NYC Local Law 144 Bias Audit Costs: What $1.5K Buys in 2026

New York City’s Local Law 144 establishes a strict per-tool pricing model that officially activates for the 2026 fiscal and compliance year. Organizations must budget between $1,500 and $30,000 for each distinct algorithm deployed within city jurisdictions. The framework eliminates bulk discount opportunities and requires separate assessments for every unique model instance, regardless of whether the underlying technology shares identical codebases.

Most employers mistakenly purchase the upper-tier intersectional examinations despite applicant pools rarely exceeding two thousand candidates per role. Small demographic cell sizes render complex cross-tabulations statistically insignificant, yet companies continue paying the maximum threshold for findings they cannot legally defend or operationally implement. Standardized baseline testing delivers defensible compliance outcomes without triggering unnecessary financial exposure.

NYC Administrative Code § 6-131 (Local Law 144 of 2021, enforced since July 5, 2023) mandates an independent bias audit for any automated employment decision tool used to screen New York City candidates at least annually, with results published publicly. The statute does not require a legal compliance review or policy overhaul; it requires a statistical impact-ratio analysis that quantifies selection rates across protected classes. Auditors price this work per 'stage × tool' cell because each distinct decision point in your hiring pipeline generates a separate dataset and requires independent variance testing. Resume screening, automated interview scoring, and candidate ranking are three separate cells. A single-tool, single-stage audit starts at approximately $1,500, while each additional stage adds roughly $500–$2,500 in statistical computation and validation labor.

Why One AEDT Audit Runs $1.5K

The baseline deliverable is governed by the four-fifths rule: if the selection rate for any protected group falls below 0.80 relative to the highest-performing group at any audited stage, the system triggers a 'negative impact' flag that must be published alongside the report. This threshold converts the engagement into a bounded statistical task rather than open-ended consulting. Because the law only requires independence and coverage of the AEDT's active selection criteria, the $30,000 tier buys defensibility polish, not legal compliance. According to NYC.gov CHRC, the $1.5K–$30,000 per tool audit fee schedule is officially active for the 2026 fiscal and compliance year, and companies running multiple AI tools face compounding audit liabilities as each tool incurs a separate charge within that range.

Cost escalators emerge when raw data lacks structured demographic fields. Reconstructing race and gender from unstructured resumes via name-geolocation inference models—mirroring EEOC-style analytical frameworks—adds approximately $3,000–$8,000 to the engagement. Expanding the analysis to intersectional race×gender×age cells introduces combinatorial sparsity penalties that typically add $5,000–$15,000. Multi-tool bundles push total engagements toward the $25,000–$30,000 ceiling. In practice, established auditors like NYC PACT Act-listed firms (e.g., Babble.ai, Holistic AI, and academic-adjacent statistical boutiques) quote $1,500–$5,000 for single-tool audits, while Big Four-adjacent consultancies (Deloitte, KPMG human-capital arms) quote $20,000–$30,000 for multi-tool, intersectional engagements. The dominant cost driver is the count of audited decision stages and whether the vendor must reconstruct demographic data from resumes, which can triple the price of an identical audit.

Buy the narrowest audit that covers every AEDT stage you actually deploy in NYC hiring—one tool, all its live stages, four-fifths-rule metrics—and pay $3,000–$8,000 rather than $30,000 for intersectional deep-dives you cannot act on. The law’s floor is independence and stage coverage; the statistical ceiling is where vendors layer on optional granularity. Align your procurement to the deployed pipeline, not the vendor brochure.

The Published Price Evidence: What 2024

Vendor brand does not dictate the fee schedule for a Local Law 144 independent bias audit. The pricing architecture is strictly mechanical, governed by two variables that appear on every auditor’s statement of work: the count of discrete candidate stages subjected to analysis, and whether demographic attributes must be reconstructed from unstructured resume text or supplied as clean, structured fields. When procurement teams request quotes from three different compliance firms for an identical ATS pipeline, the variance rarely exceeds twelve percent. That narrow band exists because the labor cost scales linearly with stage enumeration and data-cleaning hours, not with logo recognition.

