Three Tests Decide Whether Your Tool Is an AEDT Under Local Law 144

What makes a tool an AEDT?

Two elements together, never one alone. First, a computational process derived from machine learning, statistics or another data-processing technique that issues a simplified output: a score, a tag, a classification or a ranking. Second, that output is used to substantially assist or replace discretionary decision-making about employment ¹. A tool producing no simplified output about a person sits outside the definition regardless of how much AI runs inside it.

The second element is where the rules get specific. Under the Department of Consumer and Worker Protection's final rules at 6 RCNY 5-300, an output substantially assists or replaces discretion in exactly three situations ²:

1. The output is relied on solely, with no other factor considered. 2. The output is weighted more heavily than any other single criterion in the set. 3. The output is used to overrule a conclusion derived from other factors, human decision-making included.

If none of the three describes what happens in your process, the tool is not an AEDT and no bias audit duty attaches to it. If one of them does, the duties arrive as a package: a bias audit conducted within the prior year, a summary of the results posted publicly, and notice to the candidate at least ten business days before the tool is used ¹. The law took effect on January 1, 2023, and DCWP enforcement began that July ¹.

Notice what the three conditions are about. Not the model, not the vendor, not the marketing. They describe a human workflow, which means the same software can be an AEDT at one employer and not at another, and can change category on a Tuesday when someone edits a scorecard.

Which tools fall outside it?

The ones that move information without concluding anything about a person. A transcriber, a translator, a file converter, a scheduler and a spell checker all produce output, but none of it is a simplified statement about a candidate, so the definition never reaches them. The genuinely hard cases are tools that do emit a score or a category and sit beside a human who reads every application anyway.

A resume parser is the clearest example of the split. One that reads a file and fills form fields has concluded nothing. One that assigns a match category and hides everyone below it has concluded a great deal. Being able to page back through the hidden ones is not the same as having considered another factor, and the sole-reliance condition asks what was considered. Whether your ATS counts as AI is the same question wearing different words. Run it against the features a vendor switched on in an upgrade, which is where the surprises live.

The awkward part of this regime is that the employer makes the classification call and nobody checks it up front. Cornell researchers who sent 155 student investigators to record what 391 employers publicly posted under the law, across 17 days in late 2023, found 18 audit reports and 13 transparency notices across the whole set ⁴. They are emphatic that these are compliance rates and not non-compliance rates, and they coined the term "null compliance" for exactly this ambiguity: an absent audit may mean an employer concluded the law does not apply to its tools.

That freedom is real, and it is also the trap. A classification nobody wrote down is a classification nobody can defend later.

Why a posted bias audit proves less than it looks

Because the rules define one narrowly. A Local Law 144 bias audit computes a selection rate and an impact ratio for each category, separately for sex, for race and ethnicity, and for intersectional categories ². It measures group selection rates and nothing else: not accuracy, not job-relatedness, not whether any individual was treated fairly. A tool can pass its audit and still be the wrong instrument for your role.

Two carve-outs inside the rules make a posted audit weaker evidence than the word suggests. An independent auditor may exclude any category representing less than 2% of the audit data from the impact-ratio calculation, which most often excludes the smallest groups in the applicant pool, the ones a bias audit exists to protect. And an employer that has never used the tool may rely on an audit built entirely on other employers' historical data, or on synthetic test data where too little real data exists ². So a first-time buyer can lawfully post an audit that describes nobody who ever applied to it.

Enforcement adds a second discount. A New York State Comptroller audit covering the first two years found DCWP received two AEDT complaints in the whole period, and that nine of the auditors' twelve test calls to 311 never reached the agency at all ³. In DCWP's only proactive sweep, it reviewed 32 company websites and identified one instance of potential non-compliance; state auditors re-reviewing the same 22 employers on public information alone found at least 17 ³.

Those numbers measure the complaint pipeline. They say a posted audit is not a seal, and they say nobody should plan around the assumption that a classification will never be looked at.

Write the classification down before you need it

Write one paragraph per tool: what it produces, what a person does with the output, and the conclusion that follows from those two facts. That paragraph is the artifact worth making. If a complaint or an inquiry arrives, the classification is the first document anyone asks for, and a conclusion assembled after the fact reads like one.

Five things belong in each paragraph:

1. The output, described concretely. "A 0 to 100 fit number" and "a shortlist ordering" are classifications waiting to happen. "A parsed contact block" sits outside the definition. 2. What a human actually does with it. If reviewers open the top of the list and stop, the output is being weighted more heavily than any other criterion whatever the policy says. 3. Which of the three conditions you concluded does not apply, and why. The reason is the part that has to survive being read back to you. 4. Who decided, and when. A dated signature turns a guess into a considered position. 5. What would change the answer. A vendor feature, a workflow change, a new default. Set a reminder against it.

On independent review, be honest about the word. Reviewing every candidate clears the sole-reliance condition and leaves the other two open. A reviewer who works down an ordering is still weighting the output above every other criterion, and calling a reviewer independent in a policy the team does not follow changes nothing at all. Before you take a vendor's classification at face value, what to ask an AI screening vendor covers the questions that actually separate a claim from evidence.

One last thing, because it catches people who did the classification work properly. A tool outside Local Law 144 is not outside federal law. The Uniform Guidelines define a selection procedure as any measure or combination of measures used as a basis for an employment decision, reaching the full range of techniques through informal or casual interviews and unscored application forms ⁵. For the layer above this one, which AI hiring laws actually apply now sets out what else binds you. Confirm any classification with counsel before it goes in writing.

Read the evidence >