How to Check if an AEDT Vendor Has a Bias Audit

Your procurement lead just asked, "did the vendor's bias audit actually happen?"

You're three weeks from signing a contract for a resume-screening tool. Procurement forwards you the vendor's sales deck, which includes a slide that says "LL144 Compliant" in bold letters under a checkmark icon. That's it. No date, no link, no auditor name.

You need an answer before the contract is signed and the tool touches a single NYC resident's application — because once it's live, the audit either exists or it doesn't, and "the vendor said so" isn't a defense to anyone: not DCWP, not a plaintiff's attorney, not your own leadership when they ask what you checked. A vendor claiming compliance and a vendor with a dated, published, independent audit are two different facts, and only one of them protects you.

This is a solvable problem. It doesn't require a subscription, a lawyer on retainer, or a live government lookup tool — because no centralized public audit registry exists yet. It requires four repeatable steps you can run on any vendor, in about twenty minutes, and a place to write down what you found. By the end of this article you'll have that four-step method and know exactly what to do with what you find.

Why "the vendor said so" isn't a bias audit

Local Law 144 became effective January 1, 2023, with enforcement beginning July 5, 2023 (Epstein Becker Green / Workforce Bulletin, 2023). It imposes three obligations on any employer using an AEDT on a NYC candidate or employee: an annual independent bias audit, a public summary of the most recent audit results posted on the employer's website alongside the AEDT's distribution date, and candidate/employee notice at least 10 business days before use, with a path to request an alternative process or accommodation (Crowell & Moring LLP, 2023; Epstein Becker Green, 2023).

Notice the word independent. The audit must be conducted by an auditor with no financial or employment relationship to either the employer or the AEDT vendor. That's a structural requirement, not a marketing checkbox — a vendor cannot certify its own tool and call it an independent audit, and a vendor slide that says "compliant" tells you nothing about who ran the audit, when, or against what data.

Civil penalties for getting this wrong run up to $500 for a first violation (and each additional violation on the same day), then $500 to $1,500 for each subsequent violation, accruing per violation per day (Office of the NY State Comptroller, 2025). Confirm the current schedule directly with DCWP before relying on it for a specific filing decision — this article describes the mechanism, not a legal opinion on your situation.

The enforcement record so far gives you a second reason not to take a vendor's word for it. A December 2025 Comptroller audit covering July 2023 through June 2025 found DCWP's enforcement "ineffective": DCWP found minimal noncompliance among the 32 companies it reviewed — far fewer than the 17 the Comptroller's own auditors found examining the same 32 (Office of the NY State Comptroller, 2025). A separate academic study of 391 employers found only 18 had posted an audit report and only 13 had posted the required notice (ACM FAccT, Wright & Muenster et al., 2024). Posted compliance is the exception, not the rule — which is exactly why you check yourself rather than trust a claim.

The four-step way to check if an AEDT vendor has a bias audit

Here's the repeatable method. Run it on every AEDT vendor before signature, and again at each annual renewal, since an audit that was current last year may have expired.

Step 1: Ask the vendor directly, in writing. Request the audit report itself (or the independent auditor's summary), the auditor's name, the audit date, the data window the audit covered, and the AEDT's distribution date. A vendor with a real audit produces this without friction. A vendor that stalls, deflects to a general SOC 2 report, or points back to its own marketing page is telling you something.

Step 2: Find the public posting yourself. LL144 requires the employer to post the summary, but many vendors also publish theirs to make procurement easier — check the vendor's website, trust-center page, or a linked PDF. This is the step where you confirm the claim exists somewhere you can point to later, independent of what a salesperson told you on a call.

Step 3: Check the date. An audit is only current if it covers the most recent 12-month cycle for that AEDT. A 2023 audit posted with no update is not evidence of an audit for a tool deployed in 2026. This is also where the AEDT's own distribution date matters — an audit conducted before a major model update may not reflect the tool you're actually about to deploy.

Step 4: Record your source. Save the URL, the date you checked it, and a screenshot or PDF copy, because vendor pages change and disappear. This is the step most people skip, and it's the one that matters most if you're ever asked to show your work.

Run through this four times per vendor — once per step — and you have a defensible answer instead of a slide. If you want the exact same method as a repeatable checklist you can hand to anyone on your team, our vendor due diligence checklist walks through it line by line, and our deeper look at vendor verification covers edge cases like multi-product vendors and white-labeled AEDTs.

What if you can't find one, or the vendor pushes back

If a vendor cannot produce a dated, independent audit summary, don't assume malice — assume you're one of many employers who never asked. But don't deploy the tool on NYC residents until you have an answer. If the vendor claims the tool isn't subject to LL144 at all (a common argument for tools marketed as "decision support" rather than a scoring tool), that's a separate question worth working through — our guide on whether an AI hiring tool is deployable in NYC walks through how the statutory AEDT definition actually applies.

There's no live, centralized government registry today where you can look up a vendor's audit status in one search — DCWP doesn't publish one, and we don't publish an unsourced claim that one exists. We're building a hosted vendor audit registry lookup as part of a future compliance application; if that's useful to you, join the waitlist and we'll let you know when it ships. Our article on the current state of a Local Law 144 vendor audit registry lookup covers what's available today versus what's coming.

Your first action item

Checking once, at signature, isn't enough — audits expire, vendors get acquired, and tools get updated mid-year. What you need is a place to track every vendor you deploy, the date you last verified their audit, where you found it, and when the next check is due.

That's exactly what the AEDT Vendor Bias-Audit Status Tracker Workbook is built for — a downloadable register, not a subscription, that runs this four-step check as a repeatable operation across every AEDT vendor on your roster. It doesn't perform or certify anyone's audit; it documents the rationale you can defend when someone asks what you checked and when. If you're still building the broader compliance picture, our Local Law 144 compliance guide is the place to start.

Download the tracker workbook and run the check on your current vendor roster this week — before the next tool goes live.