AI & Privacy · Governance Retainer · Chicago

AI, Privacy & Data Governance Counsel in Chicago

A fractional privacy and AI governance officer for Illinois and multistate organizations: an inventory of the AI systems in use, risk classification under the NIST AI RMF and ISO/IEC 42001, working policies and training, and a written report every month.

Artificial intelligence now sits inside the software businesses already use to screen applicants, schedule staff, answer customers and draft documents. Illinois regulates several of those uses directly, and the duties fall on the employer or practice that uses the tool. Lincoln Square Law serves as AI governance and privacy counsel to Illinois and multistate organizations from our Chicago office. The founding attorney holds the AIGP and CIPP/US credentials and has served in-house as general counsel and privacy officer for multi-site healthcare organizations.

Illinois laws that already apply to AI

Four Illinois statutes are the ones we check first. Which one applies depends on what the tool does, so the analysis follows the function and not the product label.

• Employment decisions. Since January 1, 2026, the Illinois Human Rights Act makes it a civil rights violation for an employer to use AI that has the effect of subjecting employees to discrimination on the basis of a protected class in recruitment, hiring, promotion, renewal of employment, selection for training or apprenticeship, discharge, discipline, tenure, or the terms, privileges or conditions of employment. The same provision prohibits using zip codes as a proxy for a protected class and failing to give notice that the employer uses AI for those purposes (775 ILCS 5/2-102(L)).
• Recorded video interviews. An employer that asks applicants for positions based in Illinois to record video interviews and analyzes them with AI must, before the interview, notify each applicant, explain how the AI works and what general types of characteristics it evaluates, and obtain consent. Videos may be shared only with persons whose expertise or technology is necessary to evaluate the applicant, and must be deleted within 30 days after the applicant asks (820 ILCS 42/5, 42/10, 42/15).
• Biometrics. A tool that captures a voiceprint or a scan of face or hand geometry collects a biometric identifier under the Biometric Information Privacy Act (BIPA). A public written retention policy, written notice and a written release must be in place before collection (740 ILCS 14/10, 14/15).
• Therapy and psychotherapy. The Wellness and Oversight for Psychological Resources Act, effective August 1, 2025, limits licensed therapy professionals to administrative and supplementary uses of AI. It bars AI from making independent therapeutic decisions and from interacting directly with clients in therapeutic communication (225 ILCS 155/15, 155/20). Our behavioral health practice page covers that Act.

AI in hiring and employment after January 1, 2026

The Human Rights Act amendment is written broadly. An employer includes any person employing one or more employees within Illinois during 20 or more calendar weeks of the relevant year (775 ILCS 5/2-101(B)). Artificial intelligence means a machine-based system that infers, from the input it receives, how to generate outputs such as predictions, content, recommendations or decisions, and the definition expressly includes generative AI (775 ILCS 5/2-101(N), (O)). A resume ranking feature, a scheduling product that scores performance and a chatbot used to draft discipline memos may each fall within it, depending on how the output is used.

The statutory language turns on effect. The question is whether the use has the effect of subjecting employees to discrimination, and a vendor statement that a product was tested for bias does not answer that question for the employer’s own applicants and workforce. The Act also directs the Illinois Department of Human Rights to adopt rules on the circumstances that require notice, the time period for giving it and the means of giving it (775 ILCS 5/2-102(L)). We check the Department’s current rules before setting a client’s notice practice, and we recommend keeping a record of each notice.

Video interviews carry one more duty. An employer that relies solely on an AI analysis of a video interview to decide who receives an in-person interview must collect the race and ethnicity of applicants who are and are not advanced and of those hired, and report that data each year by December 31 to the Department of Commerce and Economic Opportunity (820 ILCS 42/20).

The AI system inventory and risk classification

The first deliverable is an inventory. For each tool we record the business purpose, the data that goes in, the output that comes out, the people affected, the vendor and model involved, who reviews the output, where records are kept and what decision the output influences. That record turns a general worry about AI into specific legal questions.

We then classify each use by risk. A system that drafts an internal summary is a different matter from one that ranks job applicants, supports a clinical decision, verifies identity or decides access to a service. The classification looks at the decision involved, the people affected, the sensitivity of the data, the degree of automation and the consequences of an error. It sets the level of testing, human review, notice, contract protection and leadership attention each use receives, so that effort goes to the uses that matter.

