A mid-sized manufacturer in the western suburbs posts an open operations role in the fall of 2025. Four hundred and sixty applications come in. HR uses an AI screening tool to rank candidates by fit score before any human touches the stack. By December, they've hired from the top of the list and closed the requisition.
In April 2026, an IDHR complaint arrives. A rejected candidate says the AI scoring tool filtered her out based on national origin. She's citing Illinois HB 3773, which took effect January 1, 2026.
The HR director calls the broker. The company has EPLI. It covers discrimination claims. This is a discrimination claim. It should be fine.
Maybe. And that "maybe" is exactly what this article is about.
What HB 3773 actually requires
The law puts obligations on two groups: Illinois employers who use AI in hiring decisions, and the vendors who sell them those tools. Both are in scope. Both can be liable.
If your company uses AI to screen, score, rank, or evaluate job applicants, here's what the statute requires:
- **Notify candidates** that AI is being used in the evaluation and name the specific vendor whose tool you're using
- **Disclose** what characteristics the AI is assessing
- **Maintain records** of how the AI was used and what it evaluated for four years after each hiring decision
- **Make testing results** from the AI vendor available to the IDHR on request
None of those requirements depend on your intent. HB 3773 is a strict liability statute. That means you can be found to have violated it even if you didn't know the AI was producing biased outcomes, even if you never reviewed an individual candidate score, even if you outsourced the entire screening process to a vendor.
The IDHR is the enforcement body. They investigate complaints, conduct audits, and can refer cases to the Illinois Attorney General for civil enforcement. There's no minimum employer size in the statute. A three-person office that uses an AI resume tool is in scope.
Why strict liability is the EPLI problem
Standard EPLI was designed around human conduct. A manager made a biased hiring decision. HR screened out applicants because of their age. A supervisor created a hostile work environment. Classic employment discrimination is something a person did, which means it's something your EPLI's insuring agreement can recognize.
Strict liability changes that framing in ways most EPLI forms weren't written to handle.
Under HB 3773, the violation can occur without any discriminatory act by a covered person. The AI produced a biased outcome. That's the violation. You deployed the AI. That's the connection. Whether your EPLI insuring agreement covers a strict liability regulatory violation produced by a tool you licensed from a third party is a genuinely open question, and the answer varies by policy form.
Most EPLI insuring agreements cover "wrongful employment practices" or "discriminatory employment acts." Those phrases usually carry definitions. If the form defines a discriminatory act as requiring an intentional or negligent decision by an insured person (an employee or officer of the company), then a strict liability outcome driven by an AI vendor's algorithm may not fit the definition. The insuring agreement was written for human mistakes. The claim is about a software output.
Some EPLI underwriters will argue they cover it anyway. Others won't. And you typically find out which side your carrier is on after the complaint lands.
The regulatory defense gap
IDHR enforcement doesn't start with a lawsuit. It starts with an investigation.
An employee or job applicant files a complaint. The IDHR opens an investigation, requests records, interviews witnesses, and works through a process that can take six to eighteen months before anyone files anything in court. That investigation phase, if you need outside counsel to manage it (and you should), costs $25,000 to $75,000 in legal fees before a single brief is filed.
Some EPLI forms cover administrative and regulatory proceedings, including defense costs for IDHR investigations. Many don't. Some only kick in when a civil lawsuit is filed. If your EPLI form is in that second group, you're self-funding the regulatory defense phase entirely.
This is a common EPLI gap even for traditional discrimination claims. It's a sharper one for HB 3773 claims, because the statute is new and the IDHR is actively developing enforcement practice under it. That means investigations are more likely to go long, and legal fees in the regulatory phase are going to be significant.
The vendor side of the exposure
The statute cuts twice. If you're an Illinois company that builds or sells AI hiring tools, you're in scope as a vendor.
HB 3773 creates liability for vendors whose tools produce discriminatory outcomes in employment decisions. An HR tech company, a staffing platform, or an AI assessment provider whose product is used by Illinois employers can be named in an IDHR complaint or a civil action. The theory is that the vendor was part of the causal chain that produced the discriminatory result.
