Illinois Just Made AI Underwriting a Disparate Impact Problem Again. The Deadline Is June 1, 2027.

1. What Public Act 104-0744 actually does to AI lending decisions

Illinois Public Act 104-0744 makes it a civil rights violation for a financial institution to use criteria or methods that have the effect of subjecting individuals to unlawful discrimination, regardless of whether anyone intended that result. It adds a new subsection (G) to Section 4-102 of the Illinois Human Rights Act covering loans, a parallel subsection (C) to Section 4-103 covering credit cards, and a matching provision at Section 5-102 for public accommodations. If your underwriting model produces different outcomes across protected groups, the model itself becomes something that can be challenged.

Be precise about what that does and does not mean. A disparity is not automatically a violation. Under Section 4-102(G) the criteria or methods are unlawful only if they are not necessary to achieve a substantial, legitimate, nondiscriminatory interest, or if that interest could be served by another practice with a less discriminatory effect. What changes on June 1, 2027 is that a lender with a disparity has to be able to answer both of those questions on the record. Today, in Illinois, it does not.

The Act, which its own Section 1 says “may be referred to as the Civil Rights Safeguard Act,” passed both chambers on June 1, 2026. The House vote was 72 to 38 and the Senate concurred 41 to 14. It was sent to the Governor on June 30, 2026 and approved on July 31, 2026. You can read the full enrolled text on the Illinois General Assembly’s Public Act page.

Two definitional changes do most of the work. First, the Act rewrites the definition of “unlawful discrimination” at Section 1-103(Q) to mean discrimination against a person “whether by purpose or effect.” That phrase now flows through every article of the statute. Second, it adds a new definition at Section 1-103(G-10): “Criteria or methods” include “practices, policies, and groups of practices or policies that may have the effect of subjecting individuals to discrimination prohibited under this Act.”

The words “groups of practices or policies” matter more than anything else in the bill for anyone running automated decisions. A lender can no longer defend each model in isolation if the combined effect of the scorecard, the pricing overlay, and the fraud screen produces a disparity.

2. The effective date is June 1, 2027, and most coverage has it wrong

The effective date of Public Act 104-0744 is June 1, 2027, and three separate authorities say so. The Public Act text page, which is the controlling source, ends with the line “Effective Date: 6/1/2027.” The SB 3777 bill status page records three actions dated 7/31/2026: “Governor Approved,” “Effective Date June 1, 2027,” and “Public Act . . . 104-0744.” And the agency that will enforce it, the Illinois Department of Human Rights, says in its August 13, 2026 announcement of the signing: “The law goes into effect on June 1, 2027.”

Several published law firm alerts say January 1, 2027 instead. Ballard Spahr’s Consumer Finance Monitor piece of August 14, 2026 states that “the amendments to the Act will become effective on January 1, 2027,” and that analysis was syndicated to the National Law Review and elsewhere, which is how the date propagated. If your compliance calendar was built from a January 1 alert, you have five more months than you think.

The constitutional mechanics confirm the primary source. Article IV, Section 10 of the Illinois Constitution provides that “a bill passed after May 31 shall not become effective prior to June 1 of the next calendar year unless the General Assembly by the vote of three-fifths of the members elected to each house provides for an earlier effective date.” You can read the provision on the Legislative Reference Bureau’s Article IV page.

SB 3777 passed both houses on June 1, 2026, which is after May 31. The enrolled text contains no effective date section at all. With no earlier date provided in the Act, the constitutional default applies and the law takes effect June 1, 2027. That is five months later than the date circulating in secondary coverage, and it is the date your remediation calendar should run to.

One practical note on reading Illinois bills. The version of SB 3777 as introduced amended different sections than the version that became law. House Floor Amendment No. 1, adopted June 1, 2026, replaced everything after the enacting clause, dropped two sections the introduced bill would have created, and added Section 4-105. Work from the enrolled text or the Public Act, never the introduced version.

