Compliance Guide

NYC Local Law 144 and the Expanding AI Hiring Bias-Audit Regulatory Landscape

NYC Local Law 144 requires employers using automated employment decision tools in hiring or promotion to obtain an independent bias audit within one year prior to use, publish impact-ratio results publicly, and give candidates at least 10 business days' notice before deployment. Enforcement runs through the NYC Department of Consumer and Worker Protection, with per-violation penalties that accrue daily during noncompliance. Illinois, Colorado, and California have since advanced comparable but distinct obligations, requiring enterprises to build governance infrastructure that tracks audit currency, disclosure content, and jurisdiction-specific triggers across every automated employment decision tool in use.

Learn About AI Agent Security Talk to an Expert

What Local Law 144 Actually Requires

Local Law 144 applies to employers and employment agencies using an automated employment decision tool (AEDT) for hiring or promotion decisions within New York City. The statute defines the core compliance obligation around three elements: an independent bias audit, public disclosure of audit results, and advance candidate notice.

The audit must be conducted by an auditor who was not involved in developing or deploying the tool, and it must be completed within one year prior to the tool's use. Employers must then publish a summary of the most recent audit, including calculated impact ratios, on their public website before using the AEDT for any covered decision. Candidates and employees must receive notice at least 10 business days before an AEDT is used, including information on how to request an alternative selection process where one exists.

Enforcement sits with the NYC Department of Consumer and Worker Protection, which can assess civil penalties per violation, with continued noncompliance treated as a separate violation for each day it persists. There is no single credentialing body specified for independent auditors, which means audit rigor and methodology can vary meaningfully across providers even when the statutory requirement is technically satisfied.

The Four Core Obligations at a Glance

Obligation 1

Annual Bias Audit

Independent audit completed within one year prior to AEDT use. The auditor must be unconnected to the tool's development or deployment.

Obligation 2

Public Disclosure

Impact-ratio summary published on the employer's website before the AEDT is used for any covered hiring or promotion decision.

Obligation 3

Candidate Notice

At least 10 business days' advance notice before deployment, with an option to request an alternative selection process where one exists.

Obligation 4

DCWP Enforcement

Civil penalties assessed per violation, with each day of continued noncompliance treated as a separate and additional violation.

How a Compliant Bias Audit Is Technically Conducted

The technical core of a Local Law 144 audit is the impact ratio calculation, an approach analogous to the EEOC's four-fifths rule. The auditor calculates selection rates for each demographic subgroup across sex, race and ethnicity, and intersectional categories, then divides each subgroup's selection rate by the rate of the most-selected subgroup.

This requires historical outcome data on how the AEDT scored or classified candidates, disaggregated by demographic category. Where internal applicant data is insufficient in volume or completeness, employers often depend on vendor-supplied outcome data, and auditors may substitute test data or an alternative bias-testing methodology when historical data is unavailable or statistically inadequate.

This substitution can materially affect the reliability and defensibility of the resulting impact ratios, since test data does not necessarily reflect real applicant population dynamics. Because auditor qualification standards are not uniformly defined under the law, enterprises should treat auditor selection as a governance decision rather than a procurement formality, and document the auditor's methodology and independence rationale alongside the audit results themselves.

Governance note on auditor selection

The absence of a defined credentialing standard for independent auditors under Local Law 144 means that audit quality varies. Enterprises should document the auditor's specific methodology, data sources, and independence rationale as part of the compliance record, not only the published impact-ratio summary.

How the Regulatory Landscape Is Expanding Beyond NYC

Following Local Law 144's enforcement, Illinois, Colorado, and California have each advanced comparable but materially distinct obligations. The differences in scope, triggering conditions, and disclosure requirements mean that a compliance program built solely around New York City's statute will not satisfy obligations in other jurisdictions.

Jurisdiction	Mechanism	Key Distinction from Local Law 144
New York City	Local Law 144, enforced by DCWP	The baseline: annual independent bias audit, public impact-ratio disclosure, 10-day candidate notice, per-day civil penalties for noncompliance.
Illinois	Artificial Intelligence Video Interview Act; expanded AI obligations	Focuses on AI-analyzed video interviews; requires employer disclosure when AI is used and candidate consent before analysis. Audit obligations differ from NYC's impact-ratio framework.
Colorado	SB 205 and related AI employment provisions	Addresses algorithmic discrimination more broadly; imposes obligations on both developers and deployers, creating shared liability structures not present under Local Law 144.
California	Proposed and enacted AI employment provisions	Broader consumer and worker protections; automated decision-making rules under CPRA can intersect with hiring use cases, triggering rights of access and opt-out not required in New York City.

