Local Law 144 Bias Audit Requirements: What Employers Must Maintain

Your Vendor Just Told You the Audit Is "Handled." It Isn't — Not Fully.

Here's a conversation that happens in a lot of HR departments right now: the resume-screening tool your team has used for over a year turns out to be an AEDT under Local Law 144, and someone — maybe the vendor's account rep, maybe a colleague who read a blog post — says, "don't worry, the bias audit is done." Relief lasts about a day, until someone asks the follow-up question: where is the summary posted, who got the 10-business-day notice, and who's holding the file that proves any of this happened?

That's the gap. A completed bias audit is one of three separate obligations under Local Law 144, and it's the vendor's audit but the employer's compliance posture. The audit can be finished and the employer can still be exposed, because posting the summary and notifying candidates are jobs nobody outsources by accident — they have to be assigned.

This article walks through exactly what local law 144 bias audit requirements ask of an employer, in the order you'll actually need to execute them, so you can tell the difference between "the vendor handled it" and "we're covered."

The Three Things Local Law 144 Actually Requires

Local Law 144 became effective January 1, 2023, with enforcement beginning July 5, 2023, after a delay from an originally announced April 15 date (Epstein Becker Green / Workforce Bulletin, 2023). It applies to any employer or employment agency using an AEDT — a computational process derived from machine learning, statistical modeling, data analytics, or AI that issues a simplified output like a score, classification, or recommendation used to substantially assist or replace discretionary decision-making — on a candidate or employee for a position in New York City (Perkins Coie, 2023).

Strip away the surrounding commentary and the local law 144 bias audit requirements reduce to three concrete obligations (Crowell & Moring LLP, 2023; Epstein Becker Green, 2023):

1. An annual independent bias audit of the AEDT, conducted by an auditor with no financial or employment relationship to the employer or the vendor.
2. A public summary of the most recent audit results, posted on the employer's website, along with the date the AEDT was distributed for use.
3. Notice to candidates or employees at least 10 business days before the AEDT is used on them, including a way to request an alternative process or accommodation.

Each of these has its own timing, its own owner, and its own failure mode. None of them is optional if you're using a qualifying tool on NYC-resident candidates or employees, and none of them substitutes for the others — a completed audit with no posting is still a gap, and a posting with no candidate notice is still a gap.

If you haven't yet confirmed whether your hiring or promotion tools qualify as an AEDT in the first place, that classification question comes before any of this — see what is an automated employment decision tool for the threshold test.

Who Owns the Annual Bias Audit — And What "Independent" Means

The audit itself has to be conducted by an independent auditor — someone with no financial or employment relationship to either the employer or the AEDT vendor. That independence requirement is structural, not a suggestion: it's why a vendor that sells you the AEDT generally can't also be the one certifying it's unbiased for your use, and it's why a company selling audit-execution services typically can't also sell an employer its own compliance-documentation tooling for that same audit without creating a conflict.

The audit measures selection rates across protected categories (race/ethnicity, sex) and compares them using something like the four-fifths rule from the EEOC's Uniform Guidelines: a selection rate for any group that falls below 80% of the rate for the highest-selected group may indicate adverse impact (Assessment Systems, 2024). As a worked example — not a claim about any real tool — if your highest-selected demographic group clears the AEDT at a 50% rate, a group selected at anything below 40% (80% of 50%) would trigger that adverse-impact flag under the four-fifths comparison. The auditor runs this math against your actual usage data; your job is making sure the auditor has that data, and that the audit happens on an annual cycle you can actually track.

That's the part that gets lost. "Annual" sounds simple until you're the one managing the calendar across multiple AEDTs from different vendors, each on its own anniversary date. For a fuller answer on cadence and what counts as a "new" audit trigger, see how often is a bias audit required in NYC.

One clarification worth stating plainly, because it gets blurred constantly: nothing in this article, and nothing WorkforceNewYork sells, performs, certifies, or signs a bias audit. The independent auditor does that. What the employer needs — and what a workbook can help track — is the operational record around it: which AEDT, which auditor, which audit date, which renewal deadline, and where the resulting summary lives.

What the Bias Audit Summary Posting Must Include

Once the audit is complete, Local Law 144 requires the employer to post a summary of the results publicly on its website, alongside the date the AEDT was distributed for use (Crowell & Moring LLP, 2023). This isn't a footnote requirement — it's the mechanism that lets a candidate, a journalist, or a regulator verify that the audit happened at all without requesting records directly.

And this is where enforcement data gets uncomfortable. A 2024 academic study — the "Null Compliance" study, examining 391 employers subject to Local Law 144 — found that only 18 had posted audit reports and only 13 had posted transparency notices (ACM FAccT, Wright & Muenster et al., 2024). That's not a compliance rate anyone should be comfortable replicating. A separate 2025 paper, "Auditing the Audits," found that many of the LL144 audits that were published may under-report disparities due to missing demographic data, opaque aggregation methods, or metrics that don't reflect real-world deployment (ACM FAccT, 2025). Posting something is not the same as posting something useful, accurate, or current.

