NYC Automated Employment Decision Tools (AEDT) Law Guide: Bias Audits and Candidate Notices

New York City's Local Law 144 makes it unlawful to use an automated employment decision tool to screen candidates or employees unless the tool has had an independent bias audit in the last year, the results are published, and candidates have been told at least 10 business days in advance. It was the first US law to require bias audits of AI hiring tools, and the Department of Consumer and Worker Protection (DCWP) has enforced it since 5 July 2023. A December 2025 audit by the New York State Comptroller found DCWP's enforcement weak, and DCWP agreed to tighten it, so employers that treated the law as dormant face rising risk. This guide covers who the law applies to, how the bias audit calculations work, what must be published and noticed, penalties, and the security and identity questions that come with hiring tools and their data. It is for HR technology owners, security and privacy teams, and executives approving AI in recruitment.

Key takeaways

• The definition turns on how the output is used. A tool is an AEDT if its score, tag, ranking or recommendation is relied on alone, weighted more than any other criterion, or used to overrule other conclusions, including a human's.
• The audit is arithmetic, not certification. An independent auditor calculates selection or scoring rates and impact ratios by sex, race/ethnicity and intersectional categories; the law sets no pass mark, but anti-discrimination law still applies.
• The employer carries the duty. A vendor may commission an audit, but the employer or employment agency using the tool is responsible for the audit, the published summary and the notices.
• Notices have a clock. Candidates and employees resident in the city must get notice at least 10 business days before use, with instructions for requesting an alternative selection process or accommodation.
• Hiring tools are an identity and data problem too. AEDTs hold demographic data, connect to applicant tracking systems with API credentials and are often run by vendors; a forgotten vendor admin account exposed millions of applicant records at McHire.

Scope: who and what is covered

Local Law 144 of 2021 added sections 20-870 to 20-874 to the New York City Administrative Code. The City Council passed it on 10 November 2021, it took effect on 1 January 2023, and DCWP's implementing rules sit in Title 6 of the Rules of the City of New York, Chapter 5, Subchapter T (sections 5-300 to 5-304). DCWP began enforcement on 5 July 2023.

Who is covered

• Employers and employment agencies that use an AEDT to make an employment decision in the city. DCWP's FAQ treats a job as in the city when it is tied to a New York City office, including some fully remote roles.
• Candidates are people who have applied for a specific position, and employees being considered for promotion. Sourcing activity such as scanning a resume bank, outreach or open invitations to apply is not covered, according to the FAQ.
• Employment decision means screening candidates for employment or employees for promotion; screening counts, not only the final decision.

What counts as an AEDT

The law defines an AEDT as a computational process derived from machine learning, statistical modelling, data analytics or artificial intelligence that issues simplified output (a score, classification or recommendation) used to substantially assist or replace discretionary decision-making. The rules narrow both halves:

Decision guidance: if a tool only orders candidates for convenience and recruiters review everyone, record that and test it periodically; if recruiters routinely reject below a score threshold, treat it as an AEDT. When in doubt, auditing a borderline tool costs less than defending a complaint. For how this fits other jurisdictions, see the Global AI Regulation Map.

Key obligations

1. Bias audit within one year before use (20-871(a)(1), 6 RCNY 5-301)

The tool must have had a bias audit no more than one year before use, so audits repeat at least annually. The audit must be done by an independent auditor: someone not involved in using, developing or distributing the tool, without an employment relationship with the employer, agency or vendor during the audit, and without a direct or material indirect financial interest in them. DCWP does not approve or list auditors.

Worked example: if 40 of 100 male applicants and 30 of 100 female applicants advance, the selection rates are 0.40 and 0.30 and the female impact ratio is 0.30 / 0.40 = 0.75. Local Law 144 does not set a threshold for the ratio or require any action on the result; the employer still answers to federal, state and city anti-discrimination law, and DCWP refers discrimination claims to the NYC Commission on Human Rights.

