What New York City’s AI hiring rules require in 2026
New York City Local Law 144 remains one of the most explicit US rules governing automated employment decision tools, or AEDTs. An AEDT is generally a computational process, artificial intelligence system, or algorithmic method used to make or substantially assist a hiring or promotion decision. Employers and employment agencies that use these tools in New York City must give candidates and employees notice of the tool’s use, provide the vendor’s data-governance information, and conduct and publish the results of an independent bias audit. These obligations have applied since July 5, 2023, and they remain relevant in 2026 even as New York State, Illinois, California, and other jurisdictions add broader employment-AI requirements.
Also worth reading: How Can Employers Build Responsible AI Hiring Compliance Into HR Decisions? · Can Employers Effectively Test AI Hiring Bias Before Lawsuits? · How Should Employers Control AI Hiring Risks in 2026?
The law is not a blanket ban on AI-assisted hiring. Employers may continue using systems to screen résumés, rank applicants, assess interview recordings, recommend interview questions, or support promotion decisions, provided that applicable notice, audit, and anti-discrimination requirements are met. The rule does not itself certify an AI vendor or make every algorithmic decision unlawful. Instead, it creates procedural duties and relies heavily on existing federal, state, and city discrimination law to address harmful outcomes. A tool that passes a Local Law 144 audit can still create liability if it unlawfully screens out a protected group.
Who is covered and what counts as an AI hiring tool
Local Law 144 applies to an employer or employment agency that uses an AEDT for a candidate or employee within New York City. The required notice covers the tool’s purpose and the availability of its data-related information for selection or promotion applicants. Covered entities must also publish the results of a bias audit performed within the preceding year. Common covered tools include résumé-ranking platforms, automated interview systems, candidate-chatbot scoring, video-interview assessment, and algorithms that identify qualified applicants from job boards or internal talent pools.
The compliance threshold is different from the ordinary size threshold used in some employment laws. The core requirements are not limited only to companies with a stated minimum number of employees, although the connected prohibition on discriminatory AEDT use generally protects candidates and employees rather than imposing a simple headcount threshold. Separate exemptions can matter under New York City’s Local Law 63, which regulates discriminatory automated decision making more broadly. Entities that were already subject to that law’s requirements, or that fall within its provisions, do not have to satisfy the parallel Local Law 144 notice and audit obligations.
A simple software feature is not necessarily an AEDT merely because it is automated. The key question is whether it makes or substantially assists a decision about selecting, interviewing, screening, ranking, promoting, or removing a person. Human review does not automatically remove a tool from the rule, but a reviewer who has no meaningful ability to examine the result, change the recommendation, or understand its basis may be a nominal rather than substantive safeguard. Employers should document what decision the tool influences, who can override it, and how candidates or employees can request the required information.
The notice, candidate, and publication requirements
For candidates and employees considered for selection or promotion, a covered employer must provide notice that an AEDT will be used in the hiring or promotion process. The notice may be provided during the application process, before use of the tool, or as otherwise prescribed by the city’s rules. Employers must give notice at least 10 business days before the AEDT is used to help make a selection decision, although giving earlier notice is often operationally simpler. A notice attached only to an inaccessible privacy policy is unlikely to provide a reliable compliance record.
The notice must identify the AEDT’s purpose. It must also direct the recipient to information supplied by the vendor concerning data governance. The underlying candidate data-notice provisions can include the categories of personal information the tool uses, the employer’s data-retention policy and deletion practices, and the type of source data the vendor uses. New York City’s regulations restrict what the notice itself must reproduce; employers should use the approved notice language and give the current official data notice rather than improvising a short disclosure.
At the same time, a covered employer must make available on its website the results of the most recent independent bias audit. The audit must have been completed within the prior year. The public document is a summary rather than a full technical audit dossier, and it must include the auditing and data-analysis organizations, the scope and methodology of the test, the groups tested, and the type of fairness metrics used. Publication creates a public benchmark, but it is not a substitute for maintaining workpapers, selecting the auditor, or responding internally when results show material disparities.
