Appearance
Publication and notices
The audit alone does not make use lawful. § 20-871 adds three transparency duties: the date of the most recent bias audit, the required summary, and the tool's distribution date must be publicly posted before use (§ 20-871(a)(2); 6 RCNY § 5-303), candidates and employees who reside in the city must be notified at least 10 business days before the tool is used on them (§ 20-871(b)(1)–(2)), and, under § 20-871(b)(3) and 6 RCNY § 5-304(d), the tool's data type, source, retention policy, and written-request instructions must be posted clearly and conspicuously on the employment section of the website, written requests answered within 30 days, and prohibited disclosure withheld with an explanation. MFF-27 carries them as MRF-479, MRF-480, and MRF-481, each backed by its own new control.
Publication of bias audit results — MRF-479
... 2. A summary of the results of the most recent bias audit of such tool as well as the distribution date of the tool to which such audit applies has been made publicly available on the website of the employer or employment agency prior to the use of such tool.
6 RCNY § 5-303 specifies the posting:
| Element | Rule |
|---|---|
| Where and how | On the employment section of the website, in a clear and conspicuous manner, before the use of the AEDT (§ 5-303(a)) |
| What | (1) The date of the most recent bias audit and a summary of the results, which shall include the source and explanation of the data used to conduct the audit, the number of individuals the AEDT assessed that fall within an unknown category, and the number of applicants or candidates, the selection or scoring rates as applicable, and the impact ratios for all categories; and (2) the distribution date of the AEDT (§ 5-303(a)(1)–(2)) |
| Hyperlink option | The duty may be met with an active hyperlink to a website containing the required summary and distribution date, provided the link is clearly identified as a link to results of the bias audit (§ 5-303(b)) |
| How long | The summary and distribution date stay posted for at least 6 months after the latest use of the AEDT for an employment decision (§ 5-303(c)) |
Three definitions and consequences follow:
- Distribution date (6 RCNY § 5-300) is the date the employer or employment agency began using the specific AEDT. It is the deployer's first-use date, not a vendor release date, and it stays fixed across audit refreshes.
- Where exclusions and test data appear. If the auditor excluded a category under the 2 percent rule, the published summary must include the auditor's justification and the excluded category's applicant count and selection or scoring rate (§ 5-301(d)). If the audit used test data, the published summary must explain why historical data was not used and describe how the test data was generated and obtained (§ 5-302(b)).
- Annual refresh in practice. Because an audit only supports use for one year (§ 5-301(a)), the posted summary is refreshed at least annually for a tool in continuous use, and the posting must survive at least six months past the tool's last use: decommissioning the tool does not permit taking the page down the same day.
The requirement is carried by the new control MCF-685 (Public disclosure of bias audit results), which owns only the publication: placement, completeness of the published summary, timing before the first covered use, and the six-month retention. The audit content itself is owned by MCF-684 under MRF-477 and MRF-478; publication cannot cure a non-compliant audit, nor the reverse. Evidence: the URL and a dated capture of the posting, a record that the initial posting preceded the first covered use and that each refreshed summary was posted before continued use under the refreshed audit, and, for a decommissioned tool, the last-use date and evidence the posting remained available six months beyond it.
Candidate and employee notice — MRF-480
- That an automated employment decision tool will be used in connection with the assessment or evaluation of such employee or candidate that resides in the city. Such notice shall be made no less than ten business days before such use and allow a candidate to request an alternative selection process or accommodation; 2. The job qualifications and characteristics that such automated employment decision tool will use in the assessment of such candidate or employee. Such notice shall be made no less than 10 business days before such use; ...
The notice has three content elements: the fact that an AEDT will be used, the job qualifications and characteristics it will assess, and, under 6 RCNY § 5-304(a), instructions for how an individual can request an alternative selection process or a reasonable accommodation under other laws, if available. The rule adds, verbatim: "Nothing in this subchapter requires an employer or employment agency to provide an alternative selection process." Reasonable-accommodation duties under other laws (disability, religion) exist independently and carry their own obligations.
The permitted channels differ by audience (6 RCNY § 5-304(b)–(c)), and each runs at least 10 business days before use:
| Audience | Permitted channels |
|---|---|
| Candidates for employment who reside in the city | Notice on the employment section of the website in a clear and conspicuous manner; or notice in a job posting; or notice via U.S. mail or e-mail |
| Employees being considered for promotion who reside in the city | Notice in a written policy or procedure provided to employees; or notice in a job posting; or notice via U.S. mail or e-mail |
Four points from the rules and the DCWP FAQ (section VI) govern the clock:
- Who is owed notice: candidates and employees who reside in New York City (§ 20-871(b); FAQ VI.1). Deployers rarely know a candidate's residence at the top of the funnel; for candidates, a standing notice on the employment section of the website (§ 5-304(b)(1)) avoids identifying who is owed individual notice. It does not cover employees being considered for promotion, who must be reached through a written policy or procedure, a job posting, U.S. mail, or e-mail (§ 5-304(c)).
- Website notice is not position-specific (FAQ VI.1–VI.2): notice posted on the employment section of the website need not name specific positions, and the AEDT may be used on candidates 10 business days after the posting regardless of when a specific job was posted.