• Small categories: under 5-301(d) an auditor may exclude a category that makes up less than 2% of the data from the impact ratio calculations, but the summary must justify the exclusion and give that category's applicant count and rate.
• Data (5-302): audits use historical data from the tool's use. Test data is allowed only when historical data is insufficient for a statistically significant audit, and the summary must explain why and how it was generated. The FAQ says imputed or inferred demographic data cannot be used.
• Shared audits: an employer may rely on an audit that pools several employers' data only if it supplied its own historical data to that audit or is using the tool for the first time.

2. Published results (20-871(a)(2), 6 RCNY 5-303)

Before use, publish on the employment section of the website, or by a clear hyperlink, the date of the most recent audit, a summary of results (data source, number of individuals in unknown categories, number of applicants or candidates, selection or scoring rates and impact ratios for all categories) and the tool's distribution date. Keep it posted for at least six months after the last use of the tool for an employment decision.

3. Notices (20-871(b), 6 RCNY 5-304)

• Use of an AEDT: at least 10 business days before use, tell each candidate or employee who resides in the city that an AEDT will be used, and how to request an alternative selection process or reasonable accommodation. The rules do not require an employer to provide an alternative process.
• Qualifications and characteristics: at least 10 business days before use, state the job qualifications and characteristics the tool will assess.
• Data information: if not on the website, provide the type of data collected, its source and the data retention policy within 30 days of a written request.
• Methods: for candidates, the careers section of the website, the job posting, or mail or email; for promotion candidates, a written policy or procedure, the job posting, or mail or email.

Timeline and current status

Status as at 24 October 2026: we found no amendment to sections 20-870 to 20-874 or to the 5-300 rule series on the City's official sites. The federal executive order seeking to challenge state AI laws (EO 14365) targets state laws through litigation and funding; it has not displaced this law. See the US Federal AI Policy Guide. Check DCWP's AEDT page before relying on this status.

Enforcement and penalties

• Civil penalties (20-872): up to $500 for a first violation and each additional violation on the same day; $500 to $1,500 for each subsequent violation. Each day an AEDT is used in violation is a separate violation, and each failure to give a required notice is a separate violation. Proceedings are heard at the Office of Administrative Trials and Hearings.
• Court action (20-873): the Corporation Counsel may sue to stop violations and compel compliance.
• Private claims preserved (20-874): the law does not limit a candidate's or employee's right to sue or the Commission on Human Rights' enforcement of the City Human Rights Law. It does not expressly create a new private right of action.
• Complaints: through 311 or DCWP's online complaint form, naming the job, the tool and the suspected failure.

The Comptroller's findings: DCWP received only two AEDT complaints between July 2023 and June 2025. When DCWP reviewed 32 companies it found one instance of non-compliance; the Comptroller's auditors, reviewing the same 32, found at least 17 instances of potential non-compliance. DCWP officials said they lacked technical expertise but had not consulted the City's Office of Technology and Innovation. The six recommendations include routing 311 complaints correctly, proactive research beyond complaints and using OTI to evaluate suspected tools. Because penalties accrue per day of use, an employer that has used an unaudited tool for months has a large theoretical exposure once enforcement becomes proactive.

What it means for AI agents and non-human identities

Local Law 144 is about outcomes, but compliance depends on knowing which systems score people and who can reach their data.

• AI agents in recruiting: an agent that screens applications or ranks internal candidates and whose output is relied on as described in 5-300 is an AEDT, whatever the vendor calls it. Add recruiting agents and copilot features in applicant tracking systems to the AI inventory. See the Shadow AI Discovery Guide.
• Integration credentials: AEDTs pull candidate data from applicant tracking and HR systems through API keys or OAuth clients. Give each integration its own scoped credential, a named owner and rotation, and remove it when the tool is retired.
• Vendor admin and test accounts: at McHire in 2025, a Paradox.ai test administrator account with the password 123456, outside single sign-on and unused since 2019, plus an insecure API, made more than 64 million applicant records reachable by researchers. Require SSO and MFA for vendor consoles and ask how test accounts are decommissioned.
• Audit data flows: bias audits need historical outcomes joined to sex and race/ethnicity data, which is sensitive. Send auditors a minimised extract through a controlled channel, not standing access to production. See the AI and Privacy Guide.
• Evidence of use: per-identity logs of who ran the tool, on which requisition and when, are what prove the 10 business day notice preceded use.

