NYC Local Law 144 became enforceable on 5 July 2023, after two deferrals from the original 1 January 2023 deadline. Nearly three years into enforcement, the realistic picture is messier than the law's ambition suggested. Compliance is uneven, public audit summaries that should be easy to find often are not, and the Department of Consumer and Worker Protection has chosen a posture that prioritizes specific complaints over mass sweeps.
This piece is an attempt to describe what is actually happening, with the rule text, the DCWP's own implementing rules, and publicly available enforcement signals as the evidence base. Where the rule is ambiguous and the DCWP has not clarified, I say so. Where compliance studies disagree, I name the disagreement rather than pick the flattering number.
The statutory frame, briefly
The law itself sits in Local Laws of the City of New York for 2021, codified at NYC Admin Code §§ 20-870 to 20-874. It prohibits an employer or employment agency from using an automated employment decision tool — an AEDT — to screen a candidate or employee for an employment decision unless three conditions are satisfied. The tool must have been subject to a bias audit conducted no more than one year before its use. A summary of the most recent bias audit must be publicly available on the employer's or agency's website. And the candidate or employee must have received a notice at least ten business days before the AEDT is used, informing them of the use and of the option to request alternative process.
DCWP is the enforcing agency. The Final Rules implementing the law were adopted on 5 April 2023 and effective 5 July 2023, the same day the law became enforceable. Those rules — codified at 6 RCNY Chapter 5, Subchapter T — define the audit methodology, the independence requirement, the notice content, and the publication format for the audit summary.
What the rule requires an audit to compute
The DCWP Final Rules prescribe the statistical core. For each category protected under NYC Human Rights Law — sex, ethnicity, race, and their intersectional combinations — the audit must compute selection rate and impact ratio. Selection rate is the rate at which members of a category are selected by the AEDT. Impact ratio is the selection rate of a given category divided by the selection rate of the most-selected category, expressed as a ratio.
For AEDTs that issue classifications rather than rankings, the same impact ratio logic applies. For AEDTs that score candidates on a continuous scale, the rules require computation of scoring rate and score-based impact ratio using the median score as the threshold. These details matter because they are what distinguishes an audit that satisfies the rule from a document that merely claims the label.
What the data says about compliance
Public compliance with LL144 is harder to measure than the law assumed. The statute assumes that every employer using an AEDT will post a publicly accessible bias audit summary, and therefore counting those summaries would be straightforward. In practice:
Independent studies from academic and civil-society groups since 2023 have documented compliance rates well below what the rule presumes. The Cornell–Data & Society study published in late 2023 examined large employers hiring in NYC and found only a small minority had posted a bias audit summary consistent with DCWP Final Rules formatting. Similar work from labor policy researchers in 2024 and 2025 reached the same direction — most AEDT-using employers operating in NYC in 2024 did not have a compliant audit summary posted, even though they were using tools that clearly fell within the law's scope.
The caveats on these numbers are important. Researchers cannot directly observe which employers use AEDTs, so they infer from vendor customer lists, job posting metadata, or ATS integrations. That undercounts silent users and overcounts some who may no longer use the flagged tool. But the direction is consistent: compliance in 2026 is closer to a minority than a majority practice, and the tail of non-compliance is long.
A second caveat: the employers most likely to be non-compliant are not always the ones you would expect. Some large enterprise employers with mature HR legal functions have published audit summaries reliably since 2023. Other large employers, including some Fortune 500 names, have not. Non-compliance is not primarily a story of small companies that lack resources — it is a story of organizations that deprioritized a law they judged unlikely to be enforced aggressively.
What the DCWP has done in practice
DCWP enforcement of LL144 since July 2023 has been deliberate rather than maximalist. The agency has the authority to bring proceedings under NYC Admin Code § 20-872 with civil penalties of $500 for a first violation (and each additional violation on the same day), and $500 to $1,500 for each subsequent violation, with each day of non-compliant use a separate violation. In practice, enforcement has concentrated on cases brought to the agency's attention by complaints — often from candidates who received no pre-use notice — rather than proactive sweeps of the employer universe.
This matters because it shapes the realistic risk calculus. An employer using an AEDT without a current bias audit, without a public summary, and without candidate notice is not in imminent danger of a DCWP letter arriving unsolicited. But that same employer is one candidate complaint away from being the test case. And once a proceeding is opened, the per-day-per-violation structure compounds quickly: an AEDT in continuous use for six months without a compliant audit is, on a literal reading of the penalty schedule, at least $90,000 to $270,000 of exposure before any procedural discount.
Settlements and formal adjudications at DCWP are typically published. The body of publicly documented LL144 outcomes remains small as of early 2026, but it is growing. The enforcement learning curve is on the DCWP's side: each case clarifies what the agency treats as a per-violation unit, how it handles good-faith remediation, and what documentation it accepts as evidence of a compliant audit.