Illinois also did not start here. The IDHR announcement notes that the state had already codified disparate impact protection in housing under Article 3 of the Act through Public Act 103-859. The Civil Rights Safeguard Act extends that approach to financial credit, employment and public accommodations, which is why the credit provisions arrive fitted to an existing enforcement structure rather than as a standalone regime.

3. What the federal government did to disparate impact in 2026

In 2026 the CFPB eliminated the effects test from Regulation B, while HUD proposed changes that would remove or narrow certain disparate impact regulations. Those two things are not at the same stage, and the difference matters: the CFPB action is final and in force, while the HUD actions are still only proposals.

On the credit side, the Consumer Financial Protection Bureau published a final rule amending Regulation B on April 22, 2026, and the rule states plainly that “ECOA does not authorize disparate-impact liability (effects test).” The rule carries Docket No. CFPB-2025-0039 and RIN 3170-AB54, amends 12 CFR Part 1002, and took effect July 21, 2026. The full text is on federalregister.gov, and the CFPB’s own Regulation B page reflects the amended rule.

The Bureau deleted the language in Section 1002.6(a) and its accompanying commentary that had pointed to the legislative history of ECOA as authority for an effects test, reasoning from Loper Bright Enterprises v. Raimondo that statutes have “a single, best meaning” fixed at enactment. Law firm analyses from Venable, Cooley, and Norton Rose Fulbright all reach the same reading, and all flag that the rule also narrowed the discouragement standard and tightened conditions on special purpose credit programs.

HUD has moved in the same direction on housing, in two separate and distinct rulemakings. A notice of proposed rulemaking published January 14, 2026 proposed removing HUD’s Fair Housing Act disparate impact regulations and leaving the question to the courts, with comments due February 13, 2026. A separate supplemental notice published August 10, 2026 under Docket No. FR-6540-P-02 and RIN 2529-AB09 proposes removing disparate impact provisions from HUD’s Title VI regulations. Comments on that one are due October 9, 2026.

Some headlines overstate what HUD has done, so note the status carefully: both documents are proposed rules and neither has been finalized. Four distinct bodies of law are in play here and they do not rise and fall together. ECOA and Regulation B govern credit and no longer carry an effects test. The Fair Housing Act governs housing including mortgage lending, still prohibits discrimination whatever HUD’s regulations say, and still supports disparate impact claims under Texas Department of Housing and Community Affairs v. Inclusive Communities Project, a matter of statutory interpretation an agency rulemaking does not erase. Title VI governs recipients of federal financial assistance, so a lender with no HUD funding is untouched by that proposal while remaining exposed on a mortgage product. The Illinois Human Rights Act is state law and, from June 1, 2027, carries its own effects standard for credit.

The most useful sentence in this entire regulatory episode sits in the CFPB’s own rulemaking record. Summarizing industry comments, the Bureau noted that “because creditors will remain subject to other Federal and State laws imposing disparate-impact liability, creditors will still be obligated to consider the impact of their facially neutral policies and procedures and make appropriate adjustments based on that evaluation.” The agency that removed the federal effects test wrote down, in the same document, that state law would keep the obligation alive.

4. Which lenders Illinois covers, and which it may not

Illinois defines “financial institution” as a closed list of five entity types, and the definition has been sitting in the statute since long before this amendment. Section 4-101(B) of the Illinois Human Rights Act provides that “financial institution” means “any bank, credit union, insurance company, mortgage banking company or savings and loan association which operates or has a place of business in this State.” You can read Article 4 in full through the Illinois Human Rights Act article index.

This is worth stating clearly because the most widely circulated analysis of the new law says the opposite. Ballard Spahr’s alert states that “the Illinois Human Rights Act does not define the term financial institution” and reasons from there that questions may arise about application to nonbank lenders, fintech companies, and marketplace lenders. The definition exists. It is enumerated, it is closed, and Section 4-101 says these definitions are “applicable strictly in the context of this Article.”

