Illinois AI Legislation in 2026

The Illinois Picture

Illinois sits in a category of its own among US states on AI governance, and the reason is lineage. Long before AI governance became a boardroom phrase, Illinois had already built the most consequential biometric privacy regime in the country through BIPA, a statute whose private right of action and per-violation damages reshaped how every facial-recognition, voiceprint, and fingerprint vendor operates nationwide. The 2024 SB 2979 amendment cooled the most extreme litigation exposure by collapsing repeat scans into a single recoverable violation, but it did not retreat from the underlying principle that individuals own their biometric identity and that consent must be explicit. I read this as the cultural foundation for everything Illinois is now doing in AI. The state legislates from a settled premise that automated systems touching people require notice, consent, and accountability.

What makes Illinois distinctive in 2026 is that it has paired that biometric legacy with the most aggressive employment-AI mandate in the country. HB 3773, now effective, reaches unintentional disparate impact, meaning an employer can violate the Human Rights Act even with a facially neutral hiring tool if the outcomes skew against a protected class. The explicit ban on using zip code as a proxy is a direct signal to vendors that removing the protected field is not a defense. For any business deploying resume screeners, video-interview scoring, or predictive promotion tools, Illinois is now the jurisdiction where the legal theory and the enforcement infrastructure both exist. The fact that the implementing rules are still in rulemaking as of June 2026 does not pause the obligation. The statute is live, and the prudent posture is to comply with the statutory text now.

The second distinctive vector is sector-specific prohibition, exemplified by the WOPR Act. Illinois did not write a vague principle about AI in healthcare. It drew a hard line that licensed humans must own therapeutic decisions and that AI is confined to administrative and supplementary roles, backed by Department of Financial and Professional Regulation enforcement and per-violation fines. This is the template I expect Illinois to repeat. Rather than one omnibus AI law, the state is stacking targeted statutes by domain, employment, mental health, biometrics, and soon frontier-model safety through SB 315. For builders, this means there is no single Illinois AI compliance checkbox. Obligations attach to what your system does and to whom, not to whether you call it AI.

For businesses and builders, my guidance is concrete. First, inventory every system that influences employment decisions and stand up applicant and employee notice plus bias auditing immediately, because HB 3773 is already enforceable. Second, if you operate any consumer-facing mental health, wellness, or chatbot product touching Illinois residents, assume the WOPR Act applies and architect a licensed professional into the loop. Third, maintain BIPA-grade consent discipline for any biometric capture, with electronic consent now explicitly valid. Fourth, watch SB 315. If signed as expected, large frontier developers face audit and transparency duties phasing in through 2028, and downstream deployers should anticipate diligence demands from those providers.