Who must comply with NYC Local Law 144?

Any employer or employment agency using an automated employment decision tool (AEDT) to screen candidates for a job located in New York City, regardless of where the employer is headquartered. They must run an independent bias audit within the prior year, publish the summary, and notify candidates at least 10 business days in advance.

When do EU AI Act obligations apply to hiring systems?

AI systems used for recruitment and employee selection are high-risk under Annex III 4(a). High-risk obligations for hiring systems apply from August 2, 2026, covering risk management, data governance, human oversight, transparency, logging, and post-market monitoring.

An Automated Employment Decision Tool is any computational process derived from machine learning, statistics, or AI that produces a score, classification, or recommendation used to substantially assist or replace discretionary hiring or promotion decisions.

What are the penalties for NYC Local Law 144 non-compliance?

Fines start at $500 for a first violation and reach $1,500 for each subsequent violation. Each day of non-compliant use and each missed candidate notice counts as a separate violation.

AI Hiring Compliance Checklist: A Step-by-Step Guide to Getting Audit-Ready

Q: Can our AI vendor perform our bias audit?

No. NYC Local Law 144 requires an independent auditor with no role in building, selling, or using the tool and no financial interest in it. Vendors can supply data but cannot serve as the independent auditor.

Summary: Getting AI hiring tools compliant follows a repeatable sequence: inventory your stack, classify which tools are in scope, gather the right data, run an independent bias audit, publish the results, notify candidates, document your decisions, and set up ongoing monitoring. This checklist walks through each step in the order that avoids rework. Most companies can move from unclear to compliant in a matter of weeks when they follow the sequence rather than jumping to the audit first.

Key takeaways

Compliance is a sequence, and the order matters. Auditing before you inventory wastes money.
The two hardest steps are usually the tool inventory and securing an independent auditor.
Clean demographic data is the input that most affects audit quality, so improve it early.
Documentation of your reasoning protects you as much as the audit itself.
Compliance is a state you maintain, so end the project with a monitoring cadence, not a filed report.

Step 1: Inventory your entire hiring stack

List every tool that touches candidate evaluation, from sourcing and screening through assessment and interview scoring. Include tools that individual recruiters or teams adopted on their own, because shadow tools are a frequent source of hidden exposure. The goal is a complete map before you make any judgment about scope.

Watch for: browser extensions, trial tools still in use, and features bundled inside your applicant tracking system that quietly score or rank candidates.

Step 2: Classify what is in scope

For each tool, decide whether it meets the definition of an automated employment decision tool or a high-risk system. Ask whether it produces a score, ranking, or recommendation, and whether that output substantially assists or replaces a human decision about who advances. Document the reasoning for every tool, including the ones you rule out.

Watch for: the rubber-stamp trap. A tool a human approves is still substantially assisting the decision if the human relies on its output.

Step 3: Determine your role and jurisdictions

Establish, for each tool, whether you are a deployer using it or a provider building or customizing it, and which laws apply based on where your jobs are located and which markets you operate in. A New York City role brings Local Law 144. EU market activity brings the EU AI Act. Both can apply at once.

Watch for: roles you did not think of as local. Remote positions tied to a New York City office can pull you into scope.

Step 4: Assess and improve your data

Check whether you have the demographic data an audit needs, broken down by sex, race and ethnicity, and intersections. If self-identification rates are low, improve them through voluntary, clearly explained self-identification before you audit. The completeness of this data is the single biggest driver of audit quality.

Watch for: relying on vendor test data when you could gather real historical data. Real data produces a stronger, more defensible result.

Step 5: Commission an independent bias audit

Engage an auditor with no role in building, selling, or using the tool and no financial interest in it. The audit will calculate selection rates and impact ratios across the required groups and flag any ratio that falls below the 0.8 benchmark.

Watch for: letting the vendor run the audit. That breaks the independence requirement and invalidates the result.

Step 6: Remediate what the audit reveals

Where the audit flags a disparity, investigate the cause. Sometimes the fix is in how the tool is configured, sometimes in how the role is defined, sometimes in the data feeding the model. A disparity that is not job-related and consistent with business necessity should be mitigated, not just disclosed.

Watch for: treating the audit as purely defensive. The most valuable audits produce a remediation plan, not just a number.

Step 7: Publish the audit summary

Post a summary of the most recent audit, along with the date the tool was first used, in a place candidates can actually find on your hiring or careers page. Transparency is the point, so do not bury it.

Watch for: publishing in a legal appendix no candidate will ever open. Reachability matters.

Step 8: Notify candidates

Build candidate notice into your application flow so it fires at least 10 business days before the tool is used. The notice must explain that an automated tool will be used, what it assesses, and how to request an alternative process or accommodation.

Watch for: manual notices that get forgotten under hiring pressure. Automate the trigger so it never depends on someone remembering.

Step 9: Document everything

Keep a written record of your inventory, your classification reasoning, your audit, your remediation, your disclosures, and your notices. If a regulator or candidate ever questions a decision, contemporaneous documentation is your strongest defense.

Watch for: verbal decisions and undocumented judgment calls. If it is not written down, it is hard to defend.

Step 10: Set up ongoing monitoring

Compliance is not a one-time event. Bias audits renew annually. New tools enter the stack. Laws evolve. Put a recurring cadence in place: a calendar for annual audits, a gate that reviews new tools before adoption, and a periodic scan for regulatory changes.

Watch for: treating the finished project as done. Without a monitoring cadence, you drift back out of compliance within a year.

The sequence at a glance

Inventory the stack
Classify what is in scope
Determine role and jurisdictions
Assess and improve data
Commission an independent audit
Remediate findings
Publish the summary
Notify candidates
Document everything
Set up ongoing monitoring

Frequently asked questions

How long does it take to get compliant? Many companies move from unclear to compliant in a few weeks, with the bias audit itself being the longest single step. Following the sequence prevents the rework that stretches timelines.

What is the most common mistake? Skipping straight to the audit before completing the inventory and classification, which often means auditing the wrong tools or missing in-scope ones.

Do we really need to document tools we rule out? Yes. A documented rationale for out-of-scope tools is your defense if the classification is ever challenged.

Can we do this ourselves? The steps are learnable, but the independence requirement for the audit means at least that part must involve a qualified external party.

Following this sequence is what turns a stressful scramble into a straightforward project. If you want a compliance check that runs steps one through four for you and hands you a clear map of exactly what is in scope and what to do next, that is where a good engagement begins.