A Bias Audit Is Only One Part of NYC’s AI Hiring Law

The concrete object to watch is the auditor’s PDF sitting in a compliance inbox. It may contain tables of selection rates and impact ratios, carry a recent date, and conclude that an automated employment decision tool was tested under New York City’s rules. That document matters. It does not complete the workflow.

New York City’s Local Law 144 restricts employers and employment agencies from using an automated employment decision tool, or AEDT, unless the tool has undergone a recent independent bias audit and specified information has been made public. Separate provisions govern notice to candidates and employees. The Department of Consumer and Worker Protection, or DCWP, adopted rules describing the calculations, publication format, notice methods, and relevant definitions.

That division matters operationally because vendors often sell the audit as the compliance artifact, while the law assigns duties around the employer’s use of the tool. A vendor cannot publish an employer’s careers-page notice, decide whether a recruiter relies on a score enough to bring the system into scope, or prove that an applicant received notice at least ten business days before assessment.

The audit answers a narrow question

The law says an employer or employment agency may not use an AEDT unless, “no more than one year prior to the use of the tool, the tool has been the subject of a bias audit.” It also requires a summary of the results and the relevant distribution data to be publicly available before use.

A bias audit evaluates outcome differences in the tool’s operation. Depending on whether the system selects candidates or assigns scores, the rules call for calculations such as selection rates, scoring rates, and impact ratios, including results across specified sex and race or ethnicity categories and their intersectional combinations. An impact ratio compares one group’s rate with the rate of the group receiving the highest rate.

These calculations are diagnostic, not a city-issued certification. Local Law 144 does not establish a passing score that makes a tool lawful, nor does an audit establish that the system cannot discriminate in a particular hiring decision. It reports measured disparities using the data and configuration presented to the auditor.

The data choice therefore needs scrutiny. The rules generally contemplate historical data from actual use, while allowing test data when adequate historical data is unavailable, with an explanation of why it was used. Audits can sometimes draw on data from multiple employers, but an employer should determine whether its implementation, weighting, thresholds, or other customizations match the version that was audited.

Return to the PDF. Its date may be current, yet its tables may describe a standard vendor model while the employer has added a knockout threshold or combined the model’s score with another ranking system. The report can still be genuine. The employer’s deployed workflow may no longer be the workflow the report measured.

Scope comes before the report

A system is not covered merely because it uses machine learning, and a product does not escape the law merely because its vendor calls it decision support. The scope question turns on function.

Under the law and rules, an AEDT uses machine learning, statistical modeling, data analytics, or artificial intelligence to produce a simplified output, such as a score, classification, or recommendation, that substantially assists or replaces discretionary decision-making for hiring or promotion. The rules explain substantial assistance through reliance patterns: the output may be the only factor, it may receive more weight than other criteria, or it may overrule conclusions based on other information.

A recruiting team therefore has to map what happens after an application arrives. A résumé-ranking tool that puts applicants in order may be covered when recruiters review only the top group. A transcription feature that records an interview without scoring or recommending candidates may fall outside the AEDT definition, although other privacy or employment rules can still apply. Software used only to find possible prospects before they apply to a particular position presents a different scope analysis from software screening submitted applications.

Location and decision type also matter. Local Law 144 addresses employment decisions involving hiring and promotion, not every workforce-management task. DCWP’s published guidance discusses how the rule applies to jobs connected to New York City, including certain remote roles associated with a city office. Employers need a written scope position for each use case rather than one conclusion for an entire software suite.

This is work the auditor’s PDF cannot perform. The auditor assesses the tool and data supplied for audit; the employer knows whether a recruiter follows the ranking, which jobs receive it, and whether a human review changes anything in practice.

Publication is its own control

Receiving the audit and publishing the required summary are separate events. Before using the AEDT, an employer or employment agency must make a summary of the audit results and distribution data publicly available on the employment or careers section of its website in a clear and conspicuous manner.

