What are the NYC Local Law 144 audit requirements for employers using automated employment decision tools?

What Is NYC Local Law 144 and Why Does It Matter

NYC Local Law 144, formally known as the Bias Audit Law, was enacted by the New York City Council in November 2021 and took effect on January 1, 2023, after multiple enforcement date extensions. The law was championed by advocates who argued that algorithmic hiring tools could perpetuate and amplify existing discrimination against protected groups, particularly in communities that have historically faced systemic barriers to employment. The legislation was motivated by growing evidence that automated decision tools, when trained on biased historical data, could reproduce patterns of exclusion at scale, affecting thousands of applicants without any human review or accountability. The law represents one of the first comprehensive regulatory frameworks in the United States specifically targeting the use of artificial intelligence in employment decisions, setting a precedent that other jurisdictions have since followed.

Also worth reading: What Are the AI Hiring Compliance Requirements Employers Must Meet in 2026? · How Can Employers Automate AI Employment Compliance in 2026? · What State Employment Rules Should Employers Know in September 2026?

The law applies to any employer located in New York City, including labor organizations and employment agencies, that uses an automated employment decision tool (AEDT) to screen or evaluate candidates for employment or to assess current employees for promotion, transfer, or retention. An AEDT is defined broadly as any computational process derived in whole or in part from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, such as a score, classification, or recommendation, that is used to substantially assist or replace discretionary decision making. The definition captures a wide range of tools, from simple resume screening software to complex predictive analytics platforms, meaning that employers who may not think of their technology as "AI" could still fall within the scope of the regulation.

The enforcement date was originally set for January 1, 2023, but was extended to July 5, 2023, to give employers additional time to comply. The New York City Department of Consumer and Worker Protection (DCWP) published detailed FAQs and final regulations to clarify the law's requirements, addressing questions about what constitutes an AEDT, what qualifies as a bias audit, and how employers should handle third-party vendor tools. As of 2026, the regulatory landscape continues to evolve, with additional guidance and enforcement actions shaping how employers interpret and implement their obligations under the law.

The Core Audit Requirement: What Employers Must Do

At the heart of Local Law 144 is the requirement that employers must obtain an independent bias audit of any AEDT before using it, and the audit results must be made publicly available on the employer's website. The bias audit must be conducted by an independent auditor, meaning someone who is not an employee of the employer or the vendor that developed the tool, and who has no financial or other interest in the outcome of the audit. This independence requirement is designed to ensure that the assessment is objective and credible, free from conflicts of interest that could compromise the thoroughness or honesty of the findings.

The audit must assess the tool's impact on members of protected classes, which under NYC law include categories such as race, ethnicity, gender, age, disability status, sexual orientation, and other characteristics protected by the New York City Human Rights Law. Specifically, the audit must evaluate whether the tool disproportionately excludes or disadvantages individuals from these protected groups compared to the baseline population, a concept often referred to as disparate impact. The law does not prescribe a single statistical methodology for conducting this analysis, but it does require that the audit follow the methodology described in the final regulations published by DCWP, which reference standards such as the four-fifths rule or other recognized statistical tests for adverse impact.

The results of the bias audit, along with the date of the audit and the name of the independent auditor, must be posted on the employer's website in a clear and conspicuous manner. This public disclosure requirement is a distinctive feature of Local Law 144 that goes beyond many other anti-discrimination laws, which typically require audits but do not mandate public transparency. The rationale is that public disclosure creates accountability and allows job applicants, advocacy groups, and the general public to understand how employment decisions are being made and whether they are fair. Employers must also provide a copy of the bias audit to any job applicant or employee upon request, further reinforcing the transparency mandate.

