Direct answer
New York City Local Law 144 requires an employer, employment agency, or staffing firm that uses an automated employment decision tool (AEDT) for hiring or promotion decisions affecting New York City residents to publish a bias audit covering that use. The audit must assess selection rates and a related impact ratio for race or sex, or another protected category that the Department of Consumer and Worker Protection (DCWP) has designated in writing. The results must be posted on the employer’s or agency’s website and distributed to a candidate or employee who requests them through the same channel at least 10 business days before the relevant decision is scheduled. The law also requires a summary of the job analysis supporting the AEDT, although that analysis is separate from the bias audit. These duties apply only when the tool is used substantially for making employment decisions, not merely because an employer has some AI system in ordinary business operations.
Also worth reading: What are the AI hiring law requirements by state in 2026, and how do employers stay compliant? · How does automated pay transparency compliance work in 2026, and what are the legal requirements for employers? · How does the DOL 2026 contractor classification audit impact businesses and what are the compliance requirements?
The law is codified at NYC Administrative Code §§ 20-870 through 20-879. DCWP’s final rules took effect January 1, 2023, and enforcement was extended to July 5, 2023. The local-law definition is narrower than the broader definition of AEDT in the New York City Human Rights Law amendment, so a system can fall within one definition without automatically falling within the other. The audit is not a full validation of the tool, a certification of nondiscrimination, or a substitute for other employment laws.
Scope and trigger
The first question is whether the employer is using an AEDT in the way that triggers Local Law 144. The statute defines an AEDT as a computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output used to substantially assist or replace decision-making for employment decisions concerning a person residing in New York City. The output must influence hiring or promotion. A keyword filter that simply rejects applications outside a hard qualification rule may not be an AEDT, while a model that ranks, scores, or rates applicants can be.
The law does not require every tool to be audited in every location. The candidate must reside in New York City, and the employment decision must concern hiring or promotion. A tool used only for scheduling, timekeeping, payroll, performance management, or layoffs ordinarily does not trigger this local-law audit, even if it uses similar technology. A tool used for both hiring and noncovered work also needs a documented scope decision explaining which uses are covered.
Substantial assistance is not measured by a numerical percentage. DCWP has described the issue as a facts-and-circumstances judgment, and the agency has said that a tool can be substantially assisting or replacing decision-making even when a human has some role. The more the output determines the next step, the more likely the tool is covered. The more it supplies optional information that a trained decision-maker independently evaluates, the more defensible the noncovered position. Employers should not rely on a vendor’s label such as “decision support” without documenting the actual workflow.
What the bias audit must contain
A compliant bias audit must be independent and must assess selection rates and an impact ratio for race or sex, or another protected category designated by DCWP. The final rules describe an independent auditor as someone who is not an employee of the employer or employment agency and has no financial interest in that employer or agency. The auditor must also have no direct or indirect business relationship with the employer or agency other than providing the audit service. The rule permits an employee of a vendor to serve as auditor when that person satisfies these conditions.
The audit must cover the AEDT used to make or support the relevant employment decision. It must report the selection rate for race or sex, or the other protected category used, and the impact ratio, which is the selection rate for the group with the lowest selection rate divided by the selection rate for the group with the highest selection rate. The rules also require the audit to state the time period covered, the number of people in each group, and the number of people selected or advanced. DCWP may designate additional protected categories by written notice, so employers should check for later agency guidance rather than assume that race and sex are the only possible categories.
The audit must also explain the data source, methodology, and limitations. It is not enough to publish a vendor score or a vague statement that the tool is fair. The audit must be sufficiently specific for a candidate or employee to understand what was tested, for whom, and over what period. A new tool, a new job family, or a materially changed scoring process may require a new audit. Reusing an audit from a different tool or from a different employer is not a safe shortcut.
Audit method and metrics
The practical method starts with a clearly defined selection event, such as passing an initial screen, receiving an interview, or being selected for an offer. The employer then identifies the relevant applicant or employee population and records the protected-category data required by the rules. The selection rate is the number selected from a group divided by the number in that group. The impact ratio compares the lowest group selection rate with the highest group selection rate.
The “four-fifths rule” is a useful screening benchmark, not a safe harbor. If the impact ratio is below 0.80, the result may indicate adverse impact and deserves review. An impact ratio above 0.80 does not prove that the tool is lawful, accurate, or free of bias. It also does not establish that a tool with a small sample is reliable. A score of 0.85 based on five people in one group can be much less informative than a score of 0.78 based on thousands of decisions.
The audit should distinguish between missing data, nonresponse, and a genuine selection outcome. It should identify whether the tool treats a candidate as selected, rejected, or held for human review. It should also test whether the same process was used across job categories and whether the data reflects the actual decision path. DCWP’s final rules and FAQs provide the operative formulas and procedural details, so employers should follow the current rule language rather than an older summary of the original bill.