Compliance steps

1. Inventory hiring and promotion tools. Include AI features inside applicant tracking systems, assessment platforms, video interview tools and recruiting agents. Record vendor, version and integration identities.
2. Test each tool against the three-prong use test. Interview recruiters and check configuration (auto-reject thresholds, ranking cut-offs). Document tools judged out of scope and the reason.
3. Engage an independent auditor. Confirm independence against the three conditions in 5-300 and in the contract. Decide whether you can rely on a vendor-commissioned multi-employer audit under the FAQ conditions.
4. Prepare audit data. Extract historical outcomes with self-reported demographic data; do not impute. Agree how test data will be described if historical data is insufficient.
5. Publish the summary and distribution date before first use and set a reminder to keep it posted six months after last use.
6. Build notices into the workflow. Add AEDT and qualifications notices to job postings or the careers page, set an alternative process or accommodation route, and publish data type, source and retention or answer written requests within 30 days.
7. Pilot and roll back. Introduce a new tool on a few requisitions after notice and audit, compare outcomes with the manual process, and keep the ability to switch the tool off per requisition if impact ratios move sharply.
8. Re-audit and re-check annually, and after material model or configuration changes.

Metrics: percentage of in-scope tools with an audit dated within 12 months; days of remaining audit validity for each tool; percentage of requisitions using an AEDT where notice preceded use by 10 business days; median response time to data information requests (target under 30 days); number of integrations with shared or unowned credentials; impact ratios per category tracked between audits. Large employers usually need a central register and workflow controls; a small employer using one vendor tool can meet the law with a dated audit file, a careers page section and a notice template.

Common failure patterns

• Relying on the vendor's "compliant" claim: the vendor is not responsible under the law; the employer must confirm the audit covers its use and data.
• Audit older than a year: each day of use after expiry is a separate violation.
• Defining scope by product label: "decision support" tools whose scores recruiters follow in practice meet the substantially assist test.
• Imputed demographics: inferring race or sex from names to fill gaps, which the FAQ says is not permitted.
• Notices only at interview: notice must precede use by 10 business days, so a notice given after screening is too late.
• Unmanaged vendor access: default or test accounts and long-lived API keys into candidate data, as the McHire case showed.

Practitioner checklist

• Maintain an inventory of every tool and AI feature used to screen candidates or rank employees for promotion.
• Record the three-prong scope decision for each tool, with evidence of how outputs are used.
• Hold a bias audit dated within one year for every AEDT, by an auditor meeting the independence test.
• Check the audit includes sex, race/ethnicity and intersectional categories, unknown counts and any 2% exclusion justification.
• Publish the audit summary and distribution date before use and keep it for six months after last use.
• Give notice of use and assessed qualifications at least 10 business days before use, with an accommodation route.
• Answer written requests for data type, source and retention within 30 days.
• Give each AEDT integration a scoped, owned, rotated credential and require SSO and MFA for vendor consoles.
• Re-check DCWP's AEDT page for rule changes at least quarterly.

Standards and references

• New York City Council: Local Law 144 of 2021 (Administrative Code 20-870 to 20-874)
• NYC Department of Consumer and Worker Protection: Notice of Adoption, Automated Employment Decision Tools rules (6 RCNY 5-300 to 5-304)
• NYC Department of Consumer and Worker Protection: Automated Employment Decision Tools
• NYC Department of Consumer and Worker Protection: Automated Employment Decision Tools Frequently Asked Questions
• Office of the New York State Comptroller: Enforcement of Local Law 144, Automated Employment Decision Tools
• DLA Piper: Critical audit of NYC AI hiring law signals increased risk for employers

Related NHI Mgmt Group resources: Global AI Regulation Map · AI and Privacy Guide · Explainable and Fair AI Guide · Insider Threat Programme Guide. This guide summarises New York City Local Law 144 of 2021 and the DCWP rules as at 24 October 2026 and is not legal advice.