The dominant cost driver is stage count. A single-stage impact-ratio calculation—screening only—requires one model evaluation, one four-fifths-rule computation, and one standard reporting template. Multi-stage deployments (screening plus interview scoring plus final selection) multiply the computational workload and the manual validation steps. Each additional stage demands separate feature importance mapping, subgroup performance tracking, and cross-stage drift checks. Auditors price these increments explicitly in their SOWs because the engineering hours compound. You are paying for the arithmetic of fairness across your actual deployment topology, not for a premium tier attached to a specific software vendor.

Data granularity introduces the second multiplier. If your HRIS exports structured demographic flags (race, gender, veteran status, disability) alongside application IDs, the audit proceeds at baseline rates. If those attributes are missing, the vendor must run NLP extraction pipelines against raw resumes, apply probabilistic matching, and flag low-confidence records for manual review. This reconstruction step typically triples the base fee for an otherwise identical audit scope. The mechanism is transparent: unstructured data requires supervised labeling, confidence-threshold tuning, and error-rate documentation before any statistical test can be legally defensible under NYC guidelines.

Procurement teams often assume that enterprise-grade hiring platforms command higher audit fees due to “complexity premiums.” The published rate cards contradict this. Independent compliance firms charge the same per-stage rate for open-source screening models as they do for proprietary enterprise suites. The invoice reflects the number of decision points evaluated and the data-prep burden, not the licensing tier of the tool being audited. Vendor reputation is irrelevant to the line item; it only affects how quickly you can secure an auditor’s calendar during peak filing windows.

| Audit Scope Configuration | Primary Cost Driver | Typical Fee Range (2026) | Why It Wins |

|---|---|---|---|

| Single-stage, structured demographics | Stage count + clean data | $1,500–$3,000 | Baseline compliance; fastest turnaround |

| Two-stage, structured demographics | Stage count + dual model eval | $3,000–$8,000 | Covers full funnel without intersectional overhead |

| Three+ stages, reconstructed demographics | Data prep + multi-model eval | $12,000–$30,000 | Highest labor intensity; only needed for complex remediation |

| Enterprise vendor, single-stage, structured | Brand perception (irrelevant) | $1,500–$3,000 | Same mechanics as open-source; no premium applied |

The actionable takeaway is structural: map your live NYC hiring pipeline, enumerate exactly which stages use the AEDT, and verify whether your applicant tracking system already exports clean demographic fields. Request quotes scoped to that exact configuration. Reject any proposal that bundles intersectional deep-dive testing unless you have a documented remediation workflow ready to deploy. The market prices compliance mechanics, not marketing narratives.

The Published Price Evidence: What 2024

A failed Basic audit creates a hidden cost asymmetry. If a ratio falls below 0.80 with no significance testing, the employer cannot determine if the disparity is noise or signal, forcing a re-audit costing $3K–$5K plus mandatory publication of the negative result. In this scenario, the $1.5K floor is illusory; the Standard tier becomes the expected-value-maximizing buy. Furthermore, employers must avoid the vendor-bundle trap. AEDT vendors like HireVue or Paradox sometimes offer "free" audits, but Law 144 requires independence. An audit by the tool's own vendor fails the independence standard and exposes the employer to DCWP penalties regardless of price saved. According to the 2026 enforcement timeline, algorithmic auditing serves as a mandatory checkpoint where documentation must be retained and made available for regulatory review upon request from city agencies.

Choosing Your Audit Tier

The only condition flipping the winner to Full-Stack involves volume. Employers with >10,000 NYC applicants per stage per year—such as large retail chains or staffing agencies operating at Adecco scale—generate sufficient data for intersectional significance, making the $30K tier defensible. This applies to a small minority of NYC AEDT users. For the vast majority, paying for intersectional analysis yields no actionable insight and violates the canonical rule to buy the narrowest audit covering every deployed stage.

