NYC Local Law 144 Explained for Small Staffing Agencies

NYC Local Law 144 can apply to a small staffing agency that uses AI to score, rank or screen candidates for jobs tied to New York City. Before using such a tool, the agency must have had an independent bias audit within the past year, publish a summary of the results, and give candidates notice. This is general information, not legal advice.

The detail that surprises small agencies is that the law names employment agencies directly, next to employers, and puts the duty on whoever uses the tool, not on the vendor who built it. So a screening feature switched on inside your applicant tracking system is your compliance question, even if you never think of it as "an AI tool". And the penalty clock runs by the day: each day a tool is used without the audit counts as a separate violation, so a match score left switched on for a month is not one mistake but dozens.

Follow me on Instagram@sagnikteaches

Does the law reach your agency at all?

Two tests decide it: is the thing you use an "automated employment decision tool", and is it used "in the city".

Connect on LinkedInSagnik Bhattacharya

On the first test, the City's Department of Consumer and Worker Protection (DCWP) FAQ describes an AEDT as a computer-based tool that uses machine learning, statistical modelling, data analytics or artificial intelligence; that helps employers and employment agencies make employment decisions; and that substantially assists or replaces discretionary decision-making. All three parts must be true. A prediction counts, such as an assessment of a candidate's fit for the job or likelihood of success, and so does a classification, such as sorting candidates by skill set or aptitude. "Employment decision" is broader than the final hire: the FAQ says it includes screening at any point in the hiring or promotion process.

Subscribe on YouTube@sagnikteaches

On the second test, the law applies to employers and agencies that use an AEDT "in the city". Per the FAQ, that is so where the job location is a New York City office at least part of the time, or where the job is fully remote but associated with a New York City office, or where the employment agency itself is located in New York City. If the agency is located elsewhere, one of the first two must be true. An agency with no New York City office placing people into New York City offices is therefore still likely to be inside the law for those placements.

What does not count

The FAQ is explicit that the requirements apply to using an AEDT to assess candidates for hiring or promotion. Scanning a resume bank, doing outreach to potential candidates or inviting applications are not covered, and a "candidate" means someone who has applied for a specific position by submitting the information required. So a tool that searches your database for people to approach is outside the law, while the same tool scoring the people who applied for a specific role is inside it.

Sorting your own tools: a six-row classification

Begin with a list of every step between "application received" and "shortlist sent to the client". For each step, ask the three-part test above. Here is an illustration for an agency placing warehouse and office staff.

Two rows need caution. The "probably" answers are judgements, not rulings, so keep the reasoning in writing. And the match score is the high-risk one in nearly every agency: if recruiters read the top ten and ignore the rest, the tool has substantially assisted the decision whatever the vendor's marketing says. Further background on bias checks for screening tools is in is AI CV screening fair.

Duty one: a bias audit before use, then yearly

If a tool is in scope, an independent auditor must have done a bias audit before you use it, and within the past year. The FAQ defines a bias audit as an impartial evaluation by an independent auditor which, at a minimum, calculates selection or scoring rates and the impact ratio across sex categories, race and ethnicity categories, and intersectional categories. The law does not require specific actions based on results, but anti-discrimination law applies separately, so a poor ratio needs a considered response.

Independence has a definition. An auditor is not independent if they work for the agency or for the vendor, were involved in using, developing or distributing the tool, or have a direct or material indirect financial interest in either. DCWP keeps no approved list of auditors, so choosing one is your responsibility. The vendor may commission an audit of its own tool and coordinate data collection, which can save you cost, but the agency is ultimately responsible for ensuring an audit was done.

What data the audit uses

The audit uses historical data from real use of the tool. It may pool data from several employers or agencies using the same tool, but you can only rely on it if you provided your own historical data to the auditor, or if it is your first time using the tool. If data is thin, test data may be used, and the published summary must explain why. Demographic information cannot be imputed or inferred by software. If a category makes up under 2% of the data, the calculations may exclude it, though all other categories must be included.

