Which AI hiring tools are covered by NYC Local Law 144?

Local Law 144 covers "automated employment decision tools" (AEDTs) that use machine learning, statistical modeling, or AI to substantially assist hiring decisions. This includes candidate screening systems, skills assessments, interview scheduling tools that rank candidates, and background check interpretation systems. The law applies to NYC positions regardless of employer location, with limited exemptions for tools that don't make individualized assessments.

What bias audit requirements must employers follow under Local Law 144?

Employers must conduct annual independent bias audits calculating selection rates and impact ratios by sex, race, and ethnicity. Audits must use the 80% rule (impact ratios below 0.8 indicate potential bias) and include intersectional analysis where data permits. Results must be published on company websites with auditor information, methodology, and statistical findings disclosed publicly.

What notification rights do job candidates have under Local Law 144?

Candidates must receive notice before AEDT use including description of evaluated characteristics, data sources, and instructions for requesting alternative selection processes. After assessment, candidates can request their scores, individual factors influencing results, and underlying data used. Employers have 30 days to respond and must provide reasonable alternatives to AEDT evaluation upon request.

How do GDPR Article 22 rights interact with NYC Local Law 144 requirements?

GDPR Article 22 provides rights regarding automated decision-making including human intervention and explanation rights that may exceed Local Law 144 requirements. Global employers must integrate both frameworks through harmonized bias testing, consistent candidate notifications, aligned data retention procedures, and coordinated vendor management to ensure comprehensive compliance.

What penalties apply for NYC Local Law 144 violations?

The NYC Department of Consumer and Worker Protection can impose civil penalties up to $1,500 per violation, with additional penalties for failure to remedy violations within 30 days. While the law doesn't create private right of action, compliance failures may support Title VII disparate impact claims, state civil rights violations, and contract claims against AEDT vendors.

NYC Local Law 144: The AI Hiring Compliance Guide for 2026

4 Aug 2025Sotiris SpyrouUpdated on 29 Jun 2026

Share this article

LinkedIn X Email

NYC Local Law 144: The AI Hiring Compliance Guide for 2026

If you use AI to screen, rank, or shortlist candidates for a New York City role, NYC Local Law 144 requires three things before the tool touches a single applicant: an independent bias audit done within the past year, a public summary of that audit on your website, and at least 10 business days' notice to every candidate. Miss any of them and the fines run from $500 to $1,500 per violation, with each day and each un-notified candidate counted separately. That's the floor. The EU AI Act raises the ceiling in August 2026, and the federal picture in the US has gone quiet rather than safe. Here's what HR, legal, and compliance leaders actually have to do.

What does NYC Local Law 144 require?

Local Law 144 took effect on 5 July 2023. It was the first US law to regulate AI in hiring directly, and three years on it's still the template other jurisdictions copy.

The law covers what it calls an automated employment decision tool, or AEDT. The DCWP final rules define that as any computational process derived from machine learning, statistics, data analytics or AI that produces a simplified output (a score, a classification, a recommendation) used to substantially assist or replace human judgement in a hiring or promotion decision.

If a tool does that for a job that's performed, even partly, in New York City, three obligations attach.

Obligation	What it means in practice
Bias audit	Independent audit completed no more than one year before you use the tool, repeated annually
Public summary	Plain summary of the audit results posted on a publicly accessible part of your website
Candidate notice	At least 10 business days' notice before the tool is used, naming the job qualifications and characteristics it assesses

The notice point trips people up. It's 10 business days, not 30 calendar days, and not "at some point in the process." The clock starts before the AEDT runs.

What counts as a bias audit, and who can run it?

A bias audit under Local Law 144 isn't a vibe check or a vendor's self-certification. The rules spell out the maths.

The auditor calculates the selection rate for each protected category, then the impact ratio: the selection rate for one group divided by the selection rate for the highest-scoring group. The benchmark is the EEOC's four-fifths rule. An impact ratio below 0.80 flags potential adverse impact and gets published anyway. The audit runs across sex categories, race and ethnicity categories, and the intersections of the two (for example, Hispanic women, white men) where the sample is large enough to mean anything.

Where the employer has real historical data from using the tool, the audit uses that. Where it doesn't, the rules allow test data instead, with a note explaining why historical data wasn't available.

The auditor has to be independent. The DCWP rules disqualify anyone who helped build or sell the tool, anyone with a financial stake in it, and anyone employed by the vendor. That last point matters: a "free audit" bundled in by the AEDT vendor is not an independent audit. If your vendor offers one, that's a red flag, not a convenience.

What do you have to tell candidates?

The public summary and the individual notice do different jobs.

The website summary must show the most recent audit's selection rates and impact ratios, the categories tested, the source and date range of the data, and the distribution date of the audit. It stays up while you're using the tool.

The individual notice goes to candidates who live in NYC, at least 10 business days before the AEDT assesses them. It has to state that an AEDT will be used, name the job qualifications and characteristics the tool will assess, and tell candidates how to request an alternative process or an accommodation.

Here's the part that gets misreported constantly. The notice tells candidates they may request an alternative selection process. The law does not force you to provide one. The DCWP rules say it plainly: "Nothing in this subchapter requires an employer or employment agency to provide an alternative selection process." Any guide claiming Local Law 144 grants candidates a right to a human-only review, or a 30-day right to demand their score and underlying data, is describing a law that doesn't exist. Those rights belong to the EU's GDPR and to some state privacy statutes, not to LL144.

