Illinois AI law in hiring: HB 3773, video interviews and BIPA
· Written and maintained by Nonimo
The Illinois AI hiring law is a short amendment with a long reach. Since January 1, 2026, Section 2-102(L) of the Illinois Human Rights Act makes it a civil rights violation for an employer to use AI that has the effect of discriminating in employment decisions, to use ZIP codes as a proxy for a protected class, or to use AI in those decisions without telling employees.
It sits next to two older Illinois laws that already touched hiring software: the Artificial Intelligence Video Interview Act, in force since 2020, and the Biometric Information Privacy Act. Together they give an Illinois HR team more to read than most, and the rules that were meant to explain the notice duty are not there.
This page covers only what is specific to Illinois. The federal picture and the other states with hiring rules are in our national guide to AI for HR, and every state privacy law is listed in the state by state overview.
What Illinois’s AI hiring law says
House Bill 3773 became Public Act 103-0804. It changed two sections of the Illinois Human Rights Act, 775 ILCS 5/2-101 and 2-102, and its Section 99 set the effective date at January 1, 2026. It did not create a separate AI statute: the duties live inside the state’s main civil rights law, so they apply on top of whatever privacy rules the employer follows, which our national privacy guide sets out.
Subdivision (L) has two paragraphs. Paragraph (1) covers recruitment, hiring, promotion, renewal of employment, selection for training or apprenticeship, discharge, discipline, tenure, and the terms, privileges or conditions of employment. In any of those, an employer may not use AI that has the effect of subjecting employees to discrimination on the basis of protected classes, or use ZIP codes as a proxy for those classes.
Paragraph (2) makes it a separate violation to fail to give employees notice that the employer is using AI for those purposes. The two duties are independent. A fair tool used in silence breaks the second, and a disclosed tool with a discriminatory effect breaks the first.
Effect, not intent
The wording matters. Paragraph (1) asks whether the AI “has the effect of” subjecting employees to discrimination, not whether the employer meant it. An employer that bought a scoring tool in good faith is exposed if the scores fall harder on a protected group, and the vendor’s assurances do not change what the results show.
That puts Illinois at odds with the federal direction. In April 2025, Executive Order 14281 told federal agencies to deprioritize disparate impact enforcement. Illinois had already written an effects test for AI into its own statute, and a charge under it goes to the Illinois Department of Human Rights, not the EEOC.
In August 2026 the state went further. The governor signed the Civil Rights Safeguard Act, SB 3777, which IDHR says keeps disparate impact liability enforceable under the Human Rights Act, from June 1, 2027. The federal side is covered in the national HR guide.
Who the Illinois law covers: employers with one employee
For Article 2 of the Human Rights Act, which is where subdivision (L) sits, an employer includes any person employing one or more employees within Illinois during 20 or more calendar weeks in the year of or before the alleged violation. The State, local governments and parties to public contracts are covered regardless of headcount.
| Illinois Human Rights Act, Article 2 | Title VII and the ADA | |
|---|---|---|
| Minimum size | One or more employees in Illinois | 15 or more employees |
| Period counted | 20 or more calendar weeks | 20 or more calendar weeks, each working day |
| AI rule | Section 2-102(L), from January 1, 2026 | None specific to AI |
775 ILCS 5/2-101(B) as printed in Public Act 103-0804; 42 U.S.C. 2000e(b) and 12111(5).
A dental office in Peoria with four staff, using an applicant tracking system that ranks resumes, is inside subdivision (L). It would be outside Title VII entirely. When that system’s export goes anywhere else, redacting names in Excel takes the applicants out of it first. Our healthcare page covers what small practices paste into AI more generally.
Employees, applicants and apprentices
The Act defines an employee to include any individual performing services for remuneration within Illinois, an apprentice and an applicant for an apprenticeship, and paragraph (1) reaches recruitment and hiring. In practice an employer should assume job applicants are within the rule’s reach, and write its notice for them as well as for staff.
What counts as artificial intelligence in Illinois
The Act adds two definitions to Section 2-101. Artificial intelligence means a machine based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments. The definition then says, in terms, that AI includes generative AI.
Generative AI gets its own definition: an automated computing system that, when prompted, can produce outputs simulating human produced content, including text, images and audio or video. ChatGPT, Claude and Copilot fit it squarely. What each of those keeps from a conversation is a separate question, covered for ChatGPT in our data guide.
Is a recruiter using ChatGPT “using AI” under the Act?
The statute draws no line between a dedicated screening product and a general chatbot. If a recruiter asks ChatGPT to rank applicants and acts on the ranking, that is AI used with respect to hiring. If an HR manager asks it to tidy the wording of a handbook, the link to an employment decision is thin.
