Before the bias audit, the inventory: what New York City’s hiring-tool law asked of employers
New York City’s Local Law 144 made bias audits the headline. For banks, insurers and asset managers hiring in the city, the harder prerequisite was finding every tool that scores candidates, deciding which were in scope, and naming an owner for each.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On July 5, 2023, New York City’s Department of Consumer and Worker Protection began enforcing Local Law 144, which regulates automated employment decision tools. The law had taken effect in January, but enforcement waited while the department finalized its rules, adopted in April. From July 5, employers and agencies using such a tool to substantially assist hiring or promotion decisions in the city needed three things: an independent bias audit conducted within the prior year, a public summary of its results, and advance notice to candidates that a tool was in use. The audit compares selection or scoring rates across sex and race or ethnicity categories. It was widely described as the first law of its kind in the United States.
Most commentary on Local Law 144 focused on the bias audit: who could perform it, what statistics it required, and whether its impact ratios meant anything. For financial firms with large New York hiring programs, the audit came last in a sequence. It could not start until the firm knew which tools it used, which of those the law covered, who owned each one, and how candidates would be told. We take those four steps in order: find the tools, decide scope, assign ownership of the audit, and give notice.
Finding the tools
A bank or asset manager rarely buys one hiring system. Campus recruiting may use a video interview platform with automated scoring. Experienced-hire recruiting may use the ranking feature in the applicant tracking system. Operations and contact center hiring may use online assessments from a different vendor. Technology hiring may use coding tests that grade automatically. Staffing agencies and executive search firms add their own tools, often invisible to the employer.
These tools arrive through different budgets. Talent acquisition buys some, business lines buy others, and some come bundled as features in software bought for another purpose. Procurement records will not find a scoring feature switched on in an existing contract. The practical method is a structured survey of every recruiting team and vendor, asking one question: does any software rank, score, filter or recommend candidates before a person reviews them? Each answer goes into a register with the vendor, the feature, the roles it is used for and the volume of candidates.
The register also needs the staffing agencies. The law applies to employment agencies as well as employers, but a firm that relies on an agency’s screening still carries reputational and legal exposure. Contracts with agencies and search firms should ask whether they use automated tools on the firm’s requisitions, and require them to share audit results.
Deciding scope
The law covers a tool that uses machine learning, statistical modeling, data analytics or artificial intelligence to produce a simplified output, such as a score or ranking, that substantially assists an employment decision. The department’s rules read “substantially assist” narrowly. A tool is covered when its output is the sole factor, outweighs other factors, or overrules a human decision.
That definition invited firms to conclude they were out of scope, because a recruiter nominally reviews every candidate. The conclusion may be defensible for some tools and weak for others. If recruiters in practice only look at the top-ranked quarter of applicants, the ranking is doing the deciding. A scope decision should therefore rest on how the tool is used, observed and documented, not on what the process manual says. Firms should record each scope decision, its reasoning and who made it, and check it with employment counsel. A tool judged out of scope in 2023 could move into scope if a team changed how it used the output.
Owning the audit
An audit needs data, and the data rarely sits in one place. Selection rates by sex and race or ethnicity require demographic information, usually collected voluntarily for equal employment reporting and held in the applicant tracking system. Scoring data sits with the vendor. An independent auditor needs both.
Vendors offered audits based on pooled data from many customers. The rules allow that in some circumstances, but a pooled audit says little about whether a tool behaves fairly for one firm’s candidate population. A firm recruiting heavily from particular universities or regions may see different results from the pool. Each in-scope tool therefore needs an owner, usually in talent acquisition, with authority to obtain vendor data, commission or review the audit, publish the summary and act on the results.
Acting on results is the part most often left undefined. The law requires an audit, not a particular outcome. A firm that publishes an impact ratio showing one group selected at a much lower rate has created evidence that plaintiffs and other regulators can use under existing discrimination law. The owner needs a pre-agreed path: investigate, adjust the tool or its thresholds, or stop using it. Legal, HR and the business should agree that path before the first audit arrives.
Giving notice
Candidates who live in the city must be told, at least ten business days before use, that a tool will be used and which qualifications or characteristics it assesses. Firms must also explain how to request an alternative selection process or accommodation where available, and must make information about data retention available.
Notice is an operational task for the career site and the recruiting workflow. Job postings, application confirmations and assessment invitations all need consistent language. Recruiters need a script for candidates who ask how the tool works or ask to be assessed another way. That second request is the hard one. If the firm offers an alternative, someone has to run it, which means interviewers and capacity. If it does not, the reason should be documented.
The four steps share a requirement. Someone must own the register of tools and keep it current, because the hiring stack changes every year. That role sits naturally with HR operations, with a second line of review from compliance. Without it, the audit is a document produced once and outdated by the next hiring season.
With hindsight
Local Law 144 turned out to be a weak enforcement regime and a strong signal. Researchers who looked for published audits in early 2024 found very few, and the narrow definition let many employers conclude they were out of scope. In December 2025 a New York State Comptroller audit found the city’s enforcement ineffective, citing passive, complaint-driven enforcement and misrouted complaints. The wider pattern took longer to settle. Colorado passed a broad AI law in 2024 covering employment decisions, delayed it, and in May 2026 replaced it with a narrower disclosure-focused law due to take effect in 2027. The EU’s AI Act treats many employment uses as high-risk. Generative AI spread through recruiting faster than governance did. A current register of tools that score candidates is the starting point for answering each of these rules.