NYC Local Law 144: AEDT Bias Audit Requirements (2026)

NYC Local Law 144, also known as the NYC Bias Audit Law or the AEDT Law, requires employers and employment agencies that use Automated Employment Decision Tools (AEDTs) to evaluate candidates or employees residing in New York City to (1) commission an independent annual bias audit of the tool, (2) publicly post a summary of the audit results on the employer’s website, and (3) provide at least 10 business days’ notice to candidates before the AEDT is used in their evaluation. Enacted in December 2021, the law took effect on 1 January 2023 and has been actively enforced by the NYC Department of Consumer and Worker Protection (DCWP) since 5 July 2023. Penalties run from $500 for the first violation to $1,500 per day for ongoing non-compliance.

Local Law 144 is one of the first enforceable AI employment regulations in the United States and applies extraterritorially: any employer evaluating a candidate who resides in NYC is in scope, regardless of where the employer is headquartered or where the role is located. A San Francisco company hiring a remote engineer who lives in Brooklyn is subject to the law for that candidate. This extraterritorial reach combined with the spread of AI in HR tech, particularly resume screeners, video interview analysers, and automated candidate scoring inside applicant tracking systems, has made Local Law 144 a baseline compliance topic for nearly every multi-state employer.

2026 brings a new enforcement reality. In December 2025, the New York State Comptroller released a damaging audit of how the DCWP has been enforcing Local Law 144 since 2023. The findings were unflattering: 75% of test calls to NYC’s 311 hotline about AEDT issues were misrouted and never reached the DCWP, the agency surveyed 32 companies and found just one case of non-compliance while the Comptroller’s auditors reviewing the same companies identified at least 17 potential violations, and the agency was criticised for failing to use technical resources from the NYC Office of Technology and Innovation. The DCWP has now committed to better complaint handling, cross-trained staff, more rigorous investigations, and proactive (not just complaint-driven) enforcement. Major employment law firms (DLA Piper among them) have warned employers to expect a stricter enforcement phase in 2026, with more frequent investigations and higher cumulative penalties.

This guide explains what AEDTs are and which tools fall in scope, the three core obligations under Local Law 144, how the bias audit works mathematically (selection rates, scoring rates, impact ratios, and the EEOC four-fifths rule), the candidate notice and opt-out requirements, who counts as an “independent auditor”, penalty structures and the December 2025 Comptroller audit fallout, common compliance mistakes, how Local Law 144 compares to the EU AI Act and other state-level AI hiring laws, and a practical 7-step compliance checklist for employers entering the post-Comptroller-audit enforcement era.

Local Law 144 defines an Automated Employment Decision Tool (AEDT) as any computational process derived from machine learning, statistical modelling, data analytics, or artificial intelligence that issues a simplified output (a score, classification, or recommendation) used to substantially assist or replace discretionary decision-making in employment decisions affecting candidates or employees.

“Substantially assist or replace” has a specific meaning under DCWP rules. A tool meets this threshold if it does any of the following:

• Acts as the sole basis for an employment decision
• Serves as the primary factor among several inputs used to make a decision
• Has the capability to override conclusions reached by other factors, including human judgment

Tools that merely transcribe, translate, or capture data without scoring or recommending fall outside the AEDT definition. A video interviewing platform that records interviews but does not analyse responses is not an AEDT; the same platform with sentiment analysis, scoring, or recommendation features is.

Common AEDT examples in HR tech:

• AI resume screeners that rank or score applicants against a job description
• Algorithmic candidate matching embedded in applicant tracking systems (often the most overlooked category, since employers think of the ATS as administrative rather than decision-making)
• Video interview analytics that score body language, tone, word choice, or “fit”
• Personality and cognitive assessments using machine-learning scoring rather than fixed psychometric formulas
• AI-driven sourcing platforms that surface or recommend candidates based on profile matching
• Automated reference and background-check scoring that produces a hire/no-hire signal
• AI chatbots used for candidate screening when output influences advancement decisions
• Internal mobility and promotion-recommendation tools using algorithmic scoring

The most common surprise for employers is finding AEDTs embedded inside platforms they assumed were purely manual: modern applicant tracking systems often include AI-powered ranking, recommendation, and “candidate quality score” features that activate by default. Recruitment marketing platforms, assessment vendors, and even sourcing tools may have AI scoring layers the employer has not noticed. A genuine AEDT inventory is the first compliance step, and it usually finds more in-scope tools than the employer expected.

Local Law 144 covers employers and employment agencies that use AEDTs to evaluate candidates or employees residing in New York City. Three features of the scope rules cause the most confusion in practice.

1. The candidate’s residence is what matters, not the employer’s. Local Law 144 applies whenever the candidate or employee being evaluated resides in any of the five NYC boroughs: Manhattan, Brooklyn, Queens, the Bronx, or Staten Island. The employer’s location, the role’s location, and where the AEDT vendor is headquartered are all irrelevant. A Texas company hiring for a fully remote role with a candidate who happens to live in Queens is in scope for that candidate’s evaluation.

