What are the NYC Local Law 144 bias audit requirements and how do they affect AI-powered hiring tools in 2026?

Understanding NYC Local Law 144 and Its Bias Audit Mandate

New York City’s Local Law 144, enacted in November 2021 and originally set for enforcement in April 2023, was delayed multiple times before finally taking effect on July 5, 2023. The law, codified under the New York City Administrative Code § 20-875 through § 20-879, requires any employer that uses an Automated Employment Decision Tool (AEDT) for employment decisions—including hiring, promotion, transfer, or termination—to conduct an independent bias audit. The audit must assess whether the tool produces disparate impact on the basis of gender, race, or ethnicity, and the results must be publicly posted on the employer’s website. The law applies to any employer with employees in New York City, regardless of where the company is headquartered, and it covers both proprietary tools and third-party software licensed from vendors. The enforcement date was extended twice—first to January 1, 2023, then to July 5, 2023—due to feedback from industry groups and technology providers who needed additional time to develop compliant audit methodologies. The NYC Department of Consumer and Worker Protection (DCWP) is the enforcing agency, and it has published FAQs and guidance documents to clarify compliance expectations. The law is notable for being the first in the United States to mandate third-party bias audits for algorithmic hiring systems, setting a precedent that other jurisdictions are now watching closely.

Also worth reading: What are the Illinois AI hiring law requirements for employers in 2026? · What is an AI hiring tool compliance checklist and how do I ensure my recruitment technology meets legal requirements in 2026? · How does AI labor law audit automation work and what compliance requirements apply in 2026?

Who Must Comply and What Tools Are Covered

The scope of Local Law 144 is broad. Any employer with one or more employees working in New York City must comply if it uses an AEDT for any employment decision. This includes full-time, part-time, temporary, and gig workers, as long as they perform work within the city limits. An AEDT is defined as any computational, statistical, or machine learning tool that replaces or substantially substitutes for human decision-making in screening candidates for employment or promotion decisions. This encompasses resume screening software, video interview analysis platforms, cognitive ability tests, personality assessments, and any tool that assigns scores or rankings to candidates. Even if the employer only uses the tool as one factor among many, the law still applies. The audit requirement is triggered regardless of whether the tool is developed in-house or purchased from a vendor. Additionally, if an employer uses a vendor’s tool, the vendor may also be subject to the law if it performs the audit function on behalf of the employer. The DCWP has clarified that the audit must be conducted by an independent auditor who is not affiliated with the employer or the tool’s developer, ensuring objectivity. The audit must cover the tool’s use during the preceding calendar year and must be updated annually.

How to Conduct a Compliant Bias Audit

A compliant bias audit under Local Law 144 must follow specific methodological standards outlined in the DCWP’s guidance. The audit must calculate selection rates for protected groups (gender, race, and ethnicity) and compare them to the selection rates for the reference group. The standard metric used is the “four-fifths rule” from the Uniform Guidelines on Employee Selection Procedures, which states that a selection rate for any group that is less than 80% of the rate for the group with the highest selection rate is considered evidence of adverse impact. However, the audit must go beyond this threshold and include statistical significance testing, such as chi-square tests or Fisher’s exact test, to determine whether observed disparities are unlikely to be due to chance. The audit must also examine multiple stages of the hiring process, including initial screening, interview invitations, and final selection. The independent auditor must provide a written report that includes the methodology used, the data analyzed, the results of the statistical tests, and any findings of disparate impact. The report must be retained for three years and made publicly available on the employer’s website for at least six months. Employers must also post a notice on their careers page informing applicants that an AEDT is used and that a bias audit has been conducted.

