Who must comply with NYC Local Law 144?

Any employer or employment agency using an automated employment decision tool (AEDT) to screen candidates for a job located in New York City, regardless of where the employer is headquartered. They must run an independent bias audit within the prior year, publish the summary, and notify candidates at least 10 business days in advance.

When do EU AI Act obligations apply to hiring systems?

AI systems used for recruitment and employee selection are high-risk under Annex III 4(a). High-risk obligations for hiring systems apply from August 2, 2026, covering risk management, data governance, human oversight, transparency, logging, and post-market monitoring.

An Automated Employment Decision Tool is any computational process derived from machine learning, statistics, or AI that produces a score, classification, or recommendation used to substantially assist or replace discretionary hiring or promotion decisions.

What are the penalties for NYC Local Law 144 non-compliance?

Fines start at $500 for a first violation and reach $1,500 for each subsequent violation. Each day of non-compliant use and each missed candidate notice counts as a separate violation.

Can our AI vendor perform our bias audit?

No. NYC Local Law 144 requires an independent auditor with no role in building, selling, or using the tool and no financial interest in it. Vendors can supply data but cannot serve as the independent auditor.

The Real Cost of Non-Compliance in AI Hiring: Penalties, Litigation, and Reputation

Summary: Non-compliance with AI hiring laws costs far more than the headline fine. Under NYC Local Law 144, penalties run from $500 to $1,500 and are counted per day and per candidate, so a single tool used through a busy quarter can generate a large, compounding total. The EU AI Act adds a tiered penalty structure with much higher ceilings. Layered on top are discrimination litigation, remediation costs, deal and procurement friction, and reputational damage that outlasts any single fine.

Key takeaways

Local Law 144 penalties are counted per day of use, so exposure compounds rather than capping at a single fine.
The EU AI Act carries a tiered penalty structure with substantially higher ceilings for serious breaches.
The regulatory fine is often the smallest line item. Litigation, remediation, and lost deals cost more.
A public bias audit that shows disparity, or a candidate who was never notified, can seed a discrimination claim.
Reputational damage in a hiring context reaches the exact audience you are trying to recruit.

Why the fine is the smallest part

It is tempting to look at a penalty ceiling, decide it is affordable, and move on. That reading misses how these costs actually accumulate. The direct fine is one of several exposures, and usually not the largest. The full cost of non-compliance is the sum of penalties, litigation, remediation under pressure, commercial friction, and reputational harm. Each of these can dwarf the fine on its own.

Direct penalties under Local Law 144

Local Law 144 penalties start at $500 for a first violation and reach up to $1,500 for each subsequent violation. The decisive detail is the counting method. Each day you use a non-compliant tool is a separate violation, and a failure to provide the required candidate notice is counted separately as well.

Consider what that means in practice. A tool used continuously across a hiring quarter is not one violation. It is potentially one per day, plus separate counts for missing notices. The total is not a flat fee. It is a running meter. This is why companies that assume the fine is trivial are often surprised by the arithmetic once the days are tallied.

Penalty exposure under the EU AI Act

The EU AI Act uses a tiered penalty structure tied to the severity of the breach, with the most serious violations carrying ceilings expressed as a percentage of global annual turnover or a large fixed sum, whichever is higher. Even mid-tier breaches carry meaningful ceilings. For a company of any size, an EU AI Act penalty is not a rounding error, and the structure is deliberately designed so that large firms cannot treat non-compliance as a cost of doing business.

Litigation and discrimination claims

The regulatory fine sits alongside a second, often larger, exposure: private litigation. A published bias audit that reveals a disparate impact is, in effect, a documented record that a tool selected one group at a lower rate. A candidate who was never told an automated tool scored them has a concrete grievance. Either can become the foundation of a discrimination claim under employment law that exists independently of the AI-specific statutes.

The irony is worth naming. The very transparency the laws require can supply the evidence for a lawsuit if you disclose a disparity without remediating it. This is precisely why treating the audit as diagnostic, and fixing what it finds, matters so much. Disclosure without remediation converts a compliance obligation into a litigation exhibit.

Remediation under pressure

There is a large cost difference between fixing a problem on your own schedule and fixing it under a regulator's deadline or a plaintiff's discovery request. Planned remediation is a project. Emergency remediation is a crisis: rushed engineering, expensive external counsel, paused hiring, and decisions made under duress. Companies that defer compliance are not avoiding the cost. They are trading a manageable cost now for a larger, less controllable one later.

Commercial and procurement friction

Increasingly, enterprise buyers and public authorities ask about AI governance during procurement. A vendor that cannot demonstrate compliant hiring practices can lose deals, fail security and vendor reviews, or stall in legal review. For companies that sell into regulated industries or the public sector, a compliance gap is not just a legal risk. It is a sales obstacle that quietly removes you from consideration.

Reputational damage

The reputational cost of an AI hiring failure is unusual because it lands on the exact audience you are trying to attract. A public story about biased hiring software, or an enforcement action, reaches candidates, employees, and the talent market directly. In a competitive hiring environment, that damage suppresses your applicant pool at the moment you most need it. Unlike a fine, which is paid once, a reputational hit lingers in search results and candidate conversations for a long time.

The cost of compliance, by comparison

Set against all of this, the cost of getting compliant is modest and predictable. A structured compliance review, an independent audit, and a monitoring cadence are known quantities you can budget for. The comparison is not fine versus no fine. It is a small, planned, controllable cost now against a larger, unplanned, uncontrollable cost later, spread across penalties, lawsuits, lost deals, and reputation. Framed that way, compliance is the conservative financial choice, not the expensive one.

Frequently asked questions

How are Local Law 144 penalties calculated? Between $500 and $1,500 per violation, counted per day of non-compliant use and separately for failures to provide notice, so totals compound over time.

How large can EU AI Act fines be? The Act uses a tiered structure with high ceilings for serious breaches, expressed as a percentage of global turnover or a large fixed amount, whichever is higher.

Can compliance disclosures be used against us? A disclosed disparity that you do not remediate can support a discrimination claim. This is why remediation, not just disclosure, is essential.

Is the fine really the main cost? Rarely. Litigation, emergency remediation, lost deals, and reputational damage typically exceed the direct penalty.

Is compliance expensive? It is modest and predictable compared to the compounding, unpredictable cost of non-compliance. Compliance is the lower-risk financial choice.

The math on non-compliance rarely favors waiting. A planned, budgeted compliance program is almost always cheaper than the compounding exposure it prevents. If you want a clear read on where your current risk sits, a compliance check will give you that picture before it becomes a bill.