The practical consequence runs in a different direction from the published commentary, but it is a scope question rather than an exemption. A nonbank fintech or marketplace lender that does not fit the Article 4 definition may raise a genuine question about whether Section 4-102 reaches it, and that question is fact specific. It may itself be a mortgage banking company, originate through a bank partnership where the bank is squarely covered, or operate through an affiliated covered entity. If it offers credit cards, Section 4-103 reaches “a person who offers credit cards to the public in this State” with no entity type limitation at all, and Section 5-102 reaches “any person.” Other Illinois consumer finance and unfair practices statutes operate independently, and a court or the Department may read functional lending activity broadly on particular facts. Nobody should treat this as a way out.

If you are a bank, credit union, insurance company, mortgage banking company, or savings and loan association operating in Illinois, none of that ambiguity applies. You are covered, and the analysis moves straight to your models.

Commercial and small business lending is in scope

Section 4-101(C) defines “loan” to include the providing of funds for consideration sought for either the purchase, construction, improvement, repair, or maintenance of a housing accommodation, or “any commercial or industrial purposes.” The Illinois Department of Human Rights says the same thing in plainer language on its financial credit and lending rights page, which states that Illinois law makes it illegal for financial institutions to discriminate “in granting mortgages, commercial or personal loans, and credit cards.”

Most fair lending programs at community institutions are built around consumer and mortgage products, because that is where HMDA data and federal examination pressure have always been. If you run an AI assisted small business credit model, a commercial scorecard, or an equipment finance decision engine, Illinois has just put it inside a disparate impact regime while the federal effects test was being removed from consumer credit.

The scale here is not trivial. A query of the FDIC BankFind API on September 10, 2026, filtered to active FDIC insured institutions with an Illinois home state and reporting as of the June 30, 2026 quarter end, returned 326 institutions, of which 272 reported total assets below $1 billion. You can reproduce it through FDIC BankFind Suite. That is roughly 83 percent of the state’s banking industry sitting in the asset band where there is no dedicated model validation team. Institution counts and asset bands move every quarter, so treat those as a point in time figure rather than a fixed number.

5. The lending standard is not the employment standard

The Act writes two different tests, and the lending test is drafted without the burden allocation that the employment test spells out. Read them side by side, because the difference determines what your model documentation has to prove.

New Section 2-103.5, covering employers, employment agencies, and labor organizations, says criteria or methods are unlawful if “(i) the respondent fails to demonstrate that the criteria or methods are job related for the position in question and consistent with business necessity or (ii) the respondent demonstrates that the criteria or methods are job related for the position in question and consistent with business necessity and the complainant demonstrates that the business necessity could be served by another employment practice that has a less discriminatory effect.” That is the familiar federal employment structure, and the complainant carries the burden on the less discriminatory alternative.

New Section 4-102(G), covering loans, says criteria or methods “are unlawful under this subsection if they are not necessary to achieve a substantial, legitimate, nondiscriminatory interest or if the substantial, legitimate, nondiscriminatory interest could be served by another practice that has a less discriminatory effect.” Section 4-103(C) for credit cards and Section 5-102(D) for public accommodations use identical wording.

The lending provision names no party for either prong. It states a condition of unlawfulness rather than a sequence of proof. The practical takeaway is narrow but useful: because Section 4-102(G) does not expressly allocate the burden on the less discriminatory alternative, a lender should preserve evidence of its business justification and of the alternatives it considered, rather than assuming a complainant will have to produce a better alternative first.

How that burden actually lands is unresolved. No Illinois court or Human Rights Commission decision has construed Section 4-102(G), because the provision does not take effect until June 1, 2027, and courts and the Commission may well import established burden shifting frameworks by analogy. Treat the difference in drafting as a reason to document more, not as a settled conclusion that lenders carry a heavier burden than employers.

One more provision deserves attention from anyone at a supervised institution. New Section 4-105 lets the Illinois Department of Human Rights consult the Secretary of Financial and Professional Regulation or a financial institution’s primary prudential regulator when investigating a charge, and it expressly preserves the examination authority of IDFPR, the Office of the Comptroller of the Currency, and the National Credit Union Administration. A civil rights charge and a safety and soundness examination can now inform each other.

