Ask an AI assistant who has to comply with New York City's law on automated hiring tools, and you will likely be told that the law requires tools to undergo a bias audit. That framing is common. It also misstates who the law regulates, and that matters to every company building AI for recruiting and hiring.
Local Law 144 places its obligations on employers and employment agencies that use automated employment decision tools in New York City. The company that builds the tool has no direct obligation under the law. And yet, in practice, the vendor is the one fielding the questions, supplying the data, and negotiating the contract terms that make its customers' compliance possible.
Connecticut has now taken a different path. Public Act 26-15—the AI bill informally called the "CART Act"—splits obligations between developers and deployers, and requires no bias audit at all. Below, we walk through both laws, what has changed in enforcement, and what AI hiring vendors should be doing now.
Who Local Law 144 binds
Local Law 144 (N.Y.C. Admin. Code §§ 20-870 to 20-874) and the Department of Consumer and Worker Protection's (“DCWP”) implementing rules (6 RCNY § 5-300 et seq.) apply to an employer or employment agency that uses an automated employment decision tool to make employment decisions about candidates or employees in New York City.
An automated employment decision tool is a computational process—derived from machine learning, statistical modeling, data analytics, or artificial intelligence—that issues a simplified output, such as a score, classification, or recommendation, used to substantially assist or replace discretionary decision-making. Under DCWP's rules, a tool meets that standard if the employer relies solely on its output, weighs the output more than any other criterion, or uses it to overrule other factors, including human judgment.
Before using a covered tool, the employer or employment agency must meet three conditions. First, the tool must have been the subject of an independent bias audit within one year before its use. Second, the employer must publish a summary of the most recent audit results, along with the tool's distribution date, on its website. Third, the employer must notify candidates and employees at least 10 business days before the tool is used, including the job qualifications and characteristics the tool will assess, and must disclose the type and source of data collected and its data retention policy on written request.
Civil penalties run up to $500 for a first violation and between $500 and $1,500 for each subsequent violation. Each of these obligations belongs to the employer or employment agency using the tool.
Why the work reaches vendors anyway
Because the law binds only the employer, its requirements reach vendors through procurement and contracts. An employer cannot commission a meaningful bias audit without the vendor's cooperation, and it cannot publish a summary of results it never received. In our work with AI hiring platforms, enterprise customers now ask for some combination of the following:
Audit cooperation and data access. Selection or scoring rates and impact ratios, and assistance to the employer or its independent auditor before launch and on an ongoing basis.
Prior audit documentation. Whether the tool has already been audited, by whom, whether the auditor was independent, and a full copy of the results.
Notice of model changes. How often the model changes, and advance notice of changes that could make a prior audit stale.
Representations and indemnities. Who bears the risk if the tool produces discriminatory results.
The most common mistake on the vendor side is promising more than the law asks. A vendor that represents its tool is "Local Law 144 compliant" has made a promise about obligations that belong to its customer, and that it cannot control. The stronger commitment is to cooperation: defined data, defined documentation, and defined timelines.
Enforcement is catching up
For its first two years, Local Law 144 was rarely enforced. (We wrote about likely reasons why, in this post dated March 25, 2025, linked here.) That seems to be changing.
In December 2025, the New York State Comptroller released an audit of DCWP's enforcement of the law, covering July 2023 through June 2025, and found it ineffective. Of the test calls auditors placed to the City's 311 line about automated hiring tools, 75% were misrouted and never reached DCWP. DCWP reviewed 32 publicly posted bias audits and flagged 1 compliance issue; the Comptroller's review identified at least 17 potential violations, including problems with audit quality and auditor independence.
DCWP disputed parts of the findings, but agreed to adopt 10 of the Comptroller's 13 recommendations in full and 1 in part—including strengthening its review of bias audits and monitoring whether employers renew them annually. No new rules or amendments have followed. But employers should expect closer review of the audits themselves, and vendors should expect their customers to ask harder questions about who conducted the audit and how.
Connecticut takes a different path
Connecticut's Public Act 26-15, "An Act Concerning Online Safety," includes the employment provisions of the AI bill informally called the "CART Act" (P.A. 26-15 §§ 7–14; the new sections are not yet codified). They cover "automated employment-related decision technology": technology that processes personal data and produces output that is a substantial factor in, or materially influences, an employment-related decision, such as hiring, promotion, discipline, or discharge.
Two features set Connecticut apart from New York City. First, there is no bias audit or impact assessment requirement. Second, obligations fall on both the developer and the deployer.
