AI Resume Screening Laws: NYC Local Law 144 and Beyond

NYC Local Law 144 bars an employer from using an automated employment decision tool (AEDT) to screen candidates unless the tool had an independent bias audit within the past year. Candidates must also get notice at least 10 business days before the tool is used, per the DCWP final rule. Penalties run $500 to $1,500 per day, according to the New York State Comptroller. Passing the NYC audit does not protect you from discrimination claims elsewhere, so this post also covers California, Illinois, Colorado and the EU. Status of every law is as of 16 October 2026.

What does NYC Local Law 144 require for AI resume screening?

It requires three things: a bias audit, a public summary and candidate notice. The Comptroller's audit report describes the duties as a bias audit no more than one year before use, a posted summary of results, and notice that an AEDT will be used, how, and what data it collects.

The DCWP rule adds the details:

• Notice timing: at least 10 business days before use, given on the employment section of your website, in the job posting, or by US mail or e-mail to candidates who reside in the city.
• Notice content: instructions for requesting an alternative selection process or a reasonable accommodation. The rule says nothing requires you to actually offer an alternative selection process.
• Posting period: the audit summary and its distribution date must stay posted for at least six months after the tool's latest use.
• Audit age: an AEDT may not be used if its most recent bias audit is more than a year old.

According to Norton Rose Fulbright, the law applies regardless of where the employer is headquartered, and only a summary of the audit, not the audit itself, must be public.

Does your resume screener count as an AEDT?

Only if it substantially assists or replaces discretionary decision making, and the DCWP rule defines that in three ways. A tool counts if you rely solely on its score, tag, classification or ranking; weight it more than any other criterion; or use it to overrule conclusions from other factors, including human decision-making.

A keyword ranker that sorts 400 applicants into a top 40 and drops the rest is the clear case. A tool that only highlights text for a recruiter who reads every application is less clear. If a recruiter's review is a rubber stamp on the tool's ranking, the second prong (weighted more than any other criterion) is where you are most exposed. Ask your counsel to review how the tool is used in practice, not how the vendor describes it.

How does a Local Law 144 bias audit work?

An independent auditor calculates selection or scoring rates by category and compares them as impact ratios. The rule defines the impact ratio as the selection rate for a category divided by the selection rate of the most selected category, or the equivalent for scoring rates. Its own example: if 100 Hispanic women apply and 40 are selected for interview, the selection rate is 40%.

Key mechanics from the rule:

The NYC rule does not set a pass mark. According to Pivot Point Security, the law does not specify actions to take if bias is found. The federal benchmark is the four-fifths rule: under 29 CFR 1607.4, a selection rate below 80% of the highest group's rate will generally be regarded by federal agencies as evidence of adverse impact. An audit that publishes a ratio below 0.8 without a response plan is a documented problem.

What are the penalties, and is NYC actually enforcing it?

Civil penalties are $500 to $1,500 per day, but enforcement has been thin. The Comptroller says DCWP can impose penalties in that range per day. Modulos, summarising section 20-872, says the first violation is capped at $500 and each day of use in violation is a separate violation. The two summaries differ slightly, so check the statute text with counsel.

The Comptroller's audit covered July 2023 to June 2025 and found:

• DCWP received only two AEDT complaints in that period.
• DCWP surveyed 32 companies and found a single issue of non-compliance. The Comptroller's staff reviewed the same companies and found at least 17 instances of potential non-compliance.
• DCWP officials said complaint-based enforcement plus education is the most effective approach, because it is hard to spot employers who never post an audit.

That is a weak enforcement record, and the Comptroller's report makes recommendations for DCWP to improve it. Treat it as a reason to expect more scrutiny, not as permission to skip the audit.

Can you be sued over AI screening even if you pass the NYC audit?

Yes. Local Law 144 is a transparency rule, and discrimination claims run under separate laws. The live test case is Mobley v. Workday (Case No. 3:23-cv-00770, N.D. Cal.), where the allegations are unproven.

What the record shows, with sources:

• The claim. According to Norton Rose Fulbright, Derek Mobley alleges that since 2017 he applied to more than 100 jobs with companies using Workday's screening features and was rejected every time. Workday has publicly said its AI recruiting tools do not make hiring decisions and are designed with human oversight.
• Vendor liability. On 12 July 2024 the court rejected the "employment agency" theory but let the "agent" theory proceed, according to Seyfarth.
• Collective action. In May 2025 the court granted conditional collective certification for the age discrimination (ADEA) claims, according to Norton Rose Fulbright.
• California reach. On 22 June 2026 the judge largely denied Workday's motion to dismiss. Duane Morris reports the court let the California Fair Employment and Housing Act (FEHA) claims proceed because Workday allegedly designs and operates its tools from California.
• Bias-testing privilege. On 28 May 2026 the court held Workday's attorney-curated bias-testing data was privileged, according to Norton Rose Fulbright. The firm notes this may not hold if the data went to a regulator, was made for a business purpose, or was analysed by a non-legal consultant.

