What Counts as an Automated Employment Decision Tool, and Does Your Hiring Stack Qualify?

An Automated Employment Decision Tool (AEDT) is any computational process, whether it's a machine learning model, a statistical scoring system, or a rules-based algorithm, that scores, ranks, or substantially assists a hiring or promotion decision. Under NYC's own definition, the key word is "substantially." If the tool's output meaningfully shapes who gets an interview or a promotion, it's covered. If it just stores resumes and lets a recruiter search by keyword, it isn't.

This distinction trips up a lot of HR and ops leaders who assume their applicant tracking system is safe because it's "just software." A plain ATS that lets a human search for "5 years Python" is fine. The same ATS with a bolt-on scoring feature that ranks candidates by predicted fit, even a simple weighted checklist, crosses into AEDT territory the moment that ranking substantially influences who advances. Most mid-market companies don't know which side of that line their vendor's newest feature update just moved them to. That's worth checking before you read another word of this post, because the rest of the compliance obligations only apply if the tool qualifies in the first place.

NYC Local Law 144: The Rule Every Other Jurisdiction Is Now Copying

Local Law 144 requires three things from any employer using an AEDT on a candidate or employee whose job is performed, even partly, in New York City: an independent bias audit completed within the year before the tool is used, a public summary of that audit posted where candidates can find it, and written notice to candidates at least 10 business days before the tool is used, explaining what data it collects and how it evaluates people.

Enforcement started on July 5, 2023, and it's run by the NYC Department of Consumer and Worker Protection. The NY State Comptroller's December 2025 enforcement audit is worth reading in full if you want a sense of how seriously the city is taking this: it documents ongoing gaps between the number of employers plausibly using AEDTs in NYC and the number who've actually published a compliant bias audit summary. That gap is exactly where enforcement risk concentrates.

Penalties are modest per violation but compound fast. According to Deloitte's breakdown, it's $500 for a first violation, then $500 to $1,500 per day for each subsequent violation or missing notice. Run an uncompliant tool across a hiring season with hundreds of candidates and the daily-violation structure turns a paperwork gap into a real number. The exact requirements are spelled out in the final rule text, and it's the version other states are borrowing from almost line for line.

Illinois, Colorado, California, and the EU: How Far the Rules Already Reach

NYC wasn't the last word. It was the opening move in a patchwork that now covers most of the markets a growing mid-market company hires into.

Illinois' AI Video Interview Act requires notice and consent before an AI system analyzes a video interview, and a 2022 amendment adds a reporting obligation: if AI is the sole determinant of who advances past the interview stage, the employer has to report applicant race and ethnicity data to the state. Colorado's AI Act, which we've covered in detail in our breakdown of what Colorado's new AI Act actually requires, extends similar high-risk obligations to employment decisions, with its own documentation and disclosure requirements taking effect in 2027. California's automated-decision-system rules under FEHA add yet another layer, focused on adverse-impact documentation for employers operating in the state.

Then there's the EU. Annex III of the EU AI Act names AI systems used "for recruitment or selection of natural persons" and to "evaluate candidates" as explicitly high-risk, which triggers conformity assessment, a documented risk management system, and human oversight requirements. If you're hiring in London, Berlin, or anywhere in the EU and using an algorithmic screening tool, you're inside this classification regardless of whether you've ever heard of Local Law 144. We go deeper on the specific deadline in our post on the EU AI Act's August 2026 high-risk deadline.

Put those four together and the pattern is obvious: a company hiring across NYC, Chicago, Denver, and London isn't dealing with one compliance question. It's dealing with four overlapping ones, each with a different audit cadence, a different notice window, and a different definition of what "high-risk" even means. Nobody sells a single off-the-shelf certification that covers all four, no matter what the vendor's landing page implies.

What an Independent Bias Audit Actually Has to Show

An independent bias audit is not a vendor telling you their tool is fair. It's a statistical test, run by a party with no stake in the outcome, that checks whether the tool's scoring produces disparate results across sex, race, and ethnicity categories, and reports the results publicly.

The standard most audits lean on is the EEOC's four-fifths rule, laid out in the agency's May 2023 technical guidance on assessing adverse impact in algorithmic selection procedures under Title VII. The rule is simple to state: if any protected group's selection rate falls below 80% of the highest-scoring group's rate, that's a signal of adverse impact worth investigating further. It's a federal standard, independent of NYC's law, which means it applies whether or not your company has ever hired a single person in New York City.

A few things make an audit actually independent rather than performative. The auditor shouldn't have a commercial relationship where their revenue depends on the tool passing. The audit should test the tool as it's actually configured and used in production, not a generic version the vendor ships to every customer. And the summary published to satisfy Local Law 144 should include enough detail (sample sizes, selection rates by category, the scoring criteria tested) that a reader can tell the difference between "we tested this rigorously" and "we ran a report and called it an audit."

