AI Compliance Requirements in Illinois: What Small Businesses Need to Know in 2026

If you're running a small business in Illinois and using AI tools—whether it's ChatGPT for customer service, AI-powered recruiting software, or marketing automation—you need to understand how Illinois law applies to your operations. Illinois has taken a proactive stance on AI regulation, particularly around employment and biometric data, making it one of the most regulated states for artificial intelligence use.

If you're unsure what an AI disclosure policy actually is or whether you need one, Illinois law makes it especially important to find out. This guide breaks down everything Illinois small business owners need to know about AI compliance, from the specific laws that affect you to practical steps you can take today.

Understanding Illinois's AI Regulatory Landscape

Illinois stands out as one of the few states with specific AI-focused legislation already on the books. Unlike many states that are still drafting proposals, Illinois has enforceable laws that directly impact how businesses can use artificial intelligence.

The most notable is the Illinois Artificial Intelligence Video Interview Act (AIVII Act), which went into effect in January 2020. This law specifically governs how employers use AI to analyze video interviews with job candidates. If your business uses any recruiting platform that analyzes facial expressions, speech patterns, or other characteristics through AI, this law applies to you.

But Illinois's AI compliance landscape doesn't stop there. The state's Biometric Information Privacy Act (BIPA), passed in 2008 and increasingly enforced, has major implications for AI systems that use facial recognition, voice analysis, fingerprint scanning, or other biometric identifiers. BIPA has resulted in some of the largest privacy settlements in the country, with businesses paying millions for violations.

As of February 2026, Illinois lawmakers continue to discuss additional AI transparency requirements, particularly around automated decision-making in housing, credit, and healthcare. While these proposals haven't yet become law, the trend is clear: Illinois is committed to regulating AI more stringently than most states.

Who Should Care About Illinois AI Compliance

You might think AI regulation only affects large tech companies or enterprises with massive AI deployments. That's not the case in Illinois.

The Illinois AI laws apply to any business that:

• Uses AI-powered video interviewing tools to screen job candidates
• Employs facial recognition systems for security, time tracking, or customer identification
• Deploys chatbots or AI assistants that collect or analyze voice data
• Uses AI recruiting software that scores or ranks applicants
• Implements any technology that scans, captures, or analyzes biometric information

This means even a 10-person marketing agency using an AI recruiting tool or a small retail shop with facial recognition security cameras could be subject to Illinois AI regulations.

Specific business types that should pay close attention include:

• Restaurants and retailers with AI-powered scheduling or time-clock systems
• Professional services firms using AI for hiring
• Property management companies using smart building technology
• Medical and dental practices with biometric patient check-in systems
• Any business using modern CRM or marketing platforms with AI-powered analytics

If you're using tools like HireVue, Spark Hire with AI features, or even some applicant tracking systems with AI resume screening, you're using technology that triggers Illinois compliance requirements.

Specific Requirements Under Illinois Law

The AI Video Interview Act: What You Must Do

If you use AI to analyze video interviews with job applicants in Illinois, the law requires you to:

1. Provide advance notice: Before asking an applicant to submit a video interview that will be analyzed by AI, you must notify them in writing that AI will be used to analyze their interview and consider their fitness for the position.

2. Explain how the AI works: You need to provide information explaining how the AI system evaluates candidates and what characteristics it uses in the assessment process.

3. Obtain consent: Applicants must consent to being evaluated by AI before you can proceed with the AI-analyzed video interview.

4. Limit sharing: You can only share video interviews with people whose expertise or technology is necessary to evaluate the applicant's fitness for the position. You cannot share videos indiscriminately within your organization.

5. Respect deletion requests: Upon request from an applicant within 30 days of receiving their deletion request, you must delete the interview and any copies, except for one that may be retained for legal compliance purposes.

These requirements aren't suggestions—they're legal obligations with enforcement mechanisms.

BIPA Requirements for AI Using Biometric Data

If your AI tools capture or analyze biometric information—which includes facial geometry, voiceprints, fingerprints, retina scans, or hand scans—you must comply with BIPA:

1. Develop and publish a written policy: You must make publicly available a written policy establishing a retention schedule and guidelines for permanently destroying biometric data.

2. Obtain informed written consent: Before collecting any biometric information, you must inform individuals in writing that their biometric data is being collected or stored, explain the specific purpose and length of time it will be stored, and obtain a written release from the individual.

3. Never sell biometric data: BIPA strictly prohibits selling, leasing, trading, or otherwise profiting from biometric information.

4. Implement reasonable security: You must store, transmit, and protect biometric information using standards that are the same as or more protective than how you handle other confidential and sensitive information.

Unlike many privacy laws, BIPA has a private right of action, meaning individuals can sue directly for violations—and they have, successfully, many times.

