How does the NYC Local Law 144 bias audit work, and what do employers need to do to comply in 2026?

The Direct Answer: What NYC Local Law 144 Requires

NYC Local Law 144, often called the NYC bias audit law or the Automated Employment Decision Tool (AEDT) law, requires any employer or employment agency that uses automated tools to make or substantially assist hiring and promotion decisions for jobs based in New York City to do three things. First, commission an independent bias audit of the tool no more than one year before using it. Second, publish a summary of the audit results on the company website before the tool is used. Third, provide candidates and employees with at least 10 business days' advance notice that an AEDT will be used, along with the job qualifications being assessed and instructions for requesting an alternative selection process or accommodation.

Also worth reading: What are the EU pay gap reporting categories and how do employers comply with the Pay Transparency Directive? · What do employers need to do to comply with the Colorado AI Act in 2026? · What are the current state level AI hiring tool regulations employers must comply with in 2026?

The law was passed by the NYC Council in November 2021, signed into law in December 2021, and after multiple delays took effect on January 1, 2023, with enforcement beginning July 5, 2023. As of August 2026, the law has been in force for more than three years, and enforcement has matured from early warning letters into active investigations by the NYC Department of Consumer and Worker Protection (DCWP). Violations carry civil penalties of $500 per violation for a first offense and up to $1,500 per violation for subsequent violations, with each day an AEDT is used without compliance counted as a separate violation — meaning penalties can accumulate quickly for large-scale users.

It is worth being precise about what the law does not require. It does not ban AI in hiring. It does not mandate that a tool pass the audit or achieve any particular fairness score. A vendor can publish poor results and still be used legally in New York City. The statute's mechanism is transparency, not prohibition — which is exactly why critics have called it weak, and why employers should not mistake legal compliance for protection against discrimination claims under federal, state, or other local laws.

Why the Law Exists and How It Defines Key Terms

Local Law 144 emerged from growing concern that algorithmic hiring tools could encode historical bias at scale. The City Council found that automated systems screening resumes, scoring video interviews, or ranking candidates might systematically disadvantage women, older workers, people with disabilities, and members of protected racial groups without anyone noticing. The legislative response was to force these systems into daylight through mandatory third-party testing.

The statute defines an Automated Employment Decision Tool as any computational process, derived from machine learning, statistical modeling, data analytics, or artificial intelligence, that issues simplified output — including a score, classification, or recommendation — that is used to substantially assist or replace discretionary decision-making for employment decisions. This definition matters because it draws lines around scope. Tools that merely automate administrative tasks like scheduling interviews or formatting job postings fall outside the law. Tools that rank candidates, score assessments, or recommend who advances are squarely inside it.

"Substantially assist" is the phrase that generates the most confusion. DCWP guidance indicates that a tool substantially assists a decision when it either independently makes the decision or is one of several factors weighted such that its output meaningfully determines the outcome. If a recruiter reviews every application regardless of the tool's output, the tool likely does not qualify; if recruiters only interview candidates the system ranks highly, it almost certainly does. Employers should document their actual workflow honestly rather than structuring it to evade the definition — regulators and plaintiffs' attorneys both look at how the process functions in practice, not how it is described on paper.

Who Must Comply and When

The law applies to employers and employment agencies that use AEDTs for positions physically performed in New York City, including remote roles where the work location is New York City. It also applies directly to vendors who sell or license AEDTs to covered employers. There is no small-employer exemption: a five-person startup using an applicant tracking system with AI resume ranking has the same obligations as a Fortune 500 company. Headcount thresholds that appear in other AI laws, such as Illinois's HB 3773 or Colorado's AI Act, do not apply here.

Timing requirements are specific. The independent bias audit must have been completed within the twelve months preceding the tool's use. The published summary must appear on the employer's career page or website, indexed so it is accessible via search engines, before the first use of the tool. Candidate notice must go out at least ten business days before the AETD assesses them, whether through the job posting, application flow, or a separate communication. As of mid-2026, annual re-auditing is effectively required for continuous use, since the audit must remain within the one-year window.

Employers should also track the broader regulatory environment. Illinois amended its Human Rights Act effective January 1, 2026, to require disclosure of AI use in hiring and prohibit discriminatory AI outcomes. Colorado's AI Act takes effect in June 2026 with impact assessment duties for high-risk systems. Connecticut enacted its own AI employment provisions. California's Civil Rights Council finalized regulations on automated-decision systems in 2025. Local Law 144 was the template, but it is no longer the whole picture — multistate employers need a compliance program designed for overlapping regimes, not a single New York checkbox.

How the Bias Audit Actually Works

A compliant bias audit measures the AEDT's impact rate across protected categories. The methodology follows the four-fifths rule tradition from EEOC guidance: calculate the selection rate (the proportion of candidates scored positively or advanced) for each demographic group, then compute ratios comparing each group to the highest-performing group. Under the law's published specifications, audits report impact rates by sex, race/ethnicity, and intersectional combinations of the two. For example, if 60 percent of male applicants pass an automated screen but 42 percent of female applicants do, the female-to-male impact ratio is 0.70 — below the 0.80 threshold traditionally associated with adverse impact.

The audit can be conducted prospectively (on historical data the tool already produced) or retrospectively (on live usage during the audit period), and the law permits either. Prospective audits test the tool against historical candidate data before deployment; retrospective audits measure real-world outcomes over the prior year. Most vendors choose prospective audits because they are faster and cheaper, though retrospective audits arguably reflect actual deployment conditions better. Data quality is the perennial bottleneck: many employers cannot reliably reconstruct race and gender data for past applicants, since collecting that data voluntarily at application is common practice but incomplete. Auditors handle this through statistical imputation methods, which introduce uncertainty that should be disclosed in the published summary.