Comparison of Audit Approaches: In-House vs. Third-Party vs. Vendor-Provided

Employers have three primary paths for fulfilling the audit requirement, each with distinct advantages and limitations. In-house audits involve using internal data analysts or HR teams to conduct the audit. This approach is often less expensive but risks conflicts of interest and may lack the statistical rigor required by the DCWP. Third-party audits, conducted by independent consulting firms or academic institutions, offer greater objectivity and credibility but come at a higher cost—typically ranging from $15,000 to $50,000 depending on the complexity of the tool and the size of the applicant pool. Vendor-provided audits are offered by AEDT companies as part of their service agreements. While convenient, these audits have been criticized for potential bias toward favorable results, as the vendor has a financial interest in demonstrating the tool’s fairness. The DCWP has stated that vendor-provided audits are acceptable only if the auditor is truly independent—meaning they are not employed by or compensated by the vendor beyond the audit fee. A comparison table illustrates the key differences:

Employers frequently fall into several traps when attempting to comply with Local Law 144. One common mistake is conducting the audit only for the final hiring decision and neglecting earlier stages, such as resume screening or video interview scoring, where disparate impact often originates. Another error is using insufficient sample sizes, which can render statistical tests underpowered and unreliable. The DCWP recommends a minimum of 100 applicants per protected group to achieve meaningful results. Some employers also fail to update their audits annually, assuming a one-time review is sufficient. The law requires a new audit each calendar year, reflecting the tool’s use during that year. Enforcement risks are significant: the DCWP can impose civil penalties of up to $1,500 per violation, and repeated noncompliance can lead to public naming of the employer. In 2024, the DCWP issued its first wave of warning letters to over 30 employers, many of which were tech companies and retail chains. The agency has also initiated investigations into several high-profile firms, signaling that enforcement is not merely theoretical.

Timeline and Action Steps for 2026 Compliance

For employers seeking compliance in 2026, the timeline is straightforward but requires early action. The audit must cover the 2025 calendar year and be posted by July 1, 2026, to align with the annual cycle. Employers should begin by inventorying all AEDTs used in their hiring and promotion processes, including tools from vendors like HireVue, Pymetrics, and Unilever’s AI recruiting platform. Next, they should engage an independent auditor—either a consulting firm such as Deloitte or EY, or an academic institution with a statistics or law department—to design and execute the audit. Data collection must be completed by March 2026 to allow sufficient time for analysis and reporting. The audit report should be reviewed by legal counsel to ensure it meets DCWP standards before being published. Employers must also update their career pages to include the required notice about AEDT use and audit availability. Failure to meet the July 1 deadline can result in immediate penalties, and the DCWP has indicated it will conduct random audits to verify compliance.

Cost Considerations and Budgeting

The cost of compliance varies widely based on the number of tools audited, the size of the applicant pool, and the complexity of the tool’s algorithm. For a single tool with a moderate applicant volume (500–2,000 candidates), a third-party audit typically costs between $15,000 and $30,000. Larger enterprises with multiple tools or high-volume hiring may face costs exceeding $100,000 annually. Some vendors offer bundled audit services as part of their licensing agreements, which can reduce costs but may compromise independence. Employers should also budget for ongoing expenses, such as data extraction and statistical software licenses, and potential legal review fees. It is worth noting that the DCWP does not provide grants or subsidies for compliance, placing the full financial burden on employers. However, some employers have found that investing in bias audits not only ensures legal compliance but also improves candidate trust and brand reputation, potentially yielding a return on investment through reduced turnover and enhanced employer branding.

The Broader Impact on HR and AI Governance

Local Law 144 has catalyzed a broader shift in how organizations approach AI governance in HR. The law’s emphasis on transparency, accountability, and independent oversight has influenced similar legislation in other jurisdictions, including the proposed Federal Algorithmic Accountability Act and state-level bills in California, Illinois, and Colorado. HR leaders are increasingly integrating bias audits into their compliance frameworks, often in collaboration with legal, IT, and ethics teams. The law has also spurred innovation in audit methodologies, with researchers developing more sophisticated techniques for detecting bias in complex neural networks. However, challenges remain, particularly around defining “bias” in contexts where disparate impact may reflect systemic inequalities rather than algorithmic flaws. Some critics argue that the law’s focus on gender, race, and ethnicity overlooks other forms of discrimination, such as age or disability bias. As the regulatory landscape evolves, employers must stay vigilant, not only to comply with current laws but also to anticipate future requirements that may expand the scope of protected classes or mandate additional disclosures.