Does NYC Local Law 144 apply to AI tools used only for internal employee promotions?

Yes, the law explicitly covers both hiring and promotion decisions when an automated employment decision tool is used to substantially assist or replace discretionary decision-making. The DCWP has confirmed in multiple guidance documents that internal mobility tools, including those used for succession planning or internal job boards, fall under the law’s scope if they generate scored rankings or recommendations that influence human reviewers. Employers must conduct a bias audit and publish a summary for any such tool used in NYC-based promotion processes, regardless of whether the tool is also used for external hiring.

How often must a bias audit be renewed under Local Law 144 if the tool remains unchanged?

The law does not specify a fixed renewal period for unchanged tools, but the DCWP expects audits to reflect current operational conditions and advises re-auditing at least annually as a best practice. This is because shifts in applicant demographics, job requirements, or societal benchmarks for fairness can alter disparate impact over time, even without algorithmic changes. Employers who rely on outdated audits risk enforcement action if the DCWP determines the summary no longer reflects the tool’s current impact, particularly in high-volume or rapidly evolving hiring environments.

Can a vendor provide the bias audit to satisfy Local Law 144 requirements for multiple employer clients?

No, each employer must obtain an independent bias audit specific to their use of the tool, even if the same AEDT is used by multiple clients. The independence requirement prohibits the vendor from conducting the audit, and the audit must reflect the employer’s actual applicant data and hiring outcomes, which vary by organization. While vendors may offer audit-friendly tools or pre-compliance assessments, the final audit and public summary must be employer-specific and conducted by a third party unaffiliated with both the vendor and the employer.

What penalties exist for failing to comply with NYC Local Law 144 as of September 2026?

Violations incur civil penalties of up to $1,500 per instance, with each day of non-compliance and each separate job posting using an unaudited AEDT counting as a distinct violation. The DCWP has enforced this cumulatively, resulting in six-figure fines for companies with ongoing hiring campaigns using non-compliant tools. In addition to fines, non-compliant employers may be issued cease-and-desist orders requiring immediate discontinuation of the tool in NYC contexts until audit and publication requirements are met.

Is it sufficient to link to a vendor’s general AI fairness report instead of publishing a Local Law 144-specific summary?

No, linking to a vendor’s general fairness report, ethical AI statement, or third-party certification does not satisfy the law’s public disclosure requirement. The DCWP mandates a summary that includes the audit date, tool name and version, selection rates by race/ethnicity and sex, and a clear statement of whether the four-fifths rule was met—all derived from an independent audit of the employer’s specific use of the tool. Generic vendor disclosures lack the specificity, timeliness, and independence required under the law and have been rejected in enforcement proceedings.

What are the NYC Local Law 144 audit requirements for automated employment decision tools in 2026?

Understanding NYC Local Law 144 and Its Scope

NYC Local Law 144, enacted in November 2021 and effective from July 5, 2023, regulates the use of automated employment decision tools (AEDTs) in hiring and promotion decisions within New York City. The law requires employers and employment agencies to conduct an independent bias audit before using such tools and to make a summary of the audit results publicly available on their website. As of September 2026, enforcement by the NYC Department of Consumer and Worker Protection (DCWP) has matured, with increased scrutiny on compliance, particularly for AI-driven tools used in high-volume hiring sectors like technology, finance, and healthcare. The law defines an AEDT as any computational process, derived from machine learning, statistical modeling, data analytics, or artificial intelligence, that issues simplified output (such as a score, classification, or recommendation) used to substantially assist or replace discretionary decision-making in employment contexts. Notably, the law applies regardless of whether the tool is developed in-house or by a third-party vendor, placing the compliance burden squarely on the employer using the tool in NYC. Covered entities must ensure that the audit evaluates disparate impact across race, ethnicity, and sex categories, using the four-fifths rule as a threshold for adverse impact. The law does not require audits for tools used solely for administrative tasks like scheduling or payroll, nor does it apply to general resume databases unless they generate scored rankings for hiring decisions. Employers operating remotely but hiring for NYC-based roles remain subject to the law if the AEDT influences decisions for those positions. The DCWP has clarified that even hybrid or remote hiring processes triggering NYC resident candidate evaluations fall under jurisdiction, reinforcing the law’s extraterritorial reach in practice.

