Using AI to Hire? You're Likely Breaking Law 144

New York City's AI hiring bias law has been enforceable since July 2023 — long enough that most compliance guides treat it as settled. Then, in December 2025, the New York State Comptroller audited the agency responsible for enforcing it and found the system "ineffective." The Comptroller's own team reviewed 32 companies and found 17 instances of potential non-compliance; the enforcing agency's review of the same companies had found just one. If you've been treating Local Law 144 as a checkbox you cleared years ago, 2026 is the year that stops working.

Who Is Actually in Scope

Local Law 144 applies to any employer or employment agency using an AEDT to evaluate a candidate or employee who resides in New York City — regardless of where the employer is headquartered or where the role itself is performed. A remote-first company based anywhere in the US hiring for a fully remote role is squarely in scope for any applicant who happens to live in one of the five boroughs. An AEDT is defined broadly: any computational process derived from machine learning, statistical modeling, data analytics, or AI that issues a score, classification, or recommendation used to substantially assist or replace discretionary employment decision-making — resume screeners, video-interview analysis tools, chatbot assessments, and internal promotion-scoring systems are all captured.

The Three Core Obligations

• Independent bias audit, conducted annually. An independent third party — never the vendor, never the employer itself — must audit the AEDT within one year before its use. The auditor cannot have a financial interest in the tool being audited.
• Public disclosure of results. Employers must publish a summary on their website: audit date, distribution date, data source description, and results, kept publicly available for at least six months.
• Candidate notice, at least 10 business days in advance. Candidates must be told an AEDT will be used, what it evaluates, what data it collects, and how to request an alternative selection process or accommodation.

How the Bias Audit Math Actually Works

The audit calculates a selection rate (or scoring rate, for tools with continuous outputs) for each demographic category — race/ethnicity, sex, and their intersections, like Asian women or Black men — then compares those rates using an impact ratio: the ratio between a given group's rate and the rate of the highest-scoring group. If men are selected at 60% and women at 40%, the impact ratio for women is 40 ÷ 60 = 0.67. Under the EEOC's long-standing four-fifths rule, an impact ratio below 80% (0.80) is a signal of potential adverse impact against that group — a threshold borrowed directly from federal employment discrimination law rather than invented specifically for this statute. Categories representing less than 2% of the audited data can be excluded from the required calculations.

The December 2025 Audit That Changed Everything

The Comptroller's audit, covering DCWP's enforcement activity from July 2023 through June 2025, concluded the agency's compliance system was fundamentally passive: it relied almost entirely on complaints, but received only two AEDT complaints during the entire audit period, and its own complaint-intake process wasn't reliably routing reports to the right team. When the Comptroller's staff independently reviewed 32 companies' websites and published audits, they found 17 instances of potential non-compliance — DCWP's own prior review of the same companies had identified just one.

In response, DCWP has committed to more rigorous investigations, cross-trained staff, and a shift toward proactive rather than purely complaint-driven enforcement. Multiple major employment law firms, including DLA Piper, have specifically warned clients to expect a stricter enforcement phase through 2026, with more frequent investigations and higher cumulative penalties for employers who assumed low enforcement risk meant low compliance risk.

Four Mistakes That Keep Showing Up in Non-Compliant Audits

• "Our vendor handles compliance." Local Law 144 obligates the employer, not the vendor. A vendor-provided audit can satisfy the requirement, but the employer must independently verify it covers their exact tool configuration and publish it themselves — you can't outsource the legal obligation along with the audit work.
• "The audit showed no adverse impact, so we're done." A bias audit is a snapshot. Model drift, a changing applicant pool, or a vendor-side algorithm update can shift impact ratios within months — annual audits are the legal floor, not evidence of continuous compliance.
• Treating remote roles as out of scope because the company isn't NYC-based. The law follows the candidate's residence, not the employer's address or the job's location.
• Assuming a prior clean DCWP review means the audit is actually compliant. The Comptroller's findings suggest DCWP's historical reviews weren't rigorous enough to catch real gaps — a past pass doesn't guarantee your documentation would hold up under the stricter 2026 posture.

