For HR tech vendors building AI-powered hiring tools — resume screeners, candidate rankers, interview platforms, matching engines — New York City's Local Law 144 is the most directly applicable AI regulation in the United States. The law does not regulate vendors by name. It regulates the employers and employment agencies that deploy your product. But the practical effect is that your product cannot be deployed in NYC unless it has been through an independent bias audit, and that audit has to be published before the tool is used.

Three years in, the law's effect on the HR tech market is not theoretical. Enterprise procurement now treats audit documentation as a gate. Class action litigation against vendors whose tools allegedly produced discriminatory outcomes has cleared early procedural challenges. And the state-law layer beyond NYC has continued to expand, even as a federal preemption push complicates the longer-term picture.

This playbook covers what NYC LL 144 actually requires of HR tech vendors, why "we just build the tool" is no longer a defensible posture, where DCWP enforcement stands, the multi-state outlook, and what audit certification has become in the enterprise sales cycle.

Key Takeaways

  • NYC LL 144 binds employers, but no employer can comply without vendor cooperation — the audit obligation sits on the contract surface between you and your customer.
  • Mobley v. Workday cleared the procedural path for vendors to be named as agent-defendants in discrimination class actions, regardless of LL 144's direct-regulation scope.
  • DCWP enforcement has been quiet; private right of action under NYC HRL is where the exposure is materializing. Per-day penalty exposure compounds fast on unaudited tools.
  • Multi-state law (Colorado SB 26-189, California FEHA, Illinois HB 3773) and federal preemption uncertainty argue for calibrating to the highest-bar jurisdiction and tracking the EO litigation.
  • The Warden Assured certification clears procurement diligence inside the buyer's window — audit documentation has moved from differentiator to gate.

‍What NYC LL 144 Requires of HR Tech Vendors

NYC Local Law 144 is structured around three core requirements that bind employers and employment agencies using Automated Employment Decision Tools (AEDTs) for hiring or promotion decisions affecting NYC-based candidates.

Annual independent bias audit: The employer must commission a bias audit from an independent third party at least once per calendar year. The audit measures impact ratios across sex and race/ethnicity categories using the 4/5ths rule as a baseline threshold.

Public disclosure of audit results: The employer must publish a summary of the most recent bias audit on a public-facing website, including the audit's distribution date, the score ranges by category, and the impact ratios for each group tested.

Candidate notification: Candidates must be notified at least 10 business days before an AEDT is used in their evaluation and given the opportunity to request an alternative assessment where reasonable.

These requirements bind the employer or employment agency, not the vendor directly. But none of them is satisfiable without vendor cooperation. The employer needs your audit-ready data, your model documentation, and in most cases a vendor-coordinated audit their internal teams can rely on. In practice, the law's compliance burden sits on the contract surface between you and your customer.

The Vendor Liability Question: Why "We Just Build the Tool" Doesn't Hold

A common starting posture from HR tech vendors has been: NYC LL 144 regulates employers, not us. That posture has held up legally as far as the four corners of the statute. It has not held up commercially, and it is collapsing in litigation.

Commercially, every enterprise buyer of AEDT-class tools now treats audit documentation as a procurement requirement. A vendor that cannot produce a current third-party bias audit forces the buyer to commission one independently — at the buyer's cost, on the buyer's timeline, and with the buyer's chosen audit firm. That friction is enough to lose a deal. In a competitive HR tech category, an audited tool wins the procurement review and an unaudited tool loses it.

Legally, the "we just build the tool" defense is weakening. Plaintiff's attorneys in employment discrimination cases have begun naming vendors directly as co-defendants, on the theory that the vendor's product was the proximate cause of the disparate outcome. The early procedural challenges to this theory have not held. Which brings us to Mobley.

Mobley v. Workday and the Vendor Defendant Problem

Mobley v. Workday is the case every HR tech vendor's general counsel should be tracking. The case alleges that Workday's AI screening tools discriminated against Black, older, and disabled applicants. What makes it precedent-setting for vendors is not the underlying discrimination allegation. It is the procedural ruling that Workday — the vendor, not the employer — can be held liable as an "agent" of the employers using its tool.

That ruling cleared the path for collective treatment, meaning the case can proceed against Workday on behalf of a class of applicants who were screened by Workday's tools across many different employer customers. The exposure is not capped at one customer's hiring volume. It is the aggregate of every applicant ever screened by the in-scope tool, across every customer.

