Illinois AI Hiring Compliance: Notice, Bias Testing, and Vendor Records Under HB 3773

If you hire in Illinois and software touches a resume, a job ad, or a performance score before a human makes the call, you already have AI-compliance homework. As of January 1, 2026, Illinois law governs how you use artificial intelligence across nearly every employment decision — and it applies to businesses with as little as one employee. A recent survey found 65% of employers now let AI automatically reject candidates before a human ever reviews them. If your company is one of them, this guide is your compliance checklist.

The Law in 60 Seconds​

In August 2024, Illinois enacted HB 3773 (Public Act 103-0804), amending the Illinois Human Rights Act to cover AI in employment. The amendments took effect January 1, 2026. The law does three things:

1. Bans AI with a discriminatory effect. You may not use AI that "has the effect of subjecting employees to discrimination" on the basis of any protected class under the Act — covering recruitment, hiring, promotion, renewal of employment, selection for training or apprenticeship, discharge, discipline, tenure, and the terms, privileges, or conditions of employment.
2. Requires notice. When you use AI in those decisions, you must notify applicants and employees.
3. Bans zip codes as a proxy. You may not use zip codes as a stand-in for protected characteristics.

The definition of AI is deliberately broad: any machine-based system that produces output — predictions, recommendations, classifications, scores — capable of influencing an employment decision. That sweeps in far more than futuristic robot interviewers. Resume-screening keywords in your applicant tracking system, programmatic job ads targeted by geography or demographics, chatbots that rank candidates, and productivity-monitoring tools that generate scores used in discipline all plausibly count.

And the coverage threshold should get every small employer's attention: since 2020, the Illinois Human Rights Act has applied to employers with one or more employees working in Illinois. There is no 15- or 50-employee floor to hide behind. If you employ even one person in Illinois and use AI anywhere in the employment lifecycle, this law names you.

Give Notice Before You Deploy: The Transparency Duty​

The statute requires notice but says almost nothing about what the notice must contain or how to deliver it. The Illinois Department of Human Rights (IDHR) was charged with writing rules to fill that gap — and the rulemaking ride has been bumpy. In May 2026, IDHR published detailed draft regulations, then temporarily withdrew them in June 2026 to keep coordinating with other state agencies. No revised timeline has been announced.

Here is the critical point: the withdrawal paused the rules, not the law. HB 3773 has been in effect since January 1, 2026, and the notice duty stands on its own. The withdrawn draft remains the best available blueprint for what compliance looks like, so build to it now and adjust when final rules land.

When notice is triggered​

The draft uses an "influence or facilitate" test: notice is required whenever AI influences or facilitates a covered employment decision. Examples the draft says generally do trigger notice:

• Directing job ads or recruiting materials to targeted groups, areas, or populations
• Screening resumes for particular terms or patterns
• Measuring, monitoring, or evaluating productivity or performance to generate scores, ratings, or flags used in discipline or corrective action

Examples that generally do not trigger notice:

• AI used for general business operations, not to make, influence, or facilitate an employment decision, or used in ways "merely incidental" to the decision
• Software that happens to have AI features you never switch on for employment decisions

Audit every tool against that line. If the output feeds a hiring, promotion, discipline, or termination call — even as one input among many — assume notice is required.

What the notice should contain​

Under the draft framework, plan to disclose:

• The developer, product name, and vendor of the AI system
• Which employment decision it influences or facilitates
• The job positions it will be used for
• A point of contact for questions about the system's use
• The right to request a reasonable accommodation, with a contact for making the request

Deliver it through every channel that fits: the employee handbook or policy manual, a conspicuous posting where workplace notices live, and the job notice or posting itself for applicants. Current employees (and their union representatives, if any) should get notice annually and within 30 days of adopting a new or substantially updated AI product. Keep the language readable, translate it into the languages your workforce commonly speaks, and make it accessible to employees with disabilities.

A short posting-level disclosure can look like this: "We use [product name] by [vendor] to [screen application materials for relevant experience / schedule interviews / evaluate skills assessments] for this role. Scores and rankings assist our hiring team; final decisions are made by people. Contact [name/email] with questions or to request a reasonable accommodation in this process." Have employment counsel review your version — but having a version at all already puts you ahead of most small employers.

Test for Discrimination: "The Tool Did It" Is Not a Defense​

The ban's key phrase — "has the effect of" — makes this a disparate-impact standard. Intent is irrelevant. If your screening tool advances one protected group at a meaningfully lower rate than another, the violation exists whether or not anyone meant to discriminate, and whether or not a protected trait appears anywhere in the training data. Proxies do the quiet work: commute distance, employment gaps, name-inflected language patterns, and of course location.

That is why the legislature singled out zip codes. Residential geography correlates so strongly with race and national origin that filtering or weighting by zip functions as filtering by protected class. Review every tool for location-based inputs — radius filters, "local candidates preferred" auto-tags, geo-targeted job ads — and either remove them or document a job-related justification reviewed by counsel.

Equally important: you cannot outsource this liability to your vendor. Under long-standing selection-procedure principles, the employer using the tool is the one engaging in the employment practice, and a vendor's assurances do not excuse a discriminatory result. Federal guidance has consistently warned that relying on a software vendor's say-so will not save an employer whose tool selects protected groups at substantially lower rates. Your contract with the vendor governs your business relationship; it does not govern your liability to applicants and employees.