| Compliance item | New York City requirement | Practical record to retain |
|---|---|---|
| Disclosure | Give qualifying candidates and employees notice before an AEDT assists a selection or promotion decision | Notice version, delivery method, delivery date, and recipient population |
| Timing | At least 10 business days before the covered use | Screening calendar showing the cutoff date and tool activation date |
| Vendor information | Identify the tool’s purpose and provide vendor data-governance information | Vendor name, tool version, URLs, data notice, and contracting entity |
| Bias audit | Complete an independent audit within the preceding year | Engagement letter, independence analysis, methodology, results, and sign-off |
| Publication | Publish the latest audit summary on the employer’s website | Public URL, publication date, approved summary, and change history |
| Enforcement | DCWP enforcement; the local law has no private right of action | Inspection-ready evidence of controls, oversight, and corrective action |
The independent bias audit examines whether an AEDT produces different results for different groups and uses appropriate statistical tests. The audit should cover the categories and populations required by New York City’s rules and evaluate the tool in the actual employment context in which it will operate. Merely asking a vendor for a generic certification is not enough. The employer remains responsible for confirming that the auditor is independent, the test is reasonably designed, and the published summary accurately reflects the work performed.
Audit selection should account for the vendor’s role and the employer’s access to decision data. A company using a third-party applicant-ranking service may not have unrestricted access to rejected candidates, interview results, or hiring outcomes, yet the audit still needs data that permits meaningful comparison. Contracts should therefore require access to identity and outcome data sufficient for a qualified auditor to perform required testing. Employers should also preserve the use case examined because an audit of résumé ranking cannot stand in for a materially different product used to evaluate video interviews.
An independent bias audit is not a promise that no bias exists. Statistical parity can be difficult to assess when groups differ in experience, availability, or job-related qualifications, and an audit can detect differences without establishing unlawful discrimination. Conversely, a clean summary can conceal weak data, small samples, missing variables, or a rapidly changed model. The best practice is to repeat the audit after a model update, acquire a new vendor, or move from assistance to a more consequential decision, even if the city’s rolling one-year rule is the only express timing trigger.
How the city requirements interact with state and federal law in 2026
New York City’s rules do not replace the antidiscrimination framework already applicable to employers. Title VII, the Equal Credit Opportunity Act where relevant, the New York State Human Rights Law, and the New York City Human Rights Law can apply to hiring outcomes regardless of whether an algorithm made the final decision. The US Equal Employment Opportunity Commission has also used a technical-assistance approach for software and AI tools used in employment selection, warning that existing discrimination and accessibility requirements remain controlling. Automation changes the evidence trail; it does not change the underlying employer duty to make employment decisions without unlawful discrimination.
For New York State employers, a separate employment-AI notice law took effect on January 1, 2026. Covered employers must provide candidates and employees written notice about the use of AI in recruitment, hiring, promotion, performance management, and other employment decisions. When a notice is requested, the employer must provide an explanation of how the AI is used in the process and the role it plays in making the decision. The state’s obligations should be combined with, rather than confused with, New York City’s vendor-data, 10-business-day, and independent-audit requirements.
Other jurisdictions also create a patchwork. Illinois employment-AI rules became applicable on January 1, 2026 and address notice and the treatment of AI in employment decisions. California’s employment-discrimination regulations now address the discriminatory use of automated decision systems. Colorado’s AI Act is relevant to certain high-risk employment uses, although its timing changed through state legislation. An employer recruiting in multiple locations should maintain a jurisdiction matrix covering the hiring entity, candidate location, decision location, tool use, notice period, vendor duties, audit needs, and available explanation or appeal path.
A practical compliance process for employers using AI hiring tools
The first step is an accurate inventory rather than a review of a single vendor contract. Employers should identify every tool that screens, ranks, scores, recommends, or substantially assists a hiring or promotion decision, including systems inside the applicant tracking system, job boards, interview platforms, assessment providers, and internal machine-learning products. The inventory should name the legal employer, vendor, product, owner, model version, data sources, candidate groups, business purpose, and countries or cities where the tool operates. Legacy spreadsheets or undocumented scripts can fall within the same review because they are algorithmic and can make consequential recommendations.
The second step is to classify each use by jurisdiction. New York City Local Law 144 may apply where another state’s rule does not, and the New York State notice law is not identical to the city’s AEDT framework. Covered teams should issue candidate-facing notices, attach the correct vendor information, complete the required audit, and publish its summary. A good control links the notice to the exact recruitment campaign and pauses automated scoring if notice timing is not met. Promotion, internal mobility, contract-worker, and temporary-worker processes should receive the same review rather than being treated as peripheral.
