What NYC AI Hiring Compliance Requires in 2026
NYC AI hiring compliance primarily comes from Local Law 144 of 2021, the New York City Human Rights Law amendment governing the use of automated employment decision tools. It does not prohibit employers from using artificial intelligence to screen applicants, rank candidates, assess interviews, or recommend hiring decisions. Instead, it regulates how those tools are selected and used, with particular attention to bias. The central requirements apply to a “covered employer,” which generally includes employers with 25 or more full-time or part-time employees in New York City, or 15 or more full-time or part-time employees in NYC together with at least 75 employees outside NYC.
Also worth reading: How Can Employers Automate AI Employment Compliance in 2026? · How Do AI Labor Compliance Tools Help Employers Stay Ahead of Changing HR Regulations? · How Should Employers Test Payroll Controls for Accuracy and Compliance?
A covered employer may use an AEDT only if it conducts a bias audit no earlier than one year before the tool’s use to test whether the tool disproportionately screens out applicants of any protected class. NYC defines protected classes under its Human Rights Law more broadly than federal law, including race, color, creed, national origin, sex, sexual orientation, gender identity or expression, age, disability, marital status, military status, lawful source of income, and other categories covered by local law. The employer must also give applicants notice that an AEDT will be used, provide a plain-language description of how the technology works and how it affects the hiring process, and offer a process for applicants to request an alternative selection process or accommodation.
The bias audit must be conducted by an independent third party. Employers must provide applicants with information explaining the type and purpose of the audit, the categories of information tested, the results by sex and race, and the date or dates of the audit. This is not a requirement to publish the audit publicly. Notice, audit disclosure, and accommodation information must be available in a “conspicuous” place or manner that applicants can reasonably access, while the employer must retain the required records for at least seven years. As of September 30, 2026, Local Law 144 remains the operative NYC-specific rule, but employers must also check newer New York proposals, federal developments, and the separate duties imposed by privacy, consumer-protection, and employment-discrimination laws.
Who Is Covered and When Do the Duties Begin?
Coverage is determined by workforce size and New York City connection, not by whether an employer calls a system “AI,” “machine learning,” or simply a software platform. Automated employment decision tools include systems used to make or substantially assist decisions about employment opportunities. The rule can therefore reach resume-ranking software, candidate-screening systems, automated interview or assessment tools, and scoring systems that recommend which applicants should move forward. The NYC Department of Consumer and Worker Protection, which administers the rule through its Office of Labor Policy and Standards, has emphasized that a tool does not become exempt merely because a human remains involved in the final decision.
The compliance clock is triggered once the employer begins using the tool. If a company launches a recruiting campaign with an AEDT, it should not wait until a candidate complaint or agency investigation to obtain an audit. The employer must document the tool’s purpose, identify the relevant applicant population, select an independent auditor, provide required notices, and train staff on accommodation requests. A vendor’s assurance that its product is “compliant” is not a substitute for the employer’s own review. Vendors may supply technical documentation, audit support, and model cards, but the legal duties fall on the covered employer.
Employers with fewer than the statutory employee thresholds may still face obligations under other laws. For example, a company using AI to exclude a qualified older worker, applicant with a disability, applicant of a particular race, or applicant of a protected sex may face claims under federal, New York State, or other applicable law. The thresholds also require careful treatment of affiliated entities, contractors, temporary agencies, and staff supplied by a staffing firm. A company should ask who controls the recruiting decision, who possesses the audit and records, and whether the employer has made the hiring decision through a staffing intermediary. Ambiguity about responsibility is not a safe reason to delay compliance.
How the NYC AI Hiring Compliance Process Works
The first stage is inventory and classification. An employer should identify every technology that influences candidate selection, including tools owned by an applicant tracking system, recruiting agency, staffing firm, or third-party platform. The inventory should record what data the tool receives, the decision it supports, the population it evaluates, its vendor, and whether the tool is active, optional, or merely experimental. This review matters because one platform can include several different scoring or screening functions. A resume parser, for example, may extract information without ranking applicants, while a later recommendation engine may perform a much more consequential function.
The second stage is the independent bias audit. The audit must evaluate whether the AEDT disproportionately screens out applicants in protected categories. A defensible audit generally defines selection and impact rates, selects appropriate comparison groups, checks data quality and missingness, examines intersectional results where useful, and explains the statistical method and sample limitations. The audit should test the tool as actually configured for the employer, rather than a generic demonstration. A system that performs acceptably with one prompt or data source may behave differently when connected to a particular applicant-tracking workflow.