The final deliverable includes the published summary posted publicly — showing the tool's name, version, date, impact rates by category, and the distribution of scores — plus a private full report to the employer detailing methodology, sample sizes, and caveats. The public summary is deliberately limited; the deeper analysis stays internal unless litigation forces disclosure. That asymmetry is worth understanding: your published numbers may look acceptable while your internal report reveals problems you need to fix before a plaintiff or the EEOC finds them first.

Choosing Between Vendor-Arranged and Independent Audits

One structural criticism of Local Law 144 is that most vendors arrange and pay for their own audits, raising independence questions even when the auditor is technically a separate firm. Employers have two main paths, each with tradeoffs:

For most small and mid-sized employers, relying on a vendor's published audit is the pragmatic choice, provided they verify the audit exists, falls within the one-year window, covers the specific tool version they use, and matches their deployment configuration. A generic audit of a platform's flagship product may not cover a customized instance with different weighting or training data. Larger employers, particularly those hiring thousands of candidates annually in New York City, increasingly commission their own audits or negotiate audit rights into vendor contracts precisely because the reputational and litigation stakes justify the cost.

Practical Steps to Reach Compliance

Start with an inventory. Catalog every software system involved in hiring and promotion decisions — ATS platforms, assessment providers, video interview analyzers, chatbot screeners, sourcing tools — and classify each against the AEDT definition. Document how each tool's output feeds human decisions, because that workflow determines whether the tool "substantially assists." This inventory exercise frequently surprises employers: tools acquired years ago by a recruiting team may constitute AEDTs nobody in HR leadership knew about.

Next, close the notice and publication gaps, which are the cheapest fixes and the most commonly cited violations. Post the audit summary link prominently, build the ten-business-day candidate notice into your application flows, and train recruiters to answer candidate questions about the alternative-process request right. DCWP's FAQs clarify that employers must provide a reasonable alternative selection process upon request, and failing to honor those requests is itself a violation.

Then establish an ongoing governance rhythm. Set calendar triggers for annual re-audits, assign ownership for monitoring vendor audit updates, and create a review step whenever a vendor updates a model version — a new version technically requires fresh audit coverage. Integrate the findings into your broader EEO compliance program: an impact ratio of 0.72 for a protected group is not just an LL144 data point, it is evidence a plaintiff's attorney would love. Remediation conversations with vendors, adjusted cutoffs, or human review layers should follow from bad numbers, not just publication of them.

Finally, consider centralizing this work in a compliance management function or platform. Multistate employers now face LL144, Illinois's disclosure rules, Colorado's June 2026 impact-assessment deadlines, and emerging state laws with different definitions and timelines. Tracking each obligation manually across spreadsheets breaks down quickly; organizations managing AI-in-hiring compliance through dedicated regulatory workflows report fewer missed deadlines and cleaner audit trails when regulators come asking.

Common Mistakes and Enforcement Realities

The most frequent mistakes are unglamorous. Employers post the audit summary somewhere obscure or fail to index it properly, violating the publication requirement while believing themselves compliant. They skip or shorten the ten-business-day notice window, especially for fast-moving requisitions. They assume their ATS vendor handled everything, without verifying that the audit covers their configuration and current tool version. They treat the audit as a one-time event and let it lapse past the twelve-month mark. And they request demographic data improperly — the law prohibits requiring candidates to disclose protected characteristics, so collection must be voluntary and clearly optional.

A subtler error is over-reliance on the audit itself. An audit measures disparate impact on the categories tested; it says nothing about validity, accuracy, or performance across disability status, age, or national origin intersections beyond the mandated ones. Publishing a clean LL144 summary provides zero protection against an EEOC charge or a private discrimination lawsuit if the tool actually disadvantages a group the audit did not capture. Commentators, including analyses in the National Law Review and IAPP, have noted enforcement gaps and the law's narrow scope — but courts and plaintiffs are not bound by those gaps.

Enforcement has also been weaker than the law's design suggested, which cuts both ways. Early DCWP enforcement focused on notice and publication failures rather than audit substance, and critics documented limited investigation activity in the law's first two years. But a light-touch present is not a guarantee: DCWP can retroactively examine records, and penalty accrual per day per violation means a lapsed audit discovered during an investigation can generate substantial exposure. Prudent employers treat enforcement quietness as breathing room to build durable programs, not as permission to deprioritize.

Costs, Timelines, and When to Act

Budget expectations as of 2026: vendor-bundled bias audits typically run $2,000 to $10,000 annually, standalone independent audits range from roughly $7,500 to $50,000 depending on data volume and complexity, and enterprise programs combining audits, legal review, and ongoing monitoring can exceed $100,000 per year. The candidate notice and web publication components cost little beyond staff time. Compare these figures against the penalty structure — $500 to $1,500 per violation per day — plus the far larger cost of defending a discrimination claim, and the economics favor compliance decisively.

Timeline-wise, a straightforward vendor audit takes four to eight weeks once data access is granted; employer-commissioned audits with messy historical data can take three to six months. If you are deploying a new AEDT, begin audit arrangements during procurement, not after signature — negotiating audit rights, data access, and update-trigger clauses into the contract is far easier before you are locked in.

If you have not started, act now. The regulatory trajectory points toward more states adopting LL144-style requirements with stricter definitions, and federal agencies continue scrutinizing algorithmic hiring under existing civil rights authorities. The employers best positioned for 2027 and beyond are those treating bias auditing not as a New York paperwork chore but as the visible layer of a genuine AI governance program covering inventory, testing, remediation, and documentation across every jurisdiction where they hire.