Are Bias Audits Required by Law?

An AEDT Vendor Just Said the Word "Audit" — Now What?

Say a vendor just finished demoing a resume-screening tool for your 120-person company, based in Manhattan. Partway through, the sales rep mentions, almost in passing, that the platform is "LL144-compliant" and that customers "usually run the audit themselves or use ours." You nod. Then, after the call ends, the real question surfaces: is this actually something the law requires, or is "bias audit" one of those phrases vendors use to sound rigorous?

It's a fair question, and a common one. AI vendors throw around terms like "fairness," "responsible AI," and "audited" freely, and not all of it maps to a legal obligation. Some of it is marketing. Some of it is real, statutory, dated, and enforceable with civil penalties. If you're deploying an automated hiring or promotion tool on candidates or employees who work in New York City, you need to know which one you're looking at before you sign a contract or flip the tool on.

By the end of this piece, you'll know exactly where the bias-audit mandate comes from, what it covers, and what your first move should be before you evaluate any vendor's claims about it.

Are Bias Audits Required by Law?

For employers using automated employment decision tools on candidates or employees who work in New York City, the answer is yes. New York City's Local Law 144 requires an independent bias audit of any AEDT before it's used, and annually thereafter, for as long as the tool stays in use. This isn't guidance or a voluntary framework — it's a local law with a defined effective date, a defined enforcement date, and a civil penalty schedule (Epstein Becker Green / Workforce Bulletin, 2023).

LL144 took effect January 1, 2023, with enforcement beginning July 5, 2023 — delayed from an originally announced April 15, 2023 start (Epstein Becker Green / Workforce Bulletin, 2023). That gap between "effective" and "enforced" trips people up. If your tool went live sometime in that window, or since, the audit clock has likely already been running.

So when someone asks whether bias audits are required by law, the honest, precise answer is: in New York City, for AEDTs, yes — and it's been the law for going on three years. Outside NYC, the picture gets less settled, which is a separate section below.

Where the NYC Mandate Comes From: Local Law 144

LL144 defines an automated employment decision tool (AEDT) as any computational process derived from machine learning, statistical modeling, data analytics, or AI that issues a simplified output — a score, classification, or recommendation — used to substantially assist or replace discretionary decision-making about employment (Perkins Coie, 2023). That definition is broad on purpose. It reaches resume-ranking tools, video-interview scoring platforms, and applicant-sorting algorithms alike, whether the employer built the tool or bought it off the shelf.

The law's answer to "are bias audits required by law" isn't buried in fine print — it's the operative mechanism of the statute. The bias audit exists to check whether the tool produces different selection rates across sex, race/ethnicity, and intersectional categories, and it has to be conducted by an independent auditor with no financial or employment relationship to either the employer or the AEDT vendor.

If you want the full breakdown of what a bias audit actually measures and how auditors run one, that's covered separately in what a bias audit in AI hiring actually is.

What Counts as an AEDT — and What Doesn't

Not every piece of software touching your hiring pipeline is an AEDT under LL144. An applicant tracking system that just stores resumes and lets a recruiter search keywords isn't making a substantive decision — a human is. A tool that scores, ranks, or recommends candidates and gets treated as the deciding input, though, likely is.

This distinction matters because the bias-audit requirement only attaches once you've confirmed the tool meets the statutory definition. Employers sometimes assume they're covered because they read a headline about "AI hiring bias," and other times assume they're exempt because a vendor told them so — neither assumption is reliable on its own. This is a classification question, not a guess, and it's worth working through deliberately with a method — such as tagging the actual roles and tasks the tool touches — rather than taking a vendor's word for it. Our AEDT classification decision workbook walks through that exact question using a structured, documented method, so the reasoning is something you can point to later if anyone asks.

What the Audit Actually Requires

Once a tool is confirmed as an AEDT deployed on NYC candidates or employees, LL144 imposes three specific obligations (Crowell & Moring LLP, 2023; Epstein Becker Green, 2023):

1. An annual independent bias audit, conducted by an auditor with no financial or employment ties to the employer or the vendor.
2. A public summary of the most recent audit results, posted on the employer's website, along with the AEDT's distribution date.
3. Candidate and employee notice at least 10 business days before use, including a path to request an alternative process or accommodation.

