2023, enforced from July 5, 2023; definition, bias audit, employer responsibility, notice 10 business days ahead, complaints.
• California Civil Rights Department, approval of the automated decision system regulations, June 30, 2025: OAL approval June 27, 2025; effective October 1, 2025; four year records; unlawful medical inquiry.
• CalPrivacy, California Consumer Privacy Act, effective January 1, 2026: Civil Code 1798.145(m)(4), employee exemption inoperative January 1, 2023; and announcement of September 23, 2025: ADMT duties from January 1, 2027.
• Texas Legislature Online, HB 4, 88th Legislature, enrolled: Business and Commerce Code 541.001(7), consumer excludes an individual acting in an employment context.
• Connecticut General Assembly, Public Act 26-15, the CART Act: sections 7 to 10, disclosure and written notice for automated employment decision technology deployed on or after October 1, 2027; sections 13 and 14, use of the technology is no defense to a discrimination complaint, effective October 1, 2026.
• Colorado General Assembly, SB 26-189: signed May 14, 2026; repeals and reenacts SB 24-205; employment as a consequential decision; duties from January 1, 2027; three year records; 60 day cure until January 1, 2030; attorney general rules by January 1, 2027; no new private right of action.