NYC Local Law 144 Enforcement Is Ramping Up in 2026

New York City's AI hiring law just failed its own report card. A December 2025 audit from the state comptroller found that the city agency responsible for enforcing Local Law 144, the rule requiring bias audits on AI hiring tools, has been enforcing it badly. That finding is pushing 2026 into a different phase: more investigations, less patience, and real penalties for businesses that assumed nobody was checking.

If your business uses any tool that screens, ranks, or scores job candidates for a role connected to New York City, including a remote role a NYC resident could fill, this law already applies to you. Most companies in that position have no idea.

What Local Law 144 actually requires

Local Law 144 covers what the city calls an Automated Employment Decision Tool, or AEDT. The definition is broader than most people expect. A tool counts as an AEDT if it uses machine learning, statistical modeling, or AI to produce a score, ranking, classification, or recommendation, and that output substantially assists or replaces a human decision in hiring or promotion.

Three obligations follow from that. An independent bias audit, conducted within the 12 months before the tool is used and refreshed every year after, measuring impact across sex, race and ethnicity, and the intersection of both. A public summary of that audit, posted on the employer's own website, along with the date the tool went into use. And a notice to job candidates who are NYC residents, given at least 10 business days before the tool touches their application, with the right to ask for a non-AI alternative.

The law has been enforceable since July 5, 2023. It just hasn't been enforced with much rigor until now.

Why this is back in the news

The New York State Comptroller's audit, published in December 2025, reviewed how the NYC Department of Consumer and Worker Protection had handled Local Law 144 complaints and compliance checks between July 2023 and June 2025. The findings were rough. DCWP reviewed 32 companies' publicly posted bias audits and flagged exactly one compliance issue. The comptroller's own team reviewed the same 32 audits and found at least 17 potential problems DCWP had missed.

The agency had received only two AEDT complaints in two years. When investigators tested the city's 311 complaint line with 12 calls about the law, only 3 got routed correctly.

DCWP agreed to most of the comptroller's recommendations: better complaint routing, staff training, written enforcement procedures, and more proactive reviews instead of waiting for complaints to arrive. Employment lawyers tracking the case, including DLA Piper, are telling clients to expect a materially different enforcement posture through 2026. DCWP issued its first real penalties against employers using well known AI hiring platforms in the last quarter of 2025, and investigations are still active as of this year.

The tools that quietly put you in scope

The part that catches most businesses off guard is how many ordinary HR tools qualify as an AEDT without anyone flagging it. This isn't limited to obvious "AI hiring software." It shows up inside platforms that look like plain administrative tools.

Common examples: resume screening software that ranks candidates by predicted fit, candidate matching features built into applicant tracking systems, video interview platforms that analyze tone or word choice, personality or cognitive assessments scored by machine learning instead of a fixed formula, AI sourcing tools that recommend candidates, and automated scoring layered onto reference or background checks.

The applicant tracking system category is the one most often missed. Many modern ATS platforms ship with AI ranking or "candidate quality score" features turned on by default. A company that thinks of its ATS as a filing system, not a decision tool, can be running an AEDT without ever configuring one on purpose. It's the same blind spot we've written about with shadow AI tools showing up elsewhere in a business: nobody approved it, but it's running anyway.

On the other side, plain resume storage or outreach tools that don't score or rank anyone are not covered. The trigger is the scoring, not the software category.

What it costs to get it wrong

Penalties start at up to $500 for a first violation. Each subsequent violation runs $500 to $1,500. The detail that changes the math: every day a non-compliant AEDT stays in use counts as a separate violation. A tool running 30 days past its audit anniversary without a fresh one can rack up more than $45,000 in exposure before anything else about the tool is even evaluated.

New Jersey isn't watching from the sidelines

Two things matter for a New Jersey business here. First, Local Law 144 already reaches you if you're hiring for a role a New York City resident could fill, remote or not, regardless of where your office sits. Second, New Jersey's own legislature has multiple AI hiring bills moving right now. S3263, introduced in February 2026, would require notice and consent before using AI to analyze video interviews. S4279, introduced in May 2026, goes further and would require algorithmic impact assessments at least every two years for automated decision systems affecting protected classes. An earlier bill, A3854, would build something close to NYC's own bias audit model directly into New Jersey law.

None of these have passed yet. But the direction is consistent, and it matches what's already happened in Illinois, and what's scheduled to take effect in Colorado on January 1, 2027 and Connecticut on October 1, 2026. Businesses that wait for a law to be final before thinking about AI hiring governance tend to be behind by the time it is.

What to actually do about it

Start with an inventory. Walk through every tool touching recruiting, screening, interviewing, and promotion decisions, and ask a plain question about each one: does this rank, score, or classify people? If yes, it's a candidate for AEDT treatment regardless of what the vendor calls it.

For anything that qualifies, don't take a vendor's word that a bias audit already covers you. The comptroller's audit found that surface level compliance, an audit posted somewhere on a website, was frequently missing real substance underneath. Get specifics on when the audit ran, who ran it, and whether it matches your actual use of the tool. If your business hasn't put together an AI acceptable use policy yet, this is a reasonable forcing function to start one.

Then build the process pieces: the public audit summary, the candidate notice timing, and a calendar reminder well before the 12 month mark so a fresh audit isn't a scramble. It's the same gap we saw play out with SOC 2 readiness: the requirement is clear on paper, but nobody owns making sure it actually happens month to month.

This is the kind of risk that falls between HR, legal, and IT, because it touches all three and technically belongs to none of them. That's exactly where a managed IT partner with governance experience earns its keep: someone has to own the tool inventory, flag which platforms carry AI scoring features nobody asked for, and keep the audit calendar from slipping. A vendor selling you the hiring tool has no reason to point any of this out.

FAQ

What is an Automated Employment Decision Tool under NYC law?

An AEDT is any tool that uses machine learning, statistical modeling, or artificial intelligence to produce a score, ranking, classification, or recommendation that substantially assists or replaces a human decision about hiring or promotion. Basic resume storage or outreach tools that don't score candidates don't count.

Does Local Law 144 apply to a business based outside New York City?

Yes, if the role could be filled by a New York City resident, including a remote position. The location of the employer's office doesn't determine coverage. What matters is whether a NYC resident could end up being screened by the tool.

What does a bias audit under Local Law 144 actually require?

An independent auditor, not the tool's own developer, has to evaluate the tool's impact across sex, race and ethnicity, and intersectional categories, using real usage data. It has to happen within the 12 months before the tool is used and repeat annually after that.

How much can violations of Local Law 144 cost?

The first violation runs up to $500. Later violations run $500 to $1,500 each, and every day a non-compliant tool stays in use counts as its own violation. A month of unaddressed non-compliance can pass $45,000 in exposure.

Is New Jersey getting a similar AI hiring law?

Not yet, but it's moving that way. Multiple bills are active in the New Jersey legislature as of 2026, including one that would require algorithmic impact assessments and one focused specifically on AI video interview analysis. None has passed as of this writing, but businesses hiring in New Jersey should expect the direction of travel to continue.