NYC and EU tighten AI hiring rules; 95% of employers lack required audits

NYC Local Law 144, enacted under NYC Admin Code §§ 20-870 to 20-874, requires employers using AI employment decision tools (AEDTs) to conduct independent bias audits, post audit summaries publicly, and notify candidates at least 10 business days before AEDT use. Enforcement has been active since July 5, 2023, but accelerated sharply in late 2025 and early 2026: the DCWP issued its first penalties in Q4 2025 and shifted to proactive investigations in January 2026. A subsequent NYS Comptroller audit found 17 potential violations that the DCWP had initially missed, signaling that compliance gaps remain widespread even as enforcement becomes more assertive. The penalty structure is severe: $500 for the first violation, $1,500 per day for subsequent violations, with exposure potentially reaching $270,000–$810,000 if three violation streams compound over 180 days.

The EU AI Act introduces parallel obligations on a staggered timeline. Article 50 transparency obligations (applying to all high-risk AI systems used in hiring) take effect August 2, 2026—14 days away at the article's publication. Annex III high-risk AI obligations follow December 2, 2027, requiring fundamental rights impact assessments, conformity certification before market entry, and ongoing annual monitoring and audit renewal. Both regimes demand independent audits, but the EU framework applies across member states and carries its own penalty schedule alongside LL144's.

Compliance faces three acute constraints. First, auditor scarcity: qualified independent auditors (named as Holistic AI, DCI Consulting, and BLDS) are booked months in advance, creating scheduling bottlenecks. Second, data reconstruction: employers missing 12 months of historical candidate demographic data must reconstruct it, a process taking 60–90 days. Third, widespread non-compliance: only ~5% of NYC employers using AI hiring tools have publicly posted required bias audit results, exposing the remaining 95% to proactive DCWP investigation. The audit itself must measure selection rates and impact ratios by sex, race/ethnicity, and intersectional categories—a technical requirement that auditors enforce under the four-fifths rule and other regulatory metrics. Candidate notice must arrive at least 10 business days before AEDT use and must be delivered through acceptable methods. Regulators expect not vague commitments but documents, evidence, and documented processes cited to law—making compliance a matter of demonstrable procedure rather than aspirational intent.

NYC Local Law 144 has been the first major jurisdiction to actively enforce AI hiring rules since July 2023, but enforcement has significantly escalated: the DCWP issued its first penalties in Q4 2025 and moved to proactive investigations in January 2026—a shift from complaint-driven oversight. Critically, a NYS Comptroller audit discovered 17 violations the DCWP had missed, indicating that enforcement gaps remain even as the agency becomes more aggressive. This creates urgency for employers: only 5% have publicly posted required bias audits, leaving 95% exposed to a regulator that is now actively investigating rather than waiting for complaints.

The EU AI Act compounds this pressure with staggered enforcement deadlines: Article 50 (transparency for all high-risk systems) arrives August 2, 2026, followed by Annex III high-risk AI obligations December 2, 2027. Both rules require independent audits, fundamental rights impact assessments, and conformity certification before market entry—obligations that echo NYC LL144's audit requirement but apply across the EU. The practical bottleneck is acute: qualified independent auditors (Holistic AI, DCI Consulting, BLDS) are already booked months in advance, and employers need 12 months of historical candidate demographic data to satisfy audit requirements—a gap that takes 60–90 days to reconstruct if missing. The penalty structure reinforces compliance: violations compound daily, with exposure potentially reaching $270,000–$810,000 depending on violation type and duration.

No comments yet. Be the first to share your thoughts!