Common AI Tools That Trigger Illinois Compliance

Understanding which everyday business tools fall under Illinois AI regulations is crucial. Here's a breakdown:

Hiring and Recruitment Tools

• HireVue, Spark Hire, and similar platforms that analyze video interviews using AI to assess personality traits, speech patterns, or emotional responses
• Applicant tracking systems (ATS) like Greenhouse, Lever, or Workday that use AI to score, rank, or screen resumes
• LinkedIn Recruiter or other platforms that use AI to match candidates to positions

Time and Attendance Systems

• Biometric time clocks that use fingerprint or facial recognition (common in retail, restaurants, and healthcare)
• AI scheduling software that includes facial recognition for clock-in/clock-out

Customer-Facing AI

• Chatbots that analyze voice patterns or sentiment
• Facial recognition systems at entry points or for customer identification
• AI-powered CRM tools like HubSpot or Salesforce that use voice analysis for sales calls

Marketing and Analytics

• AI photo or video analysis tools that identify people in marketing materials
• Social media monitoring tools that use facial recognition

General Purpose AI Tools

While tools like ChatGPT, Claude, or other large language models typically don't trigger BIPA concerns when used for text-based tasks, they may raise compliance issues if you're feeding them data containing biometric information or personal details about Illinois residents.

Midjourney, DALL-E, and similar AI image generators generally don't trigger Illinois-specific AI compliance requirements unless you're training custom models on facial images of identifiable individuals.

Step-by-Step Compliance Checklist for Illinois Businesses

Getting compliant with Illinois AI regulations doesn't have to be overwhelming. Follow this practical checklist:

Step 1: Conduct an AI Inventory (1–2 hours)

• List every software tool, platform, or system your business uses
• Identify which ones use AI or machine learning
• Flag any that involve video/audio analysis, facial recognition, or other biometric data collection
• Document which tools are used in hiring processes

Step 2: Review Vendor Contracts and Documentation (2–4 hours)

• Request information from vendors about how their AI systems work
• Understand what data your AI tools collect and how they analyze it
• Determine if vendors have BIPA-compliant processes
• Review data processing agreements

Step 3: Create or Update Required Policies (3–6 hours)

• Draft a biometric data retention and destruction policy if you use any biometric AI systems
• Create standardized notices for job applicants about AI use in video interviews
• Develop consent forms that meet Illinois requirements
• Establish internal procedures for handling deletion requests

Step 4: Implement Notice and Consent Processes (2–4 hours)

• Add AI disclosure language to job postings and application processes
• Create a workflow for obtaining written consent before AI-analyzed video interviews
• Update your website to include your biometric data policy (if applicable)
• Train hiring managers on new requirements

Step 5: Train Your Team (1–2 hours)

• Educate employees who conduct hiring about the AI Video Interview Act
• Train anyone with access to biometric systems about BIPA requirements
• Create simple reference guides for day-to-day compliance

Step 6: Establish Ongoing Compliance Procedures (Ongoing)

• Set calendar reminders to review AI tools annually
• Monitor for changes in Illinois AI regulations
• Maintain records of consent and notices provided
• Regularly audit vendor compliance

Step 7: Document Everything

• Keep records of all notices sent to applicants
• Store signed consent forms
• Document when and how biometric data is destroyed
• Maintain an updated inventory of AI tools and their compliance status

Penalties and Enforcement: What's at Stake

Illinois takes AI compliance seriously, and the penalties for violations can be substantial—especially under BIPA.

BIPA Penalties

For violations of BIPA, individuals can recover:

• $1,000 per negligent violation or actual damages, whichever is greater
• $5,000 per intentional or reckless violation or actual damages, whichever is greater
• Reasonable attorneys' fees and costs

Because BIPA allows private lawsuits, businesses have faced class action claims with settlement amounts ranging from hundreds of thousands to hundreds of millions of dollars. Notable cases include:

• A major tech company settling a facial recognition class action for $650 million
• Multiple companies paying $50 million+ for biometric time clock violations
• Regional businesses settling for $200,000–$500,000 over fingerprint scanner use

The statute of limitations is five years for BIPA violations, and each instance of collecting or using biometric data without proper consent can potentially constitute a separate violation.

AI Video Interview Act Penalties

The Illinois Attorney General enforces the AI Video Interview Act. Violations can result in:

• Investigation and enforcement action by the Attorney General's office
• Civil penalties for non-compliance
• Required changes to business practices
• Potential civil lawsuits from affected applicants

While the AI Video Interview Act is newer and hasn't generated the same volume of enforcement actions as BIPA, the Illinois Attorney General's office has indicated that AI regulation enforcement is a priority.

Practical Risk Assessment

For small businesses, the realistic risks include:

• Employee lawsuits: Current or former employees discovering biometric data collection without proper consent
• Applicant complaints: Job candidates reporting lack of proper AI disclosures to the Attorney General
• Class action exposure: Particularly if you've used biometric systems for multiple employees over several years
• Regulatory attention: Increased enforcement as Illinois continues to prioritize AI regulation

Even if you believe you have a defensible position, the cost of litigation defense alone can be devastating for a small business. For a detailed look at what compliance actually costs, see our guide on AI compliance costs for small businesses. Compliance is almost always more cost-effective than fighting a BIPA lawsuit.

