Who must comply with NYC Local Law 144?

Any employer or employment agency using an automated employment decision tool (AEDT) to screen candidates for a job located in New York City, regardless of where the employer is headquartered. They must run an independent bias audit within the prior year, publish the summary, and notify candidates at least 10 business days in advance.

When do EU AI Act obligations apply to hiring systems?

AI systems used for recruitment and employee selection are high-risk under Annex III 4(a). High-risk obligations for hiring systems apply from August 2, 2026, covering risk management, data governance, human oversight, transparency, logging, and post-market monitoring.

An Automated Employment Decision Tool is any computational process derived from machine learning, statistics, or AI that produces a score, classification, or recommendation used to substantially assist or replace discretionary hiring or promotion decisions.

What are the penalties for NYC Local Law 144 non-compliance?

Fines start at $500 for a first violation and reach $1,500 for each subsequent violation. Each day of non-compliant use and each missed candidate notice counts as a separate violation.

Can our AI vendor perform our bias audit?

No. NYC Local Law 144 requires an independent auditor with no role in building, selling, or using the tool and no financial interest in it. Vendors can supply data but cannot serve as the independent auditor.

Staying Compliant Year-Round: Building an Ongoing AI Hiring Governance Program

Summary: Compliance with AI hiring laws is a state you maintain, not a certificate you earn once. Bias audits renew every year. New tools enter the hiring stack. Regulations evolve. A one-time project that gets you compliant today will quietly leave you non-compliant within a year unless it is backed by an ongoing governance program. That program has a small number of moving parts: a living tool inventory, an audit calendar, a review gate for new tools, a regulatory watch, and clear ownership. Set up well, it runs quietly in the background and prevents the annual scramble.

Key takeaways

Compliance decays. Without maintenance, a company that is compliant today drifts out of compliance within a year.
Three forces cause drift: audits expiring, new tools entering the stack, and laws changing.
An ongoing program needs a living inventory, an audit calendar, a new-tool gate, a regulatory watch, and an owner.
Continuous monitoring turns compliance from a recurring crisis into a routine.
The cost of maintenance is far lower than the cost of repeatedly rebuilding compliance from scratch.

Why one-time compliance does not last

A common pattern plays out like this. A company runs a compliance project, completes its audits, publishes its summaries, sets up candidate notices, and declares victory. Twelve months later, the audits have expired, two new hiring tools have been adopted by different teams, and a regulatory update has changed a requirement no one was watching. The company is now out of compliance and does not know it.

This is not a failure of effort. It is the nature of the problem. Compliance is a moving target because the things it depends on move. Treating it as a fixed project guarantees drift. The only durable answer is a program that expects change and absorbs it.

The three forces that pull you out of compliance

Audits expire

Bias audits must be renewed every year. An audit completed in one hiring season is stale by the next. Without a calendar that triggers renewal, the audit lapses silently, and a lapsed audit means the tool is being used non-compliantly from that point forward.

New tools enter the stack

Hiring stacks are not static. Teams adopt new sourcing tools, trial new assessment platforms, and turn on new features inside existing systems. Each addition can bring a new in-scope tool that was never audited, disclosed, or covered by candidate notice. The stack you audited is not the stack you are running six months later.

Laws change

AI hiring regulation is evolving quickly. New jurisdictions are passing rules, existing rules are being interpreted and refined, and deadlines shift. A requirement you met last year may have changed, and a new obligation may now apply to markets you already operate in. Without someone watching, these changes arrive as surprises.

The parts of an ongoing governance program

An effective program is not elaborate. It has five components that work together.

A living tool inventory

Maintain a current list of every tool in your hiring stack, updated whenever tools are added or changed. This is the foundation. You cannot govern what you have not catalogued, and the inventory is the first thing to go stale if no one owns it.

An audit calendar

Track the audit date and expiry for every in-scope tool, with reminders that trigger renewal well before the deadline, not on it. Building in lead time matters, because commissioning an independent audit takes weeks, and a reminder that fires the day an audit expires is already too late.

A review gate for new tools

Put a simple checkpoint in the path to adopting any new hiring tool. Before a tool goes live, it is classified for scope, and if it is in scope, it is audited, disclosed, and wired into candidate notice before use. This gate is what prevents new tools from becoming silent compliance gaps.

A regulatory watch

Assign responsibility for tracking changes in the jurisdictions you operate in. This does not require a legal department. It requires a defined owner, a short list of sources, and a periodic review so that changes are caught while there is still time to respond.

Clear ownership

Every part of the program needs a named owner. Compliance that is everyone's responsibility is no one's. A single accountable owner, supported by the calendar and the gate, is what keeps the program alive between audits.

What continuous monitoring changes

The shift from project to program changes the experience of compliance entirely. In the project model, compliance is a periodic crisis: a scramble every time an audit comes due or a new law lands. In the program model, compliance is a routine: audits renew on schedule, new tools pass through the gate, and regulatory changes are caught early. The work is spread out, predictable, and small at any given moment, rather than concentrated into recurring emergencies.

This is also where compliance stops being purely defensive. A company running a mature governance program can answer procurement questions confidently, reassure enterprise buyers, and demonstrate to candidates that its hiring is fair by design. The program becomes an asset, not just a shield.

The economics of maintenance

Maintaining compliance is far cheaper than rebuilding it. A company that lets compliance lapse pays twice: once to rebuild the program from scratch, and again in the elevated risk it carried while non-compliant. A modest annual maintenance investment, an audit calendar, a new-tool gate, a regulatory watch, and an owner, avoids both. Framed against the compounding, per-day exposure of non-compliance, ongoing governance is one of the highest-return, lowest-drama investments a hiring organization can make.

Frequently asked questions

Why does compliance not last once we have done it? Because audits expire annually, new tools enter the stack, and laws change. Any of these can move you out of compliance without a warning.

How far ahead should we schedule audit renewals? Well before expiry. An independent audit takes weeks to commission and complete, so a reminder that fires on the expiry date is too late.

What stops a new tool from becoming a gap? A review gate that classifies every new tool for scope before it goes live, and audits and discloses it if it is in scope.

Do we need a legal team for the regulatory watch? No. You need a named owner, a defined set of sources, and a periodic review, so changes are caught in time to act on them.

Is ongoing governance expensive? It is modest, especially compared to rebuilding compliance from scratch and carrying elevated risk in the meantime.

The companies that stay out of trouble are not the ones that audit hardest once. They are the ones that build a quiet program that keeps them compliant year after year. If you would rather not manage that program yourself, staying compliant on an ongoing basis is exactly what an annual coverage plan is designed to do.