Your vendor’s bias audit probably doesn’t cover you.
Local Law 144 puts the duty on the employer, not the tool. If an automated tool substantially assists a hiring or promotion decision for a job in New York City, you owe an independent bias audit every year, a published summary, and ten business days' notice to candidates — whatever your ATS vendor has already published.
The duty is yours. The tool is theirs.
This is the part most teams get wrong, and it is worth being blunt about.
The employer or employment agency
Local Law 144 places the obligation on whoever uses the tool to make the employment decision. Commissioning the audit, publishing the summary and its distribution date, and notifying candidates are all yours. None of them can be discharged by somebody else.
The people who built the tool
Carries no obligation of its own under this law. Many vendors commission a bias audit anyway and publish it, and those audits are often genuinely good work. The difficulty is not their quality — it is whose applicants they were run on.
When you can lean on their audit
You may rely on a bias audit conducted using other employers' historical data only if you contributed your own historical data to it, or you have never used the tool. If you have been running it on your own applicants and your data was not in that audit, it does not cover you.
The plain version: if you have been using the tool and your data was not in the audit, you do not have an audit. It is the most common finding we write up.
- Who it is for
- HR-tech vendors
- Staffing & recruitment
- In-house talent teams
- Legal & compliance
- ATS and assessment platforms
Three questions. Then you’ll know.
No email. No signup. A starting point, not a legal determination — but enough to tell you whether this is worth a proper look.
Your scope check
What Local Law 144 actually requires
Local Law 144 of 2021 took effect on 1 January 2023 and has been enforced by New York City’s Department of Consumer and Worker Protection since 5 July 2023. It applies where an automated employment decision tool is used to substantially assist or replace a discretionary decision about hiring or promotion for a job in the city, and it binds employers and employment agencies alike.
Three obligations follow: an annual bias audit by an independent auditor conducted within the preceding year, a published summary of the results together with the tool’s distribution date on the employment section of your website, and notice to candidates at least ten business days before the tool is used.
The trigger is the job, not your head office. A role located in New York City brings the tool into scope wherever you and your vendor happen to sit.
$500 for a first violation and for each additional violation on the same day, then $500 to $1,500 for each subsequent one. Every day a non-compliant tool is in use is a separate violation, and failing to give notice is its own violation on top — which is how a single oversight compounds into a real number.
Four moments, and not in the order you’d guess.
Each of these is a deadline measured against the day the tool is used — so they cannot be added up, and they cannot be run in parallel.
-
01
Audit
Less than 12 months before useThe audit has to have been conducted within one year of the day the tool is used. It is a rolling twelve months against a live date, not an annual-report exercise against your financial year.
-
02
Publish
Before useSummary of results and the tool's distribution date, on the employment or careers section of your site. Publicly available: not behind a login, and not supplied on request.
-
03
Notify
At least 10 business days before useBusiness days, not calendar days — roughly two calendar weeks once holidays land in it. This is the most commonly blown deadline on the list, because it runs in front of everything else.
-
04
Re-audit
Every year, from your audit dateThe clock runs from the date of the audit rather than from your financial year. Let it lapse and every subsequent day of use is a fresh violation.
The trap. Teams schedule the audit and forget that the notice period sits in front of first use. If you plan to go live on the 1st, the notice went out around the middle of the month before — and the audit was already done and published by then.
Every layer of your AI hiring stack
What pulls a tool into scope is not its category — it is whether the output substantially assists the decision. Each of these is in scope when it does.
CV and application screening
Ranking, scoring or filtering applicants ahead of human review — the most common AEDT and the one most often assumed to be out of scope.
Video and asynchronous interviews
Automated scoring of recorded answers, including any inference drawn from speech, language or expression.
Skills and psychometric assessments
Where a score materially shapes progression rather than merely informing a conversation.
Conversational screening agents
Chat and voice agents that qualify or disqualify candidates during the conversation itself.
Matching and sourcing engines
Systems that surface or suppress candidates in a recruiter's queue — suppression is a decision, even where no rejection is recorded.
Promotion and internal mobility tools
The half of the rule most often missed: Local Law 144 covers promotion decisions, not only hiring.
Every tool in the inventory, checked against the same list
What the rule says, what we ship
Ten obligations, and the artefact that discharges each one. Paired, so every claim on this page can be checked against the requirement beside it.
- Whose obligation it is Employer or employment agency — never the vendor
- A written determination of who carries the duty for each tool in the inventory, so a vendor's published audit is never mistaken for your own compliance.
- Reliance on another audit Only if you contributed your data, or never used the tool
- An assessment of whether you can lawfully rely on your vendor's existing audit — and, where you cannot, exactly what has to be re-run.
- Annual bias audit By an independent auditor, no more than one year before use
- A dated audit performed by an auditor with no role in building, selling or operating the tool, and no financial interest in the outcome.
- Selection rate For each category the rule names
- Selection rate for every sex and race/ethnicity category — and, where the tool scores rather than passes, scoring rate calculated the way the rule defines it: the share of a category scoring above the sample median.
