# NYC AI Hiring Rule: $500-$1,500 Fines Per Day [2026] > Source: > Published: 2026-11-02 13:58:53+00:00 New York City has told employers that an algorithm is not an alibi. Three city agencies published a joint [enforcement policy on artificial intelligence](https://www.nyc.gov/site/dca/news/067-26/dcwp-tlc-cchr-issue-enforcement-policy-on-artificial-intelligence), and the message is blunt: if software helps break the law, the company that used it answers for the result. Law.com and Investopedia both reported the story under the headline “‘AI Made the Decision’ Is Not a Defense: What NYC Employers Need to Know About the City’s AI Enforcement Position.” For hiring teams, the practical anchor is NYC Local Law 144 of 2021, which the Department of Consumer and Worker Protection (DCWP) enforces. The law covers any automated employment decision tool used to screen candidates or employees in the city. It has been in force since January 1, 2023, and DCWP began enforcing it on July 5, 2023. What changed now is not the statute. It is the tone, and the city’s stated willingness to treat vendor software as the employer’s own conduct. That tone arrives at an awkward moment for corporate AI plans. Analysts at Gartner already expect that [30% of AI-driven layoffs will be reversed by 2029](https://shattered.io/gartner-30-percent-ai-layoffs-rehired-by-2029-higher-cost-2026/) because of higher costs. A compliance bill for screening tools, plus real legal exposure, makes that math harder. This analysis covers what the city said, what the law requires, where enforcement stands, and what employers and model builders should do next. Don't miss new tech stories on Google Add Shattered once in the Google app and our stories show up in your news suggestions. [Add now](https://www.google.com/preferences/source?hl=en&q=https%3A%2F%2Fshattered.io%2F) ## What New York City Actually Announced The city’s position comes from a joint policy by the DCWP, the New York City Commission on Human Rights (CCHR), and the Taxi and Limousine Commission (TLC). Deputy Mayor for Economic Justice Julie Su framed it in rights terms. In the city’s announcement she said: “New Yorkers do not lose their rights when a decision is made or facilitated by technology.” She added a second line aimed at companies: “A company that breaks the law is responsible for what its technology does, and the agencies that enforce our laws and this will hold violators accountable.” The agencies back that up in an interagency enforcement letter. It states: “An entity cannot avoid responsibility for violations of law because of reliance on an algorithm, AI, or other technology.” The letter also says the laws enforced by the three agencies “apply regardless of whether a decision or action is made with the assistance of artificial intelligence, algorithms, or other technology.” And it reduces the idea to one sentence: “Legal responsibility exists regardless of whether a human being or a machine carried out the actions.” Read together, those lines do three things. They reject the claim that a vendor’s model is a separate actor. They extend the city’s existing laws to AI-assisted decisions without creating a new statute. And they cover more than hiring, since the TLC regulates for-hire drivers and the CCHR enforces the city’s human rights law. For this article the hiring angle matters most, because Local Law 144 is the one New York rule written specifically around automated tools. ## What NYC Local Law 144 Requires of Employers NYC Local Law 144 is a transparency and testing law. It does not ban automated screening. It says an employer or employment agency may use a covered tool only after meeting a short list of duties, and it expects those duties to stay current for as long as the tool runs. - **Bias audit:** complete an audit no more than one year before using the tool. - **Public summary:** post a summary of the most recent audit results and the tool’s distribution date on the employer’s or agency’s website before use. - **Candidate notice:** tell New York City candidates and employees that a tool will be used and which qualifications or characteristics it will assess. - **Timing:** give that notice at least 10 business days before use. - **Alternatives:** let a candidate request an alternative selection process or an accommodation. - **Data disclosures:** post the type and source of the data the tool uses, along with the data-retention policy. | Duty | Trigger or deadline | Where it appears | |---|---|---| | Bias audit | No more than 1 year before use | Audit record kept by the employer | | Audit summary and distribution date | Before the tool is used | Employer or agency website | | Candidate and employee notice | At least 10 business days before use | Direct notice to NYC candidates | | Alternative process or accommodation | On candidate request | Employer’s hiring process | | Data type, source, retention policy | Posted for the life of the tool | Employer or agency website | The sequence matters. An audit that lapses after 12 months quietly turns a compliant tool into a violation, and nothing in the law sends a reminder. Compliance teams that treat the audit as a one-time purchase will miss this. ## What Counts as an Automated Employment Decision Tool The law defines an automated employment decision tool (AEDT) as a computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence. To qualify, it must produce a score, classification, or recommendation, and it must substantially