Illinois's AI Hiring Law Took Effect in January. Its Own Compliance Rules Didn't.

On January 1, 2026, Illinois amended the Illinois Human Rights Act to make the use of artificial intelligence in employment decisions a civil rights matter. The amendment — House Bill 3773, signed by Governor Pritzker on August 9, 2024, as Public Act 103-0804 — gave employers a year and a half of lead time before it took effect (DLA Piper; Byte Back Law). What employers did not get, on schedule, was a finished rulebook for one of the law's three core obligations. Nine months after the statute took effect, that rulebook still doesn't exist, and the agency that was writing it isn't saying when it will.

What the law actually requires

HB 3773 does three distinct things to the Illinois Human Rights Act, and it's worth separating them because they don't all carry the same compliance uncertainty.

First, it makes it a civil rights violation for an employer to use AI that has the effect of subjecting an applicant or employee to discrimination on the basis of a protected class — in recruitment, hiring, promotion, discharge, discipline, or other terms and conditions of employment. The standard is disparate impact, not disparate treatment: an employer's intent is irrelevant. If an AI-driven process produces a discriminatory outcome, that the employer never meant to discriminate is not a defense (Warden AI; GRSM).

Second, it separately bars using a zip code as a proxy for a protected class in an AI-driven employment decision — a direct response to the well-documented pattern of geographic data standing in for race or national origin once it's fed into a model (Jones Day; DLA Piper).

Third, it creates a freestanding notice duty: failing to tell an applicant or employee that AI is being used in a covered employment decision is, on its own, a separate civil rights violation — independent of whether the AI itself produced a discriminatory result (CASRAI; Byte Back Law).

All three are enforced the ordinary way IHRA violations are enforced: through a charge filed with the Illinois Department of Human Rights, which investigates and can refer the matter to the Illinois Human Rights Commission, with remedies drawn from the Act's existing framework of cease-and-desist orders and actual damages (Illinois Human Rights Act, 775 ILCS 5/8A-104). There's no new standalone AI agency and no new penalty schedule specific to AI — HB 3773 just plugged AI-caused discrimination into machinery that already existed.

The part that's missing: what "notice" means

The disparate-impact prohibition and the zip-code ban are self-executing — the statutory text says what's barred, and no further rule is needed to apply it. The notice duty is different: it requires an employer to tell someone something, and the statute left the specifics — what the notice must say, how it must be delivered, when — to rules IDHR was directed to write (Hinshaw).

IDHR published its proposed notice rules on May 15, 2026, opening the 45-day public comment window the Illinois Register process requires and setting a public hearing for June 10, 2026. Eighteen days later, on June 2, 2026, IDHR withdrew the proposal, pausing both the comment period and the hearing. The agency's stated reason was the need for "continued collaboration with other state agencies" — it gave no timeline for a replacement (Seyfarth; National Law Review). As of late September 2026, nothing has been refiled, and nothing has been announced about when it might be (Affirmity).

So the practical state of the law, nine months after it bound employers, is: the duty to give notice is already in force and already enforceable as its own violation, but the only government document that would have told you what a compliant notice looks like got pulled before the public even finished commenting on it. One law firm's framing of this is exactly right: it's a notice duty with no rules behind it (CASRAI).

Why this isn't just a paperwork problem

It would be easy to read the missing rules as a reason to wait — if the government hasn't defined compliance, how can you be found non-compliant? That reading only covers the notice duty. It does nothing for the other two-thirds of the law.

The disparate-impact provision doesn't care whether a notice rule exists. It asks a factual question: did your AI-involved process, in fact, produce a discriminatory effect on a protected class? That question gets answered by looking at outcomes and at the mechanism that produced them — not by checking whether an employer filed the right form. An employer (or an AI-hiring vendor) that can't describe, consistently, what its tool evaluates and how, is in a worse position to answer that question than one that can — regardless of whether IDHR has finished writing its notice regulations. The zip-code provision is the same: it's already binding, already specific, and entirely unaffected by the withdrawal.

That's the structural point underneath the headline. Rulemaking delay changes the compliance uncertainty around notice form. It changes nothing about exposure, which is already live on an effects-based standard that doesn't ask what you intended.

