NYC’s bias-audit law is under-enforced. That is not the same as safe.

New York City was first. Local Law 144 — in force since July 5, 2023 — made NYC the first jurisdiction in the country to force employers to independently audit their hiring AI for bias. It is also, by the city’s own admission, barely enforced. Both things are true at once, and the gap between them is exactly where the risk hides.

What the law requires

If you use an automated employment decision tool (AEDT) to substantially assist a hiring or promotion decision for a role located in New York City, three duties attach. You must commission an independent bias audit within one year before you use the tool. You must publish a summary of that audit — and the date of the most recent one — on your website. And you must give candidates notice at least ten business days before the tool is used, telling them the job qualifications and characteristics the AEDT assesses and, on request, the data it collects and how long it is kept.

The audit is the heart of it. It has to measure selection or scoring rates across sex, race/ethnicity, and their intersections, and it has to be done by an independent auditor — not the vendor grading its own homework. The published summary is what turns a private test into a public commitment.

What counts as an AEDT

The definition reaches tools that use machine learning, statistical modeling, or similar techniques to score, rank, or filter candidates and substantially assist a hiring decision. In practice that is resume screeners, candidate-ranking engines, and video-interview analyzers. Vendors have leaned hard on the “substantially assists” language to argue their tool is merely one input among many — but that argument is fact-specific and fragile, and it is your exposure, not the vendor’s, if it fails. The reliable move is to inventory every tool that touches candidate selection and decide applicability tool by tool, rather than accepting a blanket “we’re out of scope.”

The enforcement reality

Local Law 144 is enforced by the NYC Department of Consumer and Worker Protection (DCWP), with civil penalties of $500 to $1,500 per violation, per day. But a December 2, 2025 audit by the city Comptroller found that enforcement has been thin to the point of ineffective: only two AEDT complaints reached DCWP across two years, the intake process wasn’t reliably routing complaints, and when independent reviewers looked at the same set of employers, they flagged at least 17 instances of potential non-compliance where DCWP had found one. The city’s own watchdog concluded the agency lacked the technical expertise and the procedures to enforce its own law.

Why thin enforcement is a trap, not a reprieve

It is tempting to read “barely enforced” as “safe to ignore.” It isn’t, for four reasons. First, the plaintiffs’ bar uses a missing or unfavorable published audit as ready-made evidence in discrimination suits — the disclosure you skipped becomes the exhibit against you. Second, your AEDT vendor’s contract very likely represents that the tool supports LL 144 compliance, which pushes the operational duty — and the liability — onto you as the employer. Third, the same tools are reached by laws with real teeth and private rights of action: New Jersey’s disparate-impact rules, Illinois’s civil-rights amendment, California’s FEHA ADS regulations. Fourth, enforcement posture is a political variable — a new city administration can switch it on overnight, and the audit you didn’t do is retroactively conspicuous. Against all that, an independent bias audit is inexpensive insurance.

The through-line

Local Law 144 is the origin of the audit-and-notice model that now echoes across the country. Build one clean program — an inventory of your hiring AI, an independent bias audit, a published summary, and a candidate-notice workflow — and it ports directly to New Jersey, Illinois, and California with minor edits. Treat NYC as the first configuration of a portable capability, not a one-city errand.

New York City wrote the template the rest of the country is now copying. The fact that its own enforcer is behind doesn’t shrink your exposure — it just moves the risk from the regulator to the courtroom and the contract. The defensible position starts with knowing exactly which tools decide who you interview.

This briefing is general information from Sentinel Assurance Group, not legal advice. Regulatory dates and requirements change — we maintain these briefings, but verify against primary sources and counsel before acting. Last reviewed July 22, 2026.

See how a Gap Assessment maps your exposure →