One caveat that does bite: other laws can still force your hand. The Americans with Disabilities Act may require a reasonable accommodation even though Local Law 144 doesn't. Treat the two as separate obligations.

What are the penalties, and is anyone enforcing this?

The DCWP can fine employers between $500 and $1,500 per violation. The structure is what hurts. Each day the tool runs without a current bias audit is a separate violation. Each candidate who doesn't get the required notice is a separate violation. A single non-compliant tool used across a hiring season can stack into real money fast.

For two years, enforcement was thin. Then in December 2025 the New York State Comptroller published an audit of how DCWP had policed the law, and it wasn't flattering. The finding, in short: enforcement had been reactive and complaint-driven, with little proactive checking. DCWP committed to fixing that, with better complaint handling, cross-trained staff, and active hunting for non-compliant employers.

My read: the quiet period is ending. If you've been treating LL144 as a low-priority box because nobody got fined, the window to get clean before someone goes looking is closing. Note too that LL144 has no private right of action, but a bad bias audit becomes evidence. A published impact ratio under 0.80 is a documented disparate-impact signal a claimant can point to under Title VII or the New York City Human Rights Law.

Does the EU AI Act change the picture for HR?

Yes, and it's bigger than NYC. Under the EU AI Act, Annex III, point 4, AI used for recruitment or selection counts as high-risk. That covers targeted job ads, CV filtering, candidate evaluation, and tools that decide on promotion, termination, or task allocation.

The high-risk obligations apply from 2 August 2026. For employers who deploy these tools (deployers, in the Act's language), the duties include human oversight in line with the vendor's instructions, monitoring the system in use, keeping the automated logs for at least six months, telling affected workers and candidates the tool is in use, and, for some uses, a fundamental rights impact assessment before deployment.

This reaches well beyond Europe. If a tool screens candidates for a role based in the EU, or affects people in the EU, the rules apply regardless of where the employer sits. Penalties for breaching the high-risk obligations run up to EUR 15 million or 3% of global annual turnover, whichever is higher. That's a different order of magnitude from NYC's per-violation fines.

The practical link: if your AEDT vendor can't hand you their conformity documentation and CE marking before 2 August 2026, you shouldn't deploy them for EU-facing roles past that date.

What's happening at the US federal level?

Less than you'd expect, and not in a reassuring way.

In early 2025 the EEOC removed its technical guidance on assessing adverse impact in AI hiring tools from its website, following executive orders directing agencies to roll back AI rules. In April 2025 a further executive order directed federal agencies to step back from enforcing disparate-impact liability, and in June 2025 the EEOC rescinded its 2024 to 2028 strategic enforcement plan.

Removing guidance is not the same as repealing law. Title VII of the Civil Rights Act still prohibits employment practices with an unjustified disparate impact, and the Uniform Guidelines on Employee Selection Procedures still apply to algorithmic selection. The federal government has stopped explaining how it sees AI hiring. The underlying liability hasn't moved. For an employer, that's the worst of both worlds: the same exposure, less clarity on what regulators expect.

States have filled some of the gap. Illinois, Colorado and others have legislated, though the picture shifts fast. Colorado's AI Act, once the broadest state framework, was delayed and then repealed and replaced in 2026 with a narrower automated-decision law effective 1 January 2027. Don't build your compliance programme around any single state statute. Build it around the duty that survives every rollback: don't run a hiring tool you can't show is fair.

Frequently asked questions

Does Local Law 144 apply to my company if we're not based in New York City?

Location of the employer doesn't matter. What matters is the location of the job. If the role is performed, even partly, in NYC (including remote and hybrid roles that can be done from NYC) and you use an AEDT to assess candidates for it, the law applies.

How often do I need a bias audit?

Every year. The audit must be completed no more than one year before you use the tool, and you keep it current annually for as long as the tool is in use. Let it lapse and each day past the deadline can count as a separate violation.

Does Local Law 144 require me to offer a human alternative to AI screening?

No. The law requires you to tell candidates they may request an alternative selection process or accommodation. It does not require you to provide one. The DCWP rules state this directly. Other laws, such as the ADA, may separately require an accommodation, so don't read this as a blanket exemption.

Is the EU AI Act relevant if I only hire in the US?

Only if none of your roles touch the EU. The Act applies to AI hiring tools used for roles based in the EU or affecting people there, whatever the employer's location. A US company recruiting for an EU position is in scope from 2 August 2026.

The bottom line

Local Law 144 isn't hard to comply with. It's three steps: a current independent audit, a public summary, and 10 business days' notice. What trips employers up is bad information, the persistent myth that the law guarantees candidates a human reviewer or a right to their data, and the assumption that a vendor's bundled audit counts as independent. It doesn't.

My view: stop treating these laws as separate fire drills. NYC, the EU AI Act and Title VII all point at the same underlying duty, which is to prove your hiring tool doesn't discriminate before it makes decisions about people. Build the audit, the documentation and the candidate notice once, as a standing process, and you've covered most of the map. The employers who'll struggle in 2026 are the ones who bolt on compliance per jurisdiction, per deadline, in a panic. The ones who'll be fine treated bias auditing as a permanent part of how they hire, not a paper exercise to survive an inspection.

If you're deploying AI in hiring and you can't currently produce a current bias audit, an independent one, you don't have a documentation gap. You have a live exposure. Fix that first.

References

For the board-level view, see VerityAI's NYC Local Law 144 hiring compliance.

This is the kind of work our board-level AI governance handles.