Between those two sits the work most Illinois offices actually do: summarizing resumes, drafting interview questions, condensing performance notes before a review. Until rules say otherwise, the cautious reading is that anything feeding a covered decision is use, and the notice should say so. A US AI policy is where an employer writes down which of those uses it allows.
ZIP codes as a proxy: the one named input
Subdivision (L) names one input outright: an employer may not use ZIP codes as a proxy for protected classes. It is the only part of the Illinois rule that describes how a model works rather than what it produces, and it gives an employer something specific to ask a vendor.
The question is practical. Does the tool take the applicant’s address, at what level of detail, and what does it do with it? A five digit ZIP code fed into a scoring model is the thing the statute names, and the vendor’s answer belongs in the file.
Removing the address before it reaches the model
The simplest control sits upstream. A resume summarized in a chatbot does not need the street address or the ZIP code, and removing them before the text leaves the computer means neither the chatbot nor anything built on its output can lean on them. Redacting a PDF before AI and masking a CSV export cover the two formats applicant data usually arrives in.
The notice duty, and the IDHR rules still to come
The Act tells the Illinois Department of Human Rights to adopt any rules necessary to implement subdivision (L), including on the circumstances and conditions that require notice, the time period for providing it, and the means of providing it. Those three questions are exactly what an employer needs answered, and they are still open.
IDHR did propose rules: amendments to 56 Ill. Adm. Code 2520 implementing the AI notice duty appeared in the Illinois Register on May 15, 2026, with a hearing set for June 10. None has been adopted: on October 13, 2026 the department’s list of rules had no AI subpart, and its legislative updates page listed no open comment period. The notice duty is in force anyway: it is in the statute, and the statute took effect on January 1, 2026.
Writing a notice without rules
Without rules, the statute is the brief. It requires notice “to an employee” that the employer is using AI for the purposes in paragraph (1). A notice that names the uses, says which decisions they touch and is given before the use starts answers the text; how far to go beyond that is a judgment call to take with Illinois employment counsel.
The Act already has a model for workplace notices. Subdivision (K) requires employers to post a Department approved summary of employee rights where notices are customarily posted, and to include it in any employee handbook.
An AI notice placed alongside it, and in job postings for applicants, is a defensible starting point until IDHR says more, and a US AI policy is where the list of uses it describes comes from. How the Illinois notice compares with New York City’s and Colorado’s is in the national HR guide.
The Artificial Intelligence Video Interview Act
Illinois regulated AI in hiring years before HB 3773. The Artificial Intelligence Video Interview Act, 820 ILCS 42, took effect on January 1, 2020, and applies to an employer that asks applicants to record video interviews and uses an artificial intelligence analysis of those videos when considering applicants for positions based in Illinois.
| Duty | What the Act says | Section |
|---|---|---|
| Notice | Before the interview, tell each applicant AI may analyze the video | 42/5(1) |
| Explanation | Before the interview, explain how the AI works and what general types of characteristics it evaluates | 42/5(2) |
| Consent | Get the applicant’s consent first; no AI evaluation without it | 42/5(3) |
| Sharing | Only with people whose expertise or technology is needed to evaluate fitness | 42/10 |
| Deletion | Within 30 days of the applicant’s request, including backups held by others | 42/15 |
| Reporting | If AI alone decides who gets an in person interview, report race and ethnicity data each year | 42/20 |
820 ILCS 42, as in force on October 13, 2026.
The 30 day deletion and the backup copies
The deletion duty is the one that reaches past the employer. On request, the employer must delete the applicant’s interviews within 30 days and instruct anyone who received copies to delete theirs, including all electronically generated backups, and those recipients must comply.
A recording or transcript pasted into a general chatbot is a copy the employer cannot easily recall, which is a reason to keep interview material out of such tools. If it has already happened, deleting the ChatGPT history is the first step, though it does not reach what the provider retains under its own terms.
Demographic reporting to DCEO
Since January 1, 2022, an employer that relies solely on AI analysis of video interviews to decide who gets an in person interview must collect the race and ethnicity of applicants who do and do not get one, and of those hired. It reports the data to the Department of Commerce and Economic Opportunity by December 31 each year, covering the 12 months ending November 30.
The department then reports to the Governor and the General Assembly by July 1 on whether the data shows racial bias. The report goes to DCEO, not to the Department of Human Rights that enforces HB 3773, and the national HR guide covers how recordings and transcripts are handled elsewhere.
BIPA: when the AI looks at faces or voices
The Biometric Information Privacy Act, 740 ILCS 14, matters to hiring tools for one reason: its definition. A biometric identifier includes a retina or iris scan, a fingerprint, a voiceprint, or a scan of hand or face geometry. Photographs are expressly excluded, so a headshot on a resume is not covered, but software that maps facial geometry from a video can be.
