An AEDT Vendor Due Diligence Checklist for Hiring Tools

The RFP Question Nobody on the Buying Committee Wants to Own

Your talent acquisition lead just forwarded a demo recording from an AI resume-screening vendor. The pitch was smooth — faster time-to-fill, "bias-audited," ready to deploy across your NYC postings by next quarter. Procurement wants a signature by Friday. Nobody on the call asked to see the audit itself, and nobody quite knows whose job that is.

This is a normal moment, not a rare one. AI hiring tools are no longer a novelty: HR's use of AI to support recruiting is now the single most common HR AI use case, and overall HR AI adoption reached 43% in 2025, up from 26% the year before (SHRM 2025 Talent Trends). Vendors know this, and vendor marketing language — "compliant," "audit-ready," "NYC-approved" — has outrun what New York's Local Law 144 actually requires anyone to prove.

If your organization deploys an automated employment decision tool against NYC-resident candidates, the compliance obligation attaches to you, the employer, not to the vendor's sales deck. By the end of this checklist, you'll know exactly which questions to ask before you sign, and how to tell the difference between a vendor that's actually deployable in NYC and one that just says so.

What Local Law 144 Actually Requires From a Vendor

Start with the legal mechanism, because it defines what "due diligence" even means here. Local Law 144 defines an AEDT as any computational process derived from machine learning, statistical modeling, data analytics, or AI that issues a simplified output — a score, classification, or recommendation — used to substantially assist or replace discretionary hiring or promotion decisions (Perkins Coie, 2023). If the tool you're evaluating fits that definition and will touch NYC-resident candidates, three obligations follow: an annual independent bias audit, a public summary of the most recent audit results posted on the employer's website (with the AEDT's distribution date), and candidate notice at least 10 business days before use, including an alternative-process or accommodation option (Crowell & Moring LLP, 2023; Epstein Becker Green, 2023). The law took effect January 1, 2023, with enforcement beginning July 5, 2023 (Epstein Becker Green / Workforce Bulletin, 2023).

Here's the part procurement teams miss: the audit has to come from an independent auditor with no financial or employment relationship to either the employer or the AEDT vendor. That's a structural requirement, not a formality — it's the reason a vendor cannot simply hand you its own internal testing as "the audit," and the reason you can't buy audit-execution and audit-documentation tooling from the same company without a conflict-of-interest question following you into the file.

This article is an operations resource, not legal advice. It tells you what to ask and how to verify the answer. Whether a specific tool meets the legal definition of an AEDT, and whether a specific audit satisfies the statute, are determinations to confirm with counsel or with DCWP directly.

The AEDT Vendor Due Diligence Checklist: Nine Questions Before You Sign

This is the core of any AEDT vendor due diligence checklist worth using — nine questions, asked in writing, with the answers kept on file:

1. Does this tool meet the statutory definition of an AEDT? Get this in writing from the vendor, not inferred from a feature list.
2. Who performed the most recent bias audit, and when? Name, date, and a description of the auditor's independence.
3. Is the auditor free of any financial or employment relationship with the vendor or with you? Ask directly; don't assume.
4. Can we see the audit summary itself — not a marketing one-pager, but the underlying results?
5. What selection-rate data does the audit report by category, and does it show anything close to the four-fifths threshold, where a group's selection rate below 80% of the highest-selected group's rate can indicate adverse impact (via Assessment Systems, 2024, summarizing the EEOC Uniform Guidelines)?
6. Will the vendor supply the historical data we need to run our own audit if we can't use theirs?
7. Does the tool's output function as a score, classification, or ranking that a hiring manager could rely on with minimal independent judgment?
8. What is the vendor's process for re-audit on the required annual cadence, and who owns scheduling that?
9. Has this vendor, or this specific tool version, had any public audit posted before — and does that posting match what they're telling you now?

None of these questions require you to be a data scientist. They require you to get commitments in writing and then verify them, which is a different skill — and a more valuable one than most procurement checklists assume.

How to Verify a Vendor's Bias Audit Actually Exists

A vendor telling you "we're audited" is a claim. A public audit summary, posted with a distribution date, that you can actually read, is verification. The distinction matters more than it should, because verification is inconsistent across the market right now. A 2024 academic study of 391 employers subject to Local Law 144 found only 18 had posted an audit report and only 13 had posted a transparency notice (ACM FAccT, Wright & Muenster et al., 2024) — meaning the employer side of public posting is thin, and by extension, a vendor's claim that "our clients are all compliant" deserves a second look rather than a nod.

A separate 2025 audit-quality review found that many published Local Law 144 audits may under-report disparities, due to missing demographic data, opaque aggregation methods, or metrics that don't reflect how the tool is actually deployed (ACM FAccT, "Auditing the Audits," 2025). So even a posted audit isn't automatically a clean bill of health — read what it actually measured, not just that it exists.

A vendor saying "we're compliant" is a sales claim. A dated, independently-produced audit summary you can read yourself is verification. Ask for the second thing.

For a closer look at what a real vendor bias-audit disclosure should contain and how to request one, see how to check if an AEDT vendor has a bias audit and aedt vendor bias-audit verification. If you're trying to confirm whether a specific tool is deployable in NYC at all — before you even get to audit quality — start with is an AI hiring tool deployable in NYC.

Red Flags: When "Deployable in NYC" Isn't True

Watch for these patterns during vendor conversations:

• Vague audit dates. "We're audited annually" without a specific most-recent date is a dodge, not an answer.
• No independence statement. If the vendor can't or won't describe who ran the audit and their relationship to the vendor, that's the conflict-of-interest question unanswered.
• Refusal to share underlying data. If you can't get the historical data needed to evaluate the tool's own performance on your population, you can't independently confirm anything the vendor tells you.
• "NYC-approved" language. New York does not pre-approve or certify AEDTs. No agency stamp exists to point to. Confirm this framing with DCWP if a vendor implies otherwise.
• Bundled audit-and-documentation sales pitch from the same company that runs your bias audit. That's the structural conflict this law was written to prevent — flag it before you sign anything.

Where Procurement Due Diligence Ends and Your Compliance Operation Begins

Getting a "yes" on all nine questions is the start of the file, not the end of it. Once you deploy the tool, you own an ongoing operation: tracking the vendor's audit renewal date, keeping the posted summary current, running candidate notice on time, and maintaining a documented rationale for why the tool was deployed the way it was — a rationale you can defend if DCWP or a candidate ever asks. That operation runs on a register, not a memory. For a lookup of publicly posted vendor audits as a starting reference point, see Local Law 144 vendor audit registry lookup, and for the full compliance picture beyond procurement, see the NYC Local Law 144 compliance guide.

Your First Action Item

Before you close out this vendor evaluation, put the nine questions above into a tracked record — vendor name, audit date, auditor independence, posting status, renewal cadence — rather than leaving the answers scattered across emails and a sales deck. The AEDT Vendor Bias-Audit Status Tracker Workbook is built exactly for this: a single register that runs the ongoing due-diligence and renewal-tracking operation across every AEDT vendor on your roster, so the next annual audit deadline doesn't arrive as a surprise. Download the AEDT Vendor Bias-Audit Status Tracker Workbook and start the file today.