The third stage is public-facing and operational compliance. The employer must publish a notice stating that an automated tool is used in the hiring process. It must provide the required explanation of the tool’s purpose and operation, disclose the independent audit information, and explain how an applicant can request an alternative process. The process need not guarantee the requested alternative in every case, but the employer must offer a reasonable route for review and must consider whether the request relates to a disability, religion, pregnancy-related limitation, or another issue requiring accommodation under other applicable law. The notice should be understandable to applicants, including applicants with disabilities, and should be available before the relevant hiring decision.
What Must an Employer Give Applicants?
The required information is more specific than a generic privacy notice. Applicants must be told that an AEDT will be used during the hiring process. They must receive a brief description of what the technology does and how it is used, in plain language. The notice should describe the kinds of data the system evaluates and the effect it has on selection, such as whether it screens, scores, ranks, assesses, or recommends candidates. The language should not hide material processing behind technical phrases such as “proprietary machine learning,” particularly when the applicant’s rights depend on the information.
The bias-audit disclosure must identify the auditor and describe the purpose of the audit, the categories of information tested, the data used, the results by sex and race, and the date of the audit. The rule requires disclosure of audit results, but it does not require the employer to publish every underlying record, model parameter, or applicant-level dataset. The employer should still document what was tested and preserve the underlying report. Audit results should be matched to the actual hiring process because an audit of a staging environment may not establish how a production tool is used.
An applicant who believes the tool may screen out or disadvantage them because of a disability or another legally protected characteristic must have a known way to request an alternative selection process. Employers should establish a channel that is not dependent on the same automated scoring mechanism that is being challenged. A practical process may involve a human reviewer, a phone line, an email address, and a defined response time. The notice should state how the applicant can submit the request without having to disclose a diagnosis unnecessarily. The employer must balance the alternative-process duty with confidentiality, data minimization, and operational security.
Bias Audits, Evidence, and Recordkeeping
A compliance claim based only on a vendor certificate is weak. An independent bias audit should demonstrate that the employer examined the tool’s selection effects using a method appropriate to its function and applicant population. The audit should explain the sample, the time period, the outcome definitions, the treatment of applicants who withdrew, the treatment of missing demographic data, and the statistical or operational reasons for any exclusions. It should also test whether a protected group receives a disproportionately unfavorable outcome compared with a reference group. There is no universal requirement to use a single named statistical technique, because a system’s purpose and impact can vary.
The audit is not proof that no discrimination occurred. Statistical testing can reveal disparities, but a favorable aggregate result may conceal offsetting errors, inconsistent outcomes, poor data quality, or unlawful design choices. Conversely, a crude disparity may reflect imperfect demographic reporting rather than an unlawful effect. The employer should have the auditor explain limitations rather than treating the report as a pass-or-fail warranty. If the audit identifies material disparities, the employer should suspend or modify the tool where necessary and document the corrective action.
Records should be retained for at least seven years. At minimum, the file should contain the current bias audit, notices supplied to applicants, vendor contracts, system documentation, the employer’s tool inventory, training materials, accommodation procedures, requests and responses, and records of corrective actions. The retention policy should also account for general litigation holds and requirements under New York civil-rights, privacy, wage-and-hour, and consumer-protection rules. A company that keeps the audit but deletes the underlying data may still struggle to explain what happened. A company that keeps technical data without training staff is not fully prepared either, because employees must be able to identify and respond to applicant requests in practice.
Automated Compliance Tools Versus Manual and Hybrid Programs
The right operating model depends on the employer’s size, recruiting volume, number of vendors, and technical capacity. Automation can improve consistency by tracking deadlines, retaining documents, routing accommodation requests, and flagging missing notices. It does not determine whether the underlying bias audit is reliable, whether a notice is adequate, or whether a requested accommodation was properly handled. A legal-management platform can make the work more visible, but it cannot replace an independent auditor or professional judgment about the actual decision process.
| Feature | Automated compliance program | Manual legal review |
|---|---|---|
| Main strength | Tracks tools, audits, notices, deadlines, requests, and evidence consistently across hiring teams | Allows close contextual judgment about unusual cases, vendor terms, and disputed decisions |
| Typical cost | Usually subscription-based; vendor pricing varies widely and should be obtained in writing | Mainly professional fees, auditor fees, internal staff time, and training costs |
| Bias-audit role | May manage evidence and coordinate the independent audit; it generally cannot replace the independent auditor | Requires direct engagement with a qualified third party |
| Applicant access | Can provide a consistent intake form and record response times | Depends heavily on staffing and whether a request reaches the right person |
| Main limitation | Configuration, data quality, integrations, and false confidence can create gaps | Human inconsistency, lost documents, missed renewals, and limited visibility across recruiters |
| Best fit for growing employer | Multi-site recruiting, multiple ATS platforms, frequent audits, or many accommodation requests | Smaller, lower-volume hiring operations with experienced legal and HR staff |
Common Mistakes That Create New Risk
One common mistake is treating “AI” as a label that changes the legal analysis. The relevant question is whether the technology is an automated employment decision tool and how it affects selection, not what the vendor calls it. Another is assuming that a human recruiter’s review automatically cures the problem. A person who receives an AI-generated ranking and simply accepts it may be using the tool as a substantial aid, while a reviewer who applies documented, role-related criteria may be making a different decision. Employers should document meaningful human oversight rather than adding a nominal final click.
