NYC Local Law 144 requires employers and employment agencies using a covered automated employment decision tool in New York City to obtain an independent bias audit within the previous year, publish a results summary, and give required candidate or employee notice. The duty applies before use; buying an audited product does not transfer the employer’s responsibility.

What does NYC Local Law 144 require?

NYC Local Law 144 regulates a specific use of automation: screening people for hiring or promotion in New York City. It does not ban AI in hiring. It makes the use of a covered automated employment decision tool, or AEDT, conditional on an audit and transparency steps. The NYC Department of Consumer and Worker Protection states the three core conditions: a bias audit within one year before use, public information about that audit, and the required notices.

The sequence matters. An organization should not deploy the tool and treat the audit as cleanup. Audit, publication, and notice controls must be ready before the covered use. Enforcement began on July 5, 2023. The law therefore belongs in normal procurement and release management, not in a future-policy folder.

Who is covered by Local Law 144?

Start with the job and the employment decision. The official DCWP FAQ explains when an AEDT is used “in the city”. The scope includes a job located in an NYC office at least part time, a fully remote job associated with an NYC office, and certain uses by employment agencies. Candidate residence matters for the notice duty, but it is not a reliable substitute for the job-location test.

Use this five-question screen for each tool and workflow:

1. Is there a specific job or promotion? Local Law 144 covers screening candidates for employment and employees for promotion.
2. Is the role connected to NYC? Record the office or organizational location attached to the requisition, including fully remote roles.
3. Does a computational process create a score, classification, or recommendation? Product labels such as “copilot” or “assistant” do not decide scope.
4. Does the output substantially assist or replace discretion? Inspect how recruiters actually use it, not only what the contract permits.
5. Is the person already a candidate for a specific role? The DCWP says scanning a resume bank, conducting outreach, or inviting applications is outside these requirements when the person has not applied for a specific position.

Do not make one company-wide yes-or-no decision. The same platform can be outside scope in an administrative workflow and in scope when a scoring module ranks applicants. Build an inventory at the level of tool, feature, decision, job population, and version.

What must an AEDT bias audit measure?

A Local Law 144 bias audit is an impartial evaluation by an independent auditor. At minimum, the auditor calculates selection rates or scoring rates and impact ratios across sex, race or ethnicity, and intersectional categories. The required method depends on whether the tool selects people or assigns scores. Historical data from actual use is the default.

The public summary is more than a badge. It must identify the audit date, explain the data source, report assessed individuals in an unknown category, and show the relevant counts, rates, and impact ratios. The distribution date must also be public. Keep the disclosure reachable on the employment section of the company website or provide an active link there.

Several boundaries matter:

• No DCWP-approved auditor list exists. Independence depends on objective judgment and the absence of disqualifying work or financial interests.
• A vendor audit can help, but it does not shift accountability. The employer or employment agency must ensure that a valid audit exists before use.
• Test data is possible when historical data is insufficient. The public summary must explain why it was used and where it came from.
• Demographic characteristics cannot be inferred for the audit. DCWP says imputed or inferred demographic data may not replace the required data.
• The audit is not a government certification. It reports defined outcome metrics. It does not prove that the tool is fair in every job, disability context, or decision.

Local Law 144 does not prescribe a remediation result when an audit indicates disparate impact. That is not permission to ignore the finding. Other anti-discrimination duties still apply. Treat the result as a decision gate: investigate the affected workflow, validate job relevance, consider pausing the feature, change the process where appropriate, and document counsel’s advice.

How much does a Local Law 144 bias audit cost?

Pricing status: August 2026. The law and DCWP do not set an audit fee. Most auditors quote after scoping. One specialist’s published 2026 pricing review places visible market examples roughly between $5,000 and $50,000 and lists its own first-tool fee at $5,500. This is a vendor-published reference, not an official tariff or a guaranteed market average. Obtain comparable written quotes.

The cheapest quote may omit the work that consumes most internal time. Separate the independent statistical audit from data preparation, legal interpretation, remediation, publication, notice engineering, and ongoing governance.

Ask every bidder to price the same scope. Name the exact tool version, workflow, historical period, entities, data owners, deliverables, remediation support, and publication support. Otherwise, a $5,500 calculation-only quote and a broader five-figure engagement are not comparable. Budget internal HR, privacy, legal, analytics, procurement, and web-team time separately.

How do you complete an AI hiring audit in New York?

