Last reviewed: April 27, 2026
Key Takeaways
- New York City Local Law 144 (Admin. Code § 20-870 et seq.) was the first US law to mandate an independent annual bias audit of AI hiring tools. It took effect on July 5, 2023 and applies to employers and employment agencies hiring for any job performed in NYC or remote roles tied to a NYC office.
- Until late 2025, LL 144 was widely treated as a paper requirement. A December 2, 2025 NYS Comptroller audit found DCWP enforcement “ineffective” — DCWP reviewed 32 companies and identified 1 violation; the Comptroller’s auditors reviewed the same 32 and identified 17 potential violations. DCWP also received only 2 AEDT complaints in two years.
- DCWP issued the first real LL 144 penalties in Q4 2025 and shifted to proactive investigations beginning January 2026. Reports indicate fines have hit multiple employers using well-known AI hiring platforms without the required audits.
- Penalties: $500 for the first violation, up to $1,500 per day for each subsequent violation. Each day a tool runs without a current audit is a separate violation. A tool used for 30 days without an audit triggers ~$45,000+ in fines.
- Compliance is shockingly low. Independent estimates (Cornell / HR Brew, April 2026) suggest only ~5% of NYC employers using AI hiring tools publicly post the required bias audit results. The remaining 95% are now exposed to a proactively-enforcing DCWP.
What Does Local Law 144 Require?
Local Law 144 of 2021 amended the New York City Administrative Code to add §§ 20-870 through 20-874, regulating the use of “automated employment decision tools” (AEDTs) by employers and employment agencies. It became enforceable on July 5, 2023, after a six-month delay from the original January 2023 date.
The law has three core obligations. An AEDT cannot be used in NYC hiring or promotion unless all three are satisfied:
| # | Obligation | Citation |
|---|---|---|
| 1 | Independent bias audit within the previous 12 months | NYC Admin. Code § 20-871 |
| 2 | Public posting of the bias audit summary on the employer’s website | NYC Admin. Code § 20-872 |
| 3 | Candidate notice at least 10 business days before AEDT use | NYC Admin. Code § 20-871 |
Each obligation generates separate liability. An employer can be in compliance with one and out of compliance with the others, and each shortcoming accumulates daily violations.
The law is enforced by the NYC Department of Consumer and Worker Protection (DCWP), which has authority to impose civil penalties. Affected candidates do not have a private right of action — there is no LL 144 lawsuit. The enforcement mechanism is administrative, channeled through complaints filed with DCWP.
What Counts as an AEDT?
The definitional question is the law’s central interpretive challenge. NYC Admin. Code § 20-870 defines an AEDT as “any computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is used to substantially assist or replace discretionary decision-making for making employment decisions that impact natural persons.”
Two tests must be satisfied:
1. Computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence. The DCWP rules clarify that “machine learning, statistical modeling, data analytics, or artificial intelligence” includes any system whose output is generated by a process that “uses a model whose parameters are learned from data, or whose criteria are otherwise derived through statistical or mathematical analysis.”
2. Used to substantially assist or substantially replace discretionary decision-making. “Substantially assist or replace” is the gray zone. The DCWP rules define this as: relying solely on a simplified output (no other input considered); using a simplified output as one of multiple criteria where the simplified output is weighted more than other criteria; or using a simplified output to overrule conclusions derived from other factors.
Common gray-area examples
- Resume parser that extracts skills and experience: likely AEDT if the parsed data is used to score or rank candidates.
- Scheduling tool that books interviews based on calendar availability: likely not AEDT — does not score or recommend candidates.
- Sourcing tool that searches LinkedIn for candidates matching keywords: gray — depends on whether it ranks candidates.
- AI assistant that drafts interview questions: likely not AEDT — does not make or substantially assist a decision.
- Performance management AI used in promotion decisions: AEDT — promotions are within scope.
- Termination prediction model: AEDT if used to substantially assist discharge decisions.
If you are unsure, the conservative path is to treat the tool as an AEDT and conduct the audit. The enforcement environment as of 2026 favors caution.
