On April 6, 2023, the New York City Department of Consumer and Worker Protection (“Department”) issued its Final Rules regarding automated employment decision tools (“AEDT”). As previously reported, New York City’s AEDT law, Local Law 144 of 2021, prohibits employers and employment agencies from using AEDT unless:

• The tool has been subjected to a bias audit within a year of the tool being used or implemented;

• Information about the bias audit is made publicly available; and,

• Certain written notices have been provided to employees or job candidates.

Following the multiple public hearings and comments on the Department’s proposed rules from September and December of 2022, the newly issued Final Rules now govern the Department’s interpretation, and enforcement, of the AEDT law. Changes from the December 2022 proposed rules that are now present in the Final Rules include:

• Expansions to the scope of the AEDT law’s definition of “machine learning, statistical modeling, data analytics, or artificial intelligence;

• Adding the requirement that the bias audit indicate the number of individuals assessed by the AEDT that were not included in the audit’s calculations because they fall within an “unknown category” (and that the number be listed in the bias audit results summary);

•  Permitting independent audits to exclude a category that comprises less than 2% of the data being used for the bias audit’s impact ratio calculations;

• Examples of a bias audit;

• Guidance on when an employer or employment agency may rely on a bias audit conducted using historical data or test data, including data from other employers or employment agencies; and,

• Additional language regarding the need to include, if applicable, the number of applicants in a category and the scoring rate of a category within the bias audit summary results.

Now that the Final Rules have been issued, employers and employment agencies have the regulatory roadmap necessary to begin complying with the AEDT law when enforcement begins on July 5, 2023.

Our Data Analytics and Privacy, Data, and Cybersecurity practices will continue to monitor regulatory and enforcement updates.