White Paper · AI & Privacy · Illinois Governance

Governing AI in Illinois: Employment, Biometrics, Video Interviews, and Operational Controls

Illinois organizations using AI should connect each system to the law that actually applies: employment discrimination and notice under the Human Rights Act, video-interview duties, BIPA controls for covered biometrics, and documented governance using a framework such as NIST AI RMF.

By Lincoln Square Law · 6-minute read

I. Match each AI use to the law that governs it

A Chicago healthcare organization deploying AI in 2026 faces four overlapping legal regimes. The regimes differ in scope, enforcement mechanism, and trigger:

1. BIPA: biometric collection and retention. The Biometric Information Privacy Act requires informed written consent before collecting biometric identifiers, mandates a public retention-and-destruction policy, and grants a private right of action with liquidated damages of $1,000 per negligent and $5,000 per intentional or reckless violation. The Illinois Supreme Court held that a plaintiff need not allege actual injury beyond the statutory violation itself, and that a five-year limitations period applies. After Cothron v. White Castle held that claims accrue with each scan, the General Assembly amended the Act in 2024 to limit recovery to a single violation per person per collection method and to recognize electronic signatures for consent. The amendment tamed annihilative damages math. It did not tame BIPA. Fingerprint timeclocks, facial-recognition access control, voiceprint tools, and some AI video systems remain a recurring compliance issue where covered biometric identifiers or information are collected.

2. Illinois Human Rights Act: employment AI, effective January 1, 2026. Illinois amended the Human Rights Act to make it a civil rights violation for an employer to use AI that has the effect of discriminating on the basis of protected classes in recruitment, hiring, promotion, discipline, discharge, and other terms of employment, to use zip code as a proxy for protected classes, or to fail to notify employees and applicants that AI is being used for such decisions. The statute’s significance is structural: it regulates effects, not intent. A resume-screening model that disparately filters a protected group violates the Act whether or not anyone intended it, which makes documented testing, human review, and vendor governance important operational controls.

3. The Artificial Intelligence Video Interview Act. Since 2020, Illinois employers using AI analysis of video interviews must explain the AI’s use, obtain consent, restrict video sharing, honor deletion requests, and, where AI screening determines in-person interview selection, report demographic data to the state. It is narrow but strict, and it interlocks with HB 3773’s broader notice duty.

4. Sector-specific law still matters. Nothing in HIPAA says “artificial intelligence.” It does not need to. The Security Rule’s risk-analysis requirement obligates regulated entities to assess risks to all ePHI across all systems, which, as of the day an AI scribe, triage model, or revenue-cycle tool touches patient data, includes that tool, its vendor, its data flows, and its failure modes. OCR’s active enforcement posture centers on exactly this: a functioning, current risk-management program, with penalties inflation-adjusted in January 2026 to a willful-neglect annual cap above $2.19 million. The proposed Security Rule overhaul (NPRM published January 6, 2025) would harden these duties further, mandatory MFA, encryption, asset inventories, and testing, but as of this writing it remains a proposed rule, with final action deferred on the federal regulatory agenda to 2027. Prudent programs treat the proposal as a preview, and the current rule as the enforced floor.

II. The framework layer: NIST AI RMF and ISO/IEC 42001

Statutes tell you what outcomes are forbidden. Frameworks tell you how to run a program. Two matter most. The NIST AI Risk Management Framework organizes AI governance into four functions, Govern, Map, Measure, Manage, and is the de facto reference point for U.S. regulators and litigants asking whether an organization behaved reasonably. ISO/IEC 42001 converts the same discipline into a certifiable management system standard, useful where customers, payors, or partners demand attestation. Colorado’s AI Act, the first comprehensive state law aimed at algorithmic discrimination in consequential decisions, with an effective date deferred to June 30, 2026, expressly treats compliance with recognized frameworks as relevant to its reasonable-care standard, a signal of where multistate compliance is heading.

III. The working program: five artifacts, one calendar

Everything above reduces to five documents a mid-size organization can actually maintain:

1. The AI system inventory. Every tool that generates, transforms, or scores information affecting patients or employees, including features embedded inside your EHR, HR platform, and phone system that no one procured as “AI.” Fields: purpose, data touched (ePHI? biometric? applicant data?), vendor, human-in-the-loop status, statutory hooks (BIPA / HB 3773 / HIPAA). The inventory is the legal document from which every other obligation is scoped. You cannot give an HB 3773 notice for a tool you have not identified.
2. Risk classifications with owners. A simple three-tier scheme (prohibited / high-risk-controlled / permitted) beats an elaborate one nobody applies. Employment-decision and clinical-decision tools default to the controlled tier.
3. The notice-and-consent pack. HB 3773 employee/applicant notices, AI Video Interview Act consent scripts, BIPA written releases and the public retention-destruction policy (with electronic-signature capture now expressly valid).
4. Vendor terms. Adverse-impact testing representations, audit rights, BIPA indemnity, BAA coverage where ePHI is touched, incident-notice clocks, and data-return on exit. Vendor AI promises that live in marketing decks and not in contracts are not controls.
5. The monthly governance report. New tools identified, classifications changed, tests run, incidents, and regulatory developments. One page a board can read. Monitoring is not overhead. In a four-regime environment where two regimes changed in the last 24 months, monitoring is the product.

IV. Sequencing for the next 90 days

Weeks 1 to 2: inventory (one structured afternoon per department gets 80%). Weeks 3 to 4: classify and identify the statutory hooks per tool. Weeks 5 to 8: close the two highest-frequency gaps, missing HB 3773 notices and unconsented biometric collection, and fold AI systems into the HIPAA risk analysis. Weeks 9 to 12: paper the vendors and stand up the monthly report. An organization that completes that sequence has, in one quarter, converted four statutes and two frameworks into a program an examiner, a plaintiff’s lawyer, or a board can be shown.