What Does the Bias Audit Actually Involve?
Who Conducts It
The bias audit must be conducted by an independent auditor — defined by the DCWP rules as someone who is not the AEDT vendor and not the employer or its employee. The auditor must have no financial interest in the AEDT or the employer’s hiring outcomes. There are no formal credentialing requirements; in practice, the audit market is dominated by specialist firms (Holistic AI, DCI Consulting, BLDS are commonly named in audit reports). Costs typically run $5,000-$30,000 per audit depending on tool complexity, dataset size, and scope.
Methodology
At minimum, the auditor must calculate selection rates and impact ratios for:
- Sex categories (as defined by EEOC)
- Race/ethnicity categories (as defined by EEOC)
- Intersectional categories (sex × race/ethnicity combinations)
The standard reference point is the EEOC’s “four-fifths rule” — an impact ratio below 0.80 (80%) suggests potential adverse impact. This is the same standard Title VII employment discrimination cases use. The audit must include enough data to run statistically meaningful comparisons.
If the AEDT vendor’s training data is limited, the auditor may use the employer’s historical data, or may need to acknowledge in the audit report that the analysis is constrained by available data.
Annual Timing
The audit must be conducted within the 12 months prior to AEDT use, and renewed annually. Day 366 without a fresh audit = the AEDT is no longer compliant.
Public Disclosure
The bias audit summary must be published on the employer’s website in a clear and conspicuous manner. The summary must include:
- The date of the most recent bias audit
- The source and explanation of the data used
- The number of applicants or candidates assessed
- Selection rates and impact ratios for all required categories
- The number of individuals in any “unknown” category
- The distribution date (when the employer began using the AEDT)
The summary must remain posted for at least 6 months after the last AEDT use.
What Has Enforcement Looked Like?
Phase 1 (July 2023 – December 2025): “Toothless” enforcement
For nearly two and a half years after LL 144 took effect, enforcement was complaint-driven and effectively dormant. DCWP lacked the staff and processes to systematically investigate non-compliance. Civil rights advocates and academic observers documented widespread non-compliance — many employers either ignored the law or posted disclosure notices that were not clearly accessible, and the bias audits that did exist often failed to meaningfully test for disparate impact.
Phase 2 (December 2025): The Comptroller audit
On December 2, 2025, NYS Comptroller Thomas DiNapoli’s office published an audit titled “Enforcement of Local Law 144 – Automated Employment Decision Tools“. The audit covered DCWP’s enforcement performance from July 2023 through June 2025. The findings were stark:
| Finding | Detail |
|---|---|
| Enforcement rated | “Ineffective” |
| Companies DCWP reviewed | 32 |
| Non-compliance DCWP found | 1 instance |
| Non-compliance Comptroller found in same 32 companies | 17 instances (a 17:1 detection gap) |
| AEDT complaints DCWP received in two years | 2 |
| 311 test calls correctly routed to DCWP | 3 of 12 (25%) |
| Total Comptroller recommendations | 13 |
DCWP agreed to adopt the majority of the recommendations. Translation: the agency committed to overhauling its enforcement process — better complaint routing, cross-trained investigators, proactive sweeps instead of complaint-only enforcement.
Phase 3 (Q4 2025 onward): First real fines
DCWP issued the first material LL 144 penalties in Q4 2025, including penalties against multiple employers using well-known AI hiring platforms without the required bias audits. Active investigations are ongoing as of April 2026. DLA Piper’s analysis of the post-Comptroller environment warns employers to “expect a new phase of stringent enforcement, potentially including more frequent investigations and higher civil penalties.”
The penalty schedule itself did not change — what changed is the enforcement intensity. First violation: up to $500. Each subsequent violation: $500 to $1,500. Each day a non-compliant AEDT remains in use is a separate violation. A tool running for 30 days without a current bias audit accumulates ~$45,000+ in liability before any other LL 144 violations are counted.
What this means for HR teams in 2026
The law went from largely-unenforced to proactively-enforced essentially overnight. Two consequences:
- The grace period is over. Employers who were “going to get around to” the bias audit no longer have cover. DCWP is now actively looking for non-compliance, not waiting for complaints.
