NYC Local Law 144 in 2026: What the Comptroller Audit Changed for Employers

Summary: The mechanics of Local Law 144 have not changed since 2023. The enforcement posture has. On 2 December 2025, the New York State Comptroller published an audit concluding that the Department of Consumer and Worker Protection had enforced the law ineffectively. DCWP concurred with most recommendations and committed to proactive rather than purely complaint-driven enforcement. Employers whose compliance file was built to survive an unlikely complaint now need one that survives an inspection.

What did the Comptroller actually find?

The audit covered DCWP's enforcement from July 2023 through June 2025. Its findings were specific rather than general.

The most consequential number concerns bias audit review quality. DCWP reviewed 32 employer and vendor bias audit disclosures and identified a single likely instance of non-compliance. The Comptroller's office reviewed the same 32 disclosures and identified at least 17 potential non-compliance issues.

That gap is the whole story. It is not evidence that employers were compliant. It is evidence that the regulator was not looking closely. The audit also found that DCWP did not use its own Enforcement Workbook when evaluating whether tools qualified as AEDTs, and did not consult the city's Office of Technology and Innovation despite lacking in-house technical expertise to make those determinations.

Complaint intake was the third failure. The audit found inconsistent intake processes, incomplete documentation, unresolved complaints, and gaps in how 311 calls were routed to DCWP.

Why this changes the risk calculation

Between 2023 and 2025, the practical risk of an LL144 violation was low because the enforcement mechanism was passive. Complaints were rare, poorly routed, and reviewed by staff without the technical background to assess them.

A regulator that has just had its enforcement record publicly graded ineffective has strong institutional incentive to demonstrate otherwise. DCWP has committed to better complaint routing, cross-training staff on AEDT review, drawing on the Office of Technology and Innovation's technical resources, and identifying potential non-compliance through research and leads rather than waiting for complaints.

Employment counsel have read this consistently. Firms tracking the law have advised clients to expect more frequent investigations and higher cumulative penalties through 2026.

The practical shift for employers is this. The question is no longer whether a bias audit exists. It is whether the audit, the notice practice, and the underlying tool inventory would survive a reviewer who is finally using the workbook and consulting the technical experts.

What Local Law 144 requires

Three obligations, unchanged since the law took effect on 1 January 2023 with enforcement deferred to 5 July 2023.

An annual independent bias audit. The audit must have been conducted no more than one year before the tool is used. It must be performed by an auditor with no involvement in using, developing, or distributing the tool, and no employment or financial relationship with the employer that would compromise independence. DCWP maintains no approved list, so auditor selection is the employer's responsibility and the employer's exposure.

Public posting of the audit summary. The summary must be available on the employer's website. Not on request, not in a portal, and not on the vendor's site.

Candidate notice. Candidates must be told that an AEDT will be used, how it will be used, and what data will be collected. Notice must come before use, and the law requires ten days' advance notice.

Penalties run from $500 to $1,500 per violation, and each day a violation continues counts as a separate violation. That per-day structure is what turns a documentation gap into a material number.

The scope question most employers get wrong

Local Law 144 applies based on where the candidate is located, not where the employer is headquartered or where the role is performed.

An Austin company hiring for a fully remote role, screening a candidate who lives in Brooklyn, is within scope for that candidate's evaluation. A London company with no US office, running a US remote search, is within scope for any candidate in the five boroughs.

This is the single most common misreading, and it is the one the new enforcement posture is most likely to surface, because a proactive regulator looking for leads will start with job postings rather than complaints.

Where the exposure usually hides

In practice, most organisations discover their real exposure is not the flagship applicant tracking system. It is a scoring or ranking feature buried inside a platform nobody flagged as an AEDT: a recruitment marketing tool, an assessment provider, a sourcing product with a match score, a resume parser that ranks rather than sorts.

The definition in DCWP's final rule is broad. An AEDT is a computational process derived from machine learning, statistical modelling, data analytics, or artificial intelligence that issues a simplified output such as a score, classification, or recommendation, used to substantially assist or replace discretionary decision-making.

"Substantially assist" is doing significant work in that sentence. A tool that produces a ranked list a recruiter then works down is a much harder case to argue out of scope than most employers assume.

What to do this quarter

1. Inventory every tool that scores, ranks, or classifies candidates. Include features inside platforms, not just standalone products. This is the step that surfaces the exposure.
2. Check the date on every bias audit. The requirement is annual and the clock runs from the audit, not from the calendar year.
3. Verify auditor independence in writing. If the auditor has a commercial relationship with the tool vendor, the audit may not satisfy the requirement even if it was competently done.
4. Find your posted audit summary and read it as a regulator would. Is it on your site, current, and legible to someone outside the company?
5. Confirm notice actually reaches candidates ten days out. A notice buried in terms and conditions is a common finding.

Frequently asked questions

Does Local Law 144 apply if we are not based in New York City? Yes, if the candidate or employee is located in New York City at the time of the screening. Employer location is not the test.

Does our vendor's compliance cover us? No. The law places obligations on employers and employment agencies, not on vendors. A vendor bias audit may be usable evidence, but the legal obligation to conduct, post, and notice remains with the employer. Vendor cooperation depends entirely on your contract.

Is one bias audit enough for multiple tools? No. The requirement attaches to the tool. Multiple AEDTs mean multiple audits, each within the preceding year.

What does the candidate opt-out require? Candidates may request an alternative selection process. The law does not prescribe its form, but it must be a reasonable alternative genuinely available, not a paper option that is never used. The opt-out instruction must be published alongside the audit summary.

Have the penalties increased? The statutory range has not changed. What has changed is the likelihood of accrual, because per-day counting compounds quickly once a violation is identified rather than self-corrected.