NYC Local Law 144: the bias audit, explained properly

1. Who is actually covered

Local Law 144 applies to employers and employment agencies that use an automated employment decision tool to substantially assist or replace discretionary decision-making for hiring or promotion, where the candidate or employee is located in New York City.

The critical word is located. Coverage follows the candidate, not the company. Your headquarters is irrelevant. If you post a remote role and one applicant lives in Staten Island, that evaluation is in scope. For any company hiring remotely at scale, the practical assumption should be that you are covered unless you have affirmatively established otherwise.

The law imposes obligations on employers, not on vendors. Your applicant tracking system provider has no direct duty here, which means their cooperation depends entirely on what your contract says. This surprises people, and it explains why vendor questionnaires so often go unanswered.

2. What counts as an AEDT

DCWP's final rules define an AEDT as a computational process derived from machine learning, statistical modeling, data analytics or artificial intelligence that issues a simplified output, meaning a score, classification or recommendation, used to substantially assist or replace discretionary decision-making.

Two qualifiers do most of the work:

• Simplified output. A tool that surfaces raw information without scoring or ranking generally falls outside the definition.
• Substantially assist. The rules narrowed this considerably from the original 2022 proposal. A tool whose output is one input among many, weighted no more heavily than the others by a human decision-maker, may fall outside scope. This is a fact-specific judgment you should document rather than assume.

In practice, exposure hides in places nobody inventories: resume parsers that rank, assessment platforms that produce percentile scores, interview scheduling tools with knockout logic, and recruitment marketing systems that decide who sees a posting at all.

3. How the audit math works

This is where most compliance conversations go quiet, and it is the substance of the exercise.

The audit calculates selection rates for each demographic category, then converts them into impact ratios by dividing each group's rate by the rate of the most-selected group. The required categories are sex, race and ethnicity, and their intersections. Not just “women” and “Asian” but “Asian women.”

Group	Selected	Applicants	Selection rate	Impact ratio
Group A	120	400	30.0%	1.00
Group B	45	250	18.0%	0.60
Group C	60	300	20.0%	0.67

For scoring tools rather than pass-fail tools, the analysis uses scoring rates, meaning the proportion of each group scoring above the median, rather than selection rates. The rules also address what to do when historical data is unavailable and when test data may be substituted, which carries its own disclosure requirement.

You can run the calculation on your own numbers using the four-fifths rule calculator.

4. Who qualifies as independent

The auditor must not have been involved in using, developing or distributing the tool, and must hold no employment or financial relationship with the employer that would compromise independence.

DCWP maintains no approved auditor list. Selecting a qualified independent auditor is the employer's responsibility and the employer's risk. Two arrangements regularly fail this test:

• An audit performed by the vendor that supplies the tool, or by a party the vendor pays.
• An audit performed by a firm that also implemented the tool for you, or that holds an ongoing advisory role creating a financial interest in the outcome.

There are six questions worth putting to any prospective auditor before you engage one. Ask for the answers in writing.

5. What you must publish

A summary of the most recent bias audit must be publicly available on your website. It needs to include the source and explanation of the data used, the number of individuals assessed who fall into unknown categories, and the selection or scoring rates and impact ratios for all required categories. The distribution date of the tool goes alongside it.

The summary must remain posted for at least six months after the tool's most recent use. A common failure is posting the summary and then quietly removing it when the numbers become inconvenient, or when a site redesign drops the page.

6. Candidate notice and the opt-out

Candidates and employees must be notified at least ten business days before the tool is used. The notice must state that an AEDT will be used, identify the job qualifications and characteristics it assesses, and describe the data collected, its source, and the employer's retention policy.

Notice can be given through the employment section of your website, in the job posting itself, or by mail or email. For current employees, a written policy or procedure works.

The opt-out deserves specific attention. Candidates may request an alternative selection process. The law does not prescribe what the alternative must be, but it has to be actually available. A manual resume review or panel interview that happens, not a theoretical option no candidate has ever successfully used. If your process cannot accommodate an opt-out in practice, you have a problem regardless of what your policy says.

7. Penalties and the 2026 enforcement shift

DCWP enforces the law under N.Y.C. Admin. Code §§ 20-870 to 20-874. Penalties run from $500 for a first violation up to $1,500, and each day a violation continues is treated as a separate violation. Failing to conduct the audit, failing to publish the summary and failing to provide notice are each independently actionable.

Enforcement from 2023 through 2025 was largely complaint-driven and thin. That changed on 2 December 2025, when the New York State Comptroller published report 2024-N-6, an audit of DCWP's enforcement of this statute covering July 2023 through June 2025.

DCWP concurred with the findings and committed to fixing complaint routing, cross-training staff, adopting written complaint-handling policies, and pursuing enforcement that does not depend on somebody filing a complaint first. Employment practices have since advised clients to expect more frequent investigations and higher cumulative penalties.

The long period during which non-compliance carried a low expected cost has ended. Anything commissioned under the old posture is worth re-examining under the new one.

8. The five mistakes we see most

1. Assuming you are not covered because you are not in New York. Coverage follows the candidate. Remote hiring almost guarantees exposure.
2. Not knowing what is in the stack. Companies routinely discover AEDTs embedded in tools they believed were manual. Start with an inventory, not an audit.
3. Treating it as one and done. The audit must be less than a year old every time the tool is used. It is an annual program.
4. Using an auditor who is not independent. Vendor-supplied audits are the most common version and the least defensible.
5. Publishing the summary and letting it lapse. Six months minimum after last use, and it has to stay findable.

Where to start

If you do not know whether you are covered, the sequence is: inventory every tool touching hiring or promotion, apply the AEDT definition to each in writing, then audit what is in scope. Most organizations can complete the first two steps internally. The third requires independence by definition.

Our exposure review handles the first two steps and produces a written AEDT determination for every system in your stack, plus a scoping memo you can hand to counsel.

This guide is general information about a regulatory requirement, not legal advice. Application to your specific hiring process should be reviewed with employment counsel.