One common method auditors apply when evaluating selection-rate differences is the four-fifths (80%) rule: if a group's selection rate falls below 80% of the rate for the highest-selected group, that's treated as a signal worth investigating for adverse impact (EEOC Uniform Guidelines, via Assessment Systems, 2024). It's a screening threshold, not a verdict — but it's the kind of math an independent auditor is running, not something a compliance workbook calculates for you.

The audit itself has to be performed and signed by an independent third party. Nothing in your internal documentation — however thorough — substitutes for that.

None of this is legal advice, and nothing here should be read as a substitute for confirming your specific obligations with DCWP or outside counsel. What this section describes is the operational shape of the requirement — what has to happen, roughly when, and in what order — not a legal opinion about your situation.

For the fuller obligation-by-obligation breakdown, see Local Law 144 bias audit requirements and the NYC Local Law 144 compliance guide.

How Often You Need One — and What Happens If You Skip It

The audit isn't a one-time event. It runs on an annual cycle, tied to continued use of the tool — a fresh audit every year the AEDT stays deployed, not just at initial rollout. The specifics of that cadence, including what triggers a new audit outside the standard annual clock, are covered in how often a bias audit is required in NYC.

Skipping it carries real, published penalties: up to $500 for a first violation, escalating to $500–$1,500 for each subsequent violation, with penalties accruing per violation per day (Office of the NY State Comptroller, 2025). A missed notice period and a missing audit can each count separately — the exposure compounds.

Worth knowing, though: enforcement so far has been inconsistent. A December 2025 Comptroller's audit covering July 2023 through June 2025 found the city's enforcement "ineffective" — DCWP identified minimal non-compliance among a sample of companies where the Comptroller's own auditors found problems at 17 out of the same 32 (DLA Piper, 2026; Office of the NY State Comptroller, 2025). Separately, a 2024 academic study of 391 covered employers found only 18 had posted the required audit report and only 13 had posted the transparency notice (ACM FAccT, Wright & Muenster et al., 2024). Thin enforcement today isn't the same as no obligation — the statute and its penalty schedule are unchanged either way.

Beyond NYC: Is This a National Requirement?

Here the honest answer gets more qualified. LL144 is a New York City law — it doesn't extend statewide or nationally on its own. Other states have moved in similar directions (Illinois and Colorado both have AI-employment-related statutes in various stages), and some AI-governance vendors position their products across those frameworks alongside the EU AI Act. But the specific obligations, thresholds, and timelines in those other jurisdictions differ from LL144's, and this article isn't the place to state them precisely — confirm the current requirements in any other state directly with counsel or that state's labor agency before assuming LL144's rules travel with you.

Separately, New York State's own AI Labor Information Act (§ 201-j) passed the legislature in June 2026 but has not been signed — Governor Hochul has not publicly taken a position, and its effective status is uncertain (National Law Review, 2026; Thompson Coburn LLP, 2026). As passed, it would require annual AI-impact reporting to NYSDOL, not a bias audit — a related but distinct obligation, and one that isn't law yet. Treat it as something to watch, not something to comply with today.

Your First Move: Classify the Tool Before You Audit It

If you deploy or are considering an AEDT that touches NYC candidates or employees, the question "are bias audits required by law" resolves quickly once you know whether the tool meets LL144's definition. That classification step — not the audit itself — is where most employers should start, because it determines everything downstream: whether you need an auditor, what your notice timeline looks like, and what you're posting publicly.

Start with the AEDT classification decision workbook to document that determination with a defensible, structured rationale before you engage an independent auditor. And if you want the next installment — on how the annual audit cycle actually runs, month by month — subscribe to get it when it publishes. We're also building an always-on version of this tracking as a hosted application; join the waitlist if you'd rather have the reminders run automatically once it ships.