Deployers. An employer using a covered tool must tell employees and applicants, in plain language, when they are interacting with it (unless that would be obvious to a reasonable person). It must also give written notice before a decision is made, covering the tool's use and purpose, the nature of the decision, the tool's trade name, the categories of personal data used and how they are assessed, the sources of that data, and how to contact the deployer.
Developers. A developer whose tool is advertised, marketed, configured, contracted for, sold, or licensed to materially influence employment decisions must give deployers the information they need to meet those notice duties. A developer may also assume the deployer's duties by binding contract.
Timing and enforcement. These duties apply to tools deployed on or after October 1, 2027. The Attorney General enforces them exclusively, as unfair trade practices under the Connecticut Unfair Trade Practices Act. There is no private right of action, and violations occurring on or before December 31, 2027 come with a 60-day opportunity to cure.
What is already in effect. One part of the law took effect on October 1, 2026. Connecticut's anti-discrimination statutes now provide that the use of such a tool "shall not be a defense" to a discrimination complaint, and the Commission on Human Rights and Opportunities or a court may consider an employer's anti-bias testing—its quality, efficacy, recency, scope, results, and the employer's response.
Connecticut's existing privacy statute, the Connecticut Data Privacy Act, gives consumers a right to opt out of profiling, but its definition of "consumer" excludes individuals acting in an employment context, so it does not reach applicants and employees. The new law does not create an equivalent right for applicants and employees. What it adds, however, is transparency, through its notice requirements: applicants and employees must be told when a tool is used and what it relies on.
Beyond New York and Connecticut
New York City and Connecticut are two of several jurisdictions now regulating AI in hiring, and a vendor selling nationally has to account for all of them.
Illinois. Since January 1, 2026, the Illinois Human Rights Act makes it a civil rights violation for an employer to use AI that has a discriminatory effect on protected classes, or to use ZIP codes as a proxy for them, and requires employers to notify employees when AI is used. The Illinois Department of Human Rights proposed rules on that notice in May 2026 but withdrew them in June, so no implementing rule is yet in effect. Illinois’s separate Artificial Intelligence Video Interview Act requires notice, an explanation, and consent before AI analyzes a recorded interview.
Colorado. Colorado’s much-discussed original AI Act never took effect. In May 2026, the state repealed and replaced it with a new law, effective January 1, 2027, that drops the original duty of reasonable care and impact assessments in favor of transparency: developers and deployers must make disclosures, people must receive notice before a covered tool is used, and anyone who receives an adverse decision is entitled to an explanation within 30 days and human review. Employment decisions remain covered, and the law expressly includes employees and applicants. The Attorney General enforces it exclusively.
California. Civil Rights Council regulations in effect since October 1, 2025 apply the Fair Employment and Housing Act’s existing anti-discrimination standards to automated-decision systems and require employers to keep related records for four years. Importantly for vendors, the regulations treat an employer’s agent, including one acting through such a system, as an employer, and the California Supreme Court has held that a business-entity agent with at least five employees performing regulated functions for the employer can be directly liable. Separately, businesses that use automated decisionmaking technology for significant decisions, including employment decisions, must comply with California’s privacy regulations on that technology by January 1, 2027.
California’s agent provision is the one to watch. For a vendor with at least five employees that screens candidates on an employer’s behalf, it is the clearest path to discrimination liability in its own right.
What AI hiring vendors should do now
First, build an audit support package. Have the data, documentation, and prior audit results ready before your prospective customer’s request arrives, along with a defined process for supporting a new audit when the model changes.
Second, fix your contract terms. Commit to cooperation, data access, and notice of material model changes. Limit representations to what you control, and do not represent that your tool is "compliant" with laws that bind your customer. In Connecticut, treat any request to assume the deployer's notice duties by contract as a deliberate business decision, and price it accordingly.
Third, prepare for Connecticut now. Before October 1, 2027, assemble the information deployers will need for their notices: the tool's purpose, the categories of personal data it uses and how they are assessed, and the sources of that data. And if you sell into California, assess whether your role in screening candidates makes you the employer’s agent.
If your product scores, ranks, or screens candidates, these are product and contracting decisions as much as legal ones. AMBART LAW advises AI hiring and recruiting platforms on these questions through our fractional general counsel and AI product counsel work.
AMBART LAW’s ability to take on a new matter depends on a conflicts check against our existing clients, and we may be unable to represent companies that compete with them.