How Illinois Compares to Other States

Illinois's approach to AI regulation is notably more specific and aggressive than most states, putting it in the company of jurisdictions like Colorado and California that have taken early action on AI governance.

States with Similar AI-Specific Laws

As of February 2026, only a handful of states have passed specific AI employment laws:

• California has regulations around automated decision-making tools in employment
• Colorado requires transparency about AI use in employment decisions
• New York City has local laws requiring bias audits for automated employment decision tools
• Maryland passed legislation similar to Illinois regarding AI in hiring

Neighboring Midwest states like Ohio and Indiana are closely watching Illinois's enforcement patterns as they consider their own AI legislation.

States with Strong Biometric Privacy Laws

Illinois's BIPA remains the strongest biometric privacy law in the country, but other states have followed:

• Texas has a biometric privacy law but without private right of action
• Washington has biometric privacy protections with different enforcement mechanisms
• California includes biometric information under CCPA protections

What Makes Illinois Different

Several factors make Illinois's approach particularly impactful for small businesses:

1. Private right of action: Unlike most states, Illinois allows individuals to sue directly for BIPA violations without needing a government agency to act first
2. Established enforcement history: Courts have consistently ruled in favor of plaintiffs in BIPA cases, creating a robust body of case law
3. Specific, actionable requirements: The AI Video Interview Act provides clear, specific obligations rather than vague principles
4. No business size exemptions: These laws apply equally to businesses of all sizes

The Broader Trend

Illinois is leading a national trend toward AI-specific regulation. Several states are considering comprehensive AI bills, and federal AI legislation is under discussion. Small businesses should expect AI compliance requirements to increase, not decrease, in coming years.

Operating in compliance with Illinois law will likely position your business well for regulations that emerge in other states and at the federal level.

What to Do Right Now: Practical Next Steps

Understanding Illinois AI compliance is important, but taking action is what protects your business. Here's what you should do today:

Immediate Actions (This Week)

1. Identify your highest-risk AI uses. Look specifically at:

• Any video interviewing platforms with AI features
• Biometric time clocks or access control systems
• Facial recognition for any purpose

2. Stop using non-compliant AI immediately. If you're using AI video interviewing or biometric systems without proper notices and consent, pause those practices until you can implement compliant processes.

3. Contact your AI vendors. Reach out to ask about Illinois compliance features and support. Many enterprise software vendors have Illinois-specific compliance modules.

Short-Term Actions (This Month)

1. Create essential compliance documents. You need:

• A biometric data retention and destruction policy (if using any biometric AI)
• Job applicant notices about AI video interview use
• Consent forms that meet Illinois requirements

2. Review and update your hiring process. Build compliance steps into your recruitment workflow so every applicant receives proper notice and provides proper consent.

3. Conduct employee training. Make sure everyone involved in hiring or managing biometric systems understands the requirements.

Ongoing Actions

1. Monitor regulatory developments. Illinois continues to consider additional AI legislation. Stay informed about changes.

2. Audit your AI tools annually. Technology changes rapidly. Review your AI tool inventory at least once per year.

3. Maintain compliance documentation. Keep organized records of notices, consents, and your compliance efforts.

Getting Help with Compliance Documentation

Creating compliant policies and notices from scratch can be time-consuming and legally complex. You need documents that specifically address Illinois requirements while remaining practical for your business operations.

Attestly helps Illinois small businesses generate customized AI compliance documents in minutes, not days. The platform creates policies, notices, and consent forms tailored to your specific AI tools and business needs, ensuring you meet Illinois's unique requirements without hiring expensive legal counsel.

Whether you need a BIPA-compliant biometric data policy, applicant notices for AI video interviews, or a comprehensive AI use policy that addresses your full technology stack, having the right documentation in place is your first line of defense.

Frequently Asked Questions

The Bottom Line on Illinois AI Compliance

Illinois has established itself as one of the most stringent states for AI regulation, particularly around employment and biometric data. For small businesses, this creates real compliance obligations that cannot be ignored.

The good news is that compliance is achievable with the right information and tools. By understanding which laws apply to your business, taking inventory of your AI use, implementing proper notices and consent processes, and maintaining good documentation, you can use AI tools confidently while meeting your legal obligations.

The risk of non-compliance—particularly under BIPA—is significant enough that every Illinois business using AI should prioritize getting compliant now. With class action exposure potentially reaching hundreds of thousands or millions of dollars, the relatively small investment in compliance makes strong business sense.

Start with the practical checklist in this guide, focus first on your highest-risk AI uses, and build compliance into your regular business processes. Illinois's AI laws are here to stay and will likely become the model for other states, making your compliance efforts today an investment in long-term business stability.