- The compliance rate is rising fast but from a very low base. Independent industry surveys suggest only ~5% of covered NYC employers were publicly posting audit summaries as of early 2026. That number will rise; the unaudited 95% is the most exposed cohort.
How Does LL 144 Compare to Other State AI Hiring Laws?
| Dimension | NYC LL 144 | Illinois (AIVICA + HB 3773) | Colorado AI Act | Texas TRAIGA |
|---|---|---|---|---|
| Effective date | July 5, 2023 | Jan 1, 2020 (AIVICA); Jan 1, 2026 (HB 3773) | June 30, 2026 | January 1, 2026 |
| Required bias audit | Yes — independent annual | Demographic reporting (AIVICA Sec. 20) only; no mandatory bias audit | Risk management + impact assessments (NIST RMF as safe harbor) | None |
| Public posting | Yes — on employer website, 6+ months retention | No public posting required | Public statement on deployer website | No |
| Candidate notice | Yes — 10 business days before AEDT use | Yes (both Illinois laws) | Yes — pre-decision + adverse-decision rights | Limited (state agencies only) |
| Liability standard | Audit-based + procedural | Discriminatory effect + notice failure | Outcome-based duty of care | Intent-based prohibited harms |
| Penalties | $500-$1,500 per day per violation | Through IHRA complaint process; civil rights damages | Up to $20,000 per violation | $10K-$200K per violation (curable / uncurable split) |
| Private right of action | No (DCWP only) | Yes — through IHRA after exhaustion | No (CO AG only) | No (TX AG only) |
| NIST AI RMF safe harbor | Not specified | Not specified | Yes — explicit affirmative defense | Not specified |
| Enforcement intensity (April 2026) | Active and rising (post-Comptroller audit) | Pending IDHR rules; statute live | Pending June 30, 2026 effective date | Active since Jan 1, 2026 |
For employers operating in multiple jurisdictions, three observations:
One: an LL 144-compliant bias audit covers most of what Illinois HB 3773‘s disparate-impact standard would require. The audit methodology (selection rates, impact ratios across protected categories) is the same Title VII analysis Illinois courts will apply. Build the LL 144 audit so its outputs port directly to an Illinois IDHR defense.
Two: Colorado’s AI Act does not require an annual bias audit, but it does require an impact assessment that overlaps substantially. A team that runs an LL 144 bias audit can extend the methodology to satisfy Colorado’s impact-assessment requirement with relatively limited additional work.
Three: NIST AI RMF governance is not a safe harbor in NYC, but the documentation it produces (Govern / Map / Measure / Manage) directly supports both LL 144 audit defensibility and Colorado’s affirmative-defense posture. For the broader US enforcement picture, see our AI liability in the United States overview, and for the EU side of the comparison see our EU vs US definitive comparison.
What Is the LL 144 Compliance Checklist?
1. Determine whether your tool is an AEDT. Apply the two-test framework: (a) computational process derived from ML / statistical modeling / data analytics / AI; (b) substantially assists or replaces discretionary employment decision-making. When in doubt, treat the tool as an AEDT — the cost of a $10K-$30K audit is small relative to $45K+ in 30-day penalties for a wrongly-classified miss.
2. Identify the independent auditor. Cannot be the AEDT vendor or anyone employed by your organization or with a financial interest in your hiring outcomes. Specialty firms (Holistic AI, DCI Consulting, BLDS, Lexara, and others) compete in this market. Get scoping bids; expect $5,000-$30,000 depending on tool complexity and data volume.
3. Conduct the bias audit within 12 months before AEDT use. Methodology: selection rates and impact ratios across sex categories, race/ethnicity categories, and intersectional categories per EEOC definitions. Reference point: the four-fifths rule (impact ratio < 0.80 suggests adverse impact). Document the data source, sample size, and any limitations.