For HR tech vendors, the Mobley framing creates two practical consequences. First, the vendor's own bias testing is now potential evidence in litigation against you, not just against your customers. Second, the absence of a current independent bias audit becomes harder to defend in deposition than the audit itself. A clean audit creates a record. No audit creates a vacuum that plaintiff's counsel fills.

Where NYC DCWP Enforcement Stands

The New York City Department of Consumer and Worker Protection, which administers LL 144, has been comparatively quiet on enforcement actions since the law became enforceable in July 2023. Compared to the volume of public commentary about the law, the public docket of DCWP-initiated penalties remains small.

That should not be read as a reduced risk profile. Two things are happening underneath the quiet enforcement.

First, the statutory exposure is per-day, not per-violation. The penalty schedule is $500 for a first violation and $1,500 per day for each day a non-compliant AEDT remains in use. A single tool deployed without a current audit for a quarter is six figures of exposure before DCWP issues its first finding.

Second, NYC's broader civil rights architecture creates a private right of action under the city Human Rights Law that does not depend on DCWP acting. Plaintiff's attorneys do not need DCWP to enforce LL 144 in order to pursue discrimination claims against employers and the vendors whose tools allegedly produced the disparate outcome. The enforcement that matters is increasingly happening in plaintiff-side litigation, not in city-agency assessments.

Beyond NYC: Multi-State AI Hiring Law for HR Tech Vendors

If your tool is sold to customers outside NYC, the multi-state picture matters as much as LL 144 itself.

Colorado SB 26-189, which replaced Colorado's earlier SB 24-205 framework in May 2026, takes effect January 2027. It does not mandate a bias audit by name. It uses a disclosure-and-human-review model, requiring covered employers to disclose when AI is used in employment decisions and to provide a human-review pathway. The discrimination liability the law creates is the kind of risk that an independent bias audit is the strongest evidentiary defense against, which is why Colorado-deploying vendors should not treat SB 26-189 as a reason to lower the audit bar relative to NYC.

California's FEHA amendments brought AI hiring tools into the state's anti-discrimination framework. FEHA's enforcement record on disparate impact creates direct litigation exposure for tools that produce protected-class disparities, whether or not a specific AI-targeting statute is invoked.

Illinois HB 3773 amended the Illinois Human Rights Act to add employment AI explicitly to the state's anti-discrimination framework, effective January 2026. The Illinois framework focuses on disclosure and adverse-impact accountability rather than a specific audit mandate.

The federal preemption variable. A December 2025 White House executive order seeks to preempt or limit state-level AI regulation, citing the patchwork-compliance burden as the basis for federal action. Litigation challenging the EO is in motion, and the outcome will materially shape the state-law picture over 2026-2027. For now, the prudent vendor posture is to maintain a multi-state compliance baseline calibrated to the highest-bar jurisdiction (NYC) while tracking preemption rulings as they land. The audit itself is preemption-resistant — it defends against discrimination liability under federal law (Title VII) regardless of which state-specific statute is in scope.

What an Independent Bias Audit Covers — and What "Independent" Actually Means

An LL 144-compliant bias audit measures the AEDT's selection-rate or scoring-rate disparities across sex and race/ethnicity, including intersectional categories. Tools with pass/fail outcomes are audited on selection rates. Tools that produce numeric scores are audited on the proportion of each demographic group scoring above the median. The 4/5ths rule (impact ratio below 0.8) is the baseline threshold for surfacing adverse impact.

A rigorous audit goes beyond the threshold. Intersectional analysis surfaces disparities that group-level analysis misses — Asian women, Black men, and similar intersections often diverge from single-axis cuts. Dual-method approaches that combine disparate-impact analysis with counterfactual testing — does changing a candidate's demographic attribute change the score — produce a more complete picture of where bias enters the model.

The "independent" requirement is structural, not stylistic. The auditor cannot be involved in developing, distributing, or using the tool, and cannot have a direct financial interest in the employer or the vendor. A vendor cannot audit its own tool. An employer cannot self-audit. The independence requirement is the law's most consequential design choice, because it forces the audit's findings to be defensible in litigation rather than reframed in marketing copy.

Audit Documentation as a Sales Accelerant: The Warden Assured Certification

The most consequential change in the HR tech sales cycle over the last two years is that audit documentation has moved from a differentiator to a gate. Enterprise procurement teams now ask for current third-party audit documentation as part of standard vendor diligence. A vendor that hands over a clean Warden Assured certification clears that gate inside the diligence window. A vendor that does not extends the procurement timeline by however long it takes the buyer to commission an audit independently — typically a quarter or more.