- Impact ratio Each category against the most-selected category
- Impact ratio for each category, computed the way the rule defines it rather than by whichever fairness metric the tooling defaults to.
- EEO-1 Component 1 categories The category set is not ours to choose
- Sex and race/ethnicity taken from the EEO-1 Component 1 categories, so the output lines up with what your reporting already uses.
- Intersectional categories Sex crossed with race/ethnicity
- The full intersectional grid, which is where disparities that are invisible in either single axis usually appear.
- Small-category handling Categories under 2% of the data may be excluded
- Exclusions applied to the impact ratio only where the rule allows, with the count and the percentage of each excluded category stated — not merely noted as excluded.
- Unknown-category count People assessed but not classifiable
- The count of individuals assessed who fall into an unknown category, stated separately so the denominator is readable.
- Data source and method Where the numbers came from
- Source of the data, whether historical or test, the number of individuals assessed, and the date the audit was performed.
- Published summary On the employment section of your site
- A publication-ready summary of results plus the distribution date of the tool, formatted to drop into your careers page.
- Candidate notice At least ten business days before use
- Notice templates covering use of the tool, the qualifications and characteristics it assesses, how to request an alternative process or accommodation — and the type of data collected, its source and your retention policy.
Every line accounted for. Where the rule permits a choice — test data instead of historical, categories under 2% excluded from a ratio — the choice is stated in the report rather than made silently. An unexplained gap in the table is the first thing a reader will ask about, and the first thing that undermines the rest of it.
HR-tech AI, independently audited
From CV screening to conversational agents. We test, you sign off, you publish — and the audit is dated so next year’s clock is unambiguous.
Intake
Scope the tools and the data
We identify which of your tools meet the AEDT definition, agree the assessment window, and specify the historical or test data the calculations will run on.
Test
Run the required calculations
Selection or scoring rate and impact ratio for every category the rule names, including the intersectional ones, with the small-category exclusions recorded rather than silently dropped.
Review
You see it before anyone else
You get the findings and the method in draft. Factual corrections are welcome; the numbers are not negotiable, which is the part that makes the audit worth commissioning.
Publish
The summary and the notices
You receive the full report, a publication-ready summary for your careers site, and the candidate notice pack — with the distribution date the rule asks you to show beside it.
Included in every audit
One engagement covering the whole obligation. Splitting these across vendors is how the publication date slips.
AEDT inventory
Which of your tools are in scope, which are not, and the reasoning for each — the document you will want when someone disagrees.
The annual bias audit
The independent audit itself, with every calculation the rule requires and the method stated in full.
Disparate-impact testing
Impact ratios across every category and intersection, with the pattern behind the number explained rather than left as a table.
Notice templates
Candidate and employee notices drafted to the timing and content the rule sets out.
Publication-ready summary
The results summary and distribution date, written to be pasted onto your site without an editing pass.
Records retention pack
The working papers and inputs kept so that next year's audit starts from evidence rather than from memory.
Why employers choose iDharma as their LL 144 auditor
Genuinely independent
We do not build, resell or operate hiring tools, and we take no fee tied to the result. Independence is the one input you cannot buy back later.
Written to the rule
Every figure in the report maps to the requirement it discharges, so a reviewer can check it against the law rather than against our summary.
One engagement, end to end
Inventory, audit, summary and notices in a single scope. Splitting them across vendors is how the publication date slips.
Intersectional by default
The full sex-by-race grid is in the base scope, not an upsell — it is where the findings that matter usually are.
What you get
Concrete artefacts with names and formats, not a vague report. You should be able to tell before you buy exactly what lands.
Bias audit report
The full audit: method, data, every rate and ratio, and the findings written in plain language.
Statistical results
The underlying tables, so your own analysts can reproduce every figure in the report.
Publication-ready summary
The summary of results and distribution date, formatted for the employment section of your site.
Candidate notice pack
Notices covering use, qualifications assessed, and the route to an alternative process.
AEDT scope memo
What was in scope, what was not, and why — the record behind the inventory.
Remediation shortlist
Where the ratios point to a problem, what to look at first. Findings ranked by consequence, not by ease.
Vendor-audit assessment
Whether the bias audit your tool vendor has already published covers you, on the data-contribution test — and precisely what has to be re-run if it does not.
Frequently asked questions
Scope, timing, pricing and what actually gets published.
Our ATS vendor already published a bias audit. Are we covered?
Probably not, and this is the most common misconception about the law. You may rely on a bias audit conducted using other employers' historical data only if you contributed your own historical data to that audit, or you have never used the tool. If you have been running it on your applicants and your data was not in it, you do not have an audit for the purposes of Local Law 144 — however good theirs is.
What is Local Law 144, in one paragraph?
A New York City law, in force since 5 July 2023 and enforced by the Department of Consumer and Worker Protection. If you use an automated employment decision tool to substantially assist or replace a discretionary decision about hiring or promotion for a job in New York City, you must have an independent bias audit done within the preceding year, publish a summary of the results, and tell candidates in advance.