How Local Law 144 Fits the Broader US Patchwork

Local Law 144 was one of the first enforceable AI employment laws in the US, and other jurisdictions have built on its model rather than starting from scratch: Illinois's HB 3773 (effective January 2026) extends bias-prevention duties to AI in employment more broadly, enforced through the Illinois Department of Human Rights rather than a DCWP-style civil-fine structure. Colorado's SB 26-189 covers employment as one of its five consequential-decision domains under a disclosure-and-human-review model. Texas's TRAIGA takes a structurally different intent-based approach that doesn't map onto Local Law 144's audit-and-disclosure framework at all. The practical upshot for multi-state employers: the bias-audit infrastructure built for NYC compliance — demographic data collection, impact-ratio calculation, independent auditor engagement — is largely reusable across these other regimes, even where the legal triggers and enforcement mechanisms differ.

Penalty Exposure: How Fines Actually Accumulate

The headline penalty range — $500 to $1,500 per violation — understates the real exposure, because each day a non-compliant AEDT stays in use is counted as a separate violation. A single tool running unaudited for a quarter is not one $1,500 fine; it is potentially one fine per day it operated. The table below shows how a single non-compliant tool compounds under a worst-case daily-violation reading.

These figures are illustrative of the statutory structure, not a prediction of how DCWP exercises enforcement discretion — but they explain precisely why the December 2025 Comptroller findings matter. Under a passive, complaint-driven regime the daily-accrual mechanism was largely theoretical. Under the more proactive posture DCWP has committed to, it becomes the central financial risk for any employer who assumed low enforcement probability meant low exposure.

How Local Law 144 Compares to Other US AI Hiring Laws

Local Law 144 is the most operationally specific AI-hiring law in the US, but it is no longer the only one. For multi-state employers, the practical question is which obligations overlap and which are genuinely distinct. The comparison below maps the four regimes most likely to apply simultaneously.

The strategic upshot: the demographic-data pipeline, impact-ratio calculation, and independent-auditor relationship you build for Local Law 144 are largely reusable for Illinois and Colorado, even though the legal triggers differ. Texas is the outlier — its intent-based structure does not reward an audit-and-disclosure program the way the others do, so a NYC-tuned compliance stack maps onto three of these four regimes but not the fourth.

A Practical Compliance Checklist

• Inventory every tool that scores, ranks, or filters candidates — including features embedded inside a broader applicant tracking system that might not be marketed as "AI."
• Confirm your most recent audit actually covers your current tool configuration, not a prior version or a generic vendor-wide audit that doesn't match your specific deployment.
• Verify your public disclosure is live, current, and easy to find — not published once and forgotten as the tool or vendor changed.
• Confirm candidate notices are actually going out 10 business days ahead, not being skipped for expedited hiring processes.
• Treat this as an ongoing program, not an annual event — quarterly internal monitoring catches drift an annual audit alone will miss.

Frequently Asked Questions

Does NYC Local Law 144 apply if my company isn't based in New York?

Yes. The law applies based on where the candidate or employee resides, not where the employer is headquartered or where the role is performed — any NYC resident evaluated by an AEDT triggers coverage.

What are the penalties for Local Law 144 non-compliance?

Civil penalties range from $500 to $1,500 per violation, with each day a non-compliant tool remains in use counted as a separate violation — exposure can compound quickly.

Can a vendor's bias audit satisfy my compliance obligation?

It can, but only if it covers your exact tool configuration and you independently verify and publish it — the legal obligation stays with the employer, not the vendor.

Why is 2026 different from previous years for Local Law 144 compliance?

A December 2025 New York State Comptroller audit found DCWP's enforcement system ineffective, and the agency has since committed to more proactive, rigorous investigations — multiple law firms expect a meaningfully stricter enforcement posture through 2026.

Related reading: Colorado's SB 26-189 and its employment ADMT rules, Texas's intent-based TRAIGA framework, and a complete framework for third-party AI vendor risk.