Illinois HB 3773: An AI Notice Duty With No Rules Behind It

Illinois is currently running an unusual experiment in administrative law, and employers are the test subjects. Since 1 January 2026, it has been a civil rights violation in Illinois to use artificial intelligence in a way that discriminates in employment — and a separate civil rights violation to use AI in employment decisions without telling people you are doing it. Both duties come from HB 3773, enacted as Public Act 103-0804 and signed on 9 August 2024, which amended the Illinois Human Rights Act (IHRA).

The notice duty is the one that bites, because it does not depend on proving any discriminatory effect. You either gave notice or you did not. And the rules that were supposed to define what compliant notice looks like — what it must say, when it must be delivered, where it must appear — do not exist. The Illinois Department of Human Rights (IDHR) published proposed rules on 15 May 2026 and withdrew them eighteen days later. As of late September 2026 they have not been refiled.

So the statutory duty is live and the regulatory definition of the duty is not. This guide covers what actually binds today, what the withdrawn draft would have required, why that draft is still worth reading even though it carries no legal force, and what a defensible interim notice program looks like while Illinois works out what it wants.

What binds today: two separate violations

The operative amendments sit at 775 ILCS 5/2-102(L), inside the Act’s list of civil rights violations, and they are structured as two distinct paragraphs.

Paragraph (L)(1) — discriminatory use. It is a civil rights violation for an employer to use artificial intelligence that has the effect of subjecting employees or applicants to discrimination on the basis of a protected class with respect to recruitment, hiring, promotion, renewal of employment, selection for training or apprenticeship, discharge, discipline, tenure, or the terms, privileges, or conditions of employment. The same paragraph separately prohibits using zip code as a proxy for a protected class.

Paragraph (L)(2) — failure to notify. It is a civil rights violation for an employer to fail to provide notice that it is using artificial intelligence for any of those same purposes. This is the independent duty. A hiring model that produces perfectly even outcomes across every protected class still generates a violation if nobody was told it was running.

That structural split is the single most important thing to understand about the Illinois law. Most of the compliance literature written for New York City’s Local Law 144 and California’s FEHA automated-decision-system regulations is organised around bias auditing, because those regimes put the audit at the centre. Illinois did not. Illinois put an unconditional transparency obligation next to an effects-based discrimination prohibition, and the transparency obligation is the one with no defence available beyond “we gave notice.”

The statutory definition of AI is deliberately wide

Section 2-101 of the Act now defines artificial intelligence as:

a machine-based system that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments

and states that the term includes generative artificial intelligence. That phrasing is lifted from the OECD-derived language now common in AI statutes, and it is broad on purpose. It does not require machine learning. It does not require a neural network. It does not require the system to be the sole or even the primary basis for a decision — it requires only that the output be capable of influencing one.

Read literally, that reaches a great deal of ordinary HR software: resume-ranking and match-scoring inside an applicant tracking system, keyword-based screening that produces a recommendation, chatbot-driven pre-screening, scheduling and routing tools that sort candidates, video-interview scoring, and performance-analytics dashboards that feed discipline or promotion decisions. Employers that inventory only the tools they internally label “AI” will miss most of their exposure. The statutory test is functional, not nominal.

Who is covered

The IHRA’s employer definition does the work here, and it is unusually inclusive. Since a 2019 amendment (Public Act 101-0430) took effect on 1 July 2020, the Act reaches employers with one or more employees in Illinois during 20 or more calendar weeks within the calendar year of, or preceding, the alleged violation. There is no 15-employee floor and no carve-out for small employers.

There is also no AI-specific exemption for public-sector or non-profit employers, which is why this lands on universities, hospitals and research institutes the same way it lands on corporate recruiters.

The rules that are not there

HB 3773 delegated the details to IDHR, directing the Department to adopt rules describing the circumstances and conditions that require notice, the time period for giving it, and the means of providing it. That rulemaking has had three phases, and it is currently stalled in the third.

• December 2025 — an informal draft. IDHR shared a draft “Subpart J: Use of Artificial Intelligence in Employment” with stakeholders at a meeting. It was circulated and analysed publicly, but it was never formally published for comment at that stage, so it had no procedural status at all.
• 15 May 2026 — formal proposal. IDHR published proposed amendments to Part 2520 of the Illinois Administrative Code in the Illinois Register, creating the new Subpart J and amending the Department’s recordkeeping section. Publication opened a 45-day public comment period due to close on 29 June 2026, with a public hearing scheduled for 10 June 2026.
• 2 June 2026 — withdrawal. Eighteen days after publication, IDHR postponed the rulemaking and cancelled the hearing. The Department’s stated reason was that it “is currently reviewing matters related to the proposed rulemaking and will provide updated information regarding next steps as it becomes available,” and that “postponement is necessary to allow for continued collaboration with other state agencies.” No revised timeline was given, and none has been published since.

