What Is a Bias Audit in AI Hiring?

Your Vendor Just Sent Over a "Bias Audit Summary." Now What?

Your applicant-tracking vendor emails a PDF titled "2025 Bias Audit Summary" and asks you to post it on your careers page before your next hiring cycle opens. Your CEO forwards it to you with one line: "Are we covered?"

You open it. There's a table of selection rates broken out by category, a paragraph about methodology, a date. You have no idea if the numbers are good, bad, or missing something important — and you have thirty seconds before your next meeting to decide whether this satisfies a legal obligation with a per-day penalty attached to it.

This happens to HR leaders across New York City every audit cycle, because almost nobody explains what a bias audit actually is before asking employers to post one. It's not a security scan. It's not a legal opinion. It's a specific statistical test, run by a specific kind of independent party, measuring a specific thing.

By the end of this article, you'll be able to look at any bias audit summary and know exactly what it's supposed to be measuring, who was supposed to run it, and what you — the employer — are responsible for keeping on file around it.

What Is a Bias Audit in AI Hiring, Exactly?

Under New York City's Local Law 144, a bias audit is an evaluation of an automated employment decision tool — an AEDT — to see whether it produces different outcomes for different groups of candidates or employees at meaningfully different rates. The statute defines an AEDT broadly: any computational process derived from machine learning, statistical modeling, data analytics, or AI that issues a simplified output — a score, classification, or recommendation — used to substantially assist or replace discretionary decision-making about hiring or promotion (Perkins Coie, 2023).

That's the plain-English version of what is a bias audit ai hiring practice: it's a test of the tool's outputs, not a test of your hiring process, your job descriptions, or your intentions. The law has been in effect since January 1, 2023, with enforcement beginning July 5, 2023, after a short delay from an originally announced April date (Epstein Becker Green / Workforce Bulletin, 2023). If your company deploys an AEDT to screen or rank NYC-resident candidates or employees, the audit obligation applies to you regardless of whether you built the tool or simply licensed it from a vendor.

What an Independent Auditor Actually Measures

The audit itself calculates selection rates — what percentage of each demographic group passes through the tool toward the next stage — and compares them across categories. The output is usually expressed as an impact ratio: the selection rate for one group divided by the selection rate for the group with the highest rate.

This is a statistical comparison, not a legal judgment. The auditor isn't determining whether your company discriminated. They're documenting whether the tool's pass-through rates for different groups sit close together or far apart, and publishing that comparison for anyone to see.

This is also the point where the operations-not-legal-advice line matters. Nothing in this article, or in any bias audit summary, tells you whether your specific use of a specific AEDT is lawful. That determination sits with counsel and, ultimately, with regulators. What the audit gives you is data — a documented rationale you can defend, not a guarantee of anything. If you need a legal read on your exposure, that's a conversation with outside counsel, not a spreadsheet.

The Four-Fifths Rule: How Adverse Impact Gets Flagged

Most bias audit methodology leans on a decades-old EEOC benchmark called the four-fifths rule (also called the 80% rule): a selection rate for any group that falls below 80% of the rate for the highest-selected group may indicate adverse impact (via Assessment Systems, 2024).

Here's a worked example to show the arithmetic, using round numbers rather than any real audit's figures:

• Group A's selection rate: 60% (60 of 100 candidates advance)
• Group B's selection rate: 45% (45 of 100 candidates advance)
• Impact ratio: 45 ÷ 60 = 0.75, or 75%

Because 75% falls below the 80% threshold, this reading would flag as a potential adverse-impact signal worth investigating further. Flip the numbers and get 85%, and the same tool clears the rule for that comparison. That's the entire mechanical core of a bias audit's headline number — everything else in the summary is context around this one ratio, recalculated separately for each group comparison.

If you want the full walkthrough — how auditors choose the "highest-selected group," what happens with small sample sizes, how intersectional categories get handled — we cover it in detail in our guide to the four-fifths rule and bias audits. We also built a companion product for exactly this: the Four-Fifths Rule & Impact-Ratio Reading Guide, a PDF and calculator pair that lets you plug in the numbers from any summary you receive and see the ratio for yourself instead of taking a vendor's characterization at face value.

Who Is Allowed to Run the Audit — and Who Isn't

Local Law 144 requires the bias audit be conducted by an independent auditor — specifically, one with no financial or employment relationship to either the employer or the AEDT vendor whose tool is being tested. That independence requirement is structural, not a suggestion: it's the reason a company that builds or sells AEDT scoring tools generally cannot also perform the bias audit on its own product, and it's the reason a documentation platform built for the employer side of this work cannot claim to also be the auditor. Those are two different roles, occupied by two different parties, on purpose.

Practically, this means when that PDF lands in your inbox, one of your first checks should be: who signed this, and do they have any financial stake in the tool being tested or in your account? We walk through what to verify in our breakdown of the independent bias auditor requirement — it's a five-minute check that catches a surprising number of ambiguous vendor relationships.

What the Employer Owns Around the Audit

The audit itself is the auditor's job. What you own is everything around it. Local Law 144 sets three core obligations on the employer side:

1. Commission an annual independent bias audit of each AEDT in current use.
2. Post a public summary of the most recent audit results on your company website, along with the date the AEDT was first distributed for use.
3. Notify candidates and employees at least 10 business days before use, including how to request an alternative process or accommodation (Crowell & Moring LLP, 2023; Epstein Becker Green, 2023).

Miss any of these and the civil penalties are structured per violation, per day: up to $500 for a first violation (and each additional violation on that same day), then $500 to $1,500 for each subsequent violation (Office of the NY State Comptroller, 2025). That per-day structure is what turns a missed posting date into a compounding problem rather than a one-time fine.

None of this — the audit, the posting, the notice — is legal advice, and nothing here should be read as a determination of your specific compliance status. If you're unsure whether a tool you use meets the statutory definition of an AEDT, or whether your notice language satisfies the 10-business-day requirement, that's a question for DCWP directly or for counsel familiar with the ordinance. For a fuller walk-through of all three obligations in one place, see our Local Law 144 compliance guide and our breakdown of the specific bias audit requirements.

How to Read a Bias Audit Summary Without Getting Fooled

Not every summary that lands on your desk is complete, and not every "compliant" label means what it implies. Independent research has found real gaps in how these audits get published in practice. One academic study reviewing 391 employer disclosures found that only 18 had posted audit reports and only 13 had posted the required transparency notices (ACM FAccT, Wright & Muenster et al., 2024). A separate methodological review found that some published audits may under-report disparities because of missing demographic data, opaque aggregation choices, or metrics that don't reflect how the tool is actually deployed day to day (ACM FAccT, 2025).

None of that means every summary you receive is unreliable — it means the format alone isn't proof of substance. Read the underlying selection-rate table, not just the cover paragraph. Check whether the categories reported match the categories the law expects. Check the distribution date against your own vendor onboarding records. We go step by step through exactly what to check in how to read a bias audit summary, and if you're still asking whether any of this applies to your company at all, start with are bias audits required by law — it settles the applicability question before you spend time on the details.

Your First Action Item

If you take one thing from this article, take this: the next time a bias audit summary lands in your inbox, don't just file it — recalculate the impact ratio yourself before you post it. The Four-Fifths Rule & Impact-Ratio Reading Guide walks you through exactly how, with a built-in calculator so you're not doing the division by hand under deadline pressure.

Bias audits, notice timelines, and the penalty structure around them shift as enforcement matures and as pending state legislation moves through Albany. If you'd rather have plain-English updates land in your inbox instead of digging through comptroller reports and law firm bulletins yourself, subscribe to our newsletter — we track this so you don't have to.