The third step is to test whether the vendor can supply decision-level data and meaningful oversight. Employment contracts should define audit cooperation, data access, retention, deletion, security, model-change notice, service levels, bias testing, incident reporting, and support for candidate inquiries. If the employer cannot access the data needed to investigate a disparate-impact concern, that should be treated as a contract and governance failure, not as proof that no problem exists. Employers should avoid automatic rejection rules based on age, disability, pregnancy, caregiving status, race, sex, religion, or other protected or legally restricted characteristics unless the employer has a lawful, documented basis and specific legal review.
Costs, timelines, and vendor selection
New York City does not prescribe a single audit price, so the cost depends on tool complexity, data quality, audit scope, and the auditor’s independence. A narrow review of a low-volume recruiting workflow may cost roughly $10,000 to $30,000, while a multi-model, enterprise audit can reach $50,000 to $150,000 or more. Annual legal review, workflow redesign, and audit cycle planning may add another $10,000 to $75,000. These are planning ranges rather than government rates, and vendors offering a low-cost “NYC compliance certificate” should be evaluated carefully because the statutory duty rests with the covered employer or employment agency.
Software and monitoring services can add approximately $5,000 to $50,000 or more per year, while some enterprise audit platforms cost considerably more. These prices do not include the internal labor required to collect applicant data, train recruiters, test overrides, correct notices, and update the public audit page. For most employers, preventing unlawful selection outcomes and keeping defensible records is more valuable than optimizing the score produced by a marginal productivity tool.
| Buyer question | Evidence to request | Warning sign |
|---|---|---|
| Is the auditor genuinely independent? | Scope, methodology, data access, auditor relationship, and signed report | Auditor has a prohibited financial or business relationship with the vendor |
| Can the tool be audited in this use case? | Grouped selection rates, impact ratios or appropriate tests, and sample sizes | Vendor offers only a general platform audit unrelated to the employer’s use |
| Can candidates receive required information? | Current official notice and vendor data-governance document | Tool is used before notice and no campaign control prevents the error |
| Can the employer investigate complaints? | Decision logs, model version, inputs, outputs, overrides, retention, and deletion terms | Data is locked in the vendor and cannot be produced for review |
| Does the product change after deployment? | Advance notice of material updates, retraining, and new testing | Model or scoring logic can change without employer knowledge |
A common mistake is assuming that a vendor statement such as “bias tested” satisfies Local Law 144. The required audit must meet the city’s independence, timing, scope, and publication rules, and a vendor’s commercial assurance does not transfer the employer’s responsibility. Another mistake is giving notice after the ranking has already filtered candidates. A separate error is publishing the audit report internally but not on the employer’s public website, where the city expects the required summary to be available.
Employers also confuse numerical parity with legal compliance. Similar selection rates across large groups can coexist with a poorly designed job, inaccessible technology, or evidence that a variable serves as a proxy for protected status. Conversely, a measurable difference may be defensible when it is job-related and consistent with business necessity, but explaining that justification is a legal process, not a reporting phrase that the algorithm automatically validates. Retraining a model in response to a complaint should preserve before-and-after evidence rather than erase the prior record.
Local Law 144 is enforced through the New York City Department of Consumer and Worker Protection. The law does not provide a private right of action, but a deficient audit or notice can be used as evidence in a discrimination dispute, and other statutes may provide private claims. Administrative exposure can include correction orders, penalties, or continuing compliance requirements under the applicable city law, while discriminatory outcomes can create exposure under federal, state, and city human-rights statutes. A hiring tool should therefore be reviewed before launch, after a material update, at least annually for the city audit requirement, and whenever a complaint, regulator inquiry, or pattern in hiring outcomes suggests a problem.
The most defensible position is not that AI hiring is prohibited in New York City. It is that an employer can use an AEDT while documenting its purpose, giving timely notice, providing the prescribed vendor information, publishing a valid bias audit, preserving decision data, testing for disparate impact, and retaining meaningful human authority. For employers operating in New York City and other regulated states in 2026, that operating discipline is no longer optional. It is a condition for using automated tools in a way that management, recruiters, vendors, and the public can explain.