NYC Local Law 144: what a bias audit does not tell you about the tool.
Published
New York City Local Law 144 requires an employer or employment agency using a covered automated employment decision tool to obtain an independent bias audit, publish a summary of the results, and provide required notices. The audit answers a defined statistical question. It does not establish whether the tool is safe or appropriately controlled in the buyer's environment.
What the law requires.
Under the enacted law and the Department of Consumer and Worker Protection's implementation guidance, an employer or employment agency may not use a covered automated employment decision tool unless the tool has undergone a bias audit no more than one year before use, a summary of the results is public, and required notices have been provided. DCWP began enforcement on July 5, 2023.
For a candidate or employee who resides in the city, the notice must say that the tool will be used and identify the job qualifications and characteristics it will assess. It must be provided at least ten business days before use. Information about the types and sources of data and the employer's retention policy must be available on the website or, if not posted, provided within 30 days after a written request. Those data details are not all mandatory content of the advance-use notice itself.
We do not perform Local Law 144 bias audits. A firm with the required independence and statistical expertise should perform that work. This page addresses the deployment questions that sit alongside it.
What a bias audit measures, and what it does not.
The implementing rules define a bias audit around selection or scoring rates and impact ratios across specified categories. That is a real and useful outcome measure. It does not answer the security, privacy, access, accountability, or operational-control questions a buyer must resolve before deployment:
- What the tool can reach with the permissions granted in the buyer's environment
- What it retains, for how long, and where that data goes
- Whether candidate or employee data is used to train or improve a vendor model
- Whether the output is advisory or decisive in the real workflow
- Who is accountable for the resulting decision and who can stop the system
- How the organization detects failures or changed behavior between annual audits
A compliant bias-audit result therefore does not amount to a general security, privacy, or governance approval for the deployed tool.
What the enforcement audit found.
In December 2025, the Office of the New York State Comptroller published an audit of DCWP's enforcement from July 2023 through June 2025. DCWP had received two AEDT complaints. It reviewed 32 companies and found one issue, while the state auditors' review of the same companies found at least 17 instances of potential non-compliance.
The state audit also found that DCWP officials lacked technical expertise to evaluate AEDT use and had not consulted the city's Office of Technology and Innovation when making determinations. The audit recommended stronger complaint routing, proactive research, fuller bias-audit review, and use of technical expertise. That is evidence of weaknesses in the reviewed enforcement period, not proof of what enforcement will look like in the future.
Where a deployment review fits.
A deployment review answers the security and operational questions the statutory bias audit does not, and produces evidence an internal approver can use. It is designed to sit next to a bias audit, not to substitute for one.
We produce a findings register against named controls, mapped to NIST AI RMF 1.0 and the OWASP Top 10 for LLM Applications, with gate conditions for proof of concept, pilot, and production. We are paid by buyers and do not resell, implement, or take fees from the vendors whose tools we review.
Who this is for.
Employers and employment agencies using covered automated tools in New York City for hiring or promotion, and the HR technology, security, privacy, legal, and risk functions responsible for the deployment.
New York City is one of several jurisdictions placing dated duties on the deploying business. See the full map in state AI law and the obligations that land on the buyer.
Other jurisdictions with employment-specific AI duties are covered in AI deployment review in Illinois and AI deployment review in Connecticut.
Discovery calls take twenty minutes.
See the Rapid Readiness Review or book a scoping call.
This is not legal advice, and we do not perform Local Law 144 bias audits. Current as of September 2026. Confirm the current law, DCWP rules and guidance, and advice from your own counsel before relying on this summary.
Discovery calls take twenty minutes.
We confirm deployment fit, outline review scope, and match you to the right packaged offer. No engagement starts until you decide to proceed.