AI Bias Audit: NYC Law 144 Coverage, Notice, and Penalties

If you use an automated hiring or promotion tool on candidates for jobs in New York City, Local Law 144 requires you to have an independent bias audit of that tool completed within the past year, post a summary of the results on your website, and notify candidates at least ten business days before the tool evaluates them. An AI bias audit under NYC Law 144 is a statistical review by an independent auditor that calculates how different demographic groups fare under the tool and makes those numbers public. Skip any of the three steps and the city can fine you daily for as long as the tool stays in use.

Which Tools and Employers Are Covered

Local Law 144 applies to employers and employment agencies using an automated employment decision tool, or AEDT, on candidates for positions in New York City.¹ An AEDT is software that uses machine learning, statistical modeling, or artificial intelligence to substantially assist or replace human judgment in employment decisions.

“Substantially assist” is defined narrowly. The tool must either be the sole basis for the decision, carry more weight than any other factor, or override conclusions drawn from other inputs including human review.² Software that merely transcribes interviews, translates text, or organizes applications into a searchable database without ranking or scoring candidates generally falls outside the law. If your tool actively ranks, scores, or filters applicants and those outputs drive the decision, you are likely in scope.

The Three Things You Must Do Before Using the Tool

Compliance comes down to three obligations that all have to be in place before the tool evaluates a single NYC candidate:

A bias audit completed by an independent auditor within the previous year.
A summary of the audit results posted publicly on your website.
Notice to each candidate at least ten business days before the tool is used on them, including information about what the tool assesses and how to request an alternative process or accommodation.¹

The audit is annual. Every twelve months, the clock resets and you need a fresh one on file.

Who Can Perform the Audit

The audit must be done by an independent auditor, and the city defines independence strictly. The auditor must be capable of exercising objective and impartial judgment. Three categories of people are automatically disqualified: anyone involved in using, developing, or distributing the tool; anyone with an employment relationship with the employer, the vendor, or the developer during the audit; and anyone with a direct or material indirect financial interest in any of those parties.²

In practice, the vendor who sold you the software cannot audit it, and neither can a consultancy that owns a piece of the vendor. The rules do not require a specific credential, but the auditor needs the statistical competence to produce defensible impact ratios.

What the Audit Actually Measures

The core output is a set of impact ratios. An impact ratio compares one demographic group’s selection or scoring rate to that of the most-selected or highest-scoring group. If the tool advances 60% of male applicants and 45% of female applicants, the impact ratio for women is 0.75 (45 ÷ 60).²

The reference point is the federal four-fifths rule from the Uniform Guidelines on Employee Selection Procedures. A selection rate for any race, sex, or ethnic group that falls below four-fifths (80%) of the rate for the highest-performing group is generally regarded by federal enforcement agencies as evidence of adverse impact.³ A ratio of 0.75 sits below that line. The four-fifths rule is a rule of thumb, not a legal verdict, and small samples can produce misleading numbers.

Law 144 requires the auditor to run these calculations across three comparisons: gender alone, race and ethnicity alone, and the intersection of gender with race and ethnicity. The intersectional analysis is where patterns invisible in top-line numbers tend to surface. A tool can show acceptable ratios for women overall and for Black applicants overall yet reveal a significant disparity for Black women specifically. Race and ethnicity use the EEO-1 categories: Hispanic or Latino, White, Black or African American, Native Hawaiian or Pacific Islander, Asian, Native American or Alaska Native, and Two or More Races.

What Data the Auditor Needs

The audit runs on historical data from your actual use of the tool. You will need records showing, for each demographic group, how many people applied, how many were assessed by the tool, and how many were selected or advanced. Personally identifiable information like names and Social Security numbers must be stripped before the data reaches the auditor. Most employers export this from their applicant tracking system or HRIS.

If you have not used the tool long enough to produce a statistically meaningful dataset, the rules allow auditing with test data from the developer or from historical applicant pools. That is common for a new rollout, but it means the audit reflects simulated rather than real-world performance, and the next annual audit should use live data once enough has accumulated.

What You Have to Publish

Before the tool is used, a summary of the audit must appear on your website.¹ The summary must include:

The date of the audit.
The distribution date of the tool.
The source and explanation of the data used.
The number of applicants in each demographic category.
Impact ratios for both standalone and intersectional groups.
A note on any categories excluded due to small sample sizes.

The summary must stay publicly accessible for at least six months after you stop using the tool. It is a factual record of the numbers, not an opinion about whether the tool is fair.

How Candidate Notice Works

Each candidate must be told at least ten business days in advance that an AEDT will be used to evaluate them. The notice must describe the job qualifications or characteristics the tool assesses and give candidates a way to request an alternative selection process or a reasonable accommodation.¹

A nuance worth flagging: the law requires that your notice allow candidates to make such a request. It does not require you to actually grant an alternative process. The mechanism has to exist; the outcome is yours.

Candidates can also ask, in writing, about the type of data the tool collects, the source of that data, and your data retention policy. You have 30 business days to respond.

Penalties for Non-Compliance

The NYC Department of Consumer and Worker Protection enforces Law 144 through civil penalties. The first violation carries a $375 fine, which also applies to each additional violation discovered on that first day. Each subsequent day the violation continues brings penalties of $500 to $1,500. Because the fines accrue daily for as long as the tool is in use without a compliant audit, weeks of non-compliance can quickly produce exposure in the tens of thousands of dollars.

What To Do If the Audit Shows Bias

An impact ratio below four-fifths does not automatically mean you have violated the law, but it does mean something needs attention. The EEOC’s position is that when an employer discovers a selection tool produces adverse impact, the employer should either take steps to remedy that impact or switch to a different tool.⁴

Remediation usually means working with the developer to identify which model inputs are driving the disparity. Sometimes a variable can be removed or reweighted. Sometimes the model needs retraining on more representative data. Sometimes the tool simply is not salvageable for a particular job category and should be retired. Document every step, because if a discrimination claim arrives later, the question will not just be whether bias existed but whether you acted on what you knew.

Continuing to use the tool after a bad audit is the worst available option. It hands a future plaintiff proof that you knew about the disparity and did nothing.

Federal Liability Does Not Go Away

Law 144 is a city compliance framework. The larger legal exposure comes from Title VII of the Civil Rights Act, which prohibits employment practices that are fair in form but discriminatory in operation. Federal anti-discrimination law applies to algorithmic hiring the same way it applies to every other employment practice.⁴

Buying the tool from a vendor does not shift that liability. The EEOC expects employers to vet third-party tools before deployment and monitor them for adverse impact afterward. If the vendor’s algorithm discriminates and you use it to make hiring decisions, the legal responsibility is yours. A clean bias audit does not immunize you from a discrimination lawsuit, and a problematic one can become evidence in it. That is why the audit is worth treating as a genuine risk management step rather than a form to file.

1
NYC Consumer and Worker Protection. Automated Employment Decision Tools (AEDT)
2
NYC Department of Consumer and Worker Protection. Rules for Automated Employment Decision Tools – Subchapter T
3
eCFR. 29 CFR 1607.4 – Information on Impact
4
U.S. Equal Employment Opportunity Commission. What is the EEOC’s Role in AI?