New York Audited Its Own AI-Hiring Law Enforcement. It Failed.
A city comptroller reviewed how New York enforces its AI-hiring bias-audit law and found a system barely functioning. What that means for employers using these tools.
New York City's law on AI hiring tools has a straightforward theory: audit the algorithm every year, post the results, tell candidates when it's being used. The agency that is supposed to enforce that theory just got audited itself, and the results were not flattering. That matters even for employers outside the five boroughs. Other states have written their own versions of this law after watching New York go first, and a shaky enforcement record in the original does not exactly inspire confidence in the copies.
The city's own comptroller found the watchdog wasn't watching
Testers called New York's 311 hotline with AI-hiring complaints to see whether they reached the right agency. Three in four calls never made it to the Department of Consumer and Worker Protection at all. The complaints that did arrive fared little better: the agency's own instructions were unclear, and complaints were often routed to the wrong place internally once they landed. Even the part of the job that should have been easiest — reading the bias audits companies are required to post publicly — went badly. The department reviewed thirty-two of those audits and flagged only one as noncompliant. When the comptroller's office reviewed the identical set of audits, it found at least seventeen potential problems the agency had missed.
That gap is the whole story in one number. Seventeen issues sitting in plain sight, on documents the law already requires companies to publish, missed by the agency whose entire job is reading them.
Weak enforcement is not the same as no law
None of this changes what Local Law 144 actually requires, and it is easy to read a story about a struggling regulator and conclude the rules don't really bite yet. That reading is backwards. An agency that has just been publicly embarrassed by its own city government has every incentive to tighten up fast, and it has already agreed to most of the comptroller's fixes. Those promised fixes read like a basic checklist: train staff across divisions, write down clear procedures, and actually use the enforcement tools already sitting on the shelf when deciding whether a company is compliant. The fact that a watchdog needed to be told to do that is exactly why the correction is likely to land hard. The requirements were never optional in the first place: New York requires employers to notify candidates at least ten business days before an automated tool is used to evaluate them, audit weakness or not.
New York is also not the only jurisdiction watching this space, and some of the others ask for more than notice. California's rules require employers using these tools to test for bias proactively and keep detailed records for at least four years, regardless of how the tool actually performed. A business operating in both states cannot treat either requirement as theoretical just because one enforcer is currently understaffed and behind on its own workbook. One more wrinkle is easy to miss if you have outsourced the screening step entirely: several of these state frameworks reach past the employer to the vendor that built the tool, so the comfortable assumption that liability stops with whoever sold you the software is no longer safe.
What to actually do before the enforcement phase gets real
Start with an inventory: list every tool that screens, scores, or ranks a candidate or an employee, even the ones nobody thinks of as "AI" because they've been running quietly for years. Any tool that meaningfully shapes who advances is the kind of tool this growing body of law is written for, whatever the vendor calls it.
Then check your own paperwork the way the comptroller checked New York's. Don't just confirm a bias audit exists somewhere. Read it, and ask whether an outsider skimming it would find what it says convincing. The standard an under-resourced city agency applies today is not the standard you want your own compliance to depend on. The agencies are behind today. They have already said they intend to catch up, and an audit finding that specific is not the kind a regulator quietly lets go. A compliance file that would satisfy a careful outside reader today is worth more than one that merely would have satisfied yesterday's under-resourced reviewer.