Illinois — Employment AI (AIVIA 820 ILCS 42 + HB 3773) + Insurance AI (IDOI Company Bulletin 2024-08; algorithmic utilization review, 215 ILCS 134): AI Compliance Requirements

Notify applicants before using AI to evaluate video interviews and obtain consent.

If using any AI tool that substantially assists in employment decisions (screening, ranking, scoring) for Illinois positions: notify candidates before use, explain what the AI evaluates, identify what characteristics are assessed, and explain the candidate's ability to request accommodation. [R495 CORRECTION 2026-08-22: removed a "notice must be provided at least 3 days before" timing claim — could not verify a fixed 3-day pre-notice window in any primary or law-firm source this cycle; IDHR's implementing rules (Subpart J) were proposed 2026-05-15 and then withdrawn 2026-06-02, so the timing/means-of-notice detail is not yet settled by rule. Left unset rather than guessing a number.]

Illinois adopted the NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers as Company Bulletin 2024-08, issued March 13, 2024 by Director of Insurance Dana Popish Severinghaus and addressed to "All Insurers and Regulated Entities Licensed to Do Business in Illinois". Every such entity is expected to develop, implement and maintain a written program (an "AIS Program") for the responsible use of AI Systems that make or support decisions related to regulated insurance practices, designed to mitigate the risk of Adverse Consumer Outcomes. The AIS Program should address governance, risk management controls and internal audit functions, and should vest responsibility for its development, implementation, monitoring and oversight — and for setting the insurer's AI System strategy — with senior management accountable to the board or an appropriate committee of the board. It should be tailored to and proportionate with the insurer's use of and reliance on AI, with the scope of controls for any given use case aligned to the Degree of Potential Harm to Consumers for that use case. It should cover the whole insurance life cycle (product development and design, marketing, use, underwriting, rating and pricing, case management, claim administration and payment, and fraud detection) and every phase of an AI System's own life cycle (design, development, validation, implementation of both systems and business, use, on-going monitoring, updating and retirement), and it should cover AI Systems used for regulated insurance practices whether developed by the insurer or by a third-party vendor. It may be independent of, or part of, the insurer's existing Enterprise Risk Management programme, and may adopt, incorporate or rely on a framework or standards developed by an official third-party standard organisation such as the NIST Artificial Intelligence Risk Management Framework. Governance should prioritise transparency, fairness and accountability while protecting proprietary and trade-secret information, and should address the AI System governance accountability structure — centralised, federated or otherwise constituted committees drawn from business units, product specialists, actuarial, data science and analytics, underwriting, claims, compliance and legal; scope of responsibility, chains of command and decisional hierarchies; the independence of decision-makers and lines of defence at successive life-cycle stages; monitoring, auditing, escalation and reporting protocols; and ongoing training and supervision of personnel.

The AIS Program should document the insurer's risk identification, mitigation and management framework and internal controls for AI Systems generally and at each stage of the AI System life cycle, addressing: the oversight and approval process for the development, adoption or acquisition of AI Systems and the identification of constraints and controls on automation and design to align and balance function with risk; data practices and accountability procedures including data currency, lineage, quality, integrity, bias analysis and minimisation, and suitability; management and oversight of Predictive Models (including the algorithms used within them) covering inventories and descriptions of the models, detailed documentation of their development and use, and assessments such as interpretability, repeatability, robustness, regular tuning, reproducibility, traceability, Model Drift and the auditability of those measurements where appropriate; validating, testing and retesting as necessary to assess the generalisation of AI System outputs upon implementation, including the suitability of the data used to develop, train, validate and audit the model — validation may compare model performance on unseen data available at the time of model development against performance observed post-implementation, measure performance against expert review, or use other methods; the protection of non-public information, particularly consumer information, including unauthorised access to the Predictive Models themselves; and data and record retention. Governance must separately address, specifically for Predictive Models, the insurer's processes and procedures for designing, developing, verifying, deploying, using, updating and monitoring them, including a description of the methods used to detect and address errors, performance issues, outliers, or unfair discrimination in the insurance practices resulting from the use of the Predictive Model, together with a narrative description of the model's intended goals and objectives and how it is developed and validated to ensure the AI Systems relying on it correctly and efficiently predict or implement those goals. The bulletin fixes the substantive standard the models must meet: decisions made by insurers using AI Systems must not be inaccurate, arbitrary, capricious, or unfairly discriminatory, and compliance with that standard is required regardless of the tools and methods used to make the decision.