4. Publish the audit summary on your employer website. Include all DCWP-required elements: most recent audit date, data source, applicant count, selection rates, impact ratios, intersectional analysis, and AEDT distribution date. Make it clearly and conspicuously accessible — not buried 6 clicks deep. Keep it posted for at least 6 months after AEDT use ends.
5. Build the candidate notice infrastructure. Notify candidates at least 10 business days before AEDT use. Include: that an AEDT will be used, the job qualifications and characteristics it will assess, the type of data collected, and the data retention policy. Provide a way for candidates to request alternative selection processes or reasonable accommodations.
6. Set up the alternative selection process. Candidates can request to be assessed without the AEDT. The law does not require employers to grant the request, but the process for handling requests must exist. Document responses for audit defensibility.
7. Schedule the annual re-audit. Day 366 without a fresh audit = non-compliance. Calendar the audit start 60-90 days before the prior audit’s anniversary so the new audit completes before the deadline.
8. Monitor for tool changes. If the AEDT changes materially (new model version, new training data, new scoring logic), the prior bias audit may no longer cover the current tool. The conservative interpretation: treat material changes as triggering a new audit before continued use.
Our recommendation. Treat the December 2025 Comptroller audit as the moment LL 144 became real. If your organization deployed an AEDT before then and assumed enforcement would not come, the catch-up window is closing — and likely closed for any tool used in 2026 without a current audit. Build the audit + posting + notice infrastructure now; the cost of compliance is dwarfed by the cost of 30-90 days of unaudited use.
Sources
Official Sources
- NYC Local Law 144 of 2021, codified at NYC Admin. Code §§ 20-870 to 20-874: nyc.gov
- DCWP AEDT FAQ (June 2023): DCWP-AEDT-FAQ.pdf
- DCWP Final Rules implementing LL 144: 6 RCNY § 5-300 et seq.
- NYS Comptroller — “Enforcement of Local Law 144 – Automated Employment Decision Tools” (audit released Dec 2, 2025): osc.ny.gov
- EEOC selection rate / impact ratio guidance (Title VII)
Analysis & Commentary
- Paperclipped — “NYC AI Hiring Law Fines 2026” (March 22, 2026): paperclipped.de
- RiskTemplates — “NYC Local Law 144 Explained” (April 3, 2026): risktemplate.com
- HAIEC — “NYC Local Law 144 Public Enforcement & Compliance Ledger 2023-2026”: haiec.com
- EmployArmor — LL 144 compliance guide: employarmor.com
- DLA Piper — post-Comptroller LL 144 enforcement analysis (December 2025)
- Cornell / HR Brew — bias audit publication compliance survey (April 2026)
- DataField.Dev — “NYC Local Law 144 — The First US Mandatory AI Bias Audit Law” case study
Data Sources
- NYC Department of Consumer and Worker Protection — enforcement statistics
- NYS Comptroller audit data (32-company sample, 17 vs 1 violation gap)
Related Reading
US AI Regulation Series:
- Illinois AI Employment Law 2026: AIVICA + HB 3773 — the disparate-impact analogue at the state level
- Colorado AI Act 2026: What Developers and Deployers Must Do — the broader high-risk AI framework
- NIST AI Risk Management Framework Explained — the governance baseline that produces audit-defensible documentation
- Texas TRAIGA Compliance Guide — the prohibited-harms alternative
- AI Liability in the United States — how LL 144 fits into the broader US AI litigation landscape
- White House AI Framework 2026 — the federal preemption push that could affect state and local AI laws
- FDA AI Medical Devices: PCCP + EU AI Act Comparison — 1,451+ AI devices authorized; PCCP framework for adaptive AI
Cross-jurisdiction:
- EU vs US AI Regulation: The Definitive Comparison — how NYC’s audit model contrasts with EU AI Act conformity assessment
This article provides general information about AI regulation and does not constitute legal advice. Laws and policies change frequently. Consult qualified legal counsel for compliance decisions specific to your organization. Reg Intel is not a law firm and does not provide legal services.
Last verified: April 27, 2026. DCWP enforcement intensity rose materially after the December 2025 Comptroller audit. Re-verify enforcement statistics and the most recent fines before relying on the figures in this article.