Also worth reading: What are automated employment discrimination audits in 2026 and how do employers implement them legally? · What are the legal and operational requirements for an AI hiring bias audit in 2026? · What is a psychosocial hazard compliance checklist and how can AI-powered tools help organizations meet 2026 regulatory requirements?

Core Requirements of the Bias Audit Under Local Law 144

The bias audit must be conducted by an independent auditor or auditing entity that has no employment relationship with the employer or the vendor providing the AEDT. Independence is a critical threshold; internal HR teams, even if statistically trained, cannot perform the audit unless they are functionally segregated and demonstrably free from influence by the tool’s deployment stakeholders. The audit must calculate selection rates for each demographic group (race/ethnicity and sex) and compare them to the group with the highest selection rate, applying the four-fifths rule: if any group’s selection rate is less than 80% of the highest rate, it constitutes evidence of disparate impact requiring mitigation. Audits must use historical data from the tool’s actual use, or if insufficient, validated test data that mirrors real-world applicant pools. As of 2026, the DCWP expects audits to reflect at least one year of operational data where available, reducing reliance on synthetic or limited pilot datasets. The audit report must include the date of the audit, the tool’s name and version, the data used, the selection rates by demographic category, and a clear statement of whether the four-fifths rule was met for each category. Employers must preserve the full audit documentation for at least five years and provide it to the DCWP upon request. Importantly, the law does not require remediation if adverse impact is found—only transparency—but failure to audit or publish results incurs civil penalties of up to $1,500 per violation, with each day of non-compliance and each job posting using an unaudited tool counting as a separate violation. This cumulative penalty structure has led to significant financial exposure for non-compliant firms, particularly in industries with continuous hiring cycles.

Public Disclosure Obligations and Transparency Standards

Following the audit, employers must post a clear and conspicuous summary of the results on their employment website’s careers section before using the AEDT. The summary must include the date of the audit, the tool’s name and version, the selection rates for each demographic category (broken down by race/ethnicity and sex), and whether the tool resulted in a disparate impact based on the four-fifths rule. The DCWP has emphasized that burying this information in privacy policies, terms of service, or general corporate social responsibility pages does not satisfy the requirement; it must be readily accessible to job seekers navigating the hiring portal. As of 2026, the agency has issued guidance specifying that the summary should be available within one click from the main careers page and must not require account creation or login to view. Employers using third-party career sites (like LinkedIn or Indeed) must either ensure the summary appears on those platforms or direct applicants to their own hosted version via a prominent link. The law does not mandate specific formatting, but the DCWP recommends plain language summaries avoiding technical jargon to ensure accessibility. Some employers have adopted interactive dashboards or downloadable PDFs, though static text summaries remain most common. Failure to post the summary correctly—such as omitting demographic breakdowns or using outdated audit data—has been a frequent source of violations in DCWP enforcement actions. In 2025, over 60% of cited cases involved incomplete or inaccessible disclosures rather than the absence of an audit altogether, highlighting that transparency execution is as critical as the audit itself.

Step-by-Step Process for Conducting a Compliant Audit

Organizations seeking compliance should begin by inventorying all AEDTs in use or planned for use in NYC hiring or promotion decisions. This includes tools for resume screening, video interview analysis, skills assessment scoring, and personality inventories that generate comparative rankings. Once identified, the next step is to engage an independent auditor with demonstrated expertise in algorithmic fairness, employment law, and statistical disparity analysis. Credentials such as certification from the AI Now Institute, experience with EEOC guidelines, or prior work under Illinois’ AI Video Interview Act are strong indicators of suitability. The auditor must then define the audit period, ideally covering at least six months of operational data to ensure statistical reliability, and collect anonymized applicant data linked to hiring outcomes and demographic self-identification (voluntary disclosure, stored separately to prevent misuse). Using this data, the auditor calculates selection rates—typically the proportion of applicants from each group who advance to the next stage or receive an offer—and compares them against the highest-performing group. If the four-fifths rule is violated in any category, the audit must note the disparity but does not require corrective action under the law. The employer then drafts the public summary using the auditor’s findings, reviews it for clarity and completeness, and publishes it before deploying or continuing to use the tool. Throughout this process, legal counsel should be involved to ensure alignment with broader anti-discrimination laws like Title VII and the NYCHRL, as Local Law 144 compliance does not immunize employers from disparate treatment claims.

