The AEDT Bias Audit Posting Requirement

The AEDT Bias Audit Posting Requirement, In Plain Terms

Picture this: your AEDT vendor just sent over this year's bias audit report. It's a solid document — EEOC four-fifths ratios calculated, methodology described, numbers that look defensible. Legal signs off. You forward it to IT with a note: "post this somewhere on the site." Three weeks later a candidate emails asking where the summary is, because they can't find it. IT had posted it to an internal wiki instead of the public careers page. Nobody caught the mistake, because nobody was tracking whether the file actually went live — and stayed live — where the law requires it.

This happens more often than HR teams expect, not because employers are trying to hide audit results, but because "post it" sounds like a five-minute task and gets treated like one. It isn't. The AEDT bias audit posting requirement has its own mechanics: what has to appear, where, and how a reader has to be able to find it without digging. Miss any piece of that and the audit itself — the part you paid for and did correctly — doesn't count for compliance purposes, because the disclosure step never actually finished.

By the end of this piece, you'll know exactly what the posting requirement covers and have a way to confirm, on any given day, that every summary you're responsible for is actually live.

What LL144 Actually Requires You to Post

Local Law 144 gives employers and employment agencies three separate obligations when they use an automated employment decision tool on NYC candidates or employees: an annual independent bias audit, a public summary of the most recent audit results posted on the employer's website — including the date the AEDT was first used — and advance notice to candidates and employees, at least 10 business days before the tool is used, with a way to request an alternative process or accommodation (Crowell & Moring LLP, 2023; Epstein Becker Green, 2023).

Those three obligations are sequential in practice even though they're not always sequential on the calendar: the audit produces the numbers, the posting makes them public, and the notice tells the individual candidate the tool exists and where to look. A completed audit that never gets posted is functionally an audit that didn't happen, as far as the disclosure duty is concerned. That's the piece most compliance programs underweight — they track "audit ordered" and "audit received" carefully, then treat "audit posted" as an afterthought.

If you're still working out the underlying content requirements — what the summary itself has to say — that's covered in detail separately: see our breakdown of the summary of results and where it has to be published. This piece is specifically about the posting mechanics: the "did it go live, and is it still live" half of the problem.

Where It Has to Live, and Why "Somewhere on Our Site" Isn't Good Enough

The statute's requirement is that the summary be posted on the employer's website. In practice, that means a public-facing location a candidate could reasonably find — not a password-gated intranet, not an internal SharePoint folder, not a page that only exists because someone remembers the URL. The exact technical specifications for placement and findability are something DCWP has continued to clarify, and the precise duration a posting must remain live is worth confirming directly with DCWP before you finalize your own posting policy — we don't publish an unsourced duration figure here, and neither should your internal documentation.

What we can say with confidence: the posting has to include the AEDT's distribution date — when the tool was first used for the relevant employment decision — alongside the audit summary itself (Crowell & Moring LLP, 2023). A posting missing that date isn't a complete posting, even if the audit numbers are accurate and current.

For the cadence question — how often this whole cycle has to repeat — see our companion piece on how often a bias audit is required in NYC. The short version: it's annual, tied to continued use of the tool, which means the posting requirement isn't a one-time task either. It's a recurring one, on a clock, every single year the AEDT stays in use.

Who Actually Owns Getting It Posted

This is where the posting requirement quietly breaks down inside organizations. The audit itself usually has a clear owner — often HR or a compliance lead, working with an independent auditor and possibly IT/legal on data access. But "post the summary to the website" frequently gets handed off to whoever manages the careers page, which might be marketing, might be an outside web vendor, might be nobody in particular. That handoff is exactly where postings get delayed, buried on the wrong page, or dropped when a site redesign happens six months later and nobody remembers to carry the file forward.

There's no statutory requirement about which internal role has to do the posting — that's an operations question, not a legal one. But somebody inside your organization needs to own it explicitly, with a specific date it has to be live by and a specific person checking that it actually is. If you want the full underlying compliance framework this sits inside, our Local Law 144 bias audit requirements guide and the broader NYC Local Law 144 compliance guide both walk through where posting fits relative to the audit and the candidate notice.

What Enforcement Reality Tells Us About "Posted" vs. Actually Live

The gap between "we posted it" and "it's actually findable" isn't hypothetical. A 2024 academic study of 391 New York City employers using AEDTs — the "Null Compliance" study — found that only 18 had posted audit reports, and only 13 had posted the required transparency notices (ACM FAccT, Wright & Muenster et al., 2024). That's not a story about employers refusing to comply. It's a story about postings that were supposed to happen and quietly didn't, or happened somewhere nobody could find them.

Regulators aren't just checking whether an audit was performed. They're checking whether a member of the public could actually locate the summary — and a lot of postings fail that second test even when the first one passed.

The city's own enforcement record backs this up. The Comptroller's December 2025 audit, covering the enforcement period from July 2023 through June 2025, characterized DCWP's LL144 enforcement as ineffective overall. DCWP's own review found a small number of the 32 companies it examined non-compliant — minimal, far fewer than the 17 out of that same set of companies that the Comptroller's own auditors found (Office of the NY State Comptroller, 2025). The gap between those two counts is largely a gap in what got checked, and posting status was one of the things under-checked.

The practical lesson: don't rely on "the audit was done" as a proxy for "we're compliant." Posting status has to be verified on its own, separately, on a recurring basis — not assumed because the audit report exists in a folder somewhere.

Tracking a Posting So It Doesn't Quietly Disappear

The posting requirement fails less often at the moment of publishing and more often afterward — during a site migration, a careers-page redesign, a CMS update, or simply the following year when a new audit summary is supposed to replace the old one and nobody remembers to swap the file. A posting that was live in March can be gone by September without anyone deciding to remove it.

The fix is the same operational discipline you'd apply to any recurring filing: a dated entry that gets checked, not assumed. That means recording the URL where each summary lives, the date it went live, the date the next audit cycle's posting is due, and a periodic — quarterly is a reasonable cadence — spot-check that the link still resolves and still shows current information. If you manage AEDT compliance across more than one entity, or across a client roster as a consultant or PEO, that tracking needs to happen per employer, per tool, because posting status doesn't roll up automatically.

This is exactly the kind of recurring, dated, easy-to-let-slip obligation a compliance calendar is built for — not because a calendar performs the audit or writes the summary, but because it holds the dates and the URLs in one place where someone is actually looking at them.

Operations, Not Legal Advice

Nothing here is a substitute for legal advice. What counts as a public-facing posting, what technical placement standards apply, and how DCWP interprets its own rule in a specific edge case are legal questions, and the answers can shift as enforcement guidance evolves. Confirm your specific posting obligations with DCWP directly, or with outside counsel, before finalizing your policy. What we're describing here is the operational side: how to track that a posting happened, where it lives, and whether it's still there — the paper trail that shows you took the requirement seriously, not a legal determination that you've satisfied it.

Your First Action Item

If you don't currently have a single place that records every AEDT's audit-posting URL, its live date, its next-cycle due date, and a recurring check-in to confirm it's still up, that's the gap to close first — before the next audit cycle catches you the way it caught the 373 employers in the Null Compliance study who apparently never posted anything at all.

The LL144 + WARN Compliance Calendar & Filing Tracker is built exactly for this: a downloadable workbook that holds your posting dates, your notice dates, and your WARN filing deadlines side by side, so nothing depends on someone remembering. Download it, drop in your current AEDT posting URLs and dates, and set your next check-in now — not after the next audit lands on your desk.