Illinois isn't the only data point, and it isn't the most delayed one

It's worth placing Illinois against the two other prominent U.S. AI-hiring regimes, because the comparison cuts against the instinct to treat all of this as one undifferentiated regulatory mess.

New York City's Local Law 144, now three years old, is the most settled of the three: it requires covered employers to commission an independent annual bias audit of any automated employment decision tool and publish the results, and that requirement has been in continuous effect since 2023 with no delay or withdrawal (Warden AI).

Colorado's AI Act is the opposite case. Originally set to take effect February 1, 2026, it has been pushed back twice — first to June 30, 2026, then, under SB 25-205's amendments signed by Governor Polis on May 14, 2026, all the way to January 1, 2027 — while its substantive requirements were scaled back along the way. A federal magistrate judge separately stayed enforcement of a related piece of Colorado's AI anti-discrimination framework in April 2026 pending litigation (Fisher Phillips; National Law Review).

Illinois sits in the middle, and it's the more interesting position precisely because it isn't a clean story. Unlike Colorado, Illinois never delayed its effective date — the substantive prohibitions went live exactly on schedule and remain fully enforceable today. Unlike New York City, Illinois's one genuinely novel operational requirement — what a compliant AI-use notice actually looks like — has no finished implementing guidance at all. Employers can't treat "Illinois hasn't delayed, so we're fine" and "Illinois's rules aren't written, so nothing's really required yet" as the same conclusion. Both are true, about different parts of the same law.

Where we come down on this, as a vendor this law is actually about

NiceHire runs AI screening interviews, which is precisely the category of tool HB 3773, Colorado's Act, and NYC's Local Law 144 are all written to reach. We're not employment counsel, and nothing here is legal advice — IDHR's own notice-form guidance is unsettled, and any employer with Illinois exposure should be getting a specific read from counsel rather than from a vendor's blog post.

What we can speak to is mechanism, because it's ours to describe accurately. Every AI screening greeting NiceHire generates identifies the interviewer as AI — in English, Japanese, Traditional Chinese and Simplified Chinese, on both a candidate's first attempt and a reconnect after a dropped session — through a disclosure step that a custom or template greeting can't silently remove. Every applicant to a given role is asked from the same defined question set, in the same order, with follow-ups and rephrasing allowed but the underlying set fixed in advance rather than decided candidate-by-candidate. And every completed screening stores a structured evaluation — technical, communication and cultural-fit scores, each on a 0–100 scale, against criteria set once for the role — rather than an ad hoc, after-the-fact judgment call.

We're not claiming that adds up to "HB 3773 compliant" — that's a legal conclusion about a specific employer's specific use, and in Illinois right now it would also require guessing at a notice-form rule nobody has finished writing. What we're pointing at is narrower: the three properties above (default disclosure, a fixed question set, consistent scoring criteria) are exactly the kind of mechanism a disparate-impact inquiry under HB 3773 — or under NYC's bias-audit regime, or whatever Colorado's law eventually settles into — would actually look at. None of it depends on IDHR finishing its rulemaking. If you're evaluating an AI hiring tool for Illinois exposure, the open rule is a reason to ask your vendor harder questions about mechanism now, not a reason to wait.

What this means if you're the one deciding

1. Don't treat the missing notice rules as a reason to stop assessing risk. The disparate-impact prohibition and the zip-code ban are fully binding today, run on an effects-based standard, and have nothing to do with the withdrawn rulemaking.
2. Give notice anyway, in the most informative form you can, now. A separate civil rights violation attaches to failing to disclose AI use at all — not to using the "wrong" government-approved template, because no such template currently exists. A plain, specific disclosure is lower-risk than waiting for a rule that has no announced timeline.
3. Ask AI-hiring vendors about mechanism, not marketing. "Does every candidate for a role get the same question set and the same scoring criteria, and is that documented, not just asserted?" is a question you can get a factual answer to today, independent of any state's rulemaking calendar — and it's the question a disparate-impact inquiry will eventually ask anyway.

Illinois gave employers eighteen months of notice that this law was coming, then gave them eighteen days of a proposed rule before pulling it. The gap between those two timelines is the story — and closing it, if you're the one with hiring decisions to defend, has to happen on the first timeline, not wait for the second.