Illinois AI Video Interview Audit Evidence for Hiring Teams

Illinois regulates employers that ask applicants to record video interviews and use AI to analyze those recordings. The evidence problem begins before the model call: the employer must operate the required notice and consent process, restrict sharing, and handle deletion requests under the statute. Once analysis starts, the technical record should connect the applicant workflow to the model, policy, data class, and outcome. A recruiter staring at a folder named final_final_interviews should not have to reconstruct that chain manually six months later. The Illinois General Assembly's statutory text is the primary source for scope and duties.

Notice and consent evidence starts in the application

The employer's hiring application presents the notice, explains that AI may analyze the video and relevant characteristics, and obtains consent before analysis. DeepInspect does not render that notice or collect candidate consent. The application should preserve the notice version, presentation time, consent action, applicant identifier, and workflow state. When the model request occurs, a policy decision can require a valid consent attribute attached to the authenticated workflow. That creates a technical check between the consent system and the analysis call. The evidence packet then links the application record with the request-boundary decision rather than claiming that one log proves the entire statutory process.

Sharing restrictions need destination policy

Video interviews and derived information can move through recruiting platforms, storage services, model APIs, and human reviewers. The organization should maintain an approved destination list tied to the hiring purpose and applicable sharing rule. At the HTTP AI boundary, policy can restrict which model endpoints receive interview content and which authenticated roles may call them. Network and application controls still govern storage links, local downloads, and sharing that bypasses AI traffic. My opinion is simple: a vendor inventory without observed destination records is a guess with a spreadsheet attached. Test one approved model route and one blocked route, then keep both decisions.

Deletion requests require linked system records

The statute includes deletion duties after a request, subject to its terms and timing. The recruiting application should track the request, verify identity, locate covered copies, assign tasks to vendors, and record completion. An AI gateway can contribute a model-interaction inventory showing which endpoints received the applicant's data through the controlled HTTP path. It cannot delete copies held inside an applicant tracking system, email inbox, local drive, or provider store. The evidence design needs linked identifiers so privacy staff can locate each system owner. A per-decision model record supports discovery, while deletion confirmations come from the systems holding the data.

Model-call evidence should preserve purpose and policy

Each analysis request should record a pseudonymous applicant or workflow identifier, authenticated calling service, authorized recruiter or process, model destination, data classification, purpose code, policy version, decision, and timestamp. Avoid duplicating the full video or transcript in the audit store unless an approved retention rule requires it. Integrity protection helps demonstrate that the application could not rewrite the decision after a complaint. The organization's employment counsel should determine the final retention, notice, consent, and deletion evidence requirements against the current statute and workflow. Technical teams supply accurate records; counsel supplies the legal interpretation.

A tabletop test exposes broken links

Choose a synthetic applicant and run the whole process. Present the notice, capture consent, send an authorized analysis request, attempt an unauthorized model route, submit a deletion request, and collect completion records. The test should produce a coherent timeline across the recruiting application, AI enforcement layer, model provider, and storage systems. A single event ID or protected workflow ID should connect the pieces. If the team relies on applicant names embedded in free-text log messages, retrieval will be slow and privacy exposure will grow. The broader AI security for HR and recruiting guide covers adjacent hiring controls.

DeepInspect

DeepInspect covers HTTP AI traffic placed behind its request boundary. It binds an authenticated user or workload to the model call, classifies data, enforces approved destinations and configured consent attributes, and records the policy outcome. Each decision produces tamper-evident evidence with identity context, model route, classification, policy version, outcome, and timestamp.

The product does not present applicant notices, obtain consent, decide employment outcomes, or delete copies in external systems. It supplies request-path enforcement and a model-interaction inventory that can support the organization's wider evidence process. If your Illinois hiring workflow needs an AI control map, let's talk today.