Practical Steps for Conducting a Bias Audit

Conducting a bias audit under Local Law 144 involves several practical steps that employers should follow methodically to ensure compliance. The first step is to identify all AEDTs currently in use or planned for use, which requires a thorough inventory of the technology stack across the human resources function. Many employers discover that they are using tools they did not previously classify as AEDTs, such as video interviewing platforms that analyze facial expressions or speech patterns, gamified assessments that measure cognitive or personality traits, or natural language processing tools that screen cover letters and resumes. This inventory process often reveals a broader and more complex technology ecosystem than employers initially assumed, making it essential to involve stakeholders from IT, legal, and HR departments.

Once the AEDTs have been identified, the employer must engage an independent auditor who has the technical expertise to evaluate the tool's impact on protected classes. The auditor will typically request access to the tool's training data, algorithmic logic, and output distributions, as well as demographic data about the applicant or employee population being assessed. The auditor will then perform statistical analyses to determine whether the tool produces disparate impact against any protected group, using methodologies such as the four-fifths rule, which holds that a selection rate for a protected group that is less than four-fifths (or 80 percent) of the rate for the most favored group is generally regarded as evidence of adverse impact. The auditor may also conduct qualitative assessments to evaluate whether the tool's design or implementation introduces bias through factors such as proxy variables or flawed assumptions.

After the analysis is complete, the auditor will produce a written report that details the methodology used, the findings, and any recommendations for mitigating identified biases. This report forms the basis for the public disclosure required by the law. Employers should be aware that the audit process can take several weeks to several months depending on the complexity of the tool and the availability of data, and that the cost of a bias audit can range from several thousand dollars for a straightforward assessment to tens of thousands of dollars for a comprehensive evaluation of a complex machine learning model. Employers who use third-party vendor tools should coordinate with the vendor to obtain the necessary data and documentation, though the legal responsibility for compliance remains with the employer, not the vendor.

Comparison of Audit Approaches and Alternatives

Employers facing Local Law 144 compliance obligations have several approaches available to them, each with distinct trade-offs in terms of cost, thoroughness, and risk management. The table below compares the primary options that employers commonly consider when planning their compliance strategy.

The choice among these approaches depends on the employer's size, budget, technology complexity, and risk tolerance. Smaller employers with limited technical expertise may find that engaging a third-party auditor is the most practical and legally defensible option, even though it comes at a higher cost. Larger employers with mature data science teams may be tempted to conduct audits internally to save money, but they must be careful to ensure that the independence requirement is genuinely met, which can be challenging when the auditor is an employee of the same organization. Automated compliance platforms have emerged as a middle-ground option, offering tools that can help employers prepare for audits, monitor ongoing bias, and manage the documentation and disclosure requirements, though employers should carefully evaluate whether these platforms use genuinely independent auditors and whether their methodologies align with DCWP's expectations.

Common Mistakes and Pitfalls to Avoid

Employers navigating Local Law 144 compliance frequently make several common mistakes that can expose them to enforcement actions and reputational damage. One of the most prevalent errors is failing to recognize that the law applies to tools they already use, particularly those purchased from third-party vendors. Many employers assume that because a tool is marketed as "bias-free" or "fair" by its vendor, they are exempt from the audit requirement, but the law makes no distinction based on vendor claims. The responsibility for compliance rests squarely on the employer, and relying on a vendor's marketing materials without independent verification is a significant risk.

Another common mistake is misunderstanding the scope of what constitutes an AEDT. Some employers narrowly interpret the definition to include only tools that make final hiring decisions, when in fact the law covers any tool that "substantially assists" in the decision-making process. This means that tools used for initial screening, ranking, or categorization of applicants are covered even if a human decision-maker ultimately makes the final call. The DCWP has been clear that the threshold for "substantial assistance" is low, and employers who attempt to narrow the definition to avoid compliance are likely to find themselves on the wrong side of an enforcement action.

