I Checked 38 NYC Employers for the Bias Audit the Law Requires. Two Published One. The ATS They All Share Publishes One Monthly.

TL;DR: NYC Local Law 144 has been enforced since July 5, 2023, and requires a bias audit of automated employment decision tools, public posting of the results, and candidate notice 10 business days before use. On August 15, 2026 I harvested 954 live NYC job postings across 38 employers and checked each one. 2 of 38 employers publish a bias audit summary I could reach, and 36 of 38 publish neither an audit nor a notice. That is 5.3%, statistically indistinguishable from the 4.6% Cornell measured across 391 employers in 2024. A missing audit is not evidence of a violation: employers decide for themselves whether a tool is in scope, the condition the Cornell authors named "null compliance," so a null result cannot be read as non-compliance. This is a count of what is published, not legal advice.

The interesting part is not the employer number. It is that all 38 of them run their hiring on a vendor that audits its own AI every month, publishes the results, and hands them a notice template.

What does Local Law 144 actually require?

Straight from the city's own page, which is refreshingly short. Local Law 144 of 2021 "prohibits employers and employment agencies from using an automated employment decision tool unless the tool has been subject to a bias audit within one year of the use of the tool, information about the bias audit is publicly available, and certain notices have been provided to employees or job candidates." The Department of Consumer and Worker Protection notes it "will begin enforcement of this law and rule on July 5, 2023," and that it revised its guidance slides in June 2023 "to clarify that the Notice must be provided 10 business days prior to use of an AEDT."

Three obligations, then: audit it, post the results where a candidate can find them, and warn the candidate in advance. DCWP takes complaints on all three.

What did Cornell find in 2024?

The baseline everyone cites comes from a paper I read rather than a summary of it, because the summary I was handed and the paper agree but the contract here is to check. "Null Compliance: NYC Local Law 144 and the Challenges of Algorithm Accountability", by Lucas Wright, Roxana Mike Muenster, Briana Vecchione, Tianyao Qu, Pika Cai, 155 student investigators, Jacob Metcalf and J. Nathan Matias, was submitted June 3, 2024. Its abstract states the numbers plainly: "155 student investigators recorded 391 employers' compliance with LL 144 and the user experience for prospective job applicants. Among these employers, 18 posted audit reports and 13 posted transparency notices."

18 of 391 is 4.6%. 13 of 391 is 3.3%. The authors are careful about what that means, and so am I: "Since the law grants employers substantial discretion over whether their system is in scope of the law, a null result cannot be said to indicate non-compliance, a condition we call 'null compliance.'" They also report that nearly every audit that did exist reported an impact ratio above 0.8, the threshold that keeps a result out of trouble in employment discrimination cases.

What did 38 NYC employers show in 2026?

My sample is smaller and differently drawn, so it is a check on the shape of the finding rather than a replication. I pulled full posting bodies from 44 employer job boards through Greenhouse's public API on August 15, 2026 and kept every posting whose location field names New York or NYC. That gave 954 live NYC postings across 38 employers.

In the posting body itself, where a candidate would actually see it, 1 employer of 38 carries a Local Law 144 notice. Braze does, on all 54 of its NYC listings, and the text is a real notice rather than a gesture: it names the AEDT, offers "an alternative selection process or a reasonable accommodation instead of AI-assisted review," gives an address for the request, and links a bias audit summary.

Following every candidate privacy and legal link the postings carry adds exactly one more. Datadog's candidate legal notices disclose AEDT use, promise consent and an opt-out "where required by law," add that "choosing to opt out will not impact candidacy," and state that "an independent auditor has reviewed the AEDTs used by Datadog, the results of which may be viewed here and here."

So: 2 of 38 employers publish a bias audit summary. 2 of 38 have an LL144-style notice reachable anywhere. 36 of 38 have neither. Two other employers, Reddit and Robinhood, disclose AI use in hiring without invoking Local Law 144, and Robinhood's applicant privacy notice runs the other way: "we do not carry out any fully automated decision-making about you." Under this law that sentence is a coherent position, not an evasion. It is null compliance working exactly as designed.

2 of 38 is 5.3%. Cornell got 4.6% two years ago across ten times the employers. Whatever the last three years of AI hiring discourse did, it did not move the publication rate.

Why does the vendor publish an audit when the employers don't?

Here is the part I did not expect. Every employer in my sample runs on Greenhouse, and that is an artifact of how I sampled: I harvested Greenhouse boards, so 38 of 38 is by construction, not a discovery. What is not an artifact is what the vendor does.

Greenhouse's own AI/ML security and privacy documentation describes "monthly third-party bias audits by Warden AI across 10 protected classes," and says "the results are publicly available." It also says the company "provides AI notice templates to notify job applicants how AI will be used during hiring," and then the sentence that explains the entire gap: "Each company can configure custom notices based on their compliance obligations."

The audit exists. The notice text exists. It ships in the product. The obligation to turn it on sits with the employer, and 36 of 38 employers in my sample have not surfaced one. The compliance work was done a layer below the party the law names, which is a tidy description of why a transparency mandate can be fully operational at the vendor level and nearly invisible at the level where a job applicant is standing.

Does a missing audit mean anyone broke the law?

No, and the paper that established the baseline says so more forcefully than I would. Employers self-determine whether their tool is an AEDT. The definition turns on whether the tool substantially assists or replaces discretionary decision-making, and a company that concludes its resume ranking is only an assistive sort owes nothing under this law and appears in my "neither" bucket looking identical to a company that never thought about it. I cannot tell those two apart from outside, and I am not going to pretend otherwise by naming anyone as non-compliant.

The measurement has other holes. I read only what is publicly reachable from a job posting, and a notice emailed 10 business days before an assessment satisfies the law while staying invisible to me. My 38 employers skew to technology firms with legal teams that write candidate privacy notices at all, which likely overstates disclosure rather than understating it.

What this does not prove

It does not prove Local Law 144 failed. It proves the law produces very few public artifacts, three years in, at close to the rate an independent research team measured in 2024. That distinction matters right now, because Illinois and Colorado are building on this model, and Illinois' version has not even defined what notice looks like yet. If the design goal was a public record a job seeker can consult, 2 of 38 is the honest read on how that is going.

There is a recurring shape here. A rule that is cheap to satisfy at the platform layer and expensive to satisfy at the employer layer gets satisfied at the platform layer, and the entity that owes the disclosure quietly becomes the entity least likely to produce it. The audits in this story were mostly run by, or on behalf of, the companies selling the tools, which is the same evidence problem that shows up whenever a vendor measures its own product. Cornell already flagged the tell: nearly every published audit cleared 0.8. Audits that a regulated party commissions, scopes, and decides whether to publish tend to come out fine.