Common Pitfalls and Compliance Mistakes to Avoid

One of the most frequent errors is misunderstanding the independence requirement, with companies assigning internal data science teams to conduct audits without sufficient structural separation from HR or IT departments managing the tool. The DCWP has explicitly rejected such arrangements in enforcement guidance, noting that perceived or actual conflicts of interest undermine audit credibility. Another common mistake is relying on outdated or insufficient data—such as using audit results from a tool version that has since been updated—or failing to re-audit after significant algorithmic changes, which the DCWP treats as a new tool requiring a fresh assessment. Employers also often miscalculate selection rates by focusing only on final hires instead of each sequential stage of the hiring process (e.g., application to screen, screen to interview, interview to offer), which can mask disparities that occur early in the pipeline. Additionally, some organizations mistakenly believe that using a vendor-provided audit or certification (like ISO 42001 or AI Now Institute reviews) satisfies the law, but the DCWP requires an audit specifically tailored to Local Law 144’s demographic categories and four-fifths rule framework, not general AI ethics evaluations. Failure to update the public summary when switching tools or after material changes to the AEDT has also led to violations, as has posting the summary in locations inaccessible to mobile users or behind consent walls. Finally, many employers overlook the obligation to audit tools used for internal promotions, assuming the law applies only to external hiring—a misconception the DCWP has corrected through targeted outreach and enforcement.

Cost Considerations, Timing, and Alternatives to In-House Audits

The cost of a Local Law 144-compliant bias audit varies significantly based on tool complexity, data availability, and auditor expertise. As of 2026, basic audits for simple resume-scoring tools using existing HRIS data typically range from $5,000 to $15,000. More complex assessments involving video interview analysis, natural language processing of candidate responses, or multi-stage evaluation engines can cost between $20,000 and $50,000, particularly if data extraction and anonymization require substantial IT involvement. Audits for enterprise-scale tools used across multiple job families or geographic regions may exceed $100,000 due to the need for stratified analysis and validation testing. These costs are generally one-time per tool version, though re-audits are necessary after material updates, creating recurring compliance expenses. Employers sometimes consider alternatives such as relying on vendor-provided fairness metrics or conducting internal disparity checks, but these do not meet the legal standard for independence and public disclosure. Some organizations attempt to avoid coverage by arguing their tool is not an "AEDT" because it doesn’t make final decisions, but the DCWP has consistently interpreted "substantially assist or replace discretionary decision-making" broadly to include any ranked output that influences human reviewers. There are no exemptions for small businesses or nonprofits under the law, though the DCWP has issued guidance acknowledging proportionality in enforcement priorities, focusing first on repeat offenders and high-volume users. The most practical alternative for cost control is batch auditing multiple similar tools under a single engagement or using DCWP-recognized audit templates for low-risk tools, though any deviation from standardization must be justified to maintain defensibility.

When to Act and Ongoing Compliance Monitoring

Employers must complete the bias audit and publish the summary before using an AEDT for any NYC-related hiring or promotion decision. This means the audit cannot be conducted concurrently with deployment or as a retrospective exercise after violations are detected. For new tools, the audit should be integrated into the procurement or development lifecycle, ideally completed during user acceptance testing. For existing tools already in use as of the law’s effective date, the initial audit should have been completed by July 2023, but any material change—such as a retraining cycle, feature update, or vendor switch—triggers the need for a new audit. The DCWP recommends reviewing AEDTs for potential requalification every 12 months as a best practice, even in the absence of changes, to account for drift in applicant pools or evolving societal benchmarks for fairness. Monitoring should also include tracking changes in selection rates over time and comparing them to audit baselines, which can serve as an early warning system for emerging disparities. Employers are advised to maintain a centralized registry of all AEDTs, their audit dates, versions, and public summary locations to streamline compliance management. As AI regulation expands nationally and internationally—with frameworks like the EU AI Act and proposed federal Algorithmic Accountability Act gaining traction—proactive adherence to Local Law 144 not only mitigates local risk but also builds foundational capabilities for broader regulatory readiness. Organizations that treat the audit as a one-time checkbox exercise rather than an ongoing governance process are likely to face repeated violations as enforcement evolves and public scrutiny increases.