PeopleNotResumesBook a Compliance Score
← Back to white papers

The Complete Guide to NYC Local Law 144 Compliance

Summary: If your company uses software to screen, score, rank, or shortlist candidates for a job located in New York City, you are almost certainly subject to Local Law 144. The law took effect on July 5, 2023, and applies regardless of where your company is headquartered. Compliance is achievable in a matter of weeks and usually surfaces improvements to your hiring worth making anyway.

Contents

  1. Executive summary
  2. What Local Law 144 is, and why it reached your business
  3. What counts as an automated employment decision tool
  4. The three obligations: audit, disclosure, notice
  5. Inside the bias audit
  6. Who is responsible: you or your vendor
  7. What non-compliance actually costs
  8. The path to compliance
  9. Staying compliant: ongoing governance
  10. How PeopleNotResumes helps

01 Executive summary

If your company uses software to screen, score, rank, or shortlist candidates for a job located in New York City, you are almost certainly subject to Local Law 144. Enforcement has been in effect since July 5, 2023. Penalties run $500 to $1,500 per violation, counted per day of use. Candidate notice must be given at least 10 business days in advance. An independent bias audit is required and must be renewed every year.

The law rests on a simple idea. Automated tools increasingly decide who advances in hiring, yet candidates rarely know a tool was involved and employers rarely know whether that tool treats groups of people differently. Local Law 144 closes that gap with testing and transparency rather than a ban. It asks three things of you: commission an independent bias audit of the tool each year, publish a summary of the results, and tell candidates before the tool is used on them.

The one thing to take away. Buying compliant-looking software does not make you compliant. The legal obligations attach to the employer using the tool, not the vendor selling it. In almost every case, meaningful responsibility stays with you.

02 What Local Law 144 is, and why it reached your business

Local Law 144 of 2021 is a New York City ordinance governing how employers use automated tools to make or heavily influence hiring and promotion decisions. It is enforced by the New York City Department of Consumer and Worker Protection, and active enforcement began on July 5, 2023.

The reach of the law surprises many companies. It applies to employers and employment agencies using a regulated tool to evaluate candidates for a position located in New York City. The trigger is the location of the job, not the location of the company. A firm headquartered in London, Austin, or anywhere else is fully in scope the moment it hires for a New York City role, and remote-friendly companies with even a small New York presence frequently discover they are covered.

Why the city acted. Hiring software has quietly become a gatekeeper. A tool can shape who gets seen, shortlisted, and advanced, often without the candidate ever knowing an algorithm was involved. When that tool has learned from biased history, it can reproduce and scale that bias faster than any single human reviewer could. Local Law 144 is the city's attempt to keep that power accountable through independent testing and candidate transparency, without prohibiting the technology outright.

03 What counts as an automated employment decision tool

The law regulates a specific category it calls an automated employment decision tool. Getting this classification right is the hinge on which your whole compliance question turns. Two tests decide it.

Test one: what the tool produces. The tool has to generate a simplified output, such as a score, a ranking, a classification, a match percentage, or a shortlist recommendation. Software that merely stores or displays information without reducing it to a judgment is less likely to meet this test.

Test two: how the output is used. The output has to substantially assist or replace a human decision about who advances. A tool still substantially assists a decision even when a person signs off, if that person is relying on the tool's output to decide. The law anticipated the rubber-stamp scenario, where a recruiter simply approves whatever the model surfaces. That is still substantial assistance.

Usually in scope: resume screeners that rank or score applicants, assessments that score candidates against a model, video interview tools that evaluate responses, matching engines that generate a shortlist.

Usually out of scope: spreadsheets a recruiter updates by hand, basic keyword filters that only show or hide records, scheduling and document-management tools, communication platforms.

A common blind spot. Your applicant tracking system is not automatically in scope, but it is not automatically out of scope either. Modern platforms bundle matching, ranking, and knockout scoring, and any of those features can bring the system in. Evaluate features, not products, and document your reasoning for every tool, including the ones you rule out.

04 The three obligations: audit, disclosure, notice

For every in-scope tool, the law asks three concrete things. None of them is exotic. The friction is usually in doing them in the right order and keeping them current.

  • Independent bias audit. An audit completed by an independent party within the prior year, measuring how the tool selects candidates across demographic groups. Renewed annually.
  • Public disclosure. A summary of the most recent audit, plus the date the tool was first used, published where candidates can actually find it on your hiring page.
  • Candidate notice. Notice to New York City candidates at least ten business days before the tool is used, explaining what it assesses and how to request an alternative process or accommodation.

The word that carries the most weight here is independent. The auditor cannot be someone who built, sold, or used the tool, and cannot have a financial interest in it. This trips up more companies than any other part of the law, because the most convenient source of audit data is usually the vendor, and the vendor is precisely the party who cannot serve as your independent auditor.

Practical tip. Automate the candidate notice inside your application flow so it fires on time without depending on anyone remembering. Manual notices are the first thing to slip under hiring pressure, and a missed notice is counted as a separate violation.

05 Inside the bias audit

A bias audit does not open up the model and inspect its logic. It measures outcomes. Specifically, it asks how often the tool advances candidates from each demographic group, and whether any group is advanced at a meaningfully lower rate than the group that fares best.

Selection rate and impact ratio. The selection rate for a group is the share of people in that group who receive a favorable outcome. The impact ratio compares one group's selection rate to that of the most-selected group. The widely used benchmark is the four-fifths rule: an impact ratio below 0.8 signals that a group may be selected at a substantially lower rate than another. It is not an automatic verdict of illegality, but it is a flag that warrants investigation and, often, remediation.