- The employee-side clock runs from provision of the policy (§ 5-304(c)(1)): a written policy for employees under consideration for promotion likewise need not be position-specific, but its clock runs from when the policy is provided to the employees. An employee who receives the policy later is covered 10 business days after that provision, not after the policy's original date.
- Each unlawful omission counts (§ 20-872(c)): each failure to provide a notice in violation of § 20-871(b) is a separate violation.
The requirement is carried by the new control MCF-686 (Pre-use notice to candidates and employees): the timed, content-prescribed pre-use notice with the 10-business-day clock, the two audiences, and the channel rules. Existing notice controls in the library carry no 10-business-day clock, no candidate audience, and no channel rules, so a framework-specific control was warranted. The reused control MCF-167 (Transparent Deployment at Workplace) supports it with the framework-agnostic duty to inform employees before deploying a workplace AI system that affects them, which covers the promotion-candidate side in substance; the Local Law 144-specific timing, channels, and alternative-process instructions stay in the requirement and in MCF-686.
Data transparency disclosures — MRF-481
- If not disclosed on the employer or employment agency's website, information about the type of data collected for the automated employment decision tool, the source of such data and the employer or employment agency's data retention policy shall be available upon written request by a candidate or employee. Such information shall be provided within 30 days of the written request. Information pursuant to this section shall not be disclosed where such disclosure would violate local, state, or federal law, or interfere with a law enforcement investigation.
Three disclosure items: the type of data collected for the AEDT, the source of that data, and the deployer's data retention policy. They describe the tool's operational data practices and are distinct from the audit-data provenance published in the bias audit summary under MRF-479. A single page or passage may carry both if it clearly supplies every required element of each; the audit's data explanation does not stand in for the tool's operational data disclosure, and neither duty substitutes for the other.
The statute frames the request route as applying "if not disclosed on the ... website". The adopted rule, 6 RCNY § 5-304(d), lists the duties conjunctively: to comply with § 20-871(b)(3), an employer or employment agency "must":
- provide information on the employment section of its website in a clear and conspicuous manner about its AEDT data retention policy, the type of data collected for the AEDT, and the source of the data;
- post instructions on the employment section of its website in a clear and conspicuous manner for how to make a written request for such information, and if a written request is received, provide such information within 30 days; and
- provide an explanation to a candidate for employment or employee being considered for promotion why disclosure of such information would violate local, state, or federal law, or interfere with a law enforcement investigation.
The framework reads the rule literally: the safe compliance posture posts the information and runs the request route, with a tracked 30-day clock for written requests for those three disclosure items. Treating posting and the request route as alternatives relies on the statute's framing against the rule's text.
Two further points on the exceptions:
- Nondisclosure is mandatory where the exceptions apply. The statute says the information "shall not be disclosed" where disclosure would violate local, state, or federal law or interfere with a law enforcement investigation. Withholding is a duty in those cases, case by case, and the rule requires an explanation to the requester. The exceptions are neither a standing policy for refusing all requests nor optional where they genuinely apply.
- Each unlawful omission counts (§ 20-872(c)): each failure to provide the § 20-871(b)(3) information in violation of that provision is a separate violation. A withholding the statute itself mandates is not a violation.
The requirement is carried by the new control MCF-687 (AEDT data transparency disclosures). Existing retention controls in the library govern having and applying a retention policy; none carries the posture of disclosing data type, source, and retention policy to assessed individuals with a 30-day response clock and an explained-refusal rule. The retention policy itself is an organizational artifact the deployer will typically already maintain under other frameworks; MRF-481 and MCF-687 own only its disclosure for this tool. Evidence: dated captures of the posted disclosure and the posted request instructions, the description of data type and source for this tool, the retention policy or the excerpt applying to it, the request log with receipt and response dates, and any refusal explanations issued with their legal basis.
The three duties side by side
Publication (MRF-479) | Notice (MRF-480) | Data transparency (MRF-481) | |
|---|---|---|---|
| Audience | The public | Candidates and employees who reside in New York City | Candidates and employees |
| Content | Audit date, summary of results, distribution date | AEDT use, qualifications and characteristics assessed, alternative-process instructions | Data type, data source, retention policy |
| Timing | Before use; kept for 6 months after last use | At least 10 business days before use | Posted; written requests answered within 30 days |
| Where | Employment section of the website (or a clearly identified hyperlink) | Website, job posting, mail or e-mail (candidates); written policy, job posting, mail or e-mail (employees) | Employment section of the website, plus posted request instructions |
| Control | MCF-685 | MCF-686 (+ MCF-167) | MCF-687 |
None of the three substitutes for another: the public posting does not discharge the individual notice, and the notice does not discharge the data disclosures.
Where to go next
- The bias audit and its data — the audit whose summary the publication duty posts.
- Operationalizing Local Law 144 in Modulos — the full
MFF-27rollout with the mapping table.
Disclaimer
This page is for general informational purposes and does not constitute legal advice. Always verify against the current published text of N.Y.C. Administrative Code §§ 20-870–874 and 6 RCNY §§ 5-300–5-304 and consult qualified advisers.