New York City Local Law 144 requires an independent bias audit of an automated employment decision tool before it is used to hire or promote in the city, results published, and candidates notified. Most of the compliance difficulty is not in the obligation. It is in the two words at the centre of it.
An audit run by the vendor who sells the tool is not an independent bias audit, and a certificate stating that a tool "has been tested for bias" is not a bias audit at all. Both are common, and both are what employers hand over when asked.
1. The tool is yours, and so is the obligation
The duty attaches to the employer or employment agency using the tool, not to the company that built it.
That is the first thing worth being clear about, because it inverts the assumption behind most procurement conversations. A vendor can help. A vendor can supply data. A vendor cannot discharge your obligation by having done something once, for everyone, in the abstract — the tool is being used on your applicant pool, and the pool is what the audit is about.
It also means the answer to "is our vendor compliant" is not the answer to "are we compliant".
2. What independence rules out
Independence is a structural property, not a statement of intent.
An auditor with a commercial interest in the result is not independent, and that reaches further than it first appears: the vendor, obviously; but also a party paid on the outcome, a party auditing a tool it helped design, and — the case employers most often miss — an internal team that reports to the function whose hiring numbers are being examined.
The test we apply is simple and worth applying to any auditor you are considering, us included: could this party have produced an unfavourable result without damaging its own position? If not, whatever the exercise produced, it is not an independent audit.
3. What the audit has to measure
The substance is a comparison of outcomes across groups, not an inspection of the model.
A defensible bias audit computes selection rates for the groups the law names and expresses them as ratios against the most-selected group — the same arithmetic employment discrimination analysis has used for decades. Nothing about it requires the model to be interpretable, and nothing about it is satisfied by a vendor's internal fairness metric chosen after the fact.
Three things separate an audit that holds up from one that does not:
- It uses your data. Historical outcomes from your own use of the tool, where they exist. Test-set results from the vendor describe a different population.
- The categories are the ones the law names, computed and published as required, including the intersections — not a subset chosen because the numbers were kinder there.
- The scope names the tool and the decision. "Our hiring process was audited" is not the claim the law asks for; a specific tool, used at a specific decision point, is.
Where a category has too few observations to say anything, the honest audit says so rather than reporting a ratio computed from four people. That sentence appearing in a report is a mark of quality, not a gap in it.
4. The parts employers forget
Two duties sit outside the audit itself and are the more common findings.
Publication. A summary of results has to be publicly available. An audit sitting in a shared drive satisfies the analysis and not the law.
Notice. Candidates have to be told the tool is being used, in advance. This is an operational change to a careers page and an application flow, and it is usually owned by nobody: legal commissions the audit, recruitment runs the funnel, and the notice falls between them.
5. What an engagement covers
The work against Local Law 144 is an audit — there is no certificate and no accrediting body, which is precisely why independence has to be structural.
It takes the tool, the decision point and the outcome data; computes the required rates and ratios; states where the data cannot support a conclusion; and returns a summary in the form the publication duty needs, alongside findings on the notice and record-keeping obligations. The scope and what we examine are set out on the Local Law 144 framework page.
Three questions worth asking
Who ran our last bias audit, and who paid them? If the answer to the second is the vendor, you do not have an independent audit.
Was it computed on our applicants or on the vendor's test set? These produce different numbers, and only one of them is about you.
Where is the summary published, and when did the notice last change? Both are checkable in a minute, and both are where enforcement starts.
Frequently asked questions
- What is a Local Law 144 bias audit?
- An independent examination of an automated employment decision tool used to hire or promote in New York City, comparing selection rates across the categories the law names and expressing them as ratios. A summary of the results must be published and candidates must be notified that the tool is in use.
- Can our vendor run our bias audit?
- No. The duty attaches to the employer using the tool, and an auditor with a commercial interest in the result is not independent. A vendor certificate stating that a tool was tested for bias is neither an audit of your use of it nor independent of the party selling it.
- Does a bias audit require access to the model?
- Generally not. The analysis compares outcomes across groups rather than inspecting the model, so it can be run on selection data without interpretability into how the tool reached its decisions. What it does require is data from your own use of the tool rather than the vendor's test set.
- What happens if a category has too few applicants to analyse?
- The audit should say so rather than report a ratio computed from a handful of people. A stated limit on what the data can support is a mark of a defensible audit; a confident number computed from four observations is the opposite.
