Archive
How 815 ILCS 530 defines data collectors and personal information, when Illinois residents and the Attorney General must receive breach notice, the security, contract and disposal duties, and the decision record to keep from the first day of an incident.
A printable checklist for building a records retention schedule from the periods federal and Illinois law set, applying legal holds, destroying paper and electronic media under PIPA, BIPA, HIPAA and the FTC Disposal Rule, and keeping vendor certificates and destruction logs.
A printable checklist for reviewing vendor contracts that involve personal information: core data terms, Illinois PIPA and BIPA, AI in employment decisions, and sector and out-of-state requirements.
A committee is useful only when its charter turns AI questions into decisions: who can approve a use case, what facts must be supplied, which legal and security triggers require escalation, what evidence is retained, and who can stop a deployment.
Illinois changed the damages math in 2024, not the operating duties. A 2026 BIPA program still begins before collection: identify the biometric function, give the required notice, obtain a written release, control disclosure, publish retention rules, and make deletion real.
Illinois organizations using AI should connect each system to the law that actually applies: employment discrimination and notice under the Human Rights Act, video-interview duties, BIPA controls for covered biometrics, and documented governance using a framework such as NIST AI RMF.
A useful AI-law tracker tells the business what changed, when it becomes operative, which systems are affected, who owns implementation, and what evidence proves the change was completed. It is a legal change-control system, not a feed of bills and headlines.
An AI inventory should let counsel answer what a system did, who approved it, which law applied, what changed, and what evidence exists. A software list cannot do that.
One afternoon will not produce a perfect AI register. It can produce a defensible first-pass list of use cases, owners, data, decisions, and legal triggers, enough to know what must be investigated first.
Questions to put to an AI vendor before you buy, renew, or switch on a feature, covering use case, data flows, performance evidence, Illinois employment, biometric, and therapy triggers, HIPAA terms, security, and the go-live record.