6. Which of your AI systems are in scope

Any system that influences who gets credit, on what terms, or who is invited to apply is in scope, because the statute regulates the effect of criteria and methods rather than a defined category of technology. That is a broader footprint than most institutions have inventoried, and the gap is usually in the systems nobody thinks of as underwriting.

Start with the obvious. Automated underwriting systems and credit scoring models sit directly in Section 4-102(A) through (C), which already covered denial of services, modification of services, and denial or variation of loan terms. Risk based pricing engines are covered too, and Section 4-101(D) has long defined “varying the terms of a loan” to include requiring a greater down payment than usual, requiring a shorter amortization period than usual, charging a higher interest rate than usual, and under appraising property offered as security. A pricing model that lands more often on the higher rate for one group is squarely inside that definition.

Then the systems that get missed. Fraud and identity verification models decline applicants, and a decline is a denial of services whatever the internal label. Alternative data features such as cash flow underwriting, device signals, education, or employment history can correlate with protected characteristics in ways the vendor never tested for. Prescreen and marketing models decide who receives an offer, and Section 4-102(A) speaks to denying “any of the services normally offered.” Collections and loss mitigation triage models decide who gets a workout. Deposit account opening and overdraft eligibility engines are services of a financial institution.

The table below is a risk inventory, not a ruling. Some of these systems sit plainly inside Article 4 and others present a real question about whether a particular use is covered, with fraud screening, marketing prescreen and collections triage the most likely to be argued over. Inventory them anyway. A system you have never looked at is a system you cannot defend.

The commercial credit row is the hard one, and it is worth being honest about it. Lenders generally do not collect protected class data on business credit applicants, and collecting it raises its own questions. That does not make the exposure go away. What it means is that a written justification for each decision variable becomes an important control where outcome data is thin, not that it replaces testing. Proxy methodologies, geographic benchmarking, complaint analysis, qualitative file review, fair lending red flag screening, and whatever product level data you do hold all remain relevant. Use variable level justification alongside those, not instead of them.

7. What “criteria or methods” means when you run a stack of models

It means a complainant can put the whole decision path in issue and not just one model, because Section 1-103(G-10) defines criteria or methods to include “groups of practices or policies.” Most institutions test model by model. The text plainly permits a challenge to the combination, which makes end to end evaluation worth doing, but be clear on the status of that: it is a strong argument available to a complainant, not a testing methodology the statute imposes on you. Whether Illinois courts or the Human Rights Commission will require system level analysis is unresolved, and the Act prescribes no method. Treat path level testing as prudent governance that also happens to answer the strongest argument the text makes available.

Consider a common community bank consumer lending flow. A prescreen model selects the marketing population. A third party credit score enters the decision. An internal scorecard sets an approval threshold. A judgmental exception process handles borderline files. A pricing overlay assigns a rate tier. A fraud model can decline anything at any stage. Each component might pass an outcome test in isolation while the end to end approval rate diverges across groups, because small effects at five stages compound.

This is where AI adoption and governance maturity have come apart. Cornerstone Advisors surveyed 416 senior executives at banks and credit unions holding between $250 million and $50 billion in assets and reported that 49 percent of banks and 59 percent of credit unions have already deployed generative AI, with agentic AI now discussed at the executive or board level at more than half of institutions. Those are the figures from Cornerstone’s own announcement of its What’s Going On in Banking 2026 research, published February 20, 2026. Deployment at that rate, in institutions where the compliance function is often two or three people, is how an untested decision path gets built without anyone deciding to build one.

The governance answer is not exotic. Map every automated and judgmental step that touches an application from marketing through final terms, test the outcome at the end of the path as well as at each stage, and keep a written record of the alternatives you evaluated and why you rejected them. The NIST AI Risk Management Framework gives you the vocabulary for this in its Map, Measure, and Manage functions, and ISO/IEC 42001 gives you the management system structure if you need something auditable. Neither is a legal requirement in Illinois or anywhere else, and neither is Illinois specific. That is the point. A defensible record is portable across regimes, and building it is a model risk management choice rather than a statutory mandate.