The impact ratio, with numbers

The impact ratio is a category's selection rate divided by the selection rate of the most-selected category. An illustration with invented figures: a tool ranks 200 applicants and the agency moves the top-ranked to the shortlist. Among 100 applicants in category A, 60 are shortlisted, a rate of 0.60. Among 100 in category B, 40 are shortlisted, a rate of 0.40. The impact ratio for B is 0.40 divided by 0.60, which is 0.67. For a tool that scores instead of selecting, the auditor uses scoring rates, such as the share of each category scoring above the median.

The law sets no pass mark. The best-known benchmark is the "four-fifths rule" in the Uniform Guidelines on Employee Selection Procedures, under which a selection rate below 80% of the highest group's rate is generally regarded by the agencies that enforce them as evidence of adverse impact. Treat 0.80 as a prompt to investigate, not a safe harbour in either direction. In this example 0.67 would lead a careful agency to ask what the tool is rewarding, whether job-relevant inputs explain the gap and whether a different setting or tool would reduce it.

Duty two: publish a summary on your website

The agency must publicly share a summary of the most recent bias audit and the distribution date, which is the date it began using the tool. It can post this on the employment section of its website, or link to a page that has it. The summary must include the date of the audit, the source and an explanation of the data used, the number of individuals assessed that fall into an unknown category, and the number of applicants or candidates, selection or scoring rates and impact ratios for all categories.

Page title: Automated employment decision tool: bias audit summary (illustrative)
Tool: [vendor and product name], used to [rank applicants for warehouse and office roles]
Date we began using it: [date]
Date of most recent bias audit: [date], by [independent auditor]
Data used: [historical data from our use of the tool, [date range]; source and explanation]
Individuals in unknown category: [number]
Results (selection rates and impact ratios):
Category | Applicants | Selection rate | Impact ratio
[sex categories] ...
[race/ethnicity categories] ...
[intersectional categories] ...
Next audit due: [date, within 12 months]

Put the page link in your site footer and in your notice, and set a calendar reminder to refresh it. An out-of-date summary is the easiest violation to spot from outside.

Duty three: tell candidates ten business days ahead

Candidates who live in New York City must be told that an AEDT will be used to assess them, and which job qualifications or characteristics it will assess. Per the FAQ the notice must include instructions on how to request a reasonable accommodation, and it must be given 10 business days before the tool is used. The law text also says the candidate must be allowed to request an alternative selection process or accommodation. Notice can be given in the job posting, by mail or by email. For job applicants, a notice on the employment section of the website is an alternative, and it does not have to be specific to a position.

The law text adds a third item. If the information is not already on your website, you must provide information about the type of data collected, its source and your data retention policy within 30 days of a written request from a candidate, unless disclosure would break a law or interfere with an investigation. Put that data statement on the site up front and the request rarely arises.

Notice to candidates (illustrative; have a lawyer review)
We use an automated employment decision tool, [name], to help assess applicants for [roles]. It evaluates [qualifications or characteristics, e.g. work history, skills listed, certifications] against the role requirements.
You can ask for a reasonable accommodation or an alternative way to be assessed by contacting [email or form] before you apply.
Our bias audit summary is at [link]. Information about the data we collect, its source and how long we keep it is at [link] or on written request.
Effective [date].

On timing, the FAQ says that if notice is on the website you can begin using the tool 10 business days after posting it, regardless of when a specific job is posted. For a new tool, post the notice and the audit summary first, wait the ten business days, then switch on the tool. If you post on a Monday, count ten business days, skipping weekends and public holidays, and write the earliest start date in your plan.

Agency versus employer: who owes what

The law covers employers and employment agencies, each in its own right. An agency that screens candidates with an AEDT owes the audit, the summary and the notice for its own use. If a client employer also uses an AEDT on the candidates you send, that employer owes its own duties for its use. The text does not define "employment agency" or say how duties divide where an agency runs a tool on behalf of a client, so where the arrangement is unclear, such as a client's own ATS configured and operated by you, ask a lawyer who the "user" is, and settle it in the contract.