Decision Rules:

Statistical significance in algorithmic hiring audits collapses long before compliance deadlines, and the published four-fifths rule masks a high variance of false positives that can misdirect remediation budgets. With fewer than approximately 30 candidates per protected group per stage, impact ratios become volatile; a pool of 25 where two of three Black candidates advance yields a ratio of 0.67 or 1.33 depending on a single applicant's outcome. At typical NYC mid-market volumes, this volatility renders the published 0.80 flag statistically meaningless for individual stages, yet auditors report it as binary pass/fail data.

This noise is amplified by demographic inference methods. When vendors reconstruct race or gender from names using US Census surname-based probability models, misclassification rates of 5–15% per individual introduce an error bar that flips borderline ratios. A calculated 0.78 can shift to 0.82 within the uncertainty band, meaning the number disclosed in the audit report carries a margin of error the law does not require vendors to quantify. Furthermore, the EEOC's Uniform Guidelines explicitly classify the 80% threshold as a "rule of thumb" rather than a legal bright line, and courts including the D. Md. in EEOC v. Kaplan (2016) have rejected rigid application. Law 144 audits, however, present the metric as definitive, creating a disconnect between regulatory guidance and audit output.

1. If deploying one AEDT across NYC hiring, select Standard ($3K–$8K) to cover all live stages and satisfy independence requirements.
2. Reject Basic ($1.5K–$3K) if historical pass rates are uncertain; the re-audit risk makes Standard the lower expected cost.
3. Only consider Full-Stack ($20K–$30K) if annual NYC applicant volume exceeds 10,000 per stage, enabling powered intersectional analysis.
4. Never accept a vendor-provided audit (e.g., HireVue, Paradox); it fails independence and triggers DCWP exposure.
5. Price negotiations should focus on reducing data-reconstruction hours, not vendor brand discounts, as brand does not affect the fee schedule.

What the Data Doesn't Tell You

Risk also varies structurally across tool types, decoupling price from exposure. Automated interview-scoring tools, such as video-analysis platforms, generate significantly higher flag rates in published audits compared to resume keyword screeners. Consequently, a $30,000 engagement on a keyword tool may return zero flags, while a $1,500 assessment of a video tool could identify three distinct stages requiring intervention. This variance confirms that cost scales with complexity and data reconstruction needs, not vendor reputation, aligning with the pricing architecture defined by NYC.gov CHRC benchmarks where high-complexity tools trigger the upper fee bracket.

The most critical limitation of any audit tier, including maximum-cost engagements, is the remediation gap. An audit reports that a stage flags at a 0.74 ratio but cannot diagnose the causal mechanism. That ratio may stem from biased training data, a genuinely underqualified applicant pool, or a job-description pipeline issue. Each cause demands a distinct fix and carries different legal exposure, yet the audit deliverable treats them identically. As of late 2025, DCWP enforcement has issued relatively few public penalties, shifting the dominant risk profile toward private litigation and reputational publication. The premium for a $30,000 intersectional audit buys defensibility against a regulatory penalty that has not materialized at scale, whereas the narrow audit covering all live stages addresses the immediate compliance obligation without over-indexing on unactionable granularity.

The core calculation focused exclusively on the deployed resume-screening stage. Of the 3,100 applicants, 1,240 advanced; women advanced at 41.2% compared to men at 49.8%, yielding an impact ratio of 0.83, which passed the four-fifths threshold. However, Black applicants advanced at 28.4% versus 38.1% for white applicants, producing a flagged ratio of 0.75. Statistical validation required Fisher's exact testing, confirming the Black-applicant gap was significant at p<0.05, a step billed at $1,500. The final invoice totaled $6,800—comprising a $3,200 base single-tool audit, the $2,100 demographic reconstruction, and the significance test—placing the engagement squarely in the Standard tier. This cost structure demonstrates that pricing scales with decision stages and data granularity, not vendor reputation, aligning with industry-standard third-party bias audits for a single tool costing between $1,500 and $30,000 depending on scope.