Standard E&O policies cover professional errors and omissions. A regulatory claim under a strict liability employment law isn't quite the same category as a client saying your software had a bug. Whether your E&O carrier agrees it's an E&O claim, rather than an employment discrimination claim, matters a lot for whether defense costs flow. If your E&O form has any employment-related exclusion, that exclusion may apply to a HB 3773 vendor claim in ways neither party anticipated when the policy was written.
This is the part of the law that HR tech companies headquartered in Chicago or the suburbs are largely underestimating. If your product touches employer hiring decisions in Illinois, the compliance obligations and the liability exposure aren't just your customers' problems.
What to check in your EPLI policy
Pull the declarations and full policy form. Four things matter.
How does the insuring agreement define "wrongful employment practice"? If it requires an intentional or negligent act by a covered person, a strict liability AI outcome may not fall within the definition. Ask your broker to get a written position from the carrier on whether a HB 3773 complaint falls within the insuring agreement before a complaint arrives.
Does the policy cover administrative and regulatory proceedings? IDHR enforcement starts long before any lawsuit. If your form only triggers on civil litigation, you're uninsured for the most expensive phase of an IDHR investigation. That's not a small gap.
Is there an AI exclusion or technology exclusion in the policy? Some EPLI forms added exclusions for AI-related claims in 2025 and into 2026. Others didn't. If your policy renewed after those exclusion filings, it may have one baked in. Check the endorsement schedule specifically for any reference to artificial intelligence, automated decision tools, or algorithmic assessments.
Does the definition of "covered person" reach vendor conduct? If your EPLI covers acts by employees and officers, does it also cover acts taken by vendors you authorized to act on your behalf? An AI vendor operating under your contract is arguably acting as your agent. Whether your EPLI form reaches vendor-driven outcomes isn't something to assume.
The recordkeeping trap
Four years is a long retention window for hiring data. It means records from every AI-assisted evaluation, every candidate score, every posting where the tool was used, and the identity of the vendor and tool version need to be preserved through at least 2030 for decisions being made right now.
Most employers aren't doing this. ATS platforms often default to purging candidate data after six to twelve months, partly because of GDPR-influenced privacy practices. That default directly conflicts with HB 3773's four-year requirement.
If an IDHR complaint lands in 2028 about a 2026 hiring decision and you can't produce the required records, the recordkeeping failure is its own basis for liability. It's a separate violation from whatever happened with the AI output. An otherwise defensible process with missing records can generate liability that a messier process with complete records might not.
Whoever owns your ATS or HR data systems needs to know about the four-year requirement now. Check what's being retained, for how long, and whether the vendor retains the underlying AI evaluation records or just the final application status.
The notice requirement nobody is actually sending
Look at your current job postings. Does any language mention that an AI tool is being used to evaluate applicants? Does anything identify the specific vendor by name?
Most don't. Many employers using AI screening tools copied whatever disclosure the vendor suggested, which usually says something general about "technology tools" or "automated processes." HB 3773 requires identifying the specific vendor. A generic disclosure isn't enough.
This is an easy compliance fix. It's also the kind of documented compliance step that matters when an IDHR complaint arrives. "We had notice in place before this complaint was filed" is a meaningfully different position than "we weren't aware of the requirement."
Where EPLI stands for Illinois employers in 2026
EPLI isn't worthless for HB 3773 claims. If a rejected candidate files a civil lawsuit framing the case as traditional employment discrimination, your EPLI will likely respond with a defense. Whether it pays a settlement depends on your specific form, how the claim is characterized, and whether your carrier takes the position that AI output qualifies as a wrongful act under the insuring agreement.
The harder gap is the regulatory side: IDHR investigations, compliance audits, recordkeeping enforcement. That's where most HB 3773 exposure will actually land first, and that's where many EPLI forms quietly fall short.
Employers running AI tools in hiring need to know which gap they have before a complaint arrives, not after. A 45-minute policy review is significantly cheaper than finding out at claim time that the IDHR phase isn't covered.
If you're an Illinois employer or an HR tech company with questions about HB 3773 coverage, reach out to Jack Ray directly. He handles commercial accounts across the state and can review your current EPLI and E&O program for this specific gap.
Email: jray@lakeshoreriskadvisors.com