With first quarter closing and tax season approaching, many businesses are engaged in compliance audits. It’s the perfect time to consider how AI Governance should be implemented across your organization.
AI governance refers to the framework of policies, standards, and ethics that organizations implement to ensure artificial intelligence systems are safe, transparent, accountable, and fair. Sometimes, however, people argue that AI Governance is a big corporate concern that shouldn’t matter for small businesses. In our current regulatory environment, that’s just not true.
Want proof? Let’s consider NYC Local Law 144-21, a local AI Governance rule that influences business practices nationwide. It’s a perfect example of how many regulators around the country are beginning to legislate responsible use of AI by companies, regardless of their size. Never heard of it? Read on to see if your business might be out of compliance, and learn how you can get ready for compliance obligations as regulators continue to address AI.
What is New York City Local Law 144-21?
New York City Local Law 144-21, which took effect on July 5, 2023, imposes transparency requirements on the use of automated employment decision tools (AEDTs) by employers in New York City. The law requires employers to take specific steps if they use AI or other automated systems in hiring and promotion decisions. It mandates that employers conduct annual, independent bias audits of AI hiring tools, publicly post the results, and notify candidates 10 business days in advance when AI is used to evaluate them.
What are Automated Employment Decision Tools (AEDTs)?
Under Local Law 144-21, any tool using machine learning, statistics, or AI that substantially assists or replaces human decision-making for employment qualifies as an AEDT. Tools that perform seemingly benign tasks, such as screening resumes or ranking candidates, still qualify as AEDTs. Notably, employers must comply even if the tool comes from a third-party vendor rather than the employer itself.
Local Law 144-21 applies broadly to any qualifying tool, including:
- Vendor-provided AI hiring platforms
- Third-party applicant tracking systems with scoring/ranking
- External assessment or video interview tools
Who built the tool doesn’t matter. Employers are responsible for compliance, even if a third party developed the tool.
Who must comply with Local Law 144-21?
Employers are the primary party responsible for compliance with this regulation. Any employer using an AEDT in hiring or promotion decisions for jobs located in NYC or hiring candidates located in NYC must comply. This includes NYC-based companies, national companies where hiring or HR activities are based in NYC, and out-of-state companies hiring NYC candidates. Remember–the law is triggered by impact in NYC, not company location. Accordingly, even fully remote companies must comply if the role is tied to NYC or the candidate is located in NYC.
There is no minimum employer size or revenue requirement. All employers who fit this criteria must comply regardless of size, number of employees, or monetary resources.
Like employers, NYC-based employment agencies, staffing firms, recruiters, and other intermediaries must comply. These businesses are treated like employers when making or influencing employment decisions.
Key Requirements Employers Must Follow To Comply With NYC Local Law 144
Under NYC Local Law 144 (2021), employers and employment agencies that use automated employment decision tools (AEDTs) in hiring or promotion must ensure that:
- each tool used has undergone an independent bias audit within the past year before it is used,
- a summary of the audit results for each tool used in hiring is publicly available on the employer’s website,
- candidates and employees are given at least 10 business days of advance notice that such a tool will be used to evaluate the employment decision, including information about the job qualifications and characteristics the tool will assess, and that
- individuals are allowed to request an alternative selection process or accommodation where applicable.
Additionally, employers must disclose the types of data collected by the tool and their data retention policies upon request.
Mandatory bias audits
The bias audit requirement under NYC Local Law 144-21 applies before an employer or employment agency can use an AEDT. The tool must have undergone an independent bias audit within the past 12 months. This means the audit must be conducted by a party that is not involved in developing or using the tool and has no financial interest in the employer or tool vendor.
The purpose of the bias audit is to evaluate whether the tool produces disparate impact across protected groups, typically by analyzing selection or scoring rates by categories such as sex, race, and ethnicity. The audit must follow a quantitative methodology, often relying on metrics like selection rate ratios (e.g., the “four-fifths rule” or similar statistical comparisons), to identify whether certain groups are disproportionately disadvantaged by the tool’s outputs.