A second mistake is using an audit for a different product configuration. A tool may have multiple models, customer-specific rules, language options, integrations, or prompt settings. The audit must correspond to the configuration used for the employer’s applicants. Vendors should provide change notices, and employers should know whether updates can alter outcomes. Many incidents become compliance problems not because the product was prohibited, but because the deployed version differed from the version that had been reviewed.
A third mistake is publishing a notice in a location applicants cannot reasonably use. A recruiter’s internal handbook, a page buried in a general career site, or language available only to English-speaking applicants may not be enough. The information should be conspicuous, available at the appropriate stage, and accessible to people with disabilities. Employers also need a reliable alternative-selection process. Ignoring an accommodation request because the applicant did not use an exact form can create federal disability or religious-discrimination exposure as well as Local Law 144 exposure.
Finally, employers should not treat audit thresholds as a substitute for individualized compliance. New York City law does not create a general public deadline for every possible auditor, and the rule is not a guarantee that an employer will win every discrimination case. It requires specific, recurring controls. The employer should coordinate NYC rules with New York State and federal developments, monitor pending 2026 legislation, and reassess when recruiting models, applicant populations, or business entities change.
When Should an Employer Act, and What Should It Cost?
An employer should act before using an AEDT in NYC, not after a complaint. A practical trigger is any planned launch, renewal, expansion, new ATS integration, acquisition, or vendor change affecting candidate selection. An employer already using covered tools should immediately verify whether the current audit is within the required one-year period, whether applicant notice and audit disclosures are available, and whether accommodation requests are being recorded and answered. If the current file is missing, treat that as a remediation project rather than an administrative paperwork exercise.
The amount of work depends on the system and the employer’s staffing model. A small employer using one recruiting platform may need an initial inventory, an independent audit, updated notices, a written process, and basic training. Its costs may be primarily professional and audit fees, potentially several thousand dollars or more depending on the tool and audit complexity. Employers with many recruiting locations, multiple vendors, or high applicant volume may spend substantially more on legal review, technical validation, integrations, training, and ongoing monitoring. Platform subscription prices alone are not a reliable estimate of compliance cost because they often exclude audit fees and integration work.
Organizations should obtain written pricing covering the audit, the tool inventory, notice administration, accommodation workflows, data retention, reporting, and vendor cooperation. A cheap product can become expensive if it cannot provide the documentation needed for an investigation. Conversely, a large compliance program with no reliable testing and no accountable owner can be costly without reducing risk. The relevant return is avoided operational disruption, faster response to applicants, clearer evidence, and reduced chance that a recruiting tool is used without required oversight.
The most defensible plan for 2026 is a named compliance owner, a complete system inventory, current independent audits, accessible notices, tested accommodation procedures, documented human review, and a schedule for annual reassessment. This is not a promise of perfect compliance. It is a disciplined way to show that the employer identified the tool, tested its effects, informed applicants, and responded to concerns before an enforcement or civil-rights claim arrived.
How Employers Can Stay Prepared as Rules Change
The regulatory picture is still changing. New York has considered additional bills concerning artificial intelligence in employment, while the federal government and other states have pursued different approaches to disclosure, discrimination, privacy, and automated decision-making. Some proposals could create requirements beyond NYC’s existing audit and notice framework. An employer should not assume that compliance with Local Law 144 resolves every obligation arising from an AI hiring system.
The practical approach is to establish a quarterly policy review and an annual legal review. The quarterly review should check vendor updates, new recruiting tools, changes in applicant demographics, accommodation volumes, and complaints. The annual review should confirm the one-year audit requirement, update notices, reassess job-relatedness and data quality, and determine whether new laws apply to the employer. The employer should also document why a particular tool remains in use, what alternatives were considered, and what controls were selected. Those records can be more useful than a generic policy statement because they connect legal requirements to the actual hiring workflow.
A qualified NYC employment attorney or labor-and-employment compliance specialist should review the employer’s specific facts, especially where an automated tool is used in a highly regulated industry or has direct access to sensitive data. The advice should cover independent auditor selection, statistical methods, record retention, ADA accommodation, New York State obligations, and any developing laws. Specialized AI compliance software can organize that work, but the employer must verify the vendor’s claims and protect against automated systems that merely produce confident but unverified conclusions. The objective is not to add AI to the compliance process. It is to make existing legal duties more visible, timely, and consistent.