Illinois AI Regulations
Illinois regulates AI in five layers: frontier model safety, employment discrimination, biometrics, video interviews, and outright bans in behavioral health, claims processing, and education. Two features set it apart. Liability under the Illinois Human Rights Act attaches to discriminatory effect, not intent. And BIPA keeps a private right of action alive with per-violation statutory damages. Colorado enacted a narrowed replacement of its AI Act on May 14, 2026, effective January 1, 2027; Texas requires proof of intent and bars private suits. Illinois did neither.
Last reviewed against primary sources: . AI legislation is moving quickly — statutes have been delayed, repealed and replaced mid-cycle. Verify against the linked primary sources before relying on any date here.
In-Depth Analysis
Read the two headline statutes in the right order, because the famous one probably does not apply to you.
SB 315 got the coverage — it is the first US law requiring independent third-party audits of frontier AI developers, and the audit provision is genuinely novel. But it reaches models trained above 10^26 operations by developers whose affiliates cleared $500 million in revenue. That is a short list, and your organization is almost certainly not on it. Buying compliance services against SB 315 when you do not train frontier models is buying nothing.
HB 3773 is the one that binds you, and it has been in force since January 1, 2026. It makes it a civil rights violation to use AI that has the effect of discriminating against a protected class. Effect, not intent. That standard does not care whether you built the model, bought it, or inherited it through an applicant tracking system you have never inspected. A vendor's assurance that its model is bias-free is not a defense, because the statute asks what the system did, not what the vendor intended.
BIPA remains the sharpest financial exposure. It is the only Illinois AI-adjacent statute with statutory damages and a private right of action, and the class action bar knows it. Any AI system that analyzes a face or a voice is collecting biometric data under the Illinois definition — voice authentication in a contact center, facial recognition in access control, voiceprint analysis in call quality assurance.
For healthcare organizations the stack is deeper still: the therapy prohibition, the January 2028 downcoding rule requiring a natural person in every downcoding decision, and BIPA over any patient-facing biometric identification.
Practical Implications for SMBs & Healthcare
The practical question for most Illinois organizations is not "how do we comply with the new frontier AI law" — you are almost certainly out of its scope. It is "which of our existing systems make or influence employment decisions, and can we show what they did to whom."
That inventory is harder than it sounds, because AI has usually arrived through procurement rather than engineering. Resume ranking inside an applicant tracking system, scheduling optimization, performance scoring, interview transcription and summarization — none of these were bought as AI, and all of them are in scope.
Implicit consent is insufficient under BIPA. A banner reading "by using this site you agree" does not satisfy the written-release requirement.
Key Provisions
Effect-based AI employment discrimination liability
Since January 1, 2026 it has been a civil rights violation under the Illinois Human Rights Act for an employer to use AI that has the effect of discriminating on the basis of a protected class — in recruitment, hiring, promotion, renewal, training selection, discharge, discipline, tenure, or the terms and conditions of employment. Intent is not an element. Using ZIP codes as a proxy for a protected class is separately prohibited. The IHRA reaches employers with a single employee, and the charge-filing window is two years. For most organizations this, not the frontier model statute, is the Illinois AI law that actually applies.
Employee and applicant notice when AI influences employment decisions
Employers must notify employees and applicants when AI is used in covered employment decisions. IDHR proposed implementing rules on May 15, 2026 requiring disclosure of the AI product name, its developer and vendor, the decisions and job positions affected, the categories of data collected, an inquiry contact, and accommodation rights — delivered through handbooks, on-premises posting, the company website, and job postings, with four-year record retention. IDHR postponed that rulemaking on June 2, 2026 and has given no re-proposal date. The statutory notice duty is in force regardless of the rules.
Biometric consent, statutory damages, and a private right of action
BIPA requires written notice of purpose and retention period, a written release before collecting face geometry, voiceprints, fingerprints, or iris scans, a published retention and destruction schedule, and a bar on profiting from biometric data. Any aggrieved person may sue for $1,000 per negligent violation or $5,000 per intentional or reckless violation, whichever exceeds actual damages, plus attorney's fees. The August 2024 amendment limits repeated collection by the same method to a single recovery and confirms that electronic signatures satisfy the written-release requirement. BIPA is the only Illinois AI-adjacent statute carrying statutory damages and a private right of action.
Frontier AI framework, registration, and public disclosure
The Artificial Intelligence Safety Measures Act (SB 315) reaches developers who train foundation models above 10^26 operations. Those whose affiliates generated more than $500 million in prior-year revenue must register with the Illinois Emergency Management Agency from January 1, 2027, and from January 1, 2028 must write, implement, and conspicuously publish a frontier AI framework covering catastrophic-risk assessment, capability thresholds, mitigations, cybersecurity and model-weight security, internal governance, third-party evaluations, and risks from internal use. Annual review; material modifications disclosed within 30 days.
Independent third-party safety audits — unique to Illinois
From January 1, 2028, or within 90 days of crossing the large-frontier-developer threshold, covered developers must retain an independent auditor with demonstrated technical expertise in frontier model safety and no financial interest in the developer. The audit assesses substantial compliance and the adequacy of internal controls. A redacted report goes to the Illinois Emergency Management Agency and the Attorney General within 30 days of receipt and is published; the unredacted report is retained for the deployment period plus five years. No other state requires this.
Critical safety incident reporting on 72-hour and 24-hour clocks
A frontier developer must report a critical safety incident to the Illinois Emergency Management Agency and the Attorney General within 72 hours of learning facts sufficient to form a reasonable belief that one occurred. Where the incident poses an imminent risk of death or serious physical injury, the report goes to law enforcement or a public safety authority within 24 hours. California's comparable statute allows 15 days. "Catastrophic risk" is defined as a foreseeable and material risk of more than 50 deaths or serious injuries, or more than $1 billion in damage.