The practical failure mode isn't usually willful non-disclosure — it's that the posting gets treated as a one-time task instead of a maintained page. A new audit cycle completes, and nobody updates the summary or the distribution date. If you're building this out for the first time, the full mechanics of what the summary needs to contain and where it needs to live are covered in the AEDT bias audit posting requirement.

The Candidate Notice: Timing and Content

The third leg is the one most likely to get missed on a rolling basis, because it isn't a once-a-year event — it's per-candidate, per-use. Local Law 144 requires that candidates or employees be notified at least 10 business days before an AEDT is used to assess them, and that notice has to include a way to request an alternative selection process or a reasonable accommodation (Epstein Becker Green, 2023).

Ten business days is roughly two calendar weeks, which sounds generous until it collides with a hiring manager who wants a shortlist by Friday. If your applicant tracking system fires off the AEDT screen automatically on submission, the notice window has to be built into the workflow before that trigger, not layered on after someone realizes candidates weren't told.

The bias audit tells you whether the tool is fair in aggregate. The candidate notice is the individual's chance to opt out or ask for a different path. They are not the same requirement, and satisfying one does not satisfy the other.

For the specific language requirements, delivery methods DCWP has accepted, and how this interacts with pre-existing application workflows, see Local Law 144 candidate notice requirements.

What Records You Need to Keep on File

None of the three obligations above are self-documenting. If a candidate, DCWP, or the New York State Comptroller's office asks whether you're meeting local law 144 bias audit requirements, the answer needs to be backed by a file, not a memory. At minimum, that record should show:

• Which tools in your hiring or promotion stack qualify as AEDTs, and since when.
• The date of the most recent independent bias audit for each one, and who performed it.
• Where and when the summary was posted, with a copy of what was posted.
• A log of candidate notices sent, including dates, to demonstrate the 10-business-day window was met.
• The renewal date for the next required audit cycle.

This is exactly the kind of record-keeping that's easy to do well for one tool and easy to lose track of across three or four. It's also the piece that has nothing to do with legal interpretation and everything to do with operational discipline — which is why it's worth separating from anything requiring a lawyer's judgment call.

To be direct about scope: this article, and the workbooks referenced in it, describe an operational framework for organizing that record. They are not legal advice, they do not replace outside counsel, and they do not perform, certify, or sign any audit. If a specific fact pattern in your organization raises a real compliance question — whether a tool qualifies, whether a notice was adequate, how a penalty calculation applies — that's a conversation for counsel or for DCWP directly, not a template.

What Happens When You Don't Meet Local Law 144 Bias Audit Requirements

Civil penalties for Local Law 144 violations run up to $500 for a first violation (with each additional violation on the same day treated as its own violation), and $500 to $1,500 for each subsequent violation, with penalties accruing per violation per day (Office of the NY State Comptroller, 2025). Missing the audit, missing the posting, and missing a candidate notice can each be treated as separate violations — and each day of continued non-compliance can add up under that structure. Confirm the current per-violation penalty schedule and how it's being applied with DCWP directly before calculating your own exposure; enforcement mechanics can shift, and this is not the kind of number to estimate.

Enforcement so far has also been uneven in a way worth understanding. The New York State Comptroller's December 2025 audit, covering the review period from July 2023 through June 2025, found DCWP's enforcement "ineffective": DCWP identified only 1 of 32 reviewed companies as non-compliant, while the Comptroller's own auditors found 17 non-compliant companies within that same set (DLA Piper, 2026; OSC, 2025). The same audit found that only two AEDT complaints were received during the entire review period, and DCWP hadn't investigated whether its own complaint intake process was functioning — a concern reinforced by a separate finding that 75% of 311 test calls were improperly routed and never reached DCWP at all (DLA Piper, 2026).

None of that is a reason to treat the requirements as unenforced in practice. Weak intake and light DCWP identification don't erase the underlying obligation, and it means the Comptroller's office — not just DCWP — is actively finding non-compliance that DCWP's own process missed. Enforcement gaps close; audit trails from years ago don't retroactively appear once they do.

Building the Operational Checklist

Reading the requirements is the easy part. The hard part is running all three — audit, posting, notice — on time, across however many AEDTs your organization has, without any of them quietly slipping. A single missed renewal date, a posting nobody remembers to refresh, a notice window nobody built into the workflow — any one of these turns a compliant program into a gap, and the Comptroller's own findings suggest gaps are common even at organizations that believe they're covered.

That's the specific problem the LL144 + WARN Compliance Calendar & Filing Tracker is built to solve. It's a downloadable workbook — not a subscription, not a live dashboard — that gives you a structured place to log each AEDT, its audit date and auditor, its posting status and location, and your candidate-notice cadence, alongside your NY WARN filing deadlines on a shared calendar. It doesn't perform the audit and it doesn't score anyone; it keeps the operational record straight so you can answer "are we covered" with a file instead of a guess.

If you're still mapping which of Local Law 144's provisions apply to your organization at a broader level — thresholds, deadlines, definitions — start with the NYC Local Law 144 compliance guide and then build your compliance calendar from there using the deadline calendar reference. For most HR teams, the download is the faster starting point: get the tracker set up first, then backfill the detail as you confirm it.