assist or replace discretionary decision-making in employment decisions. That definition is wide on the technology side and narrower on the function side. ### Substantially assists is the phrase to watch A resume ranker that sorts 4,000 applicants and hands recruiters the top 50 sits inside the definition. So does a video-interview scorer or a chatbot that screens candidates out on qualification answers. A spreadsheet macro that only reformats data probably does not. The gray zone is the tool that only recommends. The Association of Corporate Counsel’s January 2026 training materials make the same point that the city now makes loudly: tools that score, rank, recommend, or screen can count even when a human clicks the final button. Large language models widen that gray zone. A team that pastes resumes into a general-purpose chatbot and asks for a shortlist has built an AEDT in everything but name. The definition says nothing about whether the model was purpose-built for hiring, only about what the output does to the decision. ## Penalties: $500 to $1,500 and How the Days Stack Up The statute provides a civil penalty of up to $500 for a first violation and $500 to $1,500 for each subsequent violation. The New York State Comptroller describes DCWP’s enforcement power as penalties of $500 to $1,500 per day. Trustible, an AI governance firm, adds that each day of violation counts separately. Daily accrual changes the arithmetic. Take a hypothetical employer that runs an unaudited screening tool for 30 days. At the statutory range, the exposure for the later days alone runs from roughly $14,500 to $43,500, before counting separate violations for missing notices or missing website postings. That figure is an illustration of the rule, not a reported case. DCWP has not announced any such assessment in the sources reviewed for this article. Fines are not the main cost for most firms. The larger risks sit next to them: a discrimination complaint that cites the missing audit, a damaged employer brand among applicants, and a procurement review by a customer. In regulated sectors, a failed audit story can travel faster than a $1,500 penalty. ## Why the December 2025 Comptroller Audit Matters In December 2025 the New York State Comptroller audited DCWP’s handling of Local Law 144 and concluded that enforcement was weak. DLA Piper’s summary says the audit pointed to problems in complaint intake and in how compliance reviews were conducted. An OpenPR roundup of AI hiring compliance reports that DCWP received only two complaints about automated tools over a two-year stretch. Treat that last number cautiously since it comes from a secondary source, but it fits the picture the audit drew. DCWP’s own on-record view, as described by the Comptroller, is that stakeholder education combined with complaint-based enforcement works best for getting employers to comply. That approach depends on candidates knowing the law exists and filing complaints. If almost nobody knows an audit summary should be on a careers page, almost nobody complains. This is why the new AI position reads as a response. DLA Piper predicted in January 2026 that the audit would bring more investigations and more exposure to daily penalties. Trustible’s page says DCWP has since moved toward targeted investigations. We could not confirm the scope, targets, or outcomes of any such action from the sources available, so employers should treat them as a signal rather than a record. ## Vendor Contracts Do Not Shift the Liability Many HR teams assume that a screening vendor carries the legal risk because the vendor built the model. NYC Local Law 144 points the other way. The duties attach to the employer or employment agency that uses the tool, and the interagency letter says reliance on technology is no excuse. The Workplace Ahead tracker and the Association of Corporate Counsel both say that handing screening to a vendor does not remove the employer’s compliance duties. The same lesson has played out in security. When a booking-platform flaw exposed 38 months of airline data, the airlines that relied on the vendor still faced the customer fallout, as our coverage of the [Amadeus vendor-risk case](https://shattered.io/amadeus-booking-display-flaw-airline-vendor-risk-38-months-2026/) showed. Hiring software follows the same logic. Outsourcing a function does not outsource the accountability. Contracts should reflect that reality. Employers can still negotiate for audit support, data access, indemnities, and notice of model changes. But they cannot contract their way out of the posting and notice duties, and they cannot rely on an audit they never read. Procurement teams should ask who performed the audit, whether the auditor was independent, which data it used, and whether the tool version being deployed matches the version audited. ## Mobley v. Workday and the Federal Picture New York is not acting alone. In Mobley v. Workday, a federal court granted conditional certification on May 16, 2025, allowing a nationwide collective action under the Age Discrimination in Employment Act to proceed. The Association of Corporate Counsel and Cooley both report that the court rejected the argument that the company was merely a software provider and found that alleged involvement in scoring, sorting, ranking, and screening could support agent liability. These are allegations in an ongoing case, not findings that any tool discriminated. Seyfarth Shaw’s 2026 edition of its EEOC