The rules require more than uploading an opaque report. The public material should identify the audit date, explain the source and nature of the data, and present the applicable group counts, rates, and impact ratios. It must also account for people whose demographic category was unknown by reporting the relevant number, even though unknown categories are excluded from impact-ratio calculations.

Publication creates a version-control problem. If a vendor replaces its audit, the employer must check whether the new report covers the deployed tool, update the public summary, and preserve the timing of that change. The rules require the summary to remain available for at least six months after the employer stops using the AEDT, so removing a page on the contract’s termination date can erase something the rules still require to be public.

A link is not enough if it breaks, points to a vendor landing page without the required tables, or becomes visible only after an applicant starts an assessment. Someone should test the page outside the corporate network and retain a dated copy showing what was published.

Candidate notice runs on a different clock

The audit’s one-year window and the notice period are separate clocks. A covered candidate or employee must receive notice at least ten business days before the AEDT is used, through a permitted method such as the job posting, direct mail or email, or a clear careers-site disclosure.

The notice must say that an AEDT will be used in connection with the assessment and identify the job qualifications and characteristics the tool will assess. Generic language stating that the employer “may use technology” does not communicate those required points. If a tool evaluates résumé experience, work-sample responses, or interview characteristics, the notice should correspond to what the deployed system evaluates rather than reproduce broad vendor marketing language.

Candidates also need instructions for requesting an alternative selection process or reasonable accommodation. The city law requires notice of that request route; it does not itself require an employer to offer an alternative selection process. Other legal obligations may govern accommodations, which is one reason the request should enter an established human-review channel rather than an unattended recruiting mailbox.

Data disclosures form another operational lane. The law and rules address information about the type of data collected, its source, and the employer’s retention policy, either through the website or in response to a written request within the specified timeframe, subject to limited exceptions. Those disclosures should match the actual vendor data flow. A statement that mentions résumés but omits recorded interview inputs is not repaired by a valid bias audit.

Build the file around each deployment

The useful compliance unit is not “the vendor.” It is one deployed tool, used for a defined decision, on a known population, under a documented configuration.

For that unit, an employer can assemble a file containing the scope analysis, contract and tool description, auditor independence information, audit version, public summary, publication evidence, notice language, delivery method, data disclosure, retention policy, and records of later configuration changes. Some of those records are expressly required to be published or retained for a stated period; others are practical evidence that the employer completed duties the audit does not document.

The distinction should remain visible. Local Law 144 expressly requires the audit, public availability, and notices, while a screenshot archive or internal approval record is an evidentiary control rather than a separately named statutory deliverable. Labeling both categories prevents a prudent internal practice from being misrepresented as quoted law.

The PDF now has a proper place. It sits inside the deployment file, linked to the exact tool version and careers-page summary, rather than serving as a substitute for the rest of the system. When procurement renews the contract or recruiting changes a threshold, that file tells the team which checks must run again before candidates encounter the tool.

Questions people ask

Does a favorable bias audit mean an employer can use the tool?

No. The audit must be recent and relevant to the deployed configuration, but the employer must also publish the required summary before use and deliver the applicable notices. The employer still needs to decide whether the system and hiring workflow fall within the AEDT definition.

Does

New York City set a passing impact ratio?

Local Law 144 requires specified disparity calculations but does not create a numerical pass-fail threshold that automatically permits or prohibits use. A result can reveal operational and legal risk without functioning as a city certification, and other anti-discrimination laws remain relevant regardless of the audit result.

Can a vendor handle all Local Law 144 compliance?

A vendor can commission an audit and supply tables, data descriptions, or notice language. The employer controls how recruiters use the output, where the tool is deployed, what appears on its careers site, and whether candidates receive timely notice, so those responsibilities cannot be resolved by the vendor’s report alone.

How long should the public audit summary stay online?

DCWP’s rules require the summary to remain publicly available for at least six months after the employer or employment agency last used the AEDT. Keeping dated copies of the page and its underlying audit also helps show which disclosure was live when a particular deployment operated.