What happens to a photo uploaded to a chatbot is a separate question, answered in our guide to whether ChatGPT stores images.
Before collecting a biometric identifier, a private entity must inform the person in writing that it is being collected, state the purpose and how long it will be kept, and receive a written release. In employment, a release executed by an employee as a condition of employment counts. The entity must also publish a retention schedule and destroy the data when the purpose is met or within 3 years of the last interaction, whichever comes first.
The damages that made BIPA famous
BIPA lets any person aggrieved sue. A prevailing party recovers, for each violation, $1,000 or actual damages for a negligent violation and $5,000 or actual damages for an intentional or reckless one, plus attorneys’ fees and costs. Since Public Act 103-0769 took effect on August 2, 2024, repeated collection of the same identifier from the same person by the same method is a single violation, with at most one recovery.
The practical test for an employer is to ask the vendor whether its video or voice analysis creates a face geometry scan or a voiceprint. If it does, the Video Interview Act’s consent is not enough on its own: BIPA wants its own written notice, purpose, retention period and release.
Biometric data also appears in Illinois’s breach law, covered next, and identity documents raise the same issue at onboarding, where watermarking an Illinois driver’s license copy limits what a stray scan can be used for.
PIPA: Illinois’s security and breach law for HR data
The Personal Information Protection Act, 815 ILCS 530, covers every data collector that handles nonpublic personal information, employers included. Its definition of personal information is a name combined with one of several data elements, when either is not encrypted or redacted, or a username or email with the password or security answer that opens an account. Most of the elements turn up in an HR file.
| Element combined with a name | Where it sits in HR |
|---|---|
| Social Security number | Payroll, onboarding, benefits |
| Driver’s license or state ID number | I-9 support, fleet and driving roles |
| Account or card number | Direct deposit forms, expense claims |
| Medical information | Leave and accommodation requests |
| Health insurance information | Benefits enrollment, claims queries |
| Unique biometric data used to authenticate | Time clocks with fingerprints or faces |
815 ILCS 530/5, definition of personal information.
Section 45 has the clause most relevant to AI vendors. A data collector holding records with Illinois residents’ personal information must keep reasonable security measures, and any contract for disclosing that information must require the recipient to keep reasonable security too. Uploading an employee file to a chatbot under a consumer account accepted with a click is hard to square with that.
Breach notice: no fixed day count
If personal information is acquired without authorization, Illinois residents must be told in the most expedient time possible and without unreasonable delay, with the contacts for consumer reporting agencies and the FTC. Above 500 Illinois residents from a single breach, the attorney general must be told no later than the residents are.
Whether a paste into a chatbot is a breach at all is worked through in our guide on whether putting client data in ChatGPT is a data breach, and what to remove first is the cheaper path.
An Illinois checklist for AI in HR
The work that is specific to Illinois lands on a handful of documents. In the order a small or midsize Illinois employer can take them:
- Count the uses. List every AI tool that touches recruitment, hiring, promotion, discipline, discharge or the terms of employment, chatbots included.
- Write the notice. Subdivision (L)(2) applies now; post it with the Human Rights Act notice, put it in the handbook and in job postings.
- Ask about location data. Get the vendor to say in writing whether the tool uses ZIP codes or addresses, and how.
- Check the video tools. If AI analyzes recorded interviews, the Video Interview Act’s notice, explanation and consent come before the interview.
- Ask about faces and voices. If the tool creates a face geometry scan or a voiceprint, BIPA’s written release and retention schedule come first.
- Fix the contracts. PIPA wants a reasonable security clause in any contract that discloses employee personal information, AI vendors included.
Steps 3 and 6 go straight into your AI policy, and step 1 starts from the national HR guide’s document table.
Nonimo in an Illinois HR office
Nonimo is an app for Mac and Windows that works on the text before it reaches ChatGPT, Claude or Copilot. A recruiter in Naperville highlights a candidate’s resume and presses one key, and the name, street address and phone number become placeholders on that computer. When the answer comes back, the real details go back in on the same machine.
For an Illinois employer, that means a resume, a review or interview notes can go to a chatbot without the candidate’s name and street address. It does not decide anything about anyone, and it does not replace the notice under subdivision (L), the Video Interview Act’s consent or a BIPA release.
The conversation stays on the computer, encrypted, and what the app sends out is a daily usage count with no text, as the security page sets out. Start from Nonimo for US teams, or watermark an Illinois driver’s license copy in your browser before it goes to payroll.
Sources
Read October 13, 2026 unless another date is given. ilga.gov refused connections from our location on that date, so its documents were read through the Internet Archive copies named below.