Practical consequence: put the question in your client agreement. Say who operates the tool, who commissions and publishes the audit, and who sends notices. Without that, each side may assume the other has done it. For related agency workflow questions see AI CV screening for recruitment agencies: setup and safeguards and bolt it onto your ATS or switch systems.

The main worked example: a five-person agency, start to finish

An illustration with invented details. A five-person agency places temporary office and warehouse staff, including for clients with New York City sites. Its ATS has an optional "AI match" panel that ranks applicants, which two recruiters use daily.

1. Week 1, inventory: the owner lists steps, and the match panel is marked in scope. The scheduling chatbot and the job-advert drafting are marked probably out of scope, with reasons recorded.
2. Week 1, vendor email: the owner asks the vendor whether an independent bias audit exists, for which data, on what date, and whether the agency's data was included. A reply that says "our model is fair" is not an audit.
3. Week 2, decision: the vendor's audit is 14 months old and used pooled data the agency never supplied. The agency cannot rely on it. It chooses to commission its own audit with an independent auditor using its last year of ATS data, or to switch the panel off until that is done.
4. Week 3, switch off: while waiting, recruiters work from the application list and a short manual scorecard. The agency loses perhaps 20 minutes per role, an acceptable cost against a penalty that accrues per day of use.
5. Weeks 4 to 8, audit and publish: the auditor returns the ratios. The agency posts the summary and notice, waits ten business days and turns the panel back on.
6. Ongoing: a calendar entry 11 months out to arrange the next audit, and a quarterly look at shortlists by category.

The decisive step is the second. Many small agencies assume a vendor's reassurance is the audit, and the FAQ says otherwise. A short vendor email also surfaces the sums the audit needs. See questions to ask a recruitment agency about AI screening for the client's-eye version of the same checks.

A vendor email that gets a straight answer

Subject: Local Law 144 bias audit for [product]
Hello [first name], we use [feature] to rank applicants for roles connected to New York City. Please send: (1) the date and author of your most recent independent bias audit; (2) whether the audit used data from customers like us, and whether our data was included; (3) the selection or scoring rates and impact ratios by sex, race/ethnicity and intersectional category; (4) your recommended wording for candidate notices; (5) whether you can export the data an auditor would need from our account. Thank you, [your name]

Penalties, complaints and the state-law pointer

The law text sets a civil penalty of up to $500 for a first violation, and for each further violation on the same day, and $500 to $1,500 for each later violation. Each day a tool is used in breach is a separate violation, and failing to give a required notice is its own violation. DCWP began enforcing on 5 July 2023 and takes complaints through 311 or its website; discrimination claims are referred to the City's Commission on Human Rights, which enforces the City's Human Rights Law. The FAQ also reminds users that national, state and City anti-discrimination laws apply regardless of the audit.

That last point is the pointer beyond the City. Other states and cities have their own rules on AI in hiring, notices and consent, and they change quickly, so check your own state's labour department and ask a lawyer about any state you place into. DCWP's FAQ is dated 29 June 2023, and its AEDT page, checked in November 2026, still links that FAQ and the rule that took effect on 5 July 2023; check the page for updates before you rely on any detail here.

When the audit shows a gap you did not expect

Suppose the independent auditor reports an impact ratio of 0.67 for one category on your match panel, as in the earlier sums. The law does not tell you to stop, and it does not tell you the result is acceptable. Treat it as a finding to investigate with a short sequence. First, ask the auditor what drives the gap: which inputs the tool weights, and whether the difference persists within the same job family. Second, look at your own process: if recruiters shortlist only the top ten, any small difference in ranking is magnified. Third, test a change, such as shortlisting twenty, adding a structured phone screen for everyone above a threshold, or switching the feature off for that role family. Fourth, record what you decided and why.

That record has a second use. If a candidate complains to the City's Commission on Human Rights, the agency's record of noticing the gap and acting on it is part of the story. A bare audit with no response reads worse than one followed by a documented adjustment. Ask your lawyer how to word the response, since discrimination law runs separately from this one.