Independence, timing, and publication
The audit must be independent, but the employer remains responsible for the accuracy of the input data, the completeness of the audit scope, and the final public notice. A vendor may provide the technical analysis, and a vendor employee may qualify as the auditor if the independence conditions are met. The auditor should have access to the necessary system documentation and should be able to challenge assumptions rather than simply repeat the vendor’s marketing claims.
The public notice must be posted on the employer’s website and distributed through the same channel when a candidate or employee requests it. The notice must be available at least 10 business days before the AEDT is used for the relevant decision. A candidate who requests the notice must receive it through the same channel, such as the same application portal or email route used for the request. Employers should retain the published version, the date posted, the date provided to requesters, and the records supporting the audit.
The timing is operational, not ceremonial. If a tool is used in a rolling recruitment campaign, the employer should confirm that the notice is available before the first covered decision. A late posting can create a compliance problem even when the audit itself is accurate. The employer should also maintain an archive because DCWP can request records and because later changes may require a new audit.
What the law does not require
Local Law 144 does not require an employer to use an AEDT, and it does not require a particular vendor, model, or score threshold. It does not create a general ban on algorithmic hiring or promotion tools. It also does not replace federal, state, or local obligations concerning discrimination, disability accommodation, background checks, privacy, or records retention. An employer can use a transparent rules-based system instead of a machine-learning model, provided the system still complies with other applicable law.
The law also does not require the employer to publish confidential source code, trade secrets, or every internal data set. The required audit is a summary of the selection-rate analysis and related information, not a full technical disclosure. However, an overly redacted report may not give enough information to satisfy the purpose of the law. Employers should balance transparency with appropriate protection of proprietary material.
A human review process does not automatically remove the law from scope. If the human reviewer routinely accepts the tool’s score or recommendation, the tool may still be substantially assisting the decision. Conversely, a meaningful review that independently evaluates the candidate and corrects the output may reduce the role of the AEDT, but the employer should document how that review works and whether it changes outcomes.
Practical compliance steps
An employer should begin with an inventory of every tool used in hiring or promotion. The inventory should identify the vendor, the covered job family, the decision stage, the population affected, and whether the output ranks, scores, filters, or recommends. It should also record whether the tool is used for New York City residents and whether a human reviewer can override it. This inventory is the foundation for deciding whether a Local Law 144 audit is required.
Next, the employer should define the selection event and preserve the data needed for the audit. That means retaining applicant-level records, group data, scores, decisions, dates, and any override reason. The employer should test whether the data is complete and whether the same process was used for comparable job categories. If the sample is small, the audit should say so and should not present a fragile percentage as definitive.
The employer should then select an independent auditor and give the auditor the necessary documentation. The audit should identify the tool, the period tested, the groups analyzed, the selection rates, the impact ratio, the methodology, and the limitations. The public notice should be drafted before the tool is used, because the 10-business-day requirement is tied to the decision date. After publication, the employer should monitor changes to the tool, the job description, the scoring weights, and the candidate population.
Common mistakes and enforcement risk
The most common mistake is assuming that a human reviewer makes the tool exempt. The law asks what the AEDT does in practice, not how the vendor describes the product. If the reviewer accepts a score without a real opportunity to evaluate the candidate, the tool may still be substantially assisting the decision. The same problem appears when a recruiter uses an AEDT for one stage of a process but treats the entire hiring workflow as outside the law.
Another mistake is publishing an audit that does not match the tool actually used. A vendor may update a model, change a weighting scheme, or add a new job category without alerting the employer. The audit must cover the relevant tool and the relevant period. An audit based on a generic platform report may be inadequate if the employer uses a customized version for a particular occupation.
DCWP may issue civil penalties for violations. The final rules and agency materials have described penalties of up to $500 for a good-faith effort to comply, up to $1,500 for negligence, and up to $2,000 for willful misconduct. The exact amount can depend on the facts and the agency’s assessment. Employers should treat the requirement as an ongoing control, not as a one-time document that can be ignored after publication.
Cost, alternatives, and when to act
The law does not set a government fee or a required price for an audit. Cost depends on the size of the data set, the number of job categories, the number of protected categories, the quality of the employer’s records, and whether an external auditor is used. A small employer with a simple, documented tool may spend far less than a company running a complex hiring platform across many occupations. The main cost is often internal: data cleanup, workflow mapping, vendor coordination, and the work needed to publish the notice on time.
| Choice | Benefit | Limitation |
|---|---|---|
| Use a rules-based screen | Lower audit complexity and easier explanation | May still be covered if it substantially assists or replaces a decision |
| Use a vendor AEDT with an independent audit | Faster technical analysis and a clearer public record | Vendor dependence and ongoing update monitoring |
| Use a human review process with documented criteria | Can reduce reliance on the tool and support consistency | Does not automatically avoid the law |