How to actually test: borrow the bias-audit playbook​

Illinois does not currently mandate a specific test the way New York City does — its 2021 automated-employment-decision law requires covered employers to run an annual independent bias audit measuring selection rates, scoring rates, and impact ratios by race, ethnicity, and sex, and to publish a summary. Illinois employers should treat that model as voluntary best practice, because an effects-based ban is only provable with effects-based evidence. At minimum:

1. Inventory every AI touchpoint. List each product, what decision it feeds, and what data it ingests. Include "invisible" AI: sourcing tools, scheduling optimizers, video-interview platforms, performance dashboards.
2. Run the four-fifths screen. The classic rule of thumb from the Uniform Guidelines on Employee Selection Procedures: a group's selection rate should be at least 80% of the highest group's rate. If 50% of one group advances but only 30% of another does, the ratio is 0.6 — below 0.8, and a red flag demanding investigation. It is a screening tool, not a safe harbor — passing it does not prove legality, and small samples need statistical care — but failing it is a stop sign.
3. Demand vendor validation. Ask each vendor for adverse-impact analyses, what populations were tested, and re-testing commitments when models update. Get it in writing before renewal.
4. Keep a human in the loop. Require human review before any adverse action, and document the legitimate, job-related reason for the final call. Automation that rubber-stamps rejections is the fact pattern regulators notice first.
5. Re-test on a schedule. Models drift and vendors ship updates silently. Annual re-testing, plus testing after any substantial model change, mirrors the New York cadence and gives you a paper trail of diligence.

Mind the Older Sibling: Video-Interview Rules From 2020​

HB 3773 was not Illinois's first AI-employment law. The Artificial Intelligence Video Interview Act (820 ILCS 42) has regulated AI analysis of video interviews since January 2020, and it still applies alongside the new amendments. If applicants record video interviews that AI evaluates, you must:

• Notify each applicant in advance that AI may analyze the interview
• Explain how the AI works and what characteristics it evaluates
• Obtain the applicant's consent before the interview — and not evaluate applicants who decline
• Limit sharing of the video and honor deletion obligations

One more Illinois trap sits beside it: if your interview platform scans facial geometry, that data can qualify as a biometric identifier under the Illinois Biometric Information Privacy Act, which demands a written release plus a public retention-and-destruction schedule — and carries its own private right of action. Before buying any video-interview tool, confirm in writing what biometric data it collects and map both statutes' consent flows.

Keep Vendor Records Like an Auditor Is Coming​

Good compliance is mostly good recordkeeping, and the draft regulations raise the bar: applicant and employee records move from a one-year to a three-year retention period, and employers must keep AI notices, postings, disclosures, and records of AI use for three years after the use. Adopt the three-year standard now — it costs little and matches where the final rules are heading.

Build one file per AI product containing:

• The contract and any data-processing addenda
• Validation studies, bias-audit reports, and adverse-impact analyses from the vendor
• Version history and vendor notices of model changes
• Copies of every notice, posting, and handbook disclosure, with dates and distribution channels
• Accommodation requests and how each was resolved
• Your own four-fifths screens and re-test results

This file is also a bookkeeping object. Bias-audit fees, validation consulting, counsel's review time, and the labor hours your team spends on testing are real compliance costs — book them to a dedicated compliance or professional-services account rather than letting them dissolve into general overhead. When leadership asks what AI governance costs, or when you need to compare vendors' total cost of ownership at renewal, a clean ledger gives you the answer in minutes instead of a week of archaeology. Set calendar reminders for annual notice refreshes, re-tests, and contract renewals; retention obligations die quietly when nobody owns the calendar.

Your 8-Step Illinois AI Compliance Checklist​

1. Inventory every AI feature touching recruitment, hiring, promotion, training selection, discipline, or termination — including ad targeting and productivity scoring.
2. Map each tool to the covered decisions it influences or facilitates, and flag any zip-code, radius, or location-based inputs for removal or counsel review.
3. Publish notices in job postings, the handbook, and on-premises postings, with product, vendor, decision, roles, contact, and accommodation information.
4. Fix video-interview flows to deliver advance notice, an explanation, and genuine consent — plus biometric releases if facial geometry is collected.
5. Paper the vendors: collect validation evidence, testing cadences, and update-notification commitments before you renew anything.
6. Run the numbers: four-fifths screens on your own hiring data now, deeper independent testing for high-volume or high-stakes tools, and re-tests after model changes.
7. Human-review adverse actions and document the job-related reason for every rejection, discipline, or termination the AI touched.
8. Retain for three years and diary the IDHR rulemaking — the notice rules will be back, and you want the final version in your inbox, not in a regulator's exhibit binder.

What Happens If You Get It Wrong​

Because HB 3773 lives inside the Human Rights Act, violations ride the Act's full enforcement track: an applicant or employee can file a charge with IDHR, which investigates and can send the case to the Human Rights Commission — and after exhausting that process, an aggrieved individual can sue directly in Illinois court. Available remedies are make-whole relief: back pay, lost benefits, hiring, promotion or reinstatement, front pay where reinstatement is not feasible, emotional-distress and other compensatory damages, personnel-file correction, and attorney's fees and costs. (Notably, the Act's administrative track does not award punitive damages — but uncapped compensatory damages plus the other side's legal fees are plenty.) Small employers sometimes assume enforcement targets only big companies; a one-employee coverage threshold and a private right of action should disabuse you of that.

Simplify Your Financial Management​

AI-hiring compliance is, at bottom, a recordkeeping discipline: vendor contracts, validation reports, test results, notices, and a three-year retention clock — all with costs that deserve their own line in your books. Beancount.io gives you plain-text accounting that keeps every compliance dollar traceable, version-controlled, and ready for your accountant or auditor. Get started for free and run your back office with the same rigor the law now expects from your hiring stack.