What triggers an investigation
From the patterns visible in published proceedings and the rule text, four common triggers surface repeatedly:
A candidate complaint. The most frequent trigger. A candidate applies for a NYC role, notices the absence of a pre-use notice on the ATS or the careers page, or receives an unexplained rejection after what appears to be an automated screen, and files a complaint. DCWP investigates whether an AEDT was in use and whether the statutory preconditions were met.
An employee complaint about internal promotion tooling. LL144 applies to promotion decisions as well as hiring. An employee who believes their promotion prospects are being assessed by an algorithmic tool without notice or bias audit can trigger an investigation, and these are harder for employers to contain because the evidence trail lives inside the company.
A journalist or researcher exposé. A meaningful share of DCWP inquiries begin after a publication names specific employers and specific vendors. The research infrastructure around AI-in-hiring has matured since 2023, and the cost of being the named example in a piece is rising.
A regulator referral. EEOC has been active on AI in employment since 2023. Where an EEOC charge involves an AEDT used in NYC, DCWP cooperation is plausible and has occurred. Similarly, state AGs with AI-in-hiring interest can refer matters.
What rarely triggers an investigation by itself is the absence of a posted audit summary, unaccompanied by any other complaint. DCWP does not appear to be running web scrapers against employer career pages and generating letters. That is a choice of enforcement posture, not a statutory limit, and it could change.
The independence requirement is where audits fail
The most technically defensible LL144 audit is worthless if the auditor is not independent within the meaning of the rule. The DCWP Final Rules define an independent auditor as a person or organization that has not been involved in using, developing, or distributing the AEDT, does not have an employment relationship with the employer or vendor, and does not have a direct financial interest or a material indirect financial interest in the employer, employment agency, or vendor.
The "material indirect financial interest" language is the part that sinks audits most often. A firm that audits an AEDT and also sells the same employer a recurring compliance-consulting engagement has a material indirect financial interest in keeping that employer as a client. A firm that audits a vendor's tool while being paid by the vendor to train the vendor's customers has the same problem. Neither of those arrangements is a theoretical worry — both appear in the market.
If a DCWP proceeding opens and the audit's independence is challenged, the employer does not simply lose the ability to point to that audit. The more practical consequence is that the employer has been using the AEDT without an audit that satisfies the rule, and the per-violation-per-day clock has been running the entire time.
What enforcement in 2026 is likely to look like
Two quiet shifts matter. First, the NY Department of Labor and EEOC coordination with DCWP on AI-in-hiring matters has deepened since 2024, which means LL144 matters increasingly travel through multi-agency routes rather than single-agency DCWP investigations. Second, the EU AI Act becoming enforceable for high-risk AI systems on 2 August 2026 pushes global HR tech vendors to develop documentation and audit support that meets both regimes — which in turn makes defensible LL144 compliance more accessible for employers who want it.
The net prediction, stated carefully: DCWP enforcement will not become mass-scale during 2026, but the size of individual enforcement actions will rise, and the typical opened case will begin to draw on documentation patterns that employers cannot easily retrofit after the fact. The cost of entering 2027 as a non-compliant AEDT user is higher than the cost of entering 2024 was.
What this means operationally
For employers and employment agencies using AEDTs for NYC positions, three things are worth doing now if they have not been done:
Confirm whether the tools in current use meet the AEDT definition in the DCWP Final Rules. The "substantially assist or replace discretionary decision-making" language has been interpreted more broadly than many vendors initially conceded. An ATS that uses a machine-learning model to rank candidates by fit is almost always an AEDT, even if the vendor prefers a different label.
Confirm whether the bias audit currently on file — if there is one — was produced by an auditor who would survive an independence challenge under DCWP Final Rules, including the material-indirect-financial-interest clause.
Confirm whether the candidate notice complies with DCWP Final Rules on content and timing. The rule requires, among other things, at least ten business days' notice before the AEDT is used, identification of the job qualifications and characteristics the AEDT will use, and an offer of alternative process.
If any of those three reveal gaps, the exposure is not theoretical. It is the per-violation-per-day clock quietly accumulating.
This piece is technical commentary for compliance teams, general counsel, and CHROs. It does not constitute legal advice and does not create an attorney-client relationship. For an independent LL144 bias audit, see the service page. For AI governance consulting that does not overlap with the audit function, see Lexara Advisory.
Primary sources referenced. NYC Admin Code §§ 20-870 to 20-874 (Local Law 144 of 2021). DCWP Final Rules, 6 RCNY Ch. 5, Subchapter T, effective 5 July 2023. Compliance rate references are from Cornell–Data & Society (2023) and subsequent peer-reviewed replications (2024–2025). EU AI Act milestone dates follow Regulation (EU) 2024/1689 transitional provisions.