The Warden Assured certification serves three procurement functions at once. It is evidence of LL 144 compliance for NYC-deploying customers. It is a defensible record under discrimination-litigation theories that extend to multi-state and federal jurisdiction. And it is a procurement artifact that lets the buyer's compliance, legal, and security teams close out the AI-tooling section of vendor diligence with documentation rather than a question.

The strategic posture this enables is the one that converts: vendors who lead with audit certification, not who add it as a follow-up. Enterprise buyers respond to compliance posture as a signal of operational maturity. The audit is the cheapest brand investment a venture-funded HR tech company can make against a six- or seven-figure enterprise deal cycle.

A Compliance Playbook for HR Tech Vendors

For HR tech vendors building or selling AI-powered hiring or promotion tools, the operational playbook has four steps.

Step 1: Scope assessment. Confirm whether your tool meets the AEDT definition under LL 144 — does it use machine learning, statistical modeling, or AI to produce a prediction, recommendation, or score that substantially assists a hiring or promotion decision? If yes, scope expands to which of your customers are deploying it for NYC-based candidates or NYC offices hiring for remote roles.

Step 2: Independent audit commissioning. Engage a qualified independent auditor with a documented LL 144 methodology. The auditor must have no involvement in developing, distributing, or using the tool, and no direct financial interest in the parties under audit.

Step 3: Publication-ready summary. The audit output must include a summary formatted for public publication — distribution date, score ranges, impact ratios, intersectional cuts. Your customers need this document to satisfy their own disclosure obligations.

Step 4: Continuous monitoring. Annual audits set the compliance floor. Continuous monitoring catches model drift between formal audit cycles and produces the evidentiary record that discrimination litigation will require if it comes. The regulatory direction across NYC, Colorado, and the EU AI Act all point toward continuous oversight, not annual snapshots.

For employer-side compliance — what your enterprise customers need to do from their side of the contract — see the Employer's Guide to the NYC Bias Audit Law. For the legal definition and category scope of AEDTs in detail, see Automated Employment Decision Tools (AEDT) Under NYC LL 144.

Audit and Certify Your AEDT Before Your Next Enterprise Cycle

Warden AI runs independent bias audits and continuous monitoring for the HR tech ecosystem — bias audits engineered for the procurement diligence stage of the enterprise sales cycle. Book a 30-minute demo.

Related Articles

Frequently Asked Questions: NYC LL 144 for HR Tech Vendors

The text of LL 144 binds employers and employment agencies. Vendors are not named regulated parties. In practice, however, no employer customer can satisfy LL 144's audit and disclosure requirements without vendor cooperation — the audit-ready data, model documentation, and audit coordination all originate with the vendor. The commercial effect of the law on vendors is direct, even if the legal scope is indirect.

LL 144 sets no statutory fee. Cost depends on the complexity of the tool being audited, the size and shape of the historical data set, and whether the audit covers a single tool or multiple model variants. Most vendors treat the audit as a recurring annual cost rather than a one-off. Warden AI offers flat-fee packages built around that annual compliance cycle.

A standard audit typically takes 15–20 business days from the point at which data is provided to the independent auditor. Timelines extend if data needs cleaning or if the tool covers multiple roles or jurisdictions. Because LL 144 requires the audit to be published before the tool is used, and requires 10 business days' candidate notification, vendors should start well ahead of any deployment cycle.

Under NYC DCWP rules, if the independent auditor determines there is not enough historical data for a statistically significant result, the audit can be conducted using test data. The published summary must explain why test data was used and describe its source. The audit still meets DCWP requirements with a limited data set, provided the methodology is documented.

No. LL 144's independence requirement excludes the tool's vendor from auditing its own product, because the auditor cannot have any financial interest in the tool under review. The same restriction applies to internal employer-side audits where the auditor is part of the deploying organization. The independence requirement is structural — a vendor cannot satisfy it through internal review or by retaining an auditor with financial ties to the deployment.

The audit defends against discrimination liability under federal law (Title VII) and under any state framework that survives preemption. The independent bias audit is preemption-resistant because its underlying purpose — producing defensible evidence that an AEDT's outcomes are not adverse — is anchored in federal employment discrimination law, not in any specific state statute. Vendors who calibrate their audit posture to NYC's bar are well positioned regardless of how the preemption litigation resolves.