Governance and Auditability Infrastructure for Multi-Jurisdiction Compliance

An enterprise deploying AEDTs across multiple jurisdictions cannot treat compliance as a one-time audit event. Each jurisdiction imposes its own audit cadence, disclosure format, and triggering conditions. What qualifies as an AEDT under Local Law 144 may differ from what constitutes an automated decision system subject to Colorado's developer obligations or California's CPRA access rights.

Sustainable compliance requires governance infrastructure with several interconnected components:

AEDT inventory and classification: A continuously maintained register of every tool used in hiring or promotion decisions, with jurisdiction-specific applicability flags and the date each tool was last audited.
Audit currency tracking: Automated monitoring of audit expiration dates, since Local Law 144 requires audits within one year prior to use and each new deployment or significant model change may restart the clock.
Disclosure management: Versioned records of every published impact-ratio summary, with timestamps and change history sufficient to demonstrate that disclosures were accurate and current at time of each use.
Candidate notice documentation: Records demonstrating that notice was delivered at least 10 business days in advance, by candidate, including records of any alternative-process requests and how they were handled.
Cross-jurisdiction obligation mapping: A structured view of how each tool's use maps to jurisdictional requirements, so that a single AEDT used in New York City, Chicago, and a Colorado-based applicant pool is evaluated against all applicable obligations simultaneously.
Auditor independence documentation: For each audit, a record of auditor identity, qualification rationale, methodology, data sources used, and any substitutions made where historical applicant data was insufficient.

Without this infrastructure, recurring audit cycles become manual and error-prone, disclosure updates lag behind model changes, and cross-jurisdictional gaps are discovered reactively rather than in advance. The regulatory trajectory suggests that the number of jurisdictions imposing some form of AEDT obligation will continue to increase, making the governance layer more valuable over time, not less.

Frequently Asked Questions

Who is covered by NYC Local Law 144?

The law applies to employers and employment agencies that use an automated employment decision tool to make or substantially assist in hiring or promotion decisions affecting candidates or employees located in New York City. Employers with fewer than 15 employees and employment agencies with fewer than 15 employees are not exempt; the threshold language focuses on tool use, not firm size.

What counts as an automated employment decision tool under the law?

An AEDT is defined as any computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is used to substantially assist or replace discretionary decision-making in hiring or promotion. Tools used only for scheduling or for purely administrative purposes without influencing candidate evaluation typically fall outside the definition.

Can an employer rely on an audit conducted by the AEDT vendor?

No. The auditor must be independent, meaning they were not involved in developing or deploying the tool. A vendor-conducted audit of its own tool would not satisfy the independence requirement. Employers should obtain a separate audit from a third party with no commercial relationship to the tool's development, and document the independence rationale explicitly.

What happens when historical applicant data is insufficient for an impact ratio calculation?

Auditors may substitute test data or an alternative bias-testing methodology when historical data is unavailable, too limited in volume, or insufficiently disaggregated by required demographic categories. However, substitution should be documented, including the reason historical data was inadequate and the specific alternative methodology applied, because test data may not reflect real applicant population dynamics and the resulting impact ratios carry different evidentiary weight.

Does Local Law 144 compliance satisfy obligations in Illinois, Colorado, and California?

Not entirely. Each jurisdiction has distinct triggering conditions, disclosure formats, and audit methodologies. Illinois focuses on AI-analyzed video interviews and requires consent. Colorado imposes shared obligations on both developers and deployers. California's CPRA creates access and opt-out rights that do not exist under Local Law 144. Enterprises should conduct a jurisdiction-by-jurisdiction applicability analysis for each tool and each use context rather than treating New York City compliance as a universal baseline.

How frequently must an audit be refreshed?

Local Law 144 requires an audit within one year prior to each use of the AEDT. Continuous or rolling deployment means the audit must remain current, and significant changes to the model or its training data may require a new audit before continued use. Enterprises should establish audit-expiration alerts tied to each AEDT in their inventory rather than managing renewal manually.

Sustain Compliance as AI Hiring Oversight Expands

As bias audit obligations extend across jurisdictions, enterprises need durable audit trails and governance controls that keep pace with recurring audit cycles, disclosure updates, and cross-jurisdictional obligations.

Learn About AI Agent Security