Why New York City’s AI hiring bias law found just 1 violation where the state found 17

New York City’s Local Law 144, enacted in 2021 and enforced since July 2023, imposes strict requirements on employers using artificial intelligence or machine learning to screen candidates or evaluate employees for promotion. Any employer using automated employment decision tools—whether a resume-screening platform, video-interview analyzer, or skills-assessment program—must prove annually that the tool does not discriminate based on protected categories like race, sex, and ethnicity. According to the DCWP’s FAQs, the law applies to employers with a physical office in New York City that use such a tool for jobs located in the city, at least part-time, or for remote positions associated with a New York City office.

The law shifts compliance responsibility to employers and their chosen auditors, not to software vendors. For New York employers and the technology companies that sell to them, understanding what the bias audit must cover, who conducts it, and how enforcement works has become central to legal hiring practices. Yet a December 2025 audit by the New York State Comptroller found that the city’s Department of Consumer and Worker Protection, the agency charged with enforcement, has identified only a fraction of the violations that actually exist. Among 32 companies reviewed by the Comptroller, the agency found at least 17 instances of potential non-compliance, yet DCWP itself had identified only one violation during the same review period.

Which hiring tools fall under the law

Local Law 144 defines covered tools broadly: any computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that is used to substantially assist or replace discretionary decision-making for employment decisions. The law excludes general software tools like spreadsheets, email filters, or antivirus programs, focusing instead on systems designed to evaluate candidate qualifications or performance.

The tool must affect hiring or promotion decisions for positions located in New York City, at least part-time, or for remote positions associated with a New York City office; the DCWP’s FAQs clarify that the law applies only to employers with a physical office in the city. The law covers tools at any stage of hiring, from resume screening through skills testing to video analysis, but does not apply to systems that only send invitations to potential candidates without assessing qualifications. Software vendors are not responsible for ensuring compliance; employers must do so before deploying any covered tool. Vendors may provide employers or auditors with the information needed to conduct audits, though the law gives flexibility on what form that information must take.

This responsibility structure means employers face significant compliance burdens. They must identify which of their tools qualify under the law’s definition, engage independent auditors for each tool, manage the audit process, and publicly disclose results—all without vendor assistance in most cases.

Timeline and Scope
Local Law 144 was enacted in 2021. Enforcement was originally scheduled to begin January 1, 2023, but the city postponed it to July 5, 2023, when the law took effect. It applies to employers with a physical office in New York City that use automated employment decision tools for hiring or promotion decisions tied to city positions, including certain remote roles associated with a New York City office. Audits must be conducted no more than one year before a tool’s use, and results must remain publicly posted for at least six months after the tool’s most recent use.

What the annual bias audit must measure

The bias audit must test the tool’s disparate impact on employment decisions across protected categories including race, sex, and ethnicity. The audit uses a specific mathematical approach: auditors calculate selection rates for each protected group by dividing the number of individuals selected by the total number of applicants in that group. They then calculate impact ratios by dividing each group’s selection rate by the highest rate among all groups.

Each audit must be conducted no more than one year before the tool’s use, measuring its effect on hiring or promotion decisions. The law requires an independent auditor to conduct the evaluation, not the vendor or the employer’s internal team. The Comptroller’s December 2025 audit flagged auditor independence as an area of concern, with the agency finding multiple instances where auditors may not have maintained sufficient separation from the employers or vendors they were evaluating.

Auditors may exclude any protected category representing less than 2 percent of the tested data, though they must report the number of individuals in unknown or unmeasured categories so employers can track gaps in their analysis. The audit scope extends to every individual assessed by the tool, including both hired and rejected candidates.

Employer disclosure and candidate notification

Employers must publish a summary of the audit results on their employment or careers website, posting them in a clear and conspicuous manner and keeping them publicly available for at least six months after the tool’s most recent use. The disclosure must include the audit date, the date the tool was implemented, a description of data sources and explanation of methodology, the number of applicants assessed, selection and scoring rates for each protected category, and impact ratios across all categories. This public disclosure requirement differs from notice to candidates: it creates a permanent, searchable record of how the tool performs across demographic groups.

Before using an AEDT, employers must notify candidates and employees at least 10 business days in advance, specifying the tool’s use and the job qualifications and characteristics it assesses. The notification must include instructions for requesting alternative selection processes or accommodations. Notices need not be position-specific; employers can use categorical descriptions of what the tool evaluates. Within 30 days of a written request, employers must also provide individuals with details about data types collected, data sources, and retention policies. This creates an ongoing transparency obligation that extends beyond the initial hiring decision.

These disclosure requirements place significant operational demands on employers. Many have struggled to post audit results on their websites, with the Comptroller finding that some companies failed to make summaries easily accessible or did not post them at all.

Among 32 companies reviewed by the Comptroller, the agency found at least 17 instances of potential non-compliance, yet DCWP itself had identified only one violation during the same review period.

Enforcement, penalties, and compliance gaps

The New York City Department of Consumer and Worker Protection enforces the law and can impose civil penalties ranging from $500 to $1,500 per violation per day. Each day an employer uses a covered tool without providing required notice or disclosure constitutes a separate violation, so cumulative penalties can reach thousands of dollars rapidly. An employer failing to post audit results for 30 days could face penalties of $15,000 to $45,000, assuming enforcement action were taken.

However, enforcement has lagged significantly. According to the December 2025 Comptroller audit, DCWP identified only one compliance violation during its review of employers. The Comptroller’s audit of 32 companies’ websites and bias audit disclosures found at least 17 instances of potential non-compliance—a discrepancy suggesting systemic gaps in oversight. The violations centered on bias audit quality issues, auditor independence concerns, data and methodology problems, and failure to publicly post required audits.

The audit revealed structural weaknesses in how the city enforces the law. Test calls to the NYC 311 hotline about AEDT issues were often improperly routed, with most calls failing to reach DCWP. Online complaint instructions were found to be unclear, offering no explicit guidance for filing AEDT-related complaints. Complaint tracking and documentation proved incomplete, with information missing on the nature of complaints and any resolution achieved. These gaps mean that employers, workers, and auditors may struggle to reliably report suspected violations.

What lies ahead for employers and vendors

The Comptroller’s findings signal increased risk for employers going forward. The agency issued 13 recommendations to strengthen DCWP enforcement, including improved complaint routing, formal enforcement procedures, consultation with technical experts, and enhanced educational outreach. Although implementation remains pending, employers should anticipate more frequent investigations and enforcement actions as DCWP adopts these recommendations and develops technical capacity to evaluate tools.

For employers, this means conducting a comprehensive audit of their software inventory to identify which tools fall under Local Law 144’s definition.

The law also creates new business opportunities: independent auditors, compliance consultants, and specialized software vendors have emerged to help employers navigate bias audit requirements. However, the quality of these services remains uneven, and employers must carefully vet auditors to ensure they meet the law’s independence standard. As enforcement tightens and penalties accumulate, the cost of non-compliance will dwarf the cost of compliance for most organizations.

Photo: Dietmar Rabich · CC BY-SA 4.0 · via Wikimedia Commons