8. Penalties, who can bring a claim, and how long the exposure lasts

Civil penalties under the Illinois Human Rights Act run to $16,000, $42,500, or $70,000 depending on prior violations, and a separate penalty may be imposed for each act and for each aggrieved party. Section 8A-104(K) sets a ceiling of $16,000 where the respondent has no prior adjudicated violation, $42,500 where there has been one other violation in the five year period ending on the date the charge was filed, and $70,000 where there have been two or more in the seven year period.

The per party language is what should get a model owner’s attention. Section 8A-104(K) provides that “a separate penalty may be imposed for each specific act constituting a civil rights violation as defined in Section 1-103, and for each aggrieved party injured by the civil rights violation.” An alleged model based violation could therefore create exposure that scales substantially with the number of affected applicants. Do not over model that arithmetic, though. Whether each use of a model, each application, or each decision counts as a separately penalized violation depends on the facts, how the charge is structured, and how the Commission calculates relief, none of which has been tested under provisions not yet in force. The point is directional: the ceiling is not $70,000 for a systemic model issue, and you should not plan as though it is.

Penalties are also not the main financial risk. Section 8A-104 sets out the relief the Commission may order on finding a violation, which includes cease and desist orders, actual damages as reasonably determined by the Commission, make whole relief including interest on actual damages running from the date of the violation, and payment of the complainant’s costs including reasonable attorney fees and expert witness fees through investigation, hearing, judicial review, and enforcement. Not every item issues in every case, and the Commission provides relief “separately or in combination.” In a model based case the expert witness line is not incidental.

On process, the exposure window is long. Under Section 7A-102(A)(1), a charge may be filed with the Illinois Department of Human Rights within two years after the date the violation allegedly occurred. The Department then has 365 days to issue its report. If it does not, Section 7A-102(G)(2) gives the complainant 90 days to either file a complaint with the Illinois Human Rights Commission or commence a civil action in circuit court. The Department’s charge process page walks through the sequence.

That is one possible route rather than a fixed maximum, but the shape of it is what matters for records. A decision made on June 2, 2027 can produce a charge filed as late as June 2029, a Department report a year after that, and a proceeding after that. Set retention against the statute rather than your default document policy: keep model governance records, documentation of data inputs and model provenance, testing results, business justification analyses, vendor documentation and testing evidence, and individual decision records for at least the charge period plus any period required by an ongoing investigation, litigation, examination or legal hold. One caveat on scope. If a vendor never gave you its underlying training data you cannot retain what you never held, so keep what you do have about how the model was built and what the vendor tested.

9. Illinois is not the only place the map diverged

Illinois is one instance of a general pattern in 2026, which is that AI accountability obligations are migrating from federal agencies to states, and a lender operating in several states now faces several standards at once. That pattern is the single most important planning assumption for a multi state institution.

Illinois in particular is becoming a dense compliance environment for AI. The state already enacted the first state AI audit law, which we covered in our analysis of Illinois SB 315 and the Artificial Intelligence Safety Measures Act. Public Act 104-0744 now layers an effects based civil rights standard on top of that, reaching a far larger population of businesses because it has no revenue threshold and no developer versus deployer distinction. Any covered financial institution is covered, whether it holds $200 million or $20 billion.

Other states are moving on adjacent ground with different mechanics, and the legal theories are genuinely different rather than variations on one idea. Colorado SB 26-189, signed May 14, 2026 and effective January 1, 2027, replaced the never effective Colorado AI Act with a notice, disclosure, and human review regime for automated decisions in consequential areas including financial and lending services. It is not an effects liability statute. We examined it in the employment context in our piece on what applies to employers under Colorado SB 26-189. Texas built a complaint intake channel and a cure process around an intent focused standard, not an effects standard, covered in our review of the Texas AI complaint portal. Several states have restricted algorithmic pricing in housing, a pricing restriction rather than an underwriting rule, tracked in four states now banning algorithmic rent pricing.