One small bookkeeping caution: published law-firm alerts on this rulemaking disagree about which Title of the Illinois Administrative Code Part 2520 sits in, with several citing Title 44 and others Title 56. The Joint Committee on Administrative Rules lists Part 2520 — Procedures of the Department of Human Rights — under Title 56: Labor and Employment. If you are pulling the docket yourself, search by Part number rather than by Title.

What the withdrawn draft would have required

The proposed Subpart J is not law and cannot be enforced. It is, however, the most direct available evidence of what the enforcing agency believes the statute means — written by the people who will investigate the charges. Treating it as a design input while being clear that it is not a compliance standard is the right posture.

As proposed, the draft was organised roughly like this:

• Section 2520.900 — definitions. Defined artificial intelligence, generative artificial intelligence and “covered employment decision,” tracking the statutory list. Critically, it defined use expansively: any instance in which the output of an AI system influences or facilitates a covered employment decision. Targeted recruitment advertising and resume-screening were named as triggering activities.
• Section 2520.910 — notice. Notice required whenever covered AI is used to influence or facilitate a covered employment decision.
• Section 2520.110 — recordkeeping. Extended the Department’s existing retention requirement and expressly brought AI-related notices, postings and disclosures inside it.

The draft notice itself would have had to identify the developer, product name and vendor of the AI; the employment decisions it affects; the system’s purpose and the categories of employee or applicant information it processes; the job positions where it is used; a contact point for questions; and information about the right to request a reasonable accommodation. Format requirements were specific: plain language, readable, available in the languages commonly spoken by the employer’s workforce, and reasonably accessible to people with disabilities.

On timing, the draft would have required notice to current employees annually and within 30 days of adopting a new or substantially updated AI system, and notice to prospective employees within the job posting itself. Delivery was to be layered rather than single-channel: employee handbooks or policy documents, physical workplace posting locations, the employer’s intranet or external website, and job postings.

Two places the draft is genuinely unsettled

Anyone building a program off the draft should know where it is soft, because the withdrawal makes these open rather than resolved.

The retention period. Published summaries of the same draft disagree on the number — some report that Section 2520.110 would have extended retention from one year to three, others report four, and at least one analysis of the formally proposed version does not find a retention figure in it at all. That is a small discrepancy, but it is exactly the kind of detail a compliance calendar gets built on, and it is a concrete reason not to treat a withdrawn draft as a specification.

Applicants versus employees. The statutory notice paragraph is phrased in terms of notice to an employee, while the discrimination paragraph expressly reaches applicants. The draft rules closed that gap by requiring notice in job postings. With the rules withdrawn, the gap is open again as a matter of text — and the practical answer is still to notify applicants, because the agency has already said in writing that it reads the duty that way, and because the downside of over-notifying is nil.

A defensible interim notice program

“Defensible” is the right word here, not “compliant” — there is no published standard to be compliant with. The goal is a program an IDHR investigator would find reasonable, documented and contemporaneous.

1. Inventory by function, not by label. Walk the actual decision path for recruitment, hiring, promotion, training selection, discipline, discharge and tenure, and record every system whose output influences any step. Include modules inside your ATS or HRIS that you did not buy separately. The statutory definition does not care what the vendor calls it.
2. Get the disclosure facts from the vendor in writing. The draft notice elements — developer, product name, vendor, purpose, data categories — are mostly facts you do not hold. The ATS or assessment vendor holds them, which makes this a contractual exercise as much as an HR one. Our guide to assessing third-party AI vendor risk covers the diligence questions and the contract terms that make disclosure obligations flow through.
3. Publish a layered notice now. Job postings, handbook or policy document, intranet, and the physical posting location you already use for employment notices. Layering costs little and directly mirrors what the agency proposed.
4. Write it in plain language, and translate it. The draft’s accessibility and language requirements are the kind of thing an agency rarely retreats from between drafts. Building them in now is cheap insurance.
5. Set a 30-day trigger and an annual cycle. Tie notice re-issuance to procurement and to any substantial model or configuration change, and run an annual refresh to current staff. Both dates came straight from the draft.
6. Handle the zip code question separately. The proxy prohibition is a use restriction, not a notice one, and no notice cures it. Ask your vendor directly whether zip code, postal geography or any derived geographic feature enters the model, and document the answer.
7. Keep the records. Retain the notices, the postings, the versions, the dates and the distribution evidence. Since the retention figure is unsettled, retain for the longest period under discussion rather than the shortest.
8. Re-read the docket periodically. A refiled Subpart J will restart a comment period, and a transition window is far easier to meet from a program that already exists.

