What an LL144 Compliance Guide Actually Covers
An LL144 compliance guide should explain New York City Local Law 144 of 2021, which regulates automated employment decision tools used to assist or replace the discretion of employers and employment agencies in hiring, promotion, termination, compensation, and other employment decisions. Its central requirements are a bias audit performed by an independent auditor, advance notice to candidates or employees, publication of the audit and a summary of its results, and notice about the types and purposes of data used by the tool. The rules took effect on January 1, 2023, and enforcement by the New York City Department of Consumer and Worker Protection began on July 5, 2023.
Also worth reading: How Can Employers Automate AI Employment Compliance in 2026? · How Can AI-Powered Labor Law Compliance Help State Employers? · How Should Employers Test Payroll Controls for Accuracy and Compliance?
The law applies to an employer or employment agency that uses a covered automated employment decision tool, not only to the company that develops the model. A “covered tool” generally must be designed to substantially assist or replace discretionary decision making about candidates or employees. The governing regulation is 5 R.C.R. § 220-A, the Automated Employment Decision Tool Law. Employers should not treat an off-the-shelf model, a recruiting platform feature, or an internally built scoring system as automatically outside the rule merely because a human nominally reviews its output.
A useful guide distinguishes legal compliance from general AI ethics. LL144 does not prohibit every algorithmic hiring decision, require a particular fairness algorithm, or certify a vendor as “compliant.” Instead, it establishes process requirements and creates evidence that an employer examined the tool’s treatment of protected groups. A compliance program is therefore more than attaching a vendor’s generic bias report to a hiring policy; it requires the employer to verify applicability, identify the decision the tool influences, and retain evidence of the duties performed.
The Three Core Duties and Their Deadlines
The first core duty is an independent bias audit. The audit must be completed within one year after the law’s effective date, which made the initial deadline January 1, 2024. For a tool first used after that deadline, the audit must be completed within one year after the tool is first used. An employer using multiple tools may have separate deadlines for each tool, and replacing or materially modifying a tool can require a new audit. The audit is meant to examine the tool’s statistical treatment of sex, race, ethnicity, and national origin, but the precise measures are not limited to a single simple pass-rate or selection-rate calculation.
The second duty is candidate and employee notice. Before using a covered tool to make or substantially assist a decision, the employer must give affected individuals notice that the tool will be used for the relevant purpose. Written notice is required, although an employer may satisfy the requirement orally if it does not use the tool in a way that makes an oral disclosure meaningless. Information in another language does not count unless it is provided in English. For a written notice, delivery must occur at least 10 business days before the tool is used, although an oral notice must be provided at least 10 days before use.
The third duty is publication. Within 30 calendar days after completing a bias audit, the employer or employment agency must publish the audit on its website or the website of the employment agency. It must also publish instructions for candidates or employees to submit a request for an alternative selection process or an alternative selection and placement process. The audit, publication method, and data-privacy notice must be made available to the independent auditor. Separately, a covered employer or employment agency must provide a data-privacy notice describing the types of data collected for the automated tool and the employer’s data-retention policy and practices.
What Counts as a Covered Automated Employment Decision Tool?
Coverage usually begins when software evaluates a person for a consequential employment action. Examples can include systems that rank applicants, reject applications, score interviews, assess video interviews, predict employee performance, identify candidates for promotion, or screen candidates against job-related criteria. A tool that organizes information, schedules interviews, or performs administrative functions may fall outside the law when it does not substantially assist or replace discretion. The function matters more than the product label, so calling a feature “decision support” does not settle the question.
The exemption is narrower than many employers assume. The regulatory commentary focuses on whether the tool is designed to substantially assist or replace discretionary decision making; an employer cannot rely exclusively on the fact that a recruiter remains involved or can reverse the result. A recruiter who supplies a résumé, enters interview notes, or clicks an approve button may still be relying on a covered tool if the software performs the principal evaluative work. This distinction should be documented through a product review, request for information about the tool’s purpose and design, and a written description of the recruiter’s actual responsibilities.
The question is not satisfied simply by knowing the vendor’s marketing claims. A proper assessment asks what the tool measures, how it combines or weights information, whether it recommends a ranking or outcome, how often a human overrides it, and whether its output is used for compensation, termination, promotion, or another listed employment action. Employers with recruiting, staffing, workforce analytics, or employee-relations operations should include third-party screening platforms and AI features supplied by applicant tracking system vendors in the inventory. Documenting control before use also makes it easier to answer questions from regulators, candidates, and internal audit teams.
