New York City Local Law 144 requires employers and employment agencies using an automated employment decision tool for hiring or promotion within the city to have the tool independently bias-audited within the previous year, to publish a summary of the audit results, and to give candidates advance notice that the tool will be used.
- Three obligations: an annual independent bias audit, a published summary of results, and candidate notice.
- The audit must be independent — an auditor who helped build or is otherwise involved with the tool does not qualify.
- The published summary must be publicly available on your own site, not just held on file.
- Notice must be given in advance of use, and must state the job qualifications and characteristics the tool assesses.
- It applies by location of the role, not by where your company is headquartered.
This is general information, not legal advice. Rules and enforcement guidance change. Confirm current requirements with the New York City Department of Consumer and Worker Protection and your own counsel before relying on anything here.
The three obligations
Local Law 144 is narrower than people expect and stricter than people expect. If you use an automated employment decision tool for hiring or promotion for a role located in New York City, you owe three things:
- An independent bias audit, conducted no more than one year before the tool is used.
- A published summary of the audit results, publicly available.
- Advance notice to candidates and employees that the tool will be used, and what it assesses.
That is the whole statute in three lines. The operational difficulty is entirely in the detail.
Obligation 1 — the independent bias audit
Independent means independent. The evaluator must not have been involved in using, developing or distributing the tool, and must not hold a disqualifying financial or employment relationship with the vendor or with you. A vendor auditing its own product does not count. Nor does your in-house data team producing a report about a tool the company relies on.
It must be current. No more than one year old at the time of use. This is an annual operating commitment, not a project.
It examines outcomes, not intentions. The analysis looks at selection or scoring rates across categories, expressed as impact ratios — the mechanics are in what an AI bias audit actually measures. Nobody asks whether the tool was designed to be fair. The question is what it did.
Scope it to the tool as you use it. A vendor audit of a default configuration may not cover your configuration — your score weights, your thresholds, your role types. Confirm the audit reflects reality rather than a demo.
Obligation 2 — publish the summary
Not "retain for inspection". Publish, on your own website, publicly accessible, including the date of the most recent audit, a summary of the results, and the distribution date of the tool version. It needs to be findable — a link buried three levels below a careers page is a poor demonstration of compliance.
This obligation catches organisations because it is a marketing and web task landing on a legal requirement, and it is nobody's job by default. Assign it explicitly. Our own disclosure lives at /bias-audit, where results are published as they are completed.
Obligation 3 — candidate notice
The most easily breached of the three, because it can be breached once per candidate.
Notice must be given at least the required number of business days in advance of using the tool — build the lead time into the funnel rather than sending notice with the assessment invitation. It must state that an automated tool will be used, and the job qualifications and characteristics it assesses. On request, you must be able to provide information about the data collected, its source, and the retention policy. And candidates must be able to request an alternative process or an accommodation.
That last point has a design consequence people miss: you need to have actually built the alternative path. A right to request a human-only alternative is meaningless if no such route exists, and discovering that during a live process is expensive.
Where this sits relative to everything else
Local Law 144 is a disclosure-and-audit regime. It is not a fairness standard, and passing an audit is not a defence to a discrimination claim.
- Title VII and state law still apply to your outcomes, independently.
- Selection procedures still need to be job-related and consistent with business necessity — the standard that governs any test or screen, audited or not.
- Other jurisdictions have taken different approaches. Colorado's AI legislation, the EU AI Act, and Illinois' video-interview law each impose distinct mechanics. Compliance with one is not compliance with another.
A tool can pass a bias audit and still be a bad selection instrument — see assessment validity — and it can be a good instrument with an unacceptable adverse-impact profile. Both questions need separate answers.
The operational checklist
Before you use a tool
- Determine whether it is an AEDT for your use — substantially assisting or replacing discretionary decision-making.
- Confirm which roles are NYC-located. This follows the job, not the head office.
- Obtain a current independent bias audit covering your configuration.
- Publish the summary on your site, with dates.
- Write the candidate notice, including the qualifications and characteristics assessed.
- Build the notice into the funnel with the required lead time.
- Build and staff the alternative-process route.
- Document data collected, source, and retention, ready to disclose on request.
Every year
- Re-audit before the previous audit ages out.
- Re-publish, with the new dates.
- Re-check scope after any material change to the tool or your configuration.
Keep on file
- Audit reports and methodology.
- Evidence of notice delivery, per candidate.
- Any alternative-process requests and how they were handled.
- Configuration change history.
That last item is the one nobody keeps and everybody needs. If you cannot show what the tool was doing in March, you cannot show that the March audit covered it.
How CalHire supports this
CalHire's automated employment-decision tooling is subject to independent third-party bias audit, and results are published at /bias-audit as they are completed. Candidates receive notice before an automated tool is used and may request a human-only alternative.
The platform is also built so the evidence exists without a reconstruction project:
- Immutable, tamper-evident audit logs of every person-affecting decision, tied to the human who made it.
- Bias-audit exports from the compliance console, so an auditor can be given data rather than screenshots.
- No auto-rejection anywhere — below-threshold candidates are flagged for human review, so there is always a person in the record.
- No PII on the scoring surface, since identity is stripped before any model sees a candidate.
The compliance console is described on the enterprise page. Your publication and notice obligations remain yours; what the platform removes is the archaeology.
Frequently asked questions
- Who does Local Law 144 apply to?
- Employers and employment agencies that use an automated employment decision tool to substantially assist or replace discretionary decision-making for hiring or promotion, where the role is located in New York City. It follows the job, not the company headquarters — a company anywhere in the world hiring for an NYC-located role can be in scope.
- What makes a bias audit "independent"?
- The audit must be conducted by an impartial evaluator that was not involved in using, developing or distributing the tool, and does not have a disqualifying financial or employment relationship with the vendor or the employer. A vendor auditing its own product does not satisfy the requirement, and neither does a self-assessment.
- Can we rely on our vendor’s bias audit?
- Sometimes, depending on the circumstances and how the audit was scoped — but the publication and notice obligations still sit with the employer. Get the audit summary and the underlying methodology in writing, confirm it covers the tool as you actually use it, and confirm it is current within the required period. Do not assume a vendor’s audit discharges your duties.
- What has to be in the candidate notice?
- That an automated employment decision tool will be used in the assessment, given at least the required number of business days in advance; the job qualifications and characteristics the tool will assess; and, on request, information about the data collected, its source, and the applicable retention policy. Candidates must also be told how to request an alternative process or accommodation.
- What is the penalty for non-compliance?
- The law provides for civil penalties per violation, with continuing violations counted separately, enforced by the city. Because the notice obligation can be breached once per candidate, exposure scales with hiring volume. Check current penalty amounts and enforcement guidance with counsel.