Pasting Resumes Into a Chatbot Is a Regulated Employment Decision

What rule does this break?

Two of them, and neither is a rule about chatbots. Since January 1, 2026 the Illinois Human Rights Act has made it a civil rights violation to use AI with the effect of discriminating in recruitment or hiring, and separately to fail to notify an employee that AI is being used for those purposes ¹. Its definition of artificial intelligence covers a machine-based system generating recommendations that can influence an outcome, and expressly includes generative AI ¹.

The notice clause has a gap the discrimination clause does not. It runs to an employee, and Article 2 of that Act defines an employee as someone performing services for remuneration, an apprentice, or an applicant for an apprenticeship ¹. Whether an ordinary job applicant is owed notice is left to Illinois Department of Human Rights rulemaking, which the statute also hands the timing, circumstances and means of notice ¹. The discrimination clause names recruitment and hiring outright, so it reaches the resume pile either way.

California reaches the same activity from a different direction. Its amended employment regulations, effective October 1, 2025 and binding on California employers with five or more employees, define an automated-decision system as a computational process that makes or facilitates a decision about an employment benefit, and they name screening resumes for particular terms or patterns as an example ²⁵. Facilitates is the operative word: a tool that only advises a human is still inside the definition.

Then comes the part that costs money rather than embarrassment. The same amendments extended the employment-records retention period from two years to four and stated expressly that automated-decision-system data is included ². The four years run from the record's creation or the personnel action, whichever is later ². A chat transcript in a personal account is that data, held somewhere your company cannot reach, under a retention setting nobody chose.

The near miss belongs to New York City. Its rule attaches where a tool substantially assists or replaces discretionary decision-making, and an employer that decides its tool merely informs a human reviewer takes itself out of scope ³. That argument is available to you. It is not available to a manager who never told anyone, because there is no record of what the tool did or how much weight it carried.

Why is the bias warning the wrong worry?

Visible risk is the manageable kind. A careful reader who knows the model can be wrong reads the output sceptically, checks the ones that matter, and catches most of it. Nobody catches a missing record. The procedural failure leaves no symptom at the moment it happens and produces its consequence eighteen months later, in writing, to somebody else.

The quality warning has one measured version. In a Harvard Business School field experiment with Boston Consulting Group consultants, on one task deliberately chosen to sit outside the model's capability, those using a 2023 model were on average 19 percentage points less likely to reach the correct answer than the control group ⁴. That is one task and one sample on a model that is no longer current, and the finding is not that AI makes people worse. It is that people could not tell which side of the capability line the task was on.

Resume comparison sits close to that line. It has the shape of summarisation, which models handle well. What it demands is inference about a person from thin evidence, which they handle confidently and badly. The failure mode is a plausible ranking of candidates on a criterion the model invented, which reads exactly like a plausible ranking on the criterion you meant.

Notice the same mistake running the other way through the funnel: managers rejecting applicants for sounding like a machine wrote their resume. If that is happening in your process too, how to stop managers rejecting candidates for sounding like AI covers the other half of it.

Write the criteria first, then run it somewhere the company controls

Two fixes, both free, and the first one carries most of the weight. Write the evaluation criteria down before you open the tool, and apply the same ones to every candidate in the pool. Then do the work inside an account your organisation administers, so the inputs and outputs land in a place a records request can reach.

The first fix changes what the artefact is. If the criteria exist in a document, the transcript becomes working notes about criteria you can produce and defend. If they do not, the transcript is the only evidence of how the decision was made, and it says whatever the model happened to emphasise that evening. The order matters more than the wording: criteria written afterwards to match an outcome are worth nothing and read as exactly that.

The second fix changes where the data lives. A company workspace is where three things become settings somebody is accountable for: whether the content trains a model, how long the history is kept, and who can export it. A personal account gives you none of those levers and no way to check which way they are set. This is also the moment to check whether the tools already in your stack are doing the same thing quietly, which is the question behind whether your ATS counts as AI.

Three smaller habits close most of what remains:

• Paste the same fields for every candidate, decided before you open the first PDF.
• Ask the model to apply your written criteria and quote the line it relied on, then read that line yourself.
• Keep the shortlist decision in your own words, in the ATS, so the human judgment is the record.

A controlled workflow does not make the resume screen good. It makes it defensible, which is a different and smaller claim. The deeper problem, that every resume now reads well, is worked through in what is actually left to screen on.

What if a chatbot has already been part of a live requisition?

Tell HR and counsel, and do not delete the chat. Deleting it converts a compliance gap you can explain into a records problem you cannot, and the transcript is the only evidence of what actually happened. Preserve it, export it if you can, and let the people whose job this is decide what the requisition needs.

Then work out what is owed going forward. If the pipeline included candidates in a jurisdiction with a notice duty, a late notice still beats none, and giving it now is better in every direction. The content and the timing are laid out in what your AI notice has to say and when.

Expect the harder question to come from a candidate before any regulator asks. Someone rejected during that stretch may ask how the decision was made, and the honest answer involves a tool nobody disclosed. That conversation is survivable and it has a shape: what a rejected candidate is owed when AI was involved.

Finally, write the clause that would have prevented it. Most AI hiring policies govern purchased tools and say nothing about the browser tab, which is why the browser tab is where the exposure accumulated. The full set of clauses and the sign-off question sits in what actually belongs in an AI hiring policy. Make the manager case the first paragraph rather than an appendix.

See a sample report >