Employers must also ensure that a summary of the audit results is made publicly available, usually on their website, before the tool is used. This summary must include key details such as the date of the audit, the categories analyzed, the data used (including whether it is historical or test data), and the resulting impact ratios or findings. While the law does not prescribe a single audit methodology, it does require enough transparency and rigor to allow outside observers to understand how the tool performs across demographic groups.
Importantly, even if a third-party vendor conducts or supplies the audit, the employer remains responsible for confirming that the audit meets the law’s standards and is current. If the tool is materially modified or retrained in a way that could affect outcomes, a new audit may be required to maintain compliance. Vendor contracts are especially important in complying with this foundational portion of the law.
Candidate notice requirements
The candidate notice requirements under NYC Local Law 144 (2021) are meant to ensure transparency whenever an employer uses an AEDT. Accordingly, the notice itself must further that goal, both in timing, content, and accessibility.
- Regarding timing, employers must provide notice to candidates or employees at least 10 business days before the tool is used to assess them.
- Regarding content, the notice must clearly inform the individual that an automated tool will be used in connection with their evaluation and must describe, in a meaningful way, the job qualifications and characteristics that the tool will consider. This included what skills, experience, or other attributes being analyzed.
- Regarding accessibility, the notice can be delivered in various ways, such as through a job posting, email, or careers webpage. However the notice is delivered, it must be clear, accessible, and provided within the required timeframe so that candidates have a genuine opportunity to understand and respond before being evaluated by the AEDT.
- Additionally, the notice must inform candidates that they have the right to request an alternative selection process or a reasonable accommodation, if one is available, and provide instructions on how to make such a request.
In addition to the AEDT notice, the law also requires a related transparency disclosure. Employers must disclose information about the type of data collected by the tool, the source of that data, and the employer’s data retention policy. This information can be provided either in the AEDT use notice itself or within 30 days of a candidate’s written request.
Alternative selection processes
This requirement is intended to provide individuals with a meaningful way to avoid being evaluated by an AEDT, where appropriate. Employers must inform candidates, at least 10 business days in advance, that they may request an alternative method of assessment or a reasonable accommodation, and must provide clear instructions on how to make such a request. While the law does not require employers to offer a completely equivalent or identical process in every case, it is expected that a genuine alternative be available where feasible, particularly if the AEDT could disadvantage certain individuals, including those with disabilities.
In practice, an alternative selection process might include a human-led resume review, a structured interview, or another non-automated evaluation method. Employers are expected to engage in a good-faith process when such requests are made, similar in spirit to accommodation frameworks under laws like the Americans with Disabilities Act, especially where the request is tied to accessibility or fairness concerns. However, the law does not explicitly require employers to grant every request; rather, it requires that candidates be given a clear opportunity to opt out and that employers have a process in place to consider and respond to those requests in a reasonable and timely manner.
Importantly, employers should not treat the alternative pathway as purely theoretical. If requests are routinely denied or no workable alternative exists in practice, this could raise compliance concerns or undermine the law's transparency goals. As with other aspects of Local Law 144-21, even when a third-party vendor provides the AEDT, the employer is responsible for ensuring that an alternative option can be requested and appropriately handled.
Common Compliance Mistakes Employers Make
Assuming the AI vendor is responsible
Under Local Law 144-21, using an AI vendor does not shift liability away from the employer. Employers are responsible for acquiring the information they need to comply with the law from vendors. Accordingly, employers should require audit documentation from their vendors, carefully allocate responsibilities in contracts, and, to the extent possible, independently verify that the information provided by their vendors is sufficient to comply with Local Law 144-21.
Savvy readers will note that Local Law 144-21 reflects an AI Governance principle, called deployer responsibility, that regulators around the world are beginning to implement. A deployer is a party that uses an AI tool within a professional environment. More and more, it is deployers, not developers, who are targeted by AI Governance regulations. Employers must be prepared to take responsibility for their AI use practices, rather than assuming the tool creators will hold that liability.
Failing to publish bias audit results
When an employer or employment agency fails to publish the required bias audit summary under NYC Local Law 144-21, they can face civil penalties and enforcement action by the New York City Department of Consumer and Worker Protection (DCWP). The law treats the failure to publicly disclose audit results as a violation separate from other requirements, meaning an employer can be penalized even if an audit was conducted but not properly disclosed.