Sectoral prohibitions in behavioral health, claims, and education
The Wellness and Oversight for Psychological Resources Act, effective August 2025, bars any person or internet-based AI from providing therapy or psychotherapy without licensure, and bars licensed professionals from using AI to make independent therapeutic decisions, communicate therapeutically with clients, detect emotions, or generate treatment plans without licensed review. IDFPR may fine up to $10,000 per violation. Separately, the Transparency in Downcoding Act requires a natural person to make or review every claim downcoding decision from January 1, 2028, and AI may not assign scores or ratings in teacher evaluations from January 1, 2027.
Bills & Statutes
Artificial Intelligence Safety Measures Act (Public Act 104-0538)
Signed July 6, 2026; effective January 1, 2027; audits from January 1, 2028
Read the primary source(opens in a new tab)Illinois Human Rights Act — artificial intelligence (Public Act 103-0804)
Signed August 9, 2024; in force January 1, 2026
Read the primary source(opens in a new tab)Biometric Information Privacy Act
Effective 2008; amended by SB 2979 effective August 2, 2024; active enforcement
Read the primary source(opens in a new tab)Wellness and Oversight for Psychological Resources Act
Signed August 2025; effective immediately
Read the primary source(opens in a new tab)Artificial Intelligence Video Interview Act
In force since January 1, 2020; demographic reporting since January 1, 2022
Read the primary source(opens in a new tab)Transparency in Downcoding Act (Public Act 104-0568)
Signed July 10, 2026; effective January 1, 2028
Read the primary source(opens in a new tab)AI prohibited in teacher evaluation scoring (Public Act 104-0565)
Signed July 10, 2026; effective January 1, 2027
Read the primary source(opens in a new tab)Consumer Artificial Intelligence Notice Act — chatbot disclosure
Passed Senate 56-1 on May 21, 2026; in House Rules Committee — not law
Read the primary source(opens in a new tab)Applicability & Enforcement
Who It Applies To
SB 315 reaches only developers who train foundation models above 10^26 operations, with framework, registration, and audit duties limited to those whose affiliates exceed $500 million in prior-year revenue. Every other Illinois AI statute reaches ordinary deployers. HB 3773 applies to any employer with one or more employees making employment decisions affecting Illinois workers. BIPA applies to any private entity collecting biometric identifiers from Illinois residents. The Wellness and Oversight for Psychological Resources Act applies to anyone offering therapy services in Illinois, including internet-based AI. The AI Video Interview Act applies to employers requesting video interviews for Illinois-based positions.
Enforcement
Illinois Attorney General — exclusive civil enforcement of SB 315. Illinois Department of Human Rights and the Human Rights Commission — HB 3773 charges, with complainants able to elect circuit court within 90 days of the Director's notice. Illinois Department of Financial and Professional Regulation — the AI therapy prohibition. Illinois Department of Commerce and Economic Opportunity — AI Video Interview Act demographic reporting. Illinois Emergency Management Agency — SB 315 registration and incident intake. Private plaintiffs and the class action bar — BIPA.
Penalties
SB 315: up to $1,000,000 for a first violation, up to $3,000,000 for each subsequent violation, and $1,000 per day for registration failures. No private right of action, and municipalities are preempted from regulating frontier models. BIPA: $1,000 per negligent violation, $5,000 per intentional or reckless violation, or actual damages if greater, plus attorney's fees, costs, and injunctive relief — with a private right of action. Wellness and Oversight for Psychological Resources Act: up to $10,000 per violation. HB 3773: standard IHRA remedies — back pay, front pay, reinstatement, emotional distress damages, attorney's fees, and civil penalties set by the Human Rights Commission.
Recommended Compliance Actions
Steps organizations should consider to prepare for and comply with Illinois's AI regulations.
- 1
Inventory every AI and automated decision system touching an Illinois employment decision — including vendor-hosted screening, resume ranking, scheduling, performance scoring, and generative tools used in interviews. Record the product name, developer, vendor, data categories consumed, and which decisions each system influences.
- 2
Issue AI notices now rather than waiting for final IDHR rules. Build the notice into the handbook, on-premises posting, the website, and every job posting. The HB 3773 notice duty took effect January 1, 2026 independent of the postponed rulemaking.
- 3
Run disparate impact testing on every AI-influenced employment decision and keep the results. Liability attaches to effect, so test outcomes by protected class and specifically confirm no model input functions as a ZIP code proxy.
- 4
Retain AI-related notices, model inputs and outputs, and decision records for four years, and preserve them beyond that while any charge is pending. The IHRA charge window is two years, so records must outlive the exposure period.
- 5
Audit every biometric touchpoint against BIPA before adding voice or face analysis to any workflow. Confirm written notice of purpose and term, a written release, a published retention schedule, and no sale of the data.
- 6
For healthcare and behavioral health, map each AI tool against the line between administrative support and therapeutic communication, and against the January 1, 2028 rule requiring a natural person to make or review every downcoding determination.
- 7
Add vendor contract terms covering audit cooperation, disparate impact testing evidence, model change notification within 30 days, biometric data handling, and indemnification for discriminatory output. Illinois liability attaches to the deploying employer, not the vendor, unless the contract shifts it.
- 8
Track SB 317 (chatbot disclosure) through the remainder of 2026. Enforced through the Consumer Fraud Act, it would reach every customer-facing deployment rather than only employment systems.
Related TrustEdge Services
As of September 14, 2026. We are not lawyers and this is not legal advice. It is the responsibility of consumers of this data that they verify the applicability and current ratified statutes and legal precedence with a qualified attorney licensed in the state or country they are researching.
Need Help with AI Compliance?
Our team helps organizations build compliance-first AI systems that meet current and emerging regulatory requirements.