How the Compliance Process Works in Practice
A defensible LL144 program starts with an inventory rather than a purchase. An employer should identify all technologies that score people or recommend employment outcomes, including tools administered by staffing firms, franchisees where relevant, and procurement vendors. For each tool, the compliance team should record the vendor, product version, employment purpose, populations exposed, decision types, contracting party, and the date the tool was first placed into use. The record should identify whether the tool is a covered automated employment decision tool under 5 R.C.R. § 220-A and explain the reasoning.
Notice is the next operational step. The employer needs a process that delivers compliant language before the first use of each tool and purpose, rather than relying on candidates to discover a privacy notice buried in a website. Interview candidates, applicants, and employees may have different triggers depending on when the tool is introduced and how the individual’s selection is conducted. A candidate who has already received a notice may also be a candidate for a later role covered by a different tool, so reusable notice text does not eliminate the need to deliver it on the right schedule.
Publication should be coordinated with the audit, since the audit must be published within 30 calendar days of completion. The website should make the document reasonably accessible and include the employer’s alternative-selection-process instructions. Employer materials should explain whether the alternative applies to a candidate, an employee, or both, and provide a usable route for submitting a request. The regulator’s official Automated Employment Decision Tool webpage is an appropriate location for employers searching for required forms and current agency materials.
Finally, employers should create a recurring review cycle. Annual review of vendor fairness results is sensible, but it is not automatically a substitute for the statutory one-year audit requirement after material changes. Changes to data sources, scoring logic, model version, thresholds, or decision purpose can alter both the legal analysis and the underlying rate disparities. A strong program records those changes, re-evaluates the tool, and determines whether a fresh audit is needed.
Independent Bias Audits: Requirements and Enforcement Risks
The word “independent” is the most important part of the audit requirement. The audit cannot simply be an internal table produced by the same team that configured the vendor’s system. The independent auditor must be able to access the tool, its data, and relevant management practices, and must issue a report containing the required information. A vendor audit is not automatically disqualified merely because the vendor performed it, because the regulatory treatment of auditor independence can depend on facts; however, an employer should obtain a clear explanation of the auditor’s role and preserve that explanation rather than assume that a vendor logo resolves the issue.
Audit readiness depends heavily on recordkeeping. The employer or agency must provide the auditor with information about the type of tool, the dates on which it was first used, the types of decisions it influences, the dates of each notice, the data-privacy notice, and the number of people whose employment decisions were influenced. The auditor also needs the data used by the tool and the employer’s data-retention policy and practices. Missing records do not necessarily make discrimination lawful, but they can make a fairness analysis incomplete and can prevent the employer from proving timely compliance.
Enforcement is not limited to a technical challenge to a disparity result. A regulator can examine whether the employer failed to conduct an audit, publish it, provide notice, or establish a compliant alternative-selection route. A disparity may prompt further scrutiny even when the law does not make every observed difference unlawful by itself. Practical legal risk therefore comes from both process defects and the possibility that a tool’s impact is challenged under other employment-discrimination laws.
New York City enforcement activity after 2023 has increased attention to the relationship between city rules and antidiscrimination duties. Employers should treat an LL144 audit as one part of a broader fairness process, including job-related validation, accessibility review, accommodation procedures, and monitoring of selection outcomes. The audit requirement is a compliance floor, not proof that the tool is legally defensible in every discrimination case.
LL144 Compared With Other Employment AI Rules
Other state and federal rules can add requirements without replacing Local Law 144. The comparison below is a working orientation, not a substitute for advice about a specific product or employer. A recruiting organization with New York City candidates may also operate in Illinois, California, Colorado, Connecticut, or an EU member state, and the same underlying tool can trigger several duties at once.
| Feature | NYC Local Law 144 | Illinois employment AI rules | EU AI Act |
|---|---|---|---|
| Main focus | Bias audits, notice, publication, and alternative process | Disclosure and restrictions on discriminatory use in employment | Risk-based duties for AI systems, including many employment uses |
| Audit and impact testing | Independent bias audit generally required for covered tools | Not a universal standalone audit requirement comparable to LL144 | High-risk systems are subject to risk management, data governance, technical documentation, and human oversight duties |
| Notice | Advance notice and publication; alternative-selection instructions required | Notice depends on the particular Illinois law and use | Transparency duties depend on the system’s role, context, and interaction with people |
| Geographic reach | Employers and employment agencies using covered tools in New York City | Illinois employment decisions covered by the relevant law | Providers, deployers, and other actors placing systems on the EU market or using them in the EU |
| Timing | Effective January 1, 2023; enforcement July 5, 2023 | Illinois duties have taken effect on schedules set by the particular law | Prohibitions began February 2, 2025; most other provisions generally apply from August 2, 2026, with some high-risk product rules later |
A practical comparison should focus on cumulative controls rather than choosing only one regime. A vendor bias report may help an EU deployer document testing, but it does not by itself satisfy an LL144 publication obligation. An Illinois disclosure may tell a worker that AI is being used, but it does not establish that the New York City candidate received the required alternative process. Employers with multi-state recruiting programs benefit from a shared data inventory, version-controlled notices, and a single governance process that can emit jurisdiction-specific communications.