2. The law applies to promotion as well as hiring. AEDTs used to evaluate existing employees for promotion or internal mobility decisions are in scope on the same terms as hiring tools. Internal “high-potential” identification platforms, AI-driven succession planning tools, and algorithmic promotion-recommendation systems all qualify if they substantially assist or replace discretionary decision-making.

3. Compliance obligations sit with the employer, not the vendor. The law does not impose direct obligations on AEDT vendors. The employer is responsible for ensuring an annual bias audit has been conducted, posting the results, and providing candidate notice, even when the AEDT is purchased from a third party. Many vendors voluntarily commission and publish bias audits to make their products easier to adopt, but the legal liability sits with the employer using the tool. “My vendor said the tool is compliant” is not a compliance defence if the vendor’s audit does not meet DCWP requirements.

What is out of scope:

• Manual candidate evaluation, even if it uses standardised rubrics
• Tools that translate, transcribe, or capture data without scoring
• Background-check services that surface raw records without producing a hire/no-hire signal
• Compensation benchmarking tools that do not screen, rank, or recommend candidates
• Standard psychometric assessments using fixed (non-ML) scoring formulas
• AEDTs used to evaluate candidates who reside outside NYC, even if the employer is in NYC

The bias audit is the technical heart of Local Law 144. It must be conducted by an independent auditor and must be completed within the 12 months before the AEDT is used; using an AEDT with an audit older than one year is itself a violation.

Who counts as an “independent auditor”: DCWP rules define an independent auditor as a person or organisation that:

• Is not employed by, or has not provided services to, the employer or AEDT vendor in a capacity that creates conflict
• Does not have a financial interest in the AEDT being audited
• Has the relevant expertise (typically I/O psychology, statistics, data science, or employment-discrimination analysis)

DCWP does not maintain an approved list of auditors, which means selecting a qualified, genuinely independent auditor is the employer’s responsibility. An auditor who helped build the AEDT, or who has an ongoing consulting relationship with the vendor on the same product, does not satisfy independence.

What the audit measures: selection rates, scoring rates, and impact ratios:

• Selection rate: For pass/fail AEDTs, the proportion of candidates from a demographic group who pass the AEDT (number who pass divided by total in the group)
• Scoring rate: For continuous-score AEDTs (e.g., 0 to 100), the proportion of candidates in a group who score above the overall median score
• Impact ratio: The ratio of one group’s selection or scoring rate to the rate of the most-selected group, calculated as: (group rate) ÷ (most-selected group rate)

The EEOC four-fifths rule: An impact ratio below 0.80 (80%) generally indicates potential adverse impact under the EEOC’s long-standing four-fifths rule. For example, if 60% of male candidates pass the AEDT but only 42% of female candidates pass, the impact ratio for women is 42 ÷ 60 = 0.70 (70%), below the 0.80 threshold. The four-fifths rule is a screening standard, not a definitive legal test; statistical significance and practical context matter, but a sub-0.80 impact ratio is the trigger for further investigation.

Required demographic categories:

• Sex categories
• Race and ethnicity categories (typically following EEOC component groupings)
• Intersections of sex with race and ethnicity (e.g., Asian women, Black men, White women) where data permits

For each required category, the audit reports both the selection or scoring rate and the corresponding impact ratio. If a demographic group has too few data points for statistical reliability, the audit must explain why that group was excluded and how many candidates fell into the unknown or excluded category. The audit summary published on the employer website must reflect these calculations with sufficient detail for a candidate or regulator to understand the methodology.

Beyond the bias audit itself, Local Law 144 imposes two transparency obligations: a publication requirement on the employer’s website and a candidate notice requirement before the AEDT is used in any individual evaluation.

Publication on the employer’s website:

• The bias audit summary must be posted in a “clear and conspicuous” location on the employer’s website, typically the employment or careers section
• The summary must include the date of the most recent audit and the distribution date of the AEDT (when the tool began being used)
• The summary must include the actual selection rates, scoring rates, and impact ratios calculated during the audit
• If candidates were excluded from the calculation due to unknown demographic data, the summary must state how many were excluded
• The publication must remain available for the lifetime of the AEDT’s use, with each annual audit updating the published summary

Candidate notice (10 business days minimum):

• Notice must be provided at least 10 business days before the AEDT is used in the candidate’s evaluation
• The notice must identify the AEDT being used and state that an automated tool will assess the candidate
• It must describe the job qualifications and characteristics the AEDT will evaluate (the data elements being assessed)
• It must inform candidates of their right to request an alternative selection process or reasonable accommodation, with instructions for making the request
• If not already disclosed on the website, the notice must offer information about the data collected, the source of the data, and the data retention policy within 30 days of a written request

The candidate opt-out: Candidates have the right to request an alternative selection process rather than be evaluated by the AEDT. The law does not prescribe what the alternative must look like, but it must be a reasonable alternative actually available to the candidate, not a paper-only option that is never used. Some employers offer a manual resume review or a panel interview as the alternative; others offer standardised non-ML assessments. The opt-out instruction must be published alongside the bias audit summary on the employer website.