NIST AI RMF and ISO/IEC 42001 as working frameworks

Neither framework is Illinois law. We use them because they give the program a structure that can be explained to a board, a customer or a regulator. The NIST Artificial Intelligence Risk Management Framework (NIST AI 100-1), released in January 2023, is voluntary and organizes the work into four functions: Govern, Map, Measure and Manage. NIST published a Generative AI Profile (NIST AI 600-1) in July 2024, and as of this writing NIST states that AI RMF 1.0 is being revised.

ISO/IEC 42001:2023 is an international standard that specifies requirements for establishing, implementing, maintaining and continually improving an AI management system, for organizations of any size that develop, provide or use AI. We do not issue certifications. We prepare the policies, records and risk assessments the standard calls for, and we scope that work to what the client needs to show.

Policies, human review and workforce training

Policies come after the inventory, and they are written for the people who will follow them. A working AI use policy says which tools are approved, what information may not be entered into them, who approves a new use, and when counsel has to be consulted. We draft the notices and consents the Illinois statutes require and tie each one to the system that triggers it.

Saying that a human is in the loop is not a control. The policy should define what the reviewer checks, what information the reviewer can see, when the reviewer may reject or override an output, and how that decision is documented. A nominal approval step gives false comfort if the reviewer lacks the time, training or authority to challenge the system. Training is built by role, covers realistic examples, including outputs that are confidently wrong, and leaves an attendance record.

Vendor terms for AI tools

The contract decides whether an organization can keep its own promises. Review covers permitted data use, rights to train models on customer data, retention and deletion, subprocessors, security, incident notice, audit cooperation, ownership of outputs, confidentiality, indemnity, limits of liability, changes to the service and help at termination. A vendor privacy policy does not settle these points. The binding agreement has to give the customer the rights and information it needs to operate lawfully and to respond when something goes wrong.

State law monitoring and the monthly governance report

Under the retainer we monitor Illinois AI and privacy law and the laws of the other states where the client has employees or customers, and we report what changes the client’s obligations. Each month the client receives a written governance report: tools added to or removed from the inventory, new uses reviewed and how they were classified, changes in law with their effective dates and the person responsible for each, open remediation items, and decisions that need leadership. A quarterly review looks at the program as a whole.

Privacy compliance under the same retainer

An AI question is usually a privacy question too, because the tool runs on personal information. The privacy side of the practice is covered on three pages. Illinois data privacy compliance covers BIPA, the Genetic Information Privacy Act and the Personal Information Protection Act. U.S. state data privacy compliance is for organizations with customers or employees in other states, and CCPA and CPRA compliance addresses California. Healthcare clients will also want our healthcare compliance page.

How an engagement starts

• A first conversation about the organization, its tools and the states where it operates, followed by a written scope.
• The inventory, built with the people who buy and use the software, and a risk classification for each use.
• A short written memo that ranks the gaps: notices not given, consents missing, contracts that do not match the product in use.
• Policies, notices and training for the higher-risk uses first.
• The monthly cycle of monitoring, review of new tools and the written report.

Common questions about AI governance in Illinois

Does the Illinois AI employment law apply to a small employer?

Yes, if it has at least one employee in Illinois. For this part of the Human Rights Act, an employer includes any person employing one or more employees within Illinois during 20 or more calendar weeks in the calendar year of or before the alleged violation (775 ILCS 5/2-101(B)).

Our vendor says its hiring tool is compliant. Is that enough?

No. The Human Rights Act places the duty on the employer that uses the AI, and the Video Interview Act places the notice, consent and deletion duties on the employer as well. A vendor’s documentation is useful evidence. We recommend reading it against the contract and against how the tool is configured in your account.

Do we have to tell applicants and employees that we use AI?

An employer that uses AI for the employment purposes listed in the Human Rights Act must give notice, and the Department of Human Rights is charged with adopting rules on when and how (775 ILCS 5/2-102(L)). AI analysis of a recorded video interview requires notice, an explanation and consent before the interview (820 ILCS 42/5).

Is following the NIST AI RMF or ISO/IEC 42001 required by Illinois law?

The Illinois statutes discussed on this page do not require either one. NIST describes its framework as voluntary, and ISO/IEC 42001 is a standard an organization chooses to adopt. We use both to organize the inventory, the risk assessments and the records so the program can be explained and audited.

Can a therapy practice use AI to help with session notes?

The Act treats preparing and maintaining client records, including therapy notes, as supplementary support that a licensed professional may use AI to assist with while keeping full responsibility. Where the session is recorded or transcribed, the patient must first be told in writing that AI will be used and for what specific purpose, and must consent (225 ILCS 155/10, 155/15).

Related resources

General information only; not legal advice and does not create an attorney-client relationship.