NYC Local Law 144: the bias audit, explained properly

1. Who is actually covered

Local Law 144 applies to employers and employment agencies that use an automated employment decision tool to substantially assist or replace discretionary decision-making for hiring or promotion, where the candidate or employee is located in New York City.

The critical word is located. Coverage follows the candidate, not the company. Your headquarters is irrelevant. If you post a remote role and one applicant lives in Staten Island, that evaluation is in scope. For any company hiring remotely at scale, the practical assumption should be that you are covered unless you have affirmatively established otherwise.

The law imposes obligations on employers, not on vendors. Your applicant tracking system provider does not carry a direct duty here, which means their cooperation depends entirely on what your contract says. This surprises people, and it is the reason vendor questionnaires often go unanswered.

2. What counts as an AEDT

DCWP's final rules define an AEDT as a computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues a simplified output — a score, classification, or recommendation — used to substantially assist or replace discretionary decision-making.

Two qualifiers do most of the work:

• Simplified output. A tool that surfaces raw information without scoring or ranking generally falls outside the definition.
• Substantially assist. The rules narrowed this considerably from the original 2022 proposal. A tool whose output is one input among many, weighted no more heavily than others by a human decision-maker, may fall outside scope — but this is a fact-specific judgment you should document rather than assume.

In practice, exposure hides in places nobody inventories: resume parsers that rank, assessment platforms that produce percentile scores, interview scheduling tools with knockout logic, and recruitment marketing systems that decide who sees a posting.

3. How the audit math works

This is where most compliance conversations go quiet, and it is genuinely the substance of the exercise.

The audit calculates selection rates for each demographic category, then converts them into impact ratios by dividing each group's rate by the rate of the most-selected group. The required categories are sex, race and ethnicity, and their intersections — so not just "women" and "Asian" but "Asian women."

Group	Selected	Applicants	Selection rate	Impact ratio
Group A	120	400	30.0%	1.00
Group B	45	250	18.0%	0.60
Group C	60	300	20.0%	0.67

Group A has the highest selection rate, so it becomes the denominator. Group B's ratio of 0.60 falls below the EEOC's four-fifths guideline of 0.80, which is treated as evidence of adverse impact warranting further examination.

For scoring tools rather than pass/fail tools, the analysis uses scoring rates — the proportion of each group scoring above the median — rather than selection rates. The rules also address what to do when historical data is unavailable and when test data may be substituted, which carries its own disclosure requirement.

You can run the impact ratio calculation yourself using the calculator on our homepage.

4. Who qualifies as independent

The auditor must not have been involved in using, developing, or distributing the tool, and must not hold an employment or financial relationship with the employer that would compromise independence.

DCWP does not maintain a list of approved auditors. Selecting a qualified independent auditor is the employer's responsibility and the employer's risk. Two arrangements that regularly fail this test:

• An audit performed by the vendor that supplies the tool, or by a party the vendor pays.
• An audit performed by a firm that also implemented the tool for you, or that holds an ongoing advisory role creating a financial interest in the outcome.

5. What you must publish

A summary of the most recent bias audit must be publicly available on your website. It needs to include the source and explanation of the data used, the number of individuals assessed who fall into unknown categories, and the selection or scoring rates and impact ratios for all required categories. The distribution date of the tool goes alongside it.

The summary must remain posted for at least six months after the tool's most recent use. A common failure is posting the summary and then quietly removing it when the numbers become inconvenient, or when a site redesign drops the page.

6. Candidate notice and the opt-out

Candidates and employees must be notified at least ten business days before the tool is used. The notice must state that an AEDT will be used, identify the job qualifications and characteristics it assesses, and describe the data collected, its source, and the employer's retention policy.

Notice can be given through the employment section of your website, in the job posting itself, or by mail or email. For current employees, a written policy or procedure works.

The opt-out deserves specific attention. Candidates may request an alternative selection process. The law does not prescribe what the alternative must be, but it must be genuinely available — a manual resume review or panel interview that actually happens, not a theoretical option that no candidate has ever successfully used. If your process cannot accommodate an opt-out in practice, you have a problem regardless of what your policy says.

7. Penalties and the 2026 enforcement shift

DCWP enforces the law under N.Y.C. Admin. Code §§ 20-870 to 20-874. Penalties run from $500 for a first violation up to $1,500, and each day a violation continues is treated as a separate violation. Failing to conduct the audit, failing to publish the summary, and failing to provide notice are each independently actionable.

Enforcement from 2023 through 2025 was largely complaint-driven, and thin. That changed on 2 December 2025, when the New York State Comptroller published an audit concluding that DCWP's enforcement had been ineffective, with particular criticism of complaint routing. DCWP concurred and committed to cross-trained staff, more rigorous investigations, and proactive rather than purely reactive enforcement.

Major employment practices have since advised clients to expect a stricter phase in 2026, with more frequent investigations and higher cumulative penalties. The practical implication: the long period during which non-compliance carried low expected cost has ended.

8. The five mistakes we see most

1. Assuming you're not covered because you're not in New York. Coverage follows the candidate. Remote hiring almost guarantees exposure.
2. Not knowing what's in the stack. Companies routinely discover AEDTs embedded in tools they believed were manual. Start with an inventory, not an audit.
3. Treating it as one-and-done. The audit must be less than a year old every time the tool is used. It is an annual program.
4. Using an auditor who isn't independent. Vendor-supplied audits are the most common version and the least defensible.
5. Publishing the summary and letting it lapse. Six months minimum after last use, and it has to stay findable.

Where to start

If you don't know whether you're covered, the sequence is: inventory every tool touching hiring or promotion, apply the AEDT definition to each in writing, then audit what's in scope. Most organizations can complete the first two steps internally. The third requires independence by definition.

Our exposure review handles the first two steps in two weeks, and produces a scoping memo you can hand to counsel.

This guide is general information about a regulatory requirement, not legal advice. Application to your specific hiring process should be reviewed with employment counsel.