The Department's regulatory oversight of insurers includes oversight of an insurer's conduct in the state, including its use of AI Systems to make or support decisions that impact consumers. Regardless of the existence or scope of a written AIS Program, an insurer can expect to be asked, in the context of an investigation or market conduct action, about its development, deployment and use of AI Systems, or any specific Predictive Model, AI System or application and its outcomes (including Adverse Consumer Outcomes), as well as any other information or documentation the Department deems relevant. Insurers should expect requests for: the written AIS Program itself; documentation evidencing its adoption; the scope of the program, including any AI Systems and technologies NOT included in or addressed by it; how the program is tailored to and proportionate with the insurer's use and reliance on AI Systems, the risk of Adverse Consumer Outcomes and the Degree of Potential Harm to Consumers; the policies, procedures, guidance and training materials relating to its adoption, implementation, maintenance, monitoring and oversight, including processes for the development, adoption or acquisition of AI Systems (identification of constraints and controls on automation and design; data governance and controls covering data lineage, quality, integrity, bias analysis and minimisation, suitability and Data Currency), processes for the management and oversight of Predictive Models including the measurements, standards or thresholds adopted or used in model development, validation and oversight, and the protection of non-public consumer information including unauthorised access to the Predictive Models themselves; pre-acquisition and pre-use diligence, monitoring, oversight and auditing of third-party data or AI Systems; documentation evidencing the formation and ongoing operation of the insurer's coordinating bodies for AI System development, use and oversight; inventories and descriptions of Predictive Models and AI Systems used to make or support decisions that can result in Adverse Consumer Outcomes; for any specific model under examination, documentation of compliance with the applicable AI Program policies, protocols and procedures, information about the data used in its development and oversight (source, provenance, lineage, quality, integrity, bias analysis and minimisation, suitability and Data Currency), and information on the techniques, measurements, thresholds and similar controls used; and documentation of validation, testing and auditing including evaluation of Model Drift, with the nature of that validation reflecting whether the underlying AI System is based on Predictive Models or on Generative AI. Where third parties are involved, the Department will additionally request the due diligence conducted on them, the contracts with third-party AI System, model or data vendors (including terms on representations and warranties, data security and privacy, data sourcing, intellectual property rights, confidentiality and disclosures, and cooperation with regulators), audits or confirmation processes performed on third-party compliance, and Model Drift validation documentation.

This is a STATUTORY duty, not a bulletin expectation, and it is the sharpest AI constraint in Illinois insurance law. Public Act 103-0650 (HB 5395, the Healthcare Protection Act) amended the Managed Care Reform and Patient Rights Act so that "utilization review" expressly includes any evaluation based on an algorithmic automated process — using AI does not move the activity outside the regime. Even where a health care plan or other utilization review program uses an algorithmic automated process in the course of utilization review for medical necessity, the plan or program must ensure that ONLY A CLINICAL PEER makes any adverse determination based on medical necessity, and that any subsequent appeal is processed as required, including the restriction that only a clinical peer may review an appeal. An automated process may certify medical necessity, or refer a case to a clinical peer — it may not deny. Programs that use algorithmic automated processes to decide whether to render adverse determinations based on medical necessity must use objective, evidence-based criteria compliant with the accreditation requirements of the Health Utilization Management Standards of URAC or of the National Committee for Quality Assurance, and licensed physicians with relevant board certifications must establish all criteria the algorithmic automated process uses and verify that the process yields results consistent with the criteria for their certified field. "Clinical peer" is defined by the Act as a health care professional in the same profession and the same or similar specialty as the health care provider who typically manages the medical condition, procedure or treatment under review.