Penalties generally start at $500 for a first violation and can increase to $500–$1,500 per subsequent violation, and each day of noncompliance can be treated as a separate offense. This means that ongoing failure to post the audit summary — such as not making it accessible on a website before using the tool — can quickly lead to accumulating fines. In addition, using an AEDT without meeting the audit and disclosure requirements may expose the employer to multiple overlapping violations, such as failure to audit, failure to notify candidates, and failure to publish results.
Beyond monetary penalties, failing to publish audit results undermines one of the law’s central transparency goals and may increase litigation or reputational risk, particularly if the tool is later alleged to produce discriminatory outcomes. Regulators and advocacy groups may view the absence of a published audit as a red flag, especially given that public disclosure is intended to allow scrutiny of whether the tool has a disparate impact across protected groups.
In short, not publishing bias audit results is not a minor technical oversight. It is a core compliance failure that can lead to fines and heightened legal and reputational exposure.
Providing inadequate candidate notice
When employers provide inadequate candidate notice under NYC Local Law 144-21 — for example, by giving less than 10 business days’ notice, failing to explain how the automated tool works, or omitting information about alternatives — the consequences are primarily regulatory penalties that can scale quickly based on the number of affected candidates and days of noncompliance. Inadequate notice is treated as a direct violation of the law’s notice requirement, not just a technical defect. The rules require clear, timely disclosure that an automated employment decision tool will be used, along with the qualifications it will assess and instructions for requesting an alternative process. If any of these elements are missing or insufficient, regulators consider the notice requirement unmet.
From an enforcement standpoint, DCWP can impose civil penalties starting at $500 for a first violation and $500–$1,500 for subsequent violations. The the law defines violations in a way that significantly increases exposure in notice-related cases because:
- Each candidate who does not receive proper notice counts as a separate violation, and
- Each day the employer continues using the tool without a compliant notice is another violation.
This means that if an employer runs a hiring process with deficient notice, penalties can multiply rapidly across both individual candidates and time. Accordingly, inadequate notice, such as vague disclosures, late notice, or failure to offer an opt-out, can trigger $500–$1,500 per day per affected candidate penalties in practice.
Beyond monetary penalties, there are also secondary risks. Because Local Law 144 is closely tied to anti-discrimination concerns, failing to provide proper notice may undermine an employer’s ability to defend the fairness of its hiring process. While the law itself does not create a private right of action, noncompliance (including deficient notice) could support claims under broader laws, like Title VII or the NYC Human Rights Law, if the tool is alleged to have discriminatory effects.
Inadequate notice is not treated as a minor procedural issue. It is a standalone compliance failure that can lead to per-candidate, per-day fines, regulatory scrutiny, and increased legal risk if the underlying hiring tool is challenged.
Not maintaining proper documentation
While Local Law 144-21 doesn’t provide a specific documentation checklist, in practice, employers must maintain sufficient documentation to demonstrate compliance with each of the law’s core obligations. Thus, employers should retain documentation showing that a valid bias audit was completed within the required timeframe, including the full audit report, underlying data descriptions, such as whether historical or test data was used, and the auditor’s independence. They must also keep evidence that a public summary of the audit results was posted (such as website records or archived pages), along with documentation of when and how candidate notices were provided, including the content of those notices and proof they were delivered at least 10 business days in advance.
In addition, employers should maintain records of requests for alternative selection processes or accommodations and how those requests were handled. This also includes documentation describing the data collected by the tool and applicable retention policies, particularly if disclosures were made in response to candidate requests.
Although the statute and implementing rules focus more on substantive obligations than formal recordkeeping, enforcement by the DCWP is complaint-driven and investigative. This means that if an employer cannot produce documentation showing compliance, regulators will generally treat that as evidence that the employer failed to meet the underlying requirement. For example, if an employer cannot demonstrate that notice was provided or that a bias audit was completed and published, DCWP may issue violations on that basis.
