Agency Liability under HB 3773: Why the Employer Is Strictly Liable for AI Used by Recruiters and Staffing Firms

The short answer

HB 3773 applies to AI in the employment decision chain regardless of who operates the AI. If a recruiting agency, staffing firm, RPO, MSP, or background-check provider uses AI to screen candidates on the employer's behalf, the employer remains strictly liable for the discriminatory effects of that AI. The agency relationship does not shield the employer. It adds a layer that has to be documented.

This question is going to be asked at every HB 3773 sales conversation, every IDHR charge, every EPLI renewal, and every D&O underwriter intake call. The published answer matters because most employers have not audited their agency relationships against the framework, and the strict-liability standard means there is no opportunity to build the documentary record after a charge is filed.

The doctrinal basis

Three threads converge here.

The IHRA's existing agent-liability framework. Under the Illinois Human Rights Act, employers have long been responsible for the discriminatory acts of those acting on the employer's behalf. This is not new. It is how Title VII works at the federal level under Burlington Industries, Inc. v. Ellerth, 524 U.S. 742 (1998), and Faragher v. City of Boca Raton, 524 U.S. 775 (1998), how the IHRA has always operated, and how the Restatement (Third) of Agency allocates responsibility between principal and agent. A recruiter screening candidates is an agent. The employer is the principal. Discriminatory acts by the agent attach to the employer.

HB 3773's statutory definition is broad. The statute, codified at 775 ILCS 5/2-102(L), makes it a civil rights violation for an employer to use artificial intelligence in covered employment decisions in a manner that has a discriminatory effect. "Use" doesn't require direct operation. An employer who delegates screening to an agency that uses AI is still using AI for the statute's purposes. The decision is the employer's; the discrimination flows through to the employer.

The strict-liability framework eliminates the most common defense. Without intent as a defense, the employer cannot argue "we didn't know the agency was using AI" or "we didn't approve the specific model." If the agency-driven AI produced a discriminatory effect on hiring outcomes, the employer is liable. Knowledge isn't required. Authorization isn't required. Good-faith reliance on the agency's representations is not a complete defense. The employer chose to delegate; the consequences of the delegation attach.

The IDHR's draft Subpart J rules reinforce this reading by extending the obligations to employers and to their "agents" — including recruiters and third parties acting on the employer's behalf — for notice, recordkeeping, and disparate-impact testing.

The operational implications

This changes vendor diligence in three concrete ways.

The diligence chain is now multi-layered. An employer using a recruiting agency that uses an AI hiring tool has two layers to document: the agency relationship and the underlying AI vendor. Both contracts need representations on HB 3773 compliance. Both relationships need disparate-impact testing documentation. Both need notice-architecture provisions and audit access. The employer's documentary obligation is not satisfied by diligence on the agency alone; it must reach through the agency to the AI vendor underneath.

Notice obligations get more complex. The employer is responsible for ensuring candidates receive HB 3773-required notice. If the agency is the candidate-facing party in the relevant decision, the notice has to either come from the agency (with the employer ensuring it is delivered in the required form on the required schedule, with documentation made available on audit) or from the employer directly. This needs to be specified in the agency contract, not assumed.

Indemnification doesn't shift regulatory exposure. A well-drafted indemnification clause in the agency contract may shift financial exposure — if the employer is sued, the agency pays. But the IDHR investigates the employer regardless of who indemnifies whom. The compliance posture, the notice deployment, and the documented record are still the employer's responsibility. An adverse IDHR finding against the employer creates the documentary precedent that is then available in subsequent administrative or civil proceedings against the employer; the agency's indemnification of the financial exposure does not undo the precedent.

And one more, often missed: staffing agencies frequently have their own IHRA exposure. Many staffing firms are themselves "employment agencies" under the IHRA at 775 ILCS 5/2-101(C) and have independent compliance obligations. The employer and the agency may both be respondents in an IDHR charge for the same AI-driven decision. The dual-respondent posture is the rule, not the exception, and it has operational implications for the contracting architecture — the parties' substantive compliance interests align (both benefit from testing, notice, and documentation), while their financial interests may diverge on indemnification and cost-of-defense allocation.

What HR leaders should be doing

Three practical moves.

Map the agency relationships. Most mid-market Illinois employers have between six and twelve external relationships that touch covered employment decisions — recruiting firms, staffing agencies, RPOs, MSPs, background-check providers, AI video interview platforms, skills-assessment vendors, scheduling and workforce- management platforms. Cataloging the relationships is the first operational deliverable. The map should include the agency name, the covered decisions the agency's services touch, the AI tools the agency uses, and the current contract language on HB 3773.

Extend the vendor questionnaire to the agency layer. If you have already deployed a vendor questionnaire to your direct AI hiring vendors, the parallel exercise is to send the questionnaire to the agencies whose hiring services use AI on your behalf. The questionnaire surfaces the agency's AI inventory, the testing the agency has performed, the notice architecture, and the agency's compliance owner.

Amend the contracts. The HB 3773 provisions belong in the agency contracts at five points: representations and warranties on AI use, notice-delegation language, information-sharing and audit rights, indemnification (drafted with the recognition that it shifts financial exposure but not regulatory exposure), and termination plus records-survival obligations. These are not boilerplate. They are the operational specification for the compliance system the contract documents.

Why this distinguishes a real compliance posture

This is one of the questions that distinguishes a real compliance posture from a generic one. Most employers think the question is "do we use AI?" — meaning their internal HR tech. The real question is "is AI anywhere in our employment decision chain?" — which extends to recruiting agencies, background-check providers, video-interview platforms, scheduling tools, and any vendor whose output influences a covered decision.

When a candidate or employee files an IDHR charge against an Illinois employer for an AI-driven adverse action, the IDHR's investigative posture will not stop at the employer's internal HR systems. It will reach the agency's processes. It will reach the AI vendor underneath the agency. The documentary record will be requested at every layer. The employer's response on each request shapes the disposition.

The employer that has done the work — the agency exposure map, the diligence questionnaire, the contract amendments, the testing program, the documentation — is the employer that produces the favorable factual record. The employer that has not done the work is the employer that scrambles after the charge is filed, with no agency- level documentary record and a strict-liability framework that has already eliminated the most common defense.

One important caveat

Everything above reflects the structure of the statute, the agent- liability framework that supports it, and the IDHR's apparent direction in the draft Subpart J rules. The specifics of how the IDHR will enforce against employers versus agents — and the contours of the indemnification doctrine as applied to AI-driven decisions specifically — will develop through enforcement actions and case law over the next one to three years. Counsel should be consulted on specific employer-agency relationships.

The operational answer for HR leaders, however, is unambiguous: assume the exposure flows to the employer, document the agency relationships, extend the diligence chain.

The full operational treatment — six chapters, ~10,000 words, with the contracting architecture set out in detail, the dual-respondent dynamic addressed, and a ninety-day diligence plan plus a before- signing checklist — is available in the Agency Liability under HB 3773 briefing. Companion to the AI Hiring Vendor Questionnaire (outbound to vendors) and the HR Readiness Checklist (inward, for the HR team).