The most important 2026 development for Local Law 144 compliance is the December 2025 New York State Comptroller audit of the DCWP’s enforcement record from July 2023 through June 2025. The findings, published 2 December 2025, were unflattering enough that the DCWP committed to a substantially more rigorous enforcement approach for 2026 onwards.

Key Comptroller findings:

• 75% of test calls to NYC’s 311 hotline about AEDT issues were misrouted and never reached the DCWP, suggesting many genuine complaints had been silently lost over the audit period
• The DCWP surveyed 32 companies and identified only 1 instance of non-compliance; the Comptroller’s auditors reviewing the same 32 companies identified at least 17 potential violations
• The DCWP’s reviews of publicly posted bias audits were “superficial” and did not use the formal procedures created jointly with the NYC Office of Technology and Innovation
• Despite lacking technical expertise to evaluate AEDT use, DCWP officials did not consult with OTI when making compliance determinations
• The DCWP relied almost entirely on complaint-driven enforcement rather than proactive investigation, and complaint volume had been very low (only 2 complaints during the entire 24-month audit window)

The DCWP commitments for 2026: The DCWP agreed to implement most of the Comptroller’s recommendations, including: better complaint routing through 311, cross-trained staff, use of OTI technical expertise, more rigorous review of publicly posted bias audits, and a shift from purely complaint-driven enforcement to proactive investigation.

Penalty structure: The financial consequences of the new enforcement phase are real and accumulate rapidly:

• $500 for a first violation, plus $500 for each additional violation occurring on the same day as the first
• $500 to $1,500 for each subsequent violation, per day of ongoing non-compliance
• Each use of a non-compliant AEDT may constitute a separate violation, so a high-volume employer running an AEDT against a large application stream can accumulate penalties fast
• Example: failing to conduct a bias audit for 30 days could result in penalties of $15,000 to $45,000 just for that single AEDT in that single month, before any per-violation multiplier kicks in

DLA Piper and other major employment-law firms have characterised 2026 as the start of a “stricter enforcement phase”: more frequent investigations, scrutinised public audit summaries, and higher cumulative penalties for employers who have been informally non-compliant since 2023.

A practical compliance approach can be structured as a 7-step checklist. The steps are sequential: each step depends on the previous one being complete.

The 12-month rule is strict. An AEDT cannot be used if more than one year has passed since its most recent bias audit. Material changes to the AEDT (retraining, configuration changes, vendor switch) typically warrant a fresh audit even within the 12-month window, since the audit reflects the model as it existed at the audit date. Organisations using multiple AEDTs from different vendors should track audit anniversaries individually rather than as a single annual programme.

Employers fall into a small set of recurring compliance errors. Most are resolvable with relatively modest effort but become expensive once a regulator engages.

• Believing the law does not apply because the company is not based in NYC. The law follows the candidate, not the employer. Any large-pool national employer should assume Local Law 144 applies.
• Missing AEDTs embedded in vendor platforms. Modern applicant tracking systems often include AI-powered ranking, “candidate quality scores”, or recommendation features that activate by default. A genuine inventory exercise typically uncovers more in-scope tools than the employer expected.
• Treating “vendor compliance” as the employer’s compliance. The vendor’s public bias audit is helpful but does not transfer the legal obligation. Employers must verify the audit is current, covers the relevant configuration, and includes the employer’s own use case where required.
• Using audits older than 12 months. AEDTs cannot be used if the most recent audit is more than one year old. This creates a strict re-audit cadence rather than a one-time compliance event.
• Posting an audit summary that is too vague. DCWP rules expect actual selection rates, scoring rates, and impact ratios with demographic breakdowns. A generic statement that the tool “was audited and showed no significant bias” does not meet the publication standard.
• Forgetting the candidate notice. The 10-business-day notice is a per-candidate obligation, not a one-time website disclaimer. ATS workflows often need to be reconfigured to ensure every NYC-resident candidate receives notice with sufficient lead time.
• Offering a non-functional opt-out. An “alternative selection process” that exists only on paper is a documented violation. The alternative must be a real, available process the candidate can elect.
• Treating promotion AEDTs as out of scope. AEDTs used for promotion, internal mobility, or “high-potential” identification are subject to the same obligations as hiring tools when used to evaluate NYC-resident employees.
• Failing to update after material changes. Retraining the underlying model, switching AEDT vendors, or reconfiguring the scoring logic typically requires a fresh bias audit even within the 12-month window.
• Underestimating the cumulative penalty exposure. Per-day, per-use penalties add up rapidly. A non-compliant AEDT running against a high-volume application stream can produce five-figure exposure inside a single month.

Local Law 144 is the most enforcement-active AI hiring regulation in the United States, but it is part of a rapidly expanding compliance landscape.

The practical implication for multi-state employers is that NYC Local Law 144 is not a standalone compliance project. The bias-audit infrastructure built for NYC compliance, including AEDT inventory, demographic data analytics, auditor relationships, candidate-notice workflows, and opt-out mechanisms, is directly reusable for Illinois, Colorado, and the EU. Treating Local Law 144 as the foundation of a broader US AI hiring compliance programme is the most efficient path forward.