In addition to the penalties already discussed, lack of documentation increases litigation and reputational risk, particularly if the employer is challenged on discriminatory outcomes, because they may be unable to prove that required safeguards — like audits and candidate transparency — were actually implemented. While Local Law 144-21 does not prescribe a rigid recordkeeping regime, failing to maintain records that establish compliance makes it difficult to defend against enforcement actions and can result in penalties equivalent to outright noncompliance.
What are the Risks of Non-compliance?
Noncompliance with NYC Local Law 144-21 exposes employers and employment agencies to a range of significant risks. Regulators at DCWP can impose civil penalties starting at $500 for a first violation and up to $1,500 for subsequent violations, with fines potentially assessed per day and per affected candidate, which can quickly escalate. Failing to conduct or publish bias audits, provide proper candidate notice, offer alternative selection processes, or maintain documentation is treated as a direct violation, and lack of records may be interpreted as evidence of noncompliance.
Beyond financial penalties, employers face reputational damage and heightened scrutiny, and deficient processes may strengthen legal challenges if the AEDT produces discriminatory outcomes, particularly under related laws like the NYC Human Rights Law. In practice, noncompliance is not merely technical; it can compound across multiple obligations and candidates, creating both substantial regulatory exposure and potential liability while undermining public trust in the fairness of the hiring process.
A Practical Compliance Checklist for Employers
- Identify all AI systems used in hiring and promotions
- Determine whether tools qualify as AEDTs
- Conduct required bias audits
- Update vendor agreements
- Implement candidate notice and alternative process request procedures
- Maintain required records
Preparing for the Future of AI Regulation in Employment
Local Law 144-21 isn’t an anomaly; it’s a bellwether. Increasingly, regular people and regulators alike are frustrated with ungoverned AI interfering with the outcomes of important decisions, and legislation to address that problem is being implemented around the world.
Illinois’ Artificial Intelligence Video Interview Act mandates clear disclosure and consent when AI is used in interview tools, and states such as Colorado and California are enacting or expanding AI laws with broader bias, transparency, and impact obligations tied to employment and other consequential decisions.
Internationally, the European Union Artificial Intelligence Act (AI Act) establishes a risk‑based framework that classifies hiring‑related AI systems as high‑risk and imposes extensive requirements on both providers and deployers, including formal conformity assessments, detailed documentation, human oversight, and proactive risk and bias mitigation measures for systems used in recruitment, selection, promotion, or performance evaluation. Non‑compliance under the AI Act can lead to significant fines tied to global turnover, reflecting its strong enforcement regime.
Ultimately, Local Law 144-21 illustrates how regulator expectations are changing around employers and AI. Around the world, regulators are increasingly likely to expect that employers know which tools they use, govern those tools to prevent bias, and behave transparently.
Contact Rudick Law Group to learn more about our AI Governance practice led by Victoria Cvitanovic.
Frequently Asked Questions about Local Law 144-21
What is an automated employment decision tool under NYC law?
Any tool using machine learning, statistics, or AI that substantially assists or replaces human decision-making for employment qualifies as an AEDT under the law. This includes tools that screen resumes or rank candidates, regardless of whether the tool was created by the employer or comes from a third party vendor.
Does Local Law 144-21 apply to remote positions?
Potentially. If the company doing the hiring is based in NYC, the hiring activity takes place in NYC, or if the individual is located in NYC. Even fully remote companies must comply if the role is tied to NYC or the candidate is located in NYC.
How often must employers conduct bias audits?
Employers must ensure that any automated employment decision tool (AEDT) used in hiring or promotion has undergone an independent bias audit within the past 12 months before it is used. This means that a bias audit must be renewed at least annually to remain valid.
What are the penalties for violating Local Law 144-21?
Violating NYC Local Law 144-21 can expose employers and employment agencies to civil penalties enforced by the New York City Department of Consumer and Worker Protection (DCWP). Penalties start at $500 for a first violation and can rise to $500–$1,500 for subsequent violations. Critically, the law allows for per-day and per-affected-candidate assessments, meaning that ongoing noncompliance or failures affecting multiple individuals can cause fines to escalate quickly. Beyond monetary fines, employers face reputational damage, regulatory scrutiny, and potential legal exposure, especially if the AEDT produces discriminatory outcomes.
.webp)