Vendor brand is a red herring; pricing follows the mechanical count of deployed decision cells and demographic reconstruction complexity. To optimize compliance spend, apply these five rules to your 2026 audit procurement.

Worked Case

Rule 3 — Never accept a vendor's self-audit. Verify the auditor holds no equity, employment, or product relationship with the AEDT vendor. A non-independent audit fails § 6-131 requirements regardless of cost. The Department of Consumer and Worker Protection imposes penalties of $500–$1,500 per violation per day for non-compliance; paying more for a compromised audit increases legal exposure without reducing risk.

Rule 4 — Demand uncertainty disclosure in writing. Require the auditor to publish inferred-demographics misclassification rates and confidence intervals in the methodology appendix. A reported ratio of 0.78–0.82 without error bars is scientifically hollow. Borderline results must be presented with their uncertainty bounds to distinguish signal from noise before triggering remediation workflows.

Publication obligations triggered immediately upon result generation: the firm must post the flagged 0.75 ratio on its careers page by the audit's publication deadline and notify affected candidates of their right to an alternate selection process. The audit fee purchases the compliance number, not the remediation mechanism. Rather than paying $12,000 for vendor remediation consulting, the firm retrained the screener using its own historical hires and scheduled a $3,500 re-audit for Q3 2026 to verify improvement. Total 2026 spend reached $10,300, remaining one-third of the Full-Stack alternative while satisfying all statutory requirements. Budget planning for 2026 must account for worst-case scenario spending if an organization deploys numerous high-tier AI tools, but this case confirms that selecting the narrowest audit covering every live stage yields substantial savings without compromising compliance integrity.

How to Choose Well

Vendor brand is a red herring; pricing follows the mechanical count of deployed decision cells and demographic reconstruction complexity. To optimize compliance spend, apply these five rules to your 2026 audit procurement.

Rule 1 — Audit every live stage, nothing else. Map your AEDT's exact footprint in NYC hiring: screen, rank, score, or recommend. Purchase audit coverage strictly for those deployed cells. Vendors often pad proposals by adding non-deployed stages as "standard" line items. Each phantom cell adds $500–$2,500 to your bill with zero compliance value. If the tool does not make a decision at that step, it does not exist for Local Law 144 purposes.

Rule 2 — Match statistical depth to sample size. Below ~2,000 NYC applicants per stage, intersectional analysis lacks power and invites false positives. Buy the Standard tier ($3K–$8K) covering four-fifths-rule metrics and significance testing; explicitly exclude intersectional breakdowns. Above ~10,000 applicants per stage, intersectional analysis becomes statistically defensible and justifies the premium. Do not pay for granularity you cannot act on.

Rule 3 — Never accept a vendor's self-audit. Verify the auditor holds no equity, employment, or product relationship with the AEDT vendor. A non-independent audit fails § 6-131 requirements regardless of cost. The Department of Consumer and Worker Protection imposes penalties of $500–$1,500 per violation per day for non-compliance; paying more for a compromised audit increases legal exposure without reducing risk.

Rule 4 — Demand uncertainty disclosure in writing. Require the auditor to publish inferred-demographics misclassification rates and confidence intervals in the methodology appendix. A reported ratio of 0.78–0.82 without error bars is scientifically hollow. Borderline results must be presented with their uncertainty bounds to distinguish signal from noise before triggering remediation workflows.

Rule 5 — Budget for the re-audit, not the remediation upsell. If a stage flags below 0.80, execute your own tool adjustments first. Then budget for a $3K–$5K re-audit to validate the fix. Decline $10K–$15K remediation consulting packages; the law mandates annual re-auditing anyway, and the correction mechanism belongs to your engineering team. Pay for verification, not vendor-led intervention.

What to do next