A practical compliance project can run in eight controlled steps:

1. Inventory decisions, not logos. Map every automated score, rank, recommendation, classification, and rejection across the hiring and promotion funnel.
2. Apply the scope test. Record job location, candidate status, feature, decision use, and why the output does or does not substantially assist discretion.
3. Freeze the audit object. Capture product name, model or feature version, configuration, inputs, outputs, thresholds, and release date.
4. Secure usable data. Export applicant counts, stages, outcomes, timestamps, demographic fields lawfully collected, unknown categories, and exclusion reasons. Reconcile totals before sending data.
5. Verify auditor independence. Ask about employment, development involvement, distribution involvement, and direct or material indirect financial interests.
6. Review the result as a decision. HR, counsel, the data owner, and the business owner should examine weak sample sizes, impact ratios, job relevance, and operational causes.
7. Publish and notify. Put the required summary and distribution date online. Configure notice at least ten business days before use and include assessed qualifications plus accommodation instructions.
8. Operate the calendar. Assign an audit expiry owner, preserve evidence, watch feature releases, and prevent an unaudited workflow from being enabled.

For products such as CV screening or voice interviews, ask for evidence at the output level. A generic vendor statement about responsible AI cannot show which model, threshold, or workflow was audited. Sprad can be assessed as one option among specialist and ATS-native tools, using the same evidence checklist.

Make the notice operational, not ornamental. If the careers page carries a general notice, confirm that it is live for the full ten-business-day period before the AEDT is used. State that an AEDT will be used. Identify the job qualifications or characteristics it assesses. Explain how to request a reasonable accommodation. Make sure recruiters know what happens after such a request.

What should buyers ask an AI recruiting vendor?

The employer’s responsibility makes vendor diligence central. Ask for artifacts before a pilot reaches real applicants:

• Which exact features create predictions, classifications, scores, ranks, or recommendations?
• Which version was independently audited, on what date, and with whose data?
• Can your organization legally rely on the vendor-coordinated audit under the DCWP data rules?
• What changes between releases, and how are customers warned before an audited object changes?
• Can the product export every field needed to reproduce selection or scoring rates?
• Can automation be disabled for NYC-linked requisitions without breaking the rest of the workflow?
• How are accommodations, manual review, overrides, and candidate requests recorded?
• What retention and deletion controls apply to source data, scores, transcripts, and derived features?

Test answers in the product. Create a sample NYC requisition. Turn the feature off and on. Export a complete decision record. Change a threshold. Process an accommodation request. Delete a candidate through the candidate portal or privacy workflow. Evidence from these tasks is more useful than a policy deck.

What changes for DACH companies hiring in New York?

A German, Austrian, or Swiss headquarters does not remove the New York obligation when the covered use is tied to NYC. At the same time, satisfying Local Law 144 does not satisfy European requirements. The NYC audit focuses on defined outcome calculations and notices. European analysis asks additional questions about data protection, automated decision-making, worker participation, transparency, risk management, and the obligations attached to high-risk AI.

Run one product inventory, then attach jurisdiction-specific controls. For the European side, use an EU AI Act recruiting obligations review and a broader AI recruiting compliance checklist. Keep the NYC audit summary separate from GDPR transparency information. They answer different questions and may have different audiences.

What happens if an employer does not comply?

The enacted text sets civil penalties of up to $500 for a first violation and additional violations on that day, then $500 to $1,500 for subsequent violations. Each day of unlawful AEDT use can create a separate violation. Notice failures are separately actionable under the text.

The more durable risk is operational. An expired audit can force a team to pause screening during an active hiring wave. A weak disclosure can attract candidate questions the recruiting team cannot answer. An audit finding without an escalation path can sit unresolved while the tool remains active. Prevention is simple: one inventory, one named control owner, one expiry calendar, and an enablement gate tied to evidence.

Frequently asked questions

Does Local Law 144 apply to every ATS?

No. An ATS that only stores, organizes, or routes records is not automatically an AEDT. A scoring, ranking, recommendation, or automated rejection feature may change the analysis. Evaluate the specific feature and its real use.

Does a human reviewer keep a tool outside the law?

Not necessarily. The question is whether the output substantially assists or replaces discretion. A nominal human review may not help if the score drives the result in practice.

Can an employer use the vendor’s AEDT bias audit?

Sometimes. A vendor can coordinate an independent audit. The employer must still confirm that the audit is current, applicable to its use, based on permitted data, and published as required.

Must a company stop using a tool when an impact ratio looks poor?

Local Law 144 itself does not prescribe a particular response to the result. Anti-discrimination laws still apply. Escalate the finding, investigate the process, and obtain qualified legal advice before continuing unchanged.

Is this article legal advice?

No. It is an operational guide based on public sources. Scope and remediation can depend on the facts, contracts, locations, data, and workflow. Qualified counsel should confirm the final legal position.