Handling a candidate who asks for an alternative

The notice invites requests for an accommodation or an alternative selection process, so decide in advance what you will offer. A workable alternative for a ranking tool is a manual review of the application against the same written criteria by a recruiter, with the same deadline and no penalty for choosing it. Log the request, the date, what was offered and the outcome. A candidate who chooses the alternative should not be told the tool's ranking, and the recruiter should not see it before deciding.

An example of the exchange: a candidate emails "I would prefer not to be scored by software, can someone review my application?" The reply: "Thank you, [first name]. We will have a member of our team review your application against the role criteria without the automated tool. You will hear from us by [date]." Keep the wording that simple, and make sure the person who replies knows how to route it.

A checklist to keep in the compliance folder

• List of every screening tool, with the three-part test and the reason for each decision.
• Vendor correspondence on audits, with dates and attachments.
• The independent auditor's report, the date, and the data period used.
• The published summary page, with the distribution date and a screenshot of when it went live.
• The candidate notice, where it appears, and the date it went live.
• The alternative-process and accommodation route, with who handles requests.
• The next audit date, an owner and a backup.
• A log of requests for data information and the dates you replied within 30 days.

Keep it light and dated. If DCWP or a candidate ever asks, a short folder showing what you assessed, when and why is the strongest answer a small agency can give. For the broader question of whether AI should rank people at all, read can AI screen CVs fairly, and for follow-up messaging that sits outside the law's scope see how staffing agencies automate candidate follow-up.

Local Law 144 questions agencies ask

Can I rely on my software vendor's bias audit?

Possibly, but the duty stays with you. The City's FAQ says the vendor is not responsible for the audit and employers and agencies are ultimately responsible. A vendor can commission an independent audit, and you may rely on one that used pooled data only if you supplied your own data to it or it is your first use of the tool.

How often must the audit be repeated?

Every year. The FAQ says an agency can rely on a bias audit for one year from the date it was conducted, and must have had one within the past year to use the tool. Diary the expiry date, and the date the published summary must be refreshed.

What are the penalties?

The law text sets civil penalties: up to $500 for a first violation and for each further violation on the same day, then $500 to $1,500 for later violations. Each day a tool is used in breach counts separately, and a missing notice is its own violation. Check the current DCWP page, as penalties and enforcement can change.

Does a keyword filter count as an automated tool?

Only if it uses machine learning, statistical modelling, data analytics or AI and substantially assists or replaces discretionary decision-making. Plain rule-based sorting may fall outside, but the line is a legal one. Ask a lawyer before assuming a filter is exempt.

Further reads

• How Recruiters Use AI to Write Candidate Summaries Clients Read — AI summaries for clients, and what they must not decide.
• How to Write Job Adverts With ChatGPT Without Biased Language — Cleaner job adverts, which sit upstream of screening.
• AI Bias in Small Business Decisions: Hiring, Pricing and Credit — Bias in hiring, pricing and credit beyond one law.
• How to Use AI in Hiring for a Small Shop: Ads, Questions, Scorecards — Scorecards and structured questions for small hirers.
• How to Set Up an AI-Assisted Hiring Process for a Small Team — A hiring process with AI and human checkpoints.
• How to Build Interview Questions and Scorecards With AI — Structured scorecards that make audits easier.
• AI Staffing Best Practices: A Checklist for Placements and Candidate Data — A checklist for staffing agencies using AI in placements: who decides at each gate, what candidates are told, how long data is kept and what to log.
• AI Staffing Tools for Skill Assessment: What to Test and Trust — How a staffing agency can use AI skill tests fairly: job-related tasks, rubric marking, an adverse impact check, a validity check and candidate notice.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: NYC Department of Consumer and Worker Protection pages on automated employment decision tools and its FAQ (29 June 2023); text of Local Law 144 of 2021 (Administrative Code sections 20-870 to 20-874); DCWP's adopted AEDT rule (definitions of scoring rate and impact ratio); Uniform Guidelines on Employee Selection Procedures, 29 CFR 1607.4(D). This is general information, not legal advice.