A third pitfall is failing to update the bias audit when the tool is modified or when the population being assessed changes significantly. A bias audit is not a one-time event but rather a snapshot of the tool's performance at a particular point in time. If the tool is updated, retrained, or used with a substantially different applicant pool, the previous audit may no longer be accurate or valid. Employers should establish processes for monitoring their AEDTs on an ongoing basis and for commissioning updated audits when significant changes occur. Additionally, some employers fail to make the audit results publicly available on their website in the manner required by the law, either by burying the information in a hard-to-find location or by failing to update the disclosure when a new audit is conducted. These procedural failures, while seemingly minor, can trigger enforcement actions and penalties.

When to Act and What Happens If You Don't

The timeline for compliance with Local Law 144 is clear and has already been in effect since July 5, 2023, meaning that any employer in New York City using an AEDT should already be in compliance. However, for employers who have delayed action or who are newly subject to the law due to expansion into NYC, the urgency is immediate. The DCWP has indicated that it will enforce the law actively, and the penalties for non-compliance can be significant. Employers who fail to obtain a bias audit or who fail to make the audit results publicly available can face civil penalties of up to $500 for the first violation, $500 for the second violation, and $1,000 for each subsequent violation, with the possibility of additional penalties through the NYC Human Rights Law enforcement process.

Beyond the financial penalties, employers who fail to comply face reputational risk that can be far more damaging than the monetary costs. In an era where job applicants and employees are increasingly aware of AI and algorithmic decision-making, a public failure to conduct a bias audit or a finding of significant bias in an employer's hiring tools can generate negative media coverage, social media backlash, and loss of trust among candidates and employees. The public disclosure requirement of Local Law 144 means that non-compliance is visible to anyone who looks, and the absence of a posted bias audit on an employer's website is itself a red flag that can deter qualified candidates from applying.

Employers should also be aware that the regulatory landscape is continuing to evolve, with additional guidance, amendments, and enforcement actions likely in the coming years. The DCWP has shown a willingness to engage with employers and provide guidance, but it has also demonstrated a commitment to enforcing the law rigorously. Employers who proactively comply not only avoid penalties but also position themselves as leaders in fair and responsible employment practices, which can be a competitive advantage in attracting top talent. The broader trend toward AI regulation at the federal, state, and local levels suggests that the requirements under Local Law 144 may become the floor rather than the ceiling for algorithmic accountability in employment, making early compliance a strategic investment rather than merely a legal obligation.

Cost Considerations and Budgeting for Compliance

The cost of complying with Local Law 144 varies significantly depending on the number of AEDTs an employer uses, the complexity of those tools, and the approach taken to conducting the bias audits. For a single, relatively straightforward AEDT, a bias audit from an independent auditor might cost in the range of $5,000 to $15,000, covering the analysis of training data, statistical testing for disparate impact, and the preparation of a written report. For more complex tools, such as machine learning models trained on large datasets with multiple protected characteristics, the cost can escalate to $25,000 to $50,000 or more, particularly if the auditor needs to conduct extensive data analysis or if the tool's logic is opaque and requires reverse engineering to assess properly.

In addition to the direct cost of the audit, employers should budget for the internal resources required to support the compliance process, including staff time for identifying AEDTs, coordinating with auditors, preparing the public disclosure, and managing ongoing monitoring. For smaller employers, these internal costs can be substantial relative to the audit cost itself, and may need to be factored into the overall compliance budget. Some employers choose to invest in automated compliance platforms that can streamline the audit process, reduce the burden on internal staff, and provide ongoing monitoring capabilities, though these platforms come with their own subscription costs that should be weighed against the potential savings in audit fees and internal labor.

It is also worth noting that the cost of non-compliance can exceed the cost of compliance by a significant margin. In addition to the civil penalties described above, employers who are found to have used biased AEDTs in violation of the NYC Human Rights Law may face remedies including back pay, reinstatement, compensatory damages, and punitive damages, as well as injunctive relief requiring changes to their hiring practices. The cumulative cost of an enforcement action, including legal fees and settlement costs, can easily reach six or seven figures, making the investment in a bias audit a relatively modest expense compared to the potential downside of non-compliance.