NYC Local Law 144 · Automated Employment Decision Tools
Your hiring tool needs an audit.Most employers fail the math, not the law.
Independent bias audits for employers running automated screening on New York City candidates. Fixed price, agreed before the work starts, and documentation that holds up when somebody asks to see it.
Impact ratio = each group's selection rate divided by the highest group's rate. Under the EEOC four-fifths guideline, below 0.80 is treated as evidence of adverse impact.
What changed
The cheap period is over.
On 2 December 2025 the New York State Comptroller published an audit of how the Department of Consumer and Worker Protection enforces Local Law 144. Its reviewers looked at the same 32 companies DCWP had already looked at, and reached a very different conclusion.
Office of the New York State Comptroller, report 2024-N-6, covering July 2023 through June 2025. DCWP identified one instance of non-compliance across the 32 companies it reviewed. The Comptroller identified at least 17 instances of potential non-compliance in the same set.
17
Instances of potential non-compliance the Comptroller found among companies DCWP had cleared
2
AEDT complaints DCWP received across the entire two-year audit period
75%
Of test calls to 311 about AEDT issues were routed somewhere other than DCWP
What DCWP agreed to do about it. The department concurred with the findings and committed to fixing complaint routing, cross-training staff, writing consistent complaint-handling policies, and interviewing employers about their tools rather than waiting for someone to file a complaint.
Enforcement between 2023 and 2025 was complaint-driven and thin. Two complaints in two years is not a compliance record. It is a measurement failure, and it has now been measured.
What the law requires
Three obligations, in order. Missing any one is a violation.
01
Audit before use
An independent bias audit conducted no more than one year before the tool is used, covering selection or scoring rates by sex, by race and ethnicity, and by their intersections.
02
Publish the summary
A summary of the most recent audit posted publicly on your website, with the distribution date of the tool. It stays up for at least six months after the tool's last use. The opt-out instructions belong here too.
03
Notify candidates
At least ten business days before use, naming the job qualifications and characteristics the tool assesses, with a route to request an alternative process that is actually available rather than theoretical.
The audit does not clear the tool permanently. It clears it for twelve months. Companies that commissioned an audit in the first compliance year and treated it as finished are the population the Comptroller's findings point at.
Who this reaches
Coverage follows the candidate, not the company.
Your headquarters is not the test. If you post a remote role and one applicant lives in Staten Island, that evaluation is in scope. For anyone hiring remotely at any scale, the working assumption should be that you are covered until you have established otherwise in writing.
Employers
Any company using a screening, ranking, assessment or promotion tool on candidates or employees located in New York City. Most exposure sits in the applicant tracking system or an assessment vendor the company assumed was manual.
Employment agencies
The statute names employment agencies directly. If you screen candidates on behalf of a client using a tool that scores or ranks them, the obligation attaches to you and not only to the employer you place them with.
Staffing and RPO firms
High-volume placement is where automated screening earns its keep, and where a single tool touches thousands of New York City candidates a year. Volume raises both the compliance obligation and the underlying discrimination exposure.
Choosing an auditor
Six questions worth asking anyone who offers to audit your tool.
DCWP publishes no approved auditor list. Selecting one is the employer's responsibility, and a report signed by a party that fails the independence test is worse than no report, because it documents that you tried and got it wrong. These six questions separate an audit from a PDF shaped like one.
Did you take any part in developing, testing, training or selling the tool you are being asked to audit?
Who performs the disparate impact analysis, and what is their background?
Will you publish your methodology, or only the results?
Is any part of your fee tied to what the audit finds?
If you also sell platform or governance software, how is the audit team separated from it?
Will a named individual sign the audit summary as auditor of record?
Inventory every tool touching hiring or promotion, apply the AEDT definition to each in writing, and produce a scoping memo you can hand to counsel. The right first step when you do not yet know whether you are covered.
$1,500Credited in full against a subsequent audit
Independent bias audit
Impact ratio analysis by sex, by race and ethnicity, and by every required intersection. Published summary drafted, candidate notice reviewed, workpapers retained behind every figure.
From $5,500Scales with the number of tools in scope
AI governance baseline
For organizations whose AI exposure runs past hiring. Enterprise inventory, risk classification against the NIST AI Risk Management Framework, control design and evidence practices.
From $10,000Scoped on assessment
Common questions
What employers ask before they commission anything.
Who has to comply with Local Law 144?
Employers and employment agencies that use an automated employment decision tool to substantially assist or replace discretionary decision-making in hiring or promotion, where the candidate or employee is located in New York City. The test is where the candidate sits, not where the company is headquartered. A fully remote company with one applicant in the five boroughs is covered for that evaluation.
How often does the audit have to be done?
The audit must have been conducted no more than one year before the tool is used. That makes it a recurring obligation rather than a one-time clearance, and it is the requirement employers most often miss after the first year.
What is the four-fifths rule?
An impact ratio compares each demographic group's selection rate against the rate of the most-selected group. Under the EEOC's four-fifths guideline, a ratio below 0.80 is treated as evidence of adverse impact warranting further examination. Local Law 144 requires those ratios to be calculated and published. It does not itself make 0.80 a pass-fail line.
Is a failing impact ratio a violation?
Not of Local Law 144. The statute requires you to calculate and publish, not to pass. The same figure is squarely relevant under Title VII, the New York City Human Rights Law and the New York State Human Rights Law, where the exposure is class litigation rather than a per-day penalty. Publishing a bad number is required. Not publishing it is the violation.
Who qualifies as an independent auditor?
A person or firm not involved in using, developing or distributing the tool, and holding no employment or financial relationship with the employer that would compromise independence. DCWP maintains no approved auditor list, so the selection is the employer's responsibility and the employer's risk.
Can our AEDT vendor perform the audit?
A vendor auditing its own tool, or paying the party that does, is the arrangement most likely to fail the independence requirement. It is also the most common one in the market. Ask the six questions on this page of anyone you are considering.
What has to be published, and for how long?
A summary of the most recent bias audit, publicly available on your website, covering the source and explanation of the data used, the number of individuals assessed who fall into unknown categories, and the selection or scoring rates and impact ratios for every required category. The distribution date of the tool goes alongside it. The summary must stay posted for at least six months after the tool's most recent use.
What are the penalties?
Between $500 and $1,500 per violation, and each day a violation continues is treated as a separate violation. Failing to conduct the audit, failing to publish the summary and failing to give notice are each independently actionable.
What if we have never collected demographic data?
The rules address this. Where historical data is insufficient, test data may be substituted, and that substitution carries its own disclosure requirement. Reconstructing or substituting data is one of the main things that moves the cost of an engagement.
We are not sure any of our tools count as AEDTs. Where do we start?
With an inventory rather than an audit. Every system touching hiring, screening, ranking, assessment or promotion gets the AEDT definition applied to it in writing. That is what the exposure review produces, and roughly a third of them conclude that nothing in the stack meets the definition.
Find out whether you are covered before somebody else does.
A twenty-minute scoping call is free and usually settles the question. If you are not in scope, we will tell you that and we are done.