litigation report adds that the Equal Employment Opportunity Commission filed an amicus brief supporting the theory that an AI vendor could be directly liable under Title VII, the ADA, or the ADEA. If that theory holds, vendors and employers could share exposure. For New York employers, it means the city’s stance and the federal courts are pointing toward the same conclusion from different directions. ### The EEOC sends mixed signals The federal agency is not a steady ally of strict AI oversight. OpenPR reports that the EEOC removed its published AI-hiring guidance in January 2025. The Workplace Ahead tracker says the commission voted 2-1 on June 4, 2026 to adopt a new National Enforcement Plan for fiscal years 2025 through 2029, with Commissioners Lucas and Panuccio in favor and Commissioner Kotagal dissenting. The tracker says the plan de-emphasizes disparate impact and does not name AI hiring as a standalone priority. That leaves a gap which cities and states are happy to fill. Withdrawn guidance does not repeal Title VII, and private plaintiffs do not need the EEOC’s blessing to sue. For employers, a quieter federal agency does not mean lower risk. ## How Other Jurisdictions Compare Employers with a national footprint face a patchwork. The table below summarizes what the cited sources report, and several dates remain unsettled, so it flags where the sources disagree. | Jurisdiction | Instrument | Reported status | Source | |---|---|---|---| | New York City | Local Law 144 of 2021 | In force Jan. 1, 2023, enforced since July 5, 2023 | NYC and Comptroller materials | | Illinois | Amended Human Rights Act | Notice and anti-discrimination duties reported effective Jan. 2026 | OpenPR | | Colorado | SB 205 | Originally set for Feb. 1, 2026, a later rewrite reported with a Jan. 1, 2027 date | Cooley, OpenPR | | California | Automated decision system rules | Dates differ by regulator (Oct. 1, 2025 and Jan. 1, 2026 both reported) | Cooley, Ogletree | | European Union | AI Act | Recruitment tools classed high-risk, timing under a 2026 omnibus proposal | OpenPR | Ogletree’s October 2026 analysis warns US employers against a US-only lens, and the table shows why. A multinational that screens candidates in New York, Chicago, and Amsterdam may need three different notice flows. Several of these regimes share a core idea, which is that automated tools used on people need disclosure, testing, and a human route around them. Building to the strictest common denominator is usually cheaper than maintaining separate processes. ## Historical Context: From a 2021 Law to a 2026 Policy Local Law 144 was among the first US laws to regulate AI in recruiting directly, as Ogletree notes. Its path from enactment to bite has been slow, and the timeline shows how many years passed between the law and the city’s current posture. | Date | Event | Why it matters | |---|---|---| | 2021 | Local Law 144 enacted | First big US bias-audit rule for hiring tools | | Jan. 1, 2023 | Law takes effect | Duties start applying to employers | | July 5, 2023 | DCWP enforcement begins | Penalties become collectable | | Jan. 2025 | EEOC reportedly removes AI-hiring guidance | Federal direction softens | | May 16, 2025 | Mobley v. Workday collective certified | Vendor and employer exposure grows | | Dec. 2025 | State Comptroller audit of DCWP | Enforcement called weak | | June 4, 2026 | EEOC adopts new enforcement plan, 2-1 vote | AI hiring not a standalone priority | | Reported Nov. 2, 2026 | NYC agencies state AI is no defense (per Law.com, Investopedia) | City signals tougher stance | The pattern is familiar from earlier tech regulation. A law passes, industry treats it as optional, an audit exposes thin enforcement, and then the regulator reasserts itself in public. ## Market Impact: Audit Firms, HR Tech, and Model Providers No source we reviewed puts a dollar figure on the market for AEDT bias audits, so we will not invent one. The direction is easier to describe. Independent auditors, AI governance platforms, and HR software vendors with audit-ready documentation gain pricing power when enforcement tightens. Vendors that cannot explain their scoring logic lose deals to those that can. The pressure lands on a labor market already in flux. Microsoft’s decision to offer buyouts alongside strong profits, covered in our look at [60,000 buyout offers](https://shattered.io/microsoft-36-6b-profit-60000-buyouts-developers-2026/), shows how heavily large employers lean on workforce planning tools. Startups building agents that learn jobs by watching them, like the one in our report on [Marble’s $3.75M pre-seed](https://shattered.io/marble-cognition-3-75m-pre-seed-ai-learns-jobs-by-watching-2026/), will face the same question once their outputs touch hiring or promotion: does the tool score a person? Model providers face a quieter shift. General-purpose models sold through APIs rarely carry hiring-specific documentation. When a customer uses one to rank candidates, the customer inherits an audit problem the provider never planned for. Expect enterprise contracts to start carrying use-case restrictions, logging requirements, and audit-cooperation clauses. ## What Developers and Model Teams Should Build Engineers building screening features sit closest to this rule. A bias audit needs inputs, outputs, and group-level results, so the product has to produce them. Teams that already run offline evaluations have a head start, and our guide to [building a RAG