The privilege point matters for how you structure testing. A public LL144 audit is not privileged, so decide with counsel whether to run a separate, lawyer-directed review.

California also has regulations. The Civil Rights Council's automated-decision system rules took effect on 1 October 2025. Ogletree Deakins says employers must keep automated-decision system data for four years, and that while auditing is not required, anti-bias testing may support a defence.

What do Illinois, Colorado and the EU require?

Each differs on timing and strength. The table summarises status as of 16 October 2026.

Illinois. Paul Hastings explains that Public Act 103-804 makes it a civil rights violation to use AI in recruitment, hiring and similar decisions if it has the effect of discriminating, or uses ZIP codes as a proxy. It is also a violation to use AI in those decisions without notifying employees, even with no discriminatory effect. The state's Department of Human Rights published proposed notice rules on 15 May 2026, then announced on 2 June 2026 it was postponing them with no revised timeline, as the National Law Review also reports. The statutory duty stands without the detailed rules.

Colorado. Seyfarth reports SB 26-189 replaces the 2024 law that was scheduled for 30 June 2026, and takes effect on 1 January 2027. It drops the duty of care and impact assessments. Employers must give notice before use and, after an adverse outcome, explain it in plain language within 30 days and offer a request for meaningful human review. Records are kept for three years. Enforcement is by the Attorney General only, with a 60-day cure period that sunsets on 1 January 2030. Indemnification clauses that shield a party from its own discrimination liability are void, so review vendor contracts (see hidden fees in HR software contracts).

EU. The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published on 24 July 2026 and entered into force on 27 July 2026, per Cooley. It moves the deadline for stand-alone high-risk systems, which include employment uses, from 2 August 2026 to 2 December 2027, according to the Cloud Security Alliance. Cooley notes the delay does not cover every 2 August 2026 obligation, and Article 50 transparency duties are treated differently. If you recruit EU candidates, plan for the later date but do not stop work.

What should an HR team do before switching on an AI screener?

Work through the steps below. This is a process outline from the sourced rules, not legal advice.

1. Inventory every tool that scores, ranks or filters applicants. Include ATS add-ons and sourcing tools, not only standalone screeners. For ATS context see Greenhouse vs Lever vs Ashby and the ATS features staffing agencies use.
2. Decide whether each tool meets the NYC three-prong test. Document how recruiters actually use the output.
3. Ask the vendor for its independent audit summary and its date. If the latest audit is more than a year old, you cannot use the tool for NYC candidates.
4. Post the summary and the notice. Give NYC candidates notice at least 10 business days before use, with accommodation instructions.
5. Calculate your own impact ratios on your own applicant flow. Compare against the four-fifths benchmark and write down what you do about any gap.
6. Keep a human who can override. Colorado's new law explicitly contemplates meaningful human review, and the NYC definition turns on whether the tool overrules human judgment.
7. Retain records. California requires four years for automated-decision system data; Colorado requires three.
8. Review vendor contracts. Look at indemnification, audit access and data-sharing terms before you sign or renew.
9. Plan notices for Illinois applicants now. The rules are withdrawn, but the statute applies.

If you are building a broader compliance process, see HR compliance software that keeps you out of court. For AI interview tools specifically, see Paradox vs HireVue.

What's still unclear?

Several points remain open as of 16 October 2026.

• Current NYC enforcement. The Comptroller's audit covers July 2023 to June 2025 only, so later enforcement activity is not captured here.
• Penalty wording. The Comptroller describes $500 to $1,500 per day, while Modulos describes a $500 first-violation cap. Confirm against the statute.
• Mobley outcome. The allegations are unproven, Workday disputes that its tools make hiring decisions, and the case is ongoing.
• Privilege ruling. It turned on specific facts about how Workday's lawyers curated the data. Your own testing program may not qualify.
• Illinois rules. No refiling timeline has been given, so the notice content and timing are unsettled. Law firm alerts also disagree on which title of the Illinois Administrative Code the proposed rules sit in.
• Colorado details. The Attorney General must adopt implementing rules. Sources also disagree on the signing date: Seyfarth and Constangy say 14 May 2026, while Lathrop GPM says 20 May 2026.
• Weakest point of this advice. Compliance steps reduce risk but do not remove it. A clean audit summary says nothing about how your recruiters use the tool day to day.