What counts as an AEDT?
A computational process that issues a simplified output — a score, a classification, a ranking — used to substantially assist or replace discretionary decision-making about employment. The test is what the output does to the decision, not what the vendor calls the product. A tool that merely surfaces information for a recruiter to weigh is usually out; a tool whose ranking determines who gets read is usually in.
Does it apply to us if we are not based in New York?
It can. The trigger is the job, not your head office: a role located in New York City, or a candidate for one, brings the tool into scope regardless of where you or your vendor sit.
Does it cover promotions as well as hiring?
Yes, and this is the half most often missed. Tools used for internal mobility, promotion shortlisting and succession scoring are in scope on the same terms as recruitment tools.
Are employment agencies covered as well as employers?
Yes. The obligations fall on employers and employment agencies alike where an automated employment decision tool is used for a role in the city. If you place candidates rather than hire them, the duty is still yours rather than your client's tool vendor's.
What makes an auditor independent?
Not being involved in using, developing or distributing the tool, not being an employee of the employer or the vendor, and having no direct financial interest in the outcome. We build no hiring tools and take no result-contingent fee, which is what lets us sign the report.
What exactly gets calculated?
Selection rate for each sex and race/ethnicity category in the EEO-1 Component 1 set, the same for each intersectional category, and an impact ratio for each against the most-selected category. Where the tool produces a score rather than a pass, scoring rate is used in place of selection rate.
What if we do not have enough historical data?
Test data may be used where historical data is insufficient, and the report must say so and explain why. It is a normal position to be in for a newly deployed tool — what is not acceptable is using test data without disclosing it.
What happens to categories with very few people in them?
Categories representing less than 2% of the data may be excluded from the impact ratio calculation. We apply that only where the rule allows it, and every exclusion is named in the report — an unexplained gap in the table is the first thing a reader will ask about.
How long does an audit take?
Typically two to four weeks from data hand-over for a single tool, longer where the inventory turns out to be bigger than expected — which it usually does. Scope is agreed with you before anything is charged.
What do we actually have to publish?
A summary of the audit results and the distribution date of the tool, on the employment or careers section of your website. It has to be publicly available — not behind a login and not on request. You get it formatted and ready to paste.
What has to be in the candidate notice, exactly?
Four things: that an automated employment decision tool will be used; the job qualifications and characteristics it assesses; how to request an alternative selection process or an accommodation; and the type of data collected for the tool, its source, and your data retention policy. That last group may sit on your website or be provided within thirty days of a written request. It is the element most notice templates in circulation leave out.
Ten business days — from when?
Before the tool is used on that candidate. Business days rather than calendar days, so roughly two calendar weeks once holidays fall inside it. The practical consequence is sequencing: the notice runs in front of first use, which means the audit has to be finished and the summary published before the notice can go out at all.
What are the penalties?
Civil penalties of $500 for a first violation and for each additional violation occurring on the same day, then between $500 and $1,500 for each subsequent violation. Each day a non-compliant tool is used is a separate violation, and failure to give the required notice is its own violation — which is how a single oversight compounds quickly.
How often does this repeat?
Annually. The audit must have been conducted within one year of the tool being used, so in practice the clock starts on your publication date rather than on your financial year. We schedule the re-audit against that date.
Request your bias audit
Tell us about your AEDTs and we come back with a scoping call within one business day.
What we need from you
Nothing you do not already have. Most of this comes out of your ATS in an afternoon, and we tell you exactly which extracts before you commit to anything.
- Which tools are used, and at which stage of the process
- Whether any of the roles are located in New York City
- Applicant-level outcomes for the period, with demographic fields
- Whether the tool scores candidates or passes them
- Your target publication date, if you have one
Scoped with you before you are charged. No payment until you approve the scope.
On this page
References are to New York City Local Law 144 of 2021 and the Department of Consumer and Worker Protection’s implementing rules. The law took effect 1 January 2023; enforcement began 5 July 2023.
This is general information about what the law requires. It is not legal advice, it does not create a professional relationship, and it should not be relied on for a decision that binds your organisation — engage qualified counsel for that. Where a scope question is genuinely arguable, our reports say so rather than pick the convenient answer.
Ready for your independent bias audit?
We run the audit, you publish the summary. The report, the statistics, the notices and the remediation shortlist land together.
This page is guidance on how we scope a bias audit, not legal advice. Where a scope question is genuinely arguable, we say so in writing rather than pick the convenient answer.
From Insights
Before you commission one
How to Prepare for an AI Audit: The Readiness Checklist
Six things to have ready before the engagement starts. Assembling them takes a fortnight off the clock — and tends to find the first two findings before an auditor does.
Read the notes
What Is an AI Audit? Scope, Standards, and What You Get
An independent review of what your AI actually does, measured against a named standard — not a certificate, and not a review of what the documentation says it does.
Read the notes
What an AI Governance Framework Actually Contains
Five working parts, not a policy document. What each one has to do, how to tell whether yours is real, and why a framework is not the same thing as compliance.
Read the guide