The audit must cover sex categories, race and ethnicity categories, and the intersections of the two. Intersectional analysis matters because a tool can look balanced on sex alone and on race alone while still disadvantaging a particular combined group. Averages hide this. Intersectional breakdowns reveal it.

The data that makes or breaks it. The audit runs on your historical selection data broken down by group. The common obstacle is missing demographic data, because many candidates decline to self-identify. When that data is thin, auditors can use developer test data or statistical estimation, but both are weaker than clean historical data. The single most useful thing you can do before an audit is improve the completeness of voluntary self-identification.

06 Who is responsible: you or your vendor

The most expensive assumption in this area is a natural one: we bought the software, so the software company handles the legal side. It is, in almost every case, wrong. The law attaches its obligations to the party using the tool to make hiring decisions, and that party is you.

This has a sharp consequence for the audit. Because the auditor must be independent, the vendor is actually disqualified from being your independent auditor. A vendor can supply the underlying data, but you must engage a separate party to run and sign the analysis, publish the result, and notify candidates.

Before you sign. Make the split explicit in your vendor contracts: the vendor supplies the data and documentation you need and cooperates with your independent auditor, while you retain the obligations the law assigns to you. Negotiating this before signing is far easier than extracting it under a deadline.

If you also hire in the European Union, note that the EU AI Act splits responsibility differently, between the provider that builds a tool and the deployer that uses it, and heavily customizing or rebranding a tool can move you into the heavier provider role.

07 What non-compliance actually costs

The penalties compound. Penalties run from $500 for a first violation to $1,500 for each subsequent one. The decisive detail is the counting method. Each day you use a non-compliant tool is a separate violation, and a failure to provide the required notice is counted separately as well. A tool used continuously across a hiring quarter is not one violation. It is a running meter.

The larger costs sit behind the fine.

  • Litigation. A published audit that reveals a disparity is a documented record that a tool selected one group at a lower rate. Disclosed without remediation, it can become the foundation of a discrimination claim.
  • Emergency remediation. Fixing a problem under a regulator's deadline costs far more than fixing it on your own schedule.
  • Lost deals. Enterprise buyers and public authorities increasingly ask about AI governance in procurement. A gap can quietly remove you from consideration.
  • Reputation. An AI hiring failure lands on the exact audience you are trying to recruit, and it lingers in search results long after any fine is paid.

08 The path to compliance

Compliance follows a repeatable sequence, and the order matters. Most companies move from unclear to compliant in a few weeks by following the steps in order.

  1. Inventory the stack. List every tool that touches candidate evaluation, including ones individual teams adopted on their own.
  2. Classify what is in scope. Apply the two tests to each tool and document your reasoning.
  3. Assess and improve your data. Check whether you have the demographic data an audit needs, and lift voluntary self-identification before you audit.
  4. Commission an independent audit. Engage an auditor with no stake in the tool.
  5. Remediate what it reveals. Investigate any flagged disparity and fix the cause, rather than only disclosing it.
  6. Publish the summary. Post the most recent audit summary and the tool's first-use date where candidates can find it.
  7. Notify candidates. Build the ten-business-day notice into your application flow so it fires automatically.
  8. Document everything and set a renewal. Keep a written record and put the annual audit on the calendar so it never lapses.

09 Staying compliant: ongoing governance

Compliance is a state you maintain, not a certificate you earn once. A project that gets you compliant today will quietly leave you non-compliant within a year, for three predictable reasons: audits expire annually, new tools enter the stack, and the law continues to evolve.

An effective program is not elaborate. It keeps a living inventory of your hiring tools, an audit calendar that triggers renewals with real lead time, a simple review gate that classifies any new tool before it goes live, a defined owner watching for regulatory change, and clear accountability so the work never falls between roles.

10 How PeopleNotResumes helps

We help companies get compliant and improve their hiring system along the way. Our work is grounded in behavioural science, which matters here because a hiring system is a chain of human and machine decisions, and fixing bias durably means addressing both. We meet you wherever you are on the path above, from a first Compliance Score to full ongoing coverage and independent bias audits.

Appendix: one-page compliance checklist

  • Every candidate-evaluation tool inventoried, including team-adopted and trial tools
  • Each tool classified in or out of scope, with written reasoning on file
  • Demographic data reviewed and voluntary self-identification improved where thin
  • Independent bias audit completed within the last twelve months for every in-scope tool
  • Flagged disparities investigated and remediated, not just disclosed
  • Audit summary and first-use date published where candidates can find them
  • Ten-business-day candidate notice wired into the application flow
  • Named owner, audit calendar, and new-tool review gate in place

Frequently asked questions

Does Local Law 144 apply to companies outside New York? Yes, if the job is located in New York City. The law follows the position, not the employer's headquarters.

Can our software vendor run our bias audit? No. The auditor must be independent, so the vendor is disqualified. It can provide data, but a separate party must run and sign the audit.

How often do we need a bias audit? Every year. The most recent audit must fall within the prior twelve months for as long as the tool is in use.

If a human makes the final call, is the tool still regulated? Often yes. If the human is relying on the tool's score, ranking, or recommendation, the tool is substantially assisting the decision.

This guide is a companion to a live compliance program. If you would like a clear picture of where your organization stands today, a Compliance Score is the fastest way to find out.