pipeline with evals](https://shattered.io/build-rag-pipeline-hybrid-search-evals-12-steps-2026/) covers the habit of scoring a system against fixed test sets. The same discipline applies to fairness checks. For more coverage of model releases and evaluation methods, see the [AI and machine learning section](https://shattered.io/ai-machine-learning/). ### Log every automated decision An auditor and a regulator both want to know which version of a model scored which candidate and what the person was told. The record below is an illustrative schema, not a format any agency has prescribed. ``` { "decision_id": "2026-11-02-000417", "tool_name": "resume-ranker", "tool_version": "3.2.1", "audit_completed_on": "2026-03-14", "audit_summary_url": "https://example.com/careers/aedt-audit", "candidate_notice_sent_on": "2026-10-15", "alternative_process_offered": true, "model_output": {"score": 0.71, "rank": 38}, "human_reviewer": "recruiter-0192", "final_action": "advanced" } ``` Log the tool version in particular. If the deployed version drifts from the audited one, the audit may no longer describe what is running. Product teams should also build a switch that routes a candidate to a human-only path when they request an alternative process. ## A 90-Day Compliance Checklist for NYC Employers Employers hiring in New York City can use the following sequence. It follows the duties in the fact sheet above and the practical advice from Ogletree, DLA Piper, and The Workplace Ahead. 1. **Inventory every tool.** List each system that scores, ranks, or recommends candidates, including features inside applicant tracking software and any chatbot staff use informally. 2. **Check the audit date.** Confirm each audit falls within the prior 12 months and that an independent party performed it. 3. **Publish the summary.** Post the latest audit results and the distribution date on the careers or compliance page. 4. **Post data disclosures.** Describe the type and source of data the tool uses and the retention policy. 5. **Send notices on time.** Give New York City candidates and employees at least 10 business days of notice and say what the tool assesses. 6. **Offer an alternative.** Set up a human review path and an accommodation process, and train recruiters to use them. 7. **Keep records.** Retain tool versions, audit reports, notices, and reviewer actions in one place. 8. **Review vendor terms.** Ask for audit cooperation, change notices, and data access in writing. Small firms should not assume they are out of scope. The law turns on the tool and the location of the candidate, not on company size. A five-person agency using a ranking feature on NYC applicants has the same posting duties as a large employer. ## Five Predictions for the Next 12 Months These are our own judgments, drawn from the sources above. They are not reported facts. 1. **First public penalty cases appear.** After a critical audit and a public policy statement, DCWP has strong reasons to show results. Expect at least one announced action against an employer or agency. 2. **Complaint volume rises.** Press coverage teaches candidates that the law exists, and filings should climb from the very low base the audit described. 3. **Audit summaries become a procurement checkbox.** Enterprise buyers will ask vendors for current audit links before signing, in every state. 4. **Courts keep widening vendor exposure.** If the agent theory in Mobley survives further rulings, other plaintiffs will copy it against other platforms. 5. **Other cities copy the AI-is-no-defense language.** The phrasing is easy to adopt because it needs no new statute, only a policy memo. ## Frequently Asked Questions ### Does NYC Local Law 144 ban AI in hiring? No. It allows automated employment decision tools if the employer completes a recent bias audit, publishes a summary, and gives candidates advance notice. ### Who enforces the law? The New York City Department of Consumer and Worker Protection enforces it. The city’s new AI policy was issued jointly with the Commission on Human Rights and the Taxi and Limousine Commission. ### How much can violations cost? The statute sets a civil penalty of up to $500 for a first violation and $500 to $1,500 for each later one. The state Comptroller describes the range as $500 to $1,500 per day. ### Can an employer blame the vendor? Not under the city’s stated position. The interagency letter says an entity cannot avoid responsibility because it relied on an algorithm, AI, or other technology. ### How far in advance must candidates be told? At least 10 business days before the tool is used. The notice must say what qualifications or characteristics the tool will assess and must allow a request for an alternative process or accommodation. ### Does a general-purpose chatbot count as an AEDT? It can. The test is whether the tool produces a score, classification, or recommendation that substantially assists or replaces discretionary decision-making, not whether it was built for hiring. Employers should get legal advice on specific uses. ### Has DCWP fined anyone yet? The sources we reviewed do not confirm any specific penalty, employer, or amount. Trustible says targeted investigations have begun, but outcomes are not public in those materials. **The takeaway:** the city has stopped treating the algorithm as a separate party. Employers that audit, disclose, notify, and keep records will be in a defensible position. Those that point at their software will not.