The compliance lesson from comparing them is that the documentation these regimes demand overlaps heavily even where the liability theories differ. A model inventory, a written justification for each decision variable, outcome testing on the full decision path, a record of alternatives considered, vendor documentation, and a human review route will serve you under an effects standard, a disclosure standard, and a cure regime alike. Build the record once.

Keep one distinction in view while you do it. Notice, disclosure and human review are legal obligations where a statute imposes them, as Colorado does. Model inventories, outcome testing and alternatives documentation are mostly model risk management practices you adopt because they make you defensible, not because these statutes prescribe them. Only the first kind carries a deadline set by someone else.

Finally, do not read the federal retreat as reducing federal risk to zero. Disparate treatment liability under ECOA is untouched. The CFPB’s rule states that facially neutral criteria remain actionable where they are intentionally designed or applied as proxies for prohibited characteristics, which means a proxy variable is still a federal problem. Unfair, deceptive, or abusive acts or practices authority, the Fair Housing Act itself, and state unfair practices statutes all remain in place. Small financial firms also face a parallel set of AI marketing and disclosure expectations, which we addressed in our article on what the SEC now expects from small RIAs using AI.

10. A 90 day plan to be defensible before June 1, 2027

Ninety days of focused work will get a small institution from no documented position to a defensible one, and starting in 2026 rather than 2027 is what makes the June 1, 2027 date manageable. Read what follows as a defensible baseline and a set of recommendations, not a safe harbor. Completing it does not immunize anyone from a disparate impact claim, and a lender that finds real disparities will need considerably more time than 90 days to address them. What it does is put you in a position to answer the two statutory questions with evidence instead of improvising during an investigation.

Days 1 to 30: inventory and scope

Build a single list of every automated or model assisted step that affects who gets credit, on what terms, or who is solicited. Include the systems from the table in section 6 that usually get missed: prescreen, fraud, alternative data, commercial credit, collections triage. For each entry record the owner, whether the model is internal or vendor supplied, what data it consumes, what decision it drives, and whether any outcome testing has ever been performed. Confirm in writing whether your entity meets the Section 4-101(B) definition of financial institution, and separately whether you offer credit cards to the public, since that provision reaches persons rather than institutions.

Days 31 to 60: test the path, not just the parts

Run outcome testing at the end of the complete decision path for each product, then at each stage, so you can see where disparity is introduced and whether stages compound. Where you lack demographic data, as in most commercial lending, document that limitation and add a variable level review in which each decision input has a written business justification tied to a substantial, legitimate, nondiscriminatory interest. Do not treat that review as a full substitute for testing. Proxy analysis, geographic benchmarking, complaint review and product level data you already hold can all still tell you something. Pull vendor documentation for every third party model and ask specifically what fairness testing the vendor performed, on what population, and when. A vendor’s general assurance is not evidence about your portfolio.

Days 61 to 90: write down the alternatives

This is the step almost nobody does, and under Section 4-102(G) it is the step that matters most. For each material decision variable and threshold, record the less discriminatory alternatives you considered, what you measured, and why you rejected them. If you tested a lower cutoff, a different feature set, or a model without a particular variable, keep the results even when the alternative performed worse. Assign a named owner for the annual review, set a document retention period that covers the two year charge window plus the Department’s 365 days plus subsequent litigation, and put the whole package in front of the board or a board committee so the governance decision is recorded.

One judgment call worth making deliberately: whether to hold your whole book to the Illinois effects standard or to run a state specific configuration. Most institutions under $1 billion in assets will find a single higher standard cheaper to operate than a per state variant, because the alternative is maintaining divergent model configurations, testing regimes, and documentation for each jurisdiction. To be explicit, applying a single enterprise wide effects testing and model governance standard is a business and risk management choice for operational simplicity. It is not required by Illinois law outside Illinois covered activity. Make the call on the record either way, rather than arriving at one by default.

This article is provided for general informational purposes and reflects the state of the law as of September 2026. It is not legal advice. Regulations in this area are changing quickly. Confirm current requirements and consult qualified counsel before making decisions for your organization.