How this is enforced

HB 3773 did not create a new enforcement mechanism. It made AI misuse and AI non-disclosure into civil rights violations under the existing Act, which means the existing IHRA machinery applies: an aggrieved person files a charge with IDHR, generally within 300 days of the alleged violation. IDHR investigates and either dismisses — a dismissal the complainant can ask the Illinois Human Rights Commission to review — or files a complaint with the Commission. Complainants also have the option of opting out and proceeding in state court. The ordinary IHRA remedies follow, including actual damages, injunctive relief and attorney’s fees.

That matters for how you should think about risk. There is no AI-specific penalty schedule to read, no algorithmic-audit filing to submit, and no registry. The exposure is an ordinary discrimination charge, brought by an ordinary claimant, in a forum that already knows how to run one — with a notice element that is trivially easy to plead and, in the absence of records, awkward to rebut.

Why this lands on research administration

Universities, academic medical centres and research institutes are among Illinois’s larger employers, and their hiring is unusually AI-exposed for reasons that have nothing to do with enthusiasm for the technology.

Academic hiring is high-volume and repetitive at the screening stage: faculty searches, postdoctoral appointments, research staff, core facility technicians, clinical research coordinators, and a continuous flow of grant-funded positions that open and close on award cycles. That volume is exactly what drives institutions onto applicant tracking systems with ranking, match-scoring and knockout-question features switched on by default — often procured centrally years before anyone framed them as AI systems.

Three consequences follow for research administration specifically:

• The inventory crosses office boundaries. Central HR owns the ATS, but individual departments, core facilities and grant-funded labs frequently run their own screening workflows, and sponsored programs offices sit on the hiring that follows an award. An institution-wide inventory that stops at central HR will be incomplete.
• Grant-funded hiring inherits the duty. A position funded by a federal award is still an Illinois employment decision. The notice obligation does not distinguish by funding source, and the job postings that sponsored programs and departments generate are precisely where the draft rules would have required applicant notice to appear.
• The compliance structure already exists. Institutions running IHRA training, EEO reporting and affirmative-action obligations already have the apparatus for this. The gap is not capability, it is that nobody has yet mapped the AI inventory onto it — and the model holder is usually a vendor, not the institution.

Illinois in context

Illinois is not the only state regulating AI in consequential decisions, but its design is distinctive. Colorado’s law builds a developer/deployer duty structure around “high-risk” systems and consequential decisions across many sectors. Texas TRAIGA takes an intent-based approach. The federal Algorithmic Accountability Act, still a bill, would impose impact assessments. Illinois did none of those things: it wrote two sentences into an existing civil rights statute and let the existing enforcement regime carry them.

That minimalism is why the missing rules matter so much. A statute that defines its own compliance artefacts can survive a stalled rulemaking. A statute that delegates the entire definition of the duty and then loses the delegation leaves employers guessing — and, as the enforcement record in FTC v. Rite Aid and EEOC v. iTutorGroup shows, regulators have been comfortable for years bringing AI cases under general-purpose law without any AI-specific rulebook behind them.

Frequently asked questions

Is the Illinois AI employment law actually in effect?

Yes. Public Act 103-0804’s amendments to the Illinois Human Rights Act took effect on 1 January 2026 and are enforceable now. The withdrawal of IDHR’s proposed rules did not suspend, delay or modify the statute.

Do I have to give notice if my AI tool is not discriminatory?

Yes. The notice duty at 775 ILCS 5/2-102(L)(2) is independent of the discrimination prohibition at (L)(1). A non-discriminatory system used without notice still produces a violation.

What does a compliant notice have to say?

Nothing is prescribed, because the rules that would have prescribed it were withdrawn. The most defensible position is to follow the withdrawn draft’s elements — developer, product name and vendor, the decisions affected, the system’s purpose, data categories, positions covered, a contact point, and accommodation information — while documenting that you were following draft guidance, not a binding standard.

When will IDHR refile the rules?

Unknown. IDHR gave no timeline when it postponed the rulemaking on 2 June 2026, saying only that postponement was necessary to allow continued collaboration with other state agencies, and had not refiled as of late September 2026.

Does the law apply to small employers?

Yes. The IHRA covers employers with one or more employees in Illinois during 20 or more calendar weeks in the calendar year of, or preceding, the alleged violation. There is no small-employer exemption for these provisions.

Does using an outside vendor’s tool shift the obligation?

No. The statute puts the duty on the employer. The vendor typically holds the model and the disclosure facts, which makes vendor diligence and contract terms a practical necessity, but it does not transfer the legal obligation.

Can I rely on my NYC Local Law 144 bias audit for Illinois?

Not as a substitute. An LL144 audit is evidence you have examined your tool for disparate impact, which is useful under (L)(1). It does nothing for the Illinois notice duty, whose required content, timing and delivery are different, and which applies to a broader set of employment decisions than LL144’s hiring and promotion focus.

What about the zip code provision?

Using zip code as a proxy for a protected class is separately prohibited. It is a restriction on use, not a disclosure obligation, so disclosing it does not cure it. Ask your vendor directly whether geographic features enter the model, and keep the answer.