Common Compliance Mistakes and the Human Review Misconception
One common mistake is assuming that “a human decides” ends the legal analysis. Humans can remain accountable for a decision that an automated tool drives, especially when reviewers receive a score, a ranking, or a short list and have limited time or information to challenge it. Another error is treating all algorithm use as covered. Routine calendar tools or applicant-tracking features that neither evaluate nor recommend an employment outcome may be outside the regulation, but the employer needs facts rather than a product-category label.
A second mistake is missing the publication deadline. Completing an audit is not the end of the obligation; the completed report must be published within 30 calendar days. Some employers publish only a summary, while the regulation calls for publication of the audit and a summary of its results. Employers should check the exact requirement in the current agency materials and document the location and date of publication.
A third mistake is relying on an outdated notice after the tool’s purpose changes. A tool used for recruiting may have different notice and data-description requirements from the same product used for promotion or termination. Updating the underlying model or expanding the applicant pool can also affect whether a new audit or revised notice is appropriate. Finally, collecting more personal data is not a safe response to an audit problem. The data-privacy notice must describe the relevant data and retention practices accurately, and the organization should consider data minimization and access controls rather than using additional sensitive information without a defensible purpose.
These mistakes are avoidable through clear ownership. A named legal or compliance owner should approve applicability decisions, while a product owner maintains technical documentation and a recruiting or HR owner controls notice delivery. Vendor management should track contracts, report availability, model changes, and incident escalation. The most useful control is not a generic statement that the company “uses AI responsibly”; it is a dated record showing who decided, what evidence was reviewed, and which action followed.
When to Act and What Implementation May Cost
Employers should act before a new tool goes live, not after a candidate asks whether a score was used. The 10-business-day notice period makes advance preparation necessary, and the initial audit deadline shows that inventory work can become urgent quickly. An organization that already uses a covered tool should review its compliance history immediately, publish any missing material where appropriate, and determine whether remediation requires an updated audit or a new notice cycle. Waiting for a complaint increases the risk of compounded issues across discrimination, privacy, procurement, and consumer-protection questions.
There is no general government filing fee or official “LL144 certificate” purchase. Costs therefore come from legal analysis, an independent audit, vendor documentation, internal labor, website and notice changes, data mapping, and ongoing monitoring. Independent bias audits can range from several thousand dollars for a narrowly scoped tool with clean documentation to tens of thousands of dollars or more for a complex, high-volume, or poorly documented system. Legal review, system changes, and remediation can add further expense, and prices vary by vendor and data readiness. A buyer should request a written scope, deliverables, auditor credentials, assumptions about data access, and a statement about whether the work satisfies the current New York City requirements.
Small organizations can reduce cost by creating a complete inventory, centralizing notices, and collecting the records auditors need before commissioning outside work. They should not reduce the scope by excluding a tool simply because a vendor calls it assistive. Large employers with several recruiting brands or countries face different costs: they may need jurisdiction-specific notices, translation and accessibility review, distributed training, and controls that survive vendor or product changes. The right budget is the cost of a defensible process, not the cheapest document labelled a bias audit.
The Best Compliance Approach for a Growing Employer
The best LL144 compliance guide is a decision tool for employers, vendors, HR teams, and legal advisers. It should begin with the direct answer: a covered employer generally needs an independent bias audit, timely written or oral notice, publication of the audit and alternative-process instructions, and a data-privacy notice. It should then explain how the rule reaches vendors and multi-purpose platforms, how the deadlines operate, and why human oversight does not automatically remove a tool from coverage. It should also acknowledge what the law does not decide, including whether a particular outcome is discriminatory under every other legal standard.
For an employer, the immediate priority is to determine whether New York City is already within the recruiting or employment footprint and whether any system substantially assists a discretionary employment decision. If the answer is uncertain, document the uncertainty and obtain a focused review rather than treating the issue as resolved. If the tool is covered, the organization should confirm the audit status, publication history, notice channel, alternative-selection process, and data-retention description. Those five items provide a practical starting point for an AI-powered labor-law compliance and HR regulatory management program, while leaving room for additional state, federal, and EU requirements.
No single report should be represented as a guarantee of legal safety. Statutes, agency interpretations, enforcement priorities, and vendor designs can change, and an audit describes a tool at a particular time under particular conditions. A genuine compliance program continues after publication by tracking model changes, monitoring outcomes, responding to requests, and reviewing the legal analysis as operations expand. That is the defensible standard: not pretending that AI is objective, but showing how the organization tests, explains, and governs its use.