- Illinois General Assembly, Public Act 103-0804 (HB 3773 enrolled), archive copy of September 10, 2026: 775 ILCS 5/2-101(A), (B), (M) and (N); 2-102(K) and (L); Section 99, effective January 1, 2026.
- Illinois General Assembly, Artificial Intelligence Video Interview Act, 820 ILCS 42, archive copy of September 25, 2026: sections 5, 10, 15 and 20; P.A. 101-260, effective January 1, 2020; P.A. 102-47, effective January 1, 2022.
- Illinois General Assembly, Biometric Information Privacy Act, 740 ILCS 14, archive copy of March 13, 2026: sections 10, 15 and 20; P.A. 103-769, effective August 2, 2024.
- Illinois General Assembly, Personal Information Protection Act, 815 ILCS 530, archive copy of May 16, 2026: sections 5, 10 and 45.
- Joint Committee on Administrative Rules, Flinn Report, May 15, 2026, archive copy of August 24, 2026: IDHR proposed amendments to 56 Ill. Adm. Code 2520 implementing P.A. 103-804, 50 Ill. Reg. 6794, hearing June 10, 2026.
- Illinois Department of Human Rights, rules and regulations: Part 2520 with no AI subpart on October 13, 2026; and Civil Rights Safeguard Act release, August 13, 2026: SB 3777 signed, disparate impact liability kept, effective June 1, 2027.
- Illinois Department of Human Rights, Legislative Updates: no current comment periods listed on October 13, 2026.
- Federal Register, Executive Order 14281, signed April 23, 2025: deprioritizing disparate impact enforcement.
- US Code via govinfo, 42 U.S.C. 2000e and 42 U.S.C. 12111: the 15 employee threshold of Title VII and the ADA.
Common questions
What is the Illinois AI hiring law?
It is House Bill 3773, Public Act 103-0804, which amended the Illinois Human Rights Act from January 1, 2026. Under Section 2-102(L), an employer commits a civil rights violation if it uses AI that has the effect of discriminating on a protected basis, uses ZIP codes as a proxy for a protected class, or fails to notify employees that it uses AI in employment decisions. Nonimo keeps candidate names out of the chatbots HR already uses.
When did HB 3773 take effect?
On January 1, 2026. Section 99 of Public Act 103-0804 sets that date, and since then the duties in Section 2-102(L) of the Illinois Human Rights Act have applied to employers in the state. The Department of Human Rights has not adopted the rules on notice that the Act asks it to write, so the statute applies on its own terms for now.
Does the Illinois AI law apply to small employers?
Yes. For Article 2 of the Illinois Human Rights Act, an employer includes any person employing one or more employees within Illinois during 20 or more calendar weeks in the year of or before the alleged violation. That is far below the 15 employees that Title VII and the ADA require, so a five person office using AI to screen applicants is inside the Illinois rule.
Do I have to tell employees I use ChatGPT in Illinois?
If you use it with respect to recruitment, hiring, promotion, discipline, discharge or the terms of employment, Section 2-102(L)(2) makes failing to give notice a civil rights violation. The Act's definition of AI expressly includes generative AI. What the notice must say, when and how, was left to rules that IDHR has not adopted. Using ChatGPT only to write a policy or a job ad is a weaker fit.
What happened to the IDHR rules on AI notice?
They were proposed and never adopted. IDHR published amendments to 56 Ill. Adm. Code 2520 on the AI notice in the Illinois Register on May 15, 2026, with a hearing set for June 10. As of October 13, 2026 its rules contain no AI subpart and no comment period is open. The notice duty in the statute applies anyway, so employers are working from the statutory text.
What does the Illinois AI Video Interview Act require?
An employer that asks applicants for Illinois based positions to record video interviews and uses AI to analyze them must, before the interview, tell each applicant AI may be used, explain how it works and what characteristics it evaluates, and get consent. It may share the videos only with people whose expertise is needed and must delete them within 30 days of a request, including backups.
Does BIPA apply to AI video interviews?
It can. BIPA treats a scan of face geometry and a voiceprint as biometric identifiers, while plain photographs are excluded. A tool that measures facial geometry needs a written release before collection, a public retention schedule and limits on disclosure. A person aggrieved can recover $1,000 per negligent violation or $5,000 per intentional or reckless one, or actual damages if greater, plus attorneys' fees.
Is putting employee data into ChatGPT a breach in Illinois?
Not automatically. The Personal Information Protection Act defines a breach as unauthorized acquisition of computerized personal information that compromises its security. A deliberate upload to a vendor is a disclosure question first. But the Act also requires contracts that disclose Illinois residents' personal information to oblige the recipient to keep reasonable security, which an accepted consumer chatbot account does not obviously do. Nonimo reduces what is disclosed.