Delete collected interview videos and AI analysis data within 30 days upon request.

Do not share applicant video interviews with anyone except persons whose expertise or technology is necessary in order to evaluate the applicant's fitness for the position (820 ILCS 42/10). The statute states no other exception — there is no marketing, model-training, analytics, or general-vendor carve-out — so any onward disclosure of interview video to a recipient outside that necessity test violates the Act.

AIVIA reporting (820 ILCS 42/20): an employer that relies SOLELY on an AI analysis of a video interview to decide whether to advance an applicant to an in-person interview must collect each applicant's race and ethnicity and report it to the Illinois Department of Commerce and Economic Opportunity (DCEO) annually by December 31; DCEO analyzes the data for racial bias and reports to the Governor and General Assembly by July 1. Separately, HB 3773 (amending the Illinois Human Rights Act, 775 ILCS 5/2-102) is IN FORCE since January 1, 2026: using AI in employment in a way that produces a discriminatory effect on a protected class is unlawful discrimination under a strict-liability standard (discriminatory intent is not required), and using zip codes as a proxy for protected classes is prohibited. The Illinois Department of Human Rights (IDHR) published draft implementing rules (Subpart J, "Use of Artificial Intelligence in Employment") on 2026-05-15, then WITHDREW them on 2026-06-02 and postponed the scheduled hearing; as of this cycle no revised rules have been published, but the statutory notice and anti-discrimination duties are already in force independent of the rulemaking. [R169 CORRECTION 2026-06-08, and R495 (2026-08-22) refreshed the rulemaking-status sentence: Sources: 820 ILCS 42/20 (ilga.gov/Justia); Hinshaw, Ogletree & Seyfarth analyses of HB 3773 / IDHR Subpart J; the withdrawal date is web-verified this cycle.]

Each AIS Program should address the insurer's process for acquiring, using, or relying on (i) third-party data to develop AI Systems and (ii) AI Systems developed by a third party, including as appropriate the establishment of standards, policies, procedures and protocols for: due diligence and the methods employed by the insurer to assess the third party and its data or AI Systems acquired from the third party, to ensure that decisions made or supported by such AI Systems that could lead to Adverse Consumer Outcomes will meet the legal standards imposed on the insurer itself; the inclusion, where appropriate and available, of contract terms with third parties that provide audit rights and/or entitle the insurer to receive audit reports by qualified auditing entities, and that require the third party to cooperate with the insurer with regard to regulatory inquiries and investigations related to the insurer's use of the third party's product or services; and the performance of those contractual rights regarding audits and/or other activities to confirm the third party's compliance with contractual and, where applicable, regulatory requirements. The AIS Program must in any event address AI Systems used with respect to regulated insurance practices whether developed by the insurer or by a third-party vendor — buying the model does not move it outside the program. "Third Party" is defined in the bulletin as an organization other than the insurer that provides services, data, or other resources related to AI.

The AIS Program should include processes and procedures providing notice to impacted consumers that AI Systems are in use, and providing access to appropriate levels of information based on the phase of the insurance life cycle in which the AI Systems are being used. This sits alongside the bulletin's treatment of transparency and explainability of outcomes to the impacted consumer as one of the five factors that determine how extensive an insurer's AI controls must be, and alongside the governance requirement that the framework prioritise transparency, fairness and accountability in the design and implementation of AI Systems while recognising that proprietary and trade secret information must be protected.

HB 3773 (2024 expansion, 775 ILCS 5/2-102) does NOT create a freestanding consent requirement — it is a notice/disclosure duty (see il_ai_employment_notice_2024). This entry is retained to record that correction and to flag the distinction for anyone tracking employer obligations: do not treat HB 3773 as adding a second, AI-specific consent form on top of the notice — only the original 2020 AIVIA video-interview provision (820 ILCS 42/10) requires affirmative applicant consent, and only for video-interview AI analysis specifically.