Since July 2023, any employer using an automated employment decision tool on a New York City candidate needs a bias audit from the last 12 months, a published summary of it, and notice to the candidate 10 business days before use. Here is the checklist and the data you need.
1. Decide whether your tool is an AEDT
If it produces a score, ranking or recommendation that substantially assists a hiring decision, it is in scope. AI CV ranking is squarely in scope.
In Qcandidate: Qcandidate outputs a ranked score per candidate, so treat it as an AEDT for any NYC-resident applicant.
2. Commission an independent bias audit
An impartial auditor calculates selection rates and impact ratios by sex and by race/ethnicity category, and by their intersections, using your historical data (or test data if you have too little).
In Qcandidate: The bias audit dashboard computes selection rates and impact ratios per run and exports the underlying rows for your auditor to verify independently.
3. Publish the results summary
A summary of the most recent audit — including source and explanation of the data, selection or scoring rates and impact ratios — must be publicly available on the employment section of your website, plus the tool's distribution date.
In Qcandidate: Export the audit summary as a PDF or JSON artifact and publish it directly; it is formatted for that purpose.
4. Give 10 business days' notice
Before use, tell NYC candidates that an AEDT will be used, list the job qualifications and characteristics it assesses, and explain how to request an alternative process or accommodation.
In Qcandidate: The careers page and application form carry an AEDT notice block listing the rubric criteria being assessed.
5. Disclose data and retention on request
Publish, or provide within 30 days of a written request, the categories of data collected, its source and the retention policy.
In Qcandidate: The DPA page states the data categories, source and the 12-month retention default.
6. Keep the evidence
Enforcement is complaint-driven. What matters is being able to show, per role, what was run and who signed off.
In Qcandidate: Every run keeps an immutable log with rubric version, scores, reviewer and outcome, bundled into the compliance evidence pack.
Source: NYC Administrative Code §20-870 et seq. and DCWP rules. Guidance, not legal advice — the bias audit itself must be run by an independent auditor.
- Can Qcandidate be our independent auditor?
- No — the law requires independence from the tool's vendor and the employer. Qcandidate produces the selection-rate and impact-ratio data your independent auditor works from.
- What if we have no demographic data?
- The rules allow an audit on test data where historical data is insufficient, provided the published summary explains why and describes the test data used.
- What are the penalties?
- Up to $500 for a first violation and up to $1,500 for each subsequent one, with each day of non-compliant use counted as a separate violation.