Why Buying an "AEDT-Compliant" Vendor Tool Doesn't Transfer the Risk

Here's the part vendor sales decks tend to gloss over: under Local Law 144 and every peer law we've mentioned, liability sits with the employer, not the software provider. A vendor can market their tool as "Local Law 144 compliant" all day long, but if you deploy it without your own audit trail, your own notice workflow, and your own documentation of how it's configured for your specific roles, you're the one exposed when the Comptroller's office or a rejected candidate comes asking.

Littler Mendelson's analysis of the final regulation makes this point clearly: the audit obligation attaches to the use of the tool, not to its manufacture. A generic bias audit the vendor ran on their training data doesn't cover how you've weighted criteria for your operations manager role versus your sales role. If your configuration differs from what the vendor's own audit tested, you may have a compliance gap even while running a "certified" tool.

This is the same diagnosis-first argument that shows up across most of our work at Genta AI Solutions, just applied to a regulatory context instead of a workflow one. Before you decide whether to buy a compliance-branded AEDT vendor, extend your own AI hiring tool, or build something narrower and fully documented in-house, you need to know exactly which parts of your hiring process the tool touches, what data it trains or scores on, and who owns the audit trail when a regulator asks. Most companies skip that diagnosis and inherit the vendor's assumptions instead. If you're evaluating a vendor relationship for anything AI-related, our checklist on what to ask an AI vendor before you sign the contract covers the questions that apply well beyond hiring, and most of them apply here directly: where does the training data come from, who's liable for downstream decisions, and what happens to your data if the vendor relationship ends.

What to Ask Before You Deploy (or Keep Running) an AI Hiring Tool

A short list, drawn from actually working through this with clients rather than reading the statute cold:

• Has an independent bias audit been run on the tool as configured for your roles, within the past 12 months, and is the summary actually published somewhere candidates can find it?

• Who owns the audit documentation if you switch vendors? If the answer is "the vendor," you have no continuity when you leave.

• Does your notice workflow reach candidates at least 10 business days before the tool is used, and does it explain the data collected and evaluation method in plain language, not legal boilerplate?

• Are you hiring for roles performed in more than one jurisdiction? If so, map which of NYC, Illinois, Colorado, California, or the EU applies to each role, because a single national tool doesn't get a single compliance answer.

• Does the tool's scoring logic change based on model updates the vendor pushes without notice? If so, your last audit may no longer describe the tool you're actually running.

None of this requires exotic engineering. It requires someone treating the audit trail and the notice workflow as part of the system, not an afterthought bolted on after legal flags a problem. That's the operational discipline that separates companies that sail through an enforcement inquiry from ones that get a $1,500-a-day letter.

Where This Leaves Mid-Market Employers in 2026

The regulatory patchwork isn't slowing down, and every new state law borrows heavily from NYC's blueprint: independent audit, public disclosure, advance notice. If you're hiring across even two of the jurisdictions we've covered, treating compliance as a one-time vendor checkbox is a bet against how this space is trending. The companies handling it well are the ones who diagnosed their actual hiring workflow, decided deliberately whether to buy, extend, or build their scoring tool, and kept the audit trail somewhere they control rather than somewhere a vendor controls for them.

If you're working through this decision for your own hiring stack, this is exactly the kind of diagnosis our Discovery phase at Genta AI Solutions runs before anyone touches a line of code, and we're happy to compare notes.

Frequently asked questions

What counts as an Automated Employment Decision Tool (AEDT) under NYC Local Law 144?

An AEDT is any computational process, algorithmic, statistical, or machine learning based, that scores, ranks, or substantially assists or replaces a discretionary hiring or promotion decision for a role performed in NYC. Basic resume storage or keyword search doesn't qualify. A feature that ranks candidates by predicted fit does.

Does Local Law 144 apply if my company isn't headquartered in New York City?

Yes. The law applies based on where the covered role is performed, not where the employer is headquartered. A company based in Austin using an AI screening tool to hire for a role performed in NYC, even partially or remotely tied to the city, falls under Local Law 144's audit, notice, and posting requirements.

What does an independent bias audit for an AI hiring tool actually have to include?

It's a statistical test, conducted by a party without a financial stake in the outcome, checking selection rates across sex, race, and ethnicity categories, typically against the EEOC's four-fifths adverse-impact standard. The results, including sample sizes and rates by category, have to be summarized and published, not just handed to the employer privately.

What happens if we don't comply, what are the actual penalties?

The first violation carries a $500 fine, with an additional $500 for each same-day violation. Subsequent violations, or a failure to provide required candidate notice, run $500 to $1,500 per day. Those daily penalties add up fast across a hiring season with hundreds of applicants, which is why the Comptroller's enforcement audit flagged compliance gaps as a real financial exposure, not just a paperwork risk.

Does a basic applicant tracking system (ATS) count, or only tools that score or rank candidates?

A plain ATS used only for storage and keyword search generally doesn't count as an AEDT. The moment that system adds a scoring or ranking feature that substantially influences who advances, it crosses into AEDT territory, even if the underlying software is the same product you've always used. Vendor feature updates are the most common way companies drift into coverage without noticing.