NYC Local Law 144 — Module 5
The enforcement is over. Three more AI tools are in procurement. The question is what kind of company Vantage decides to be.
Your Role
Director, People Operations — AI Governance (newly titled)
Six months after the DCWP consent order. The quarterly attestations are clean. TalentScope was replaced at the end of Q3. Priya Venkatesan’s settlement closed in July. Gil Fontaine is no longer at TalentScope.
Today, Procurement is asking for sign-off on three new AI tools: a performance-management platform, a promotion-ranking engine, and an engagement analytics system. Each one could trigger the same cycle. The VP wants a decision by end of week.
The final module. Three decisions about the governance framework. Compliance is no longer a reactive cycle — it’s the design brief.
| Tool | Vendor | Use | Regulatory surface |
|---|---|---|---|
| PerformPro | Ascend AI | Performance management: scores 1,800 employees quarterly on 'impact' | NYC LL144, NY State AI Bill pending, EEOC guidance |
| PromoteIQ | Meridian Talent (Kari Patel) | Promotion ranking: scores internal candidates for open roles | Same as above + CO SB 24-205 if extended to CO employees |
| PulseRead | Northstar Engagement | Sentiment analysis on Slack, email, survey data | IL AI Video Interview Act-adjacent, EEOC-adjacent |
Nora is now a VP-peer. Rachel still runs GC. You have the Director title, the AI Governance mandate, and about five days to write the framework that shapes the next three tools — and the next five after that.
Before you design the Vantage governance framework, classify these six elements. Is each one a minimum required by LL 144, a best practice beyond the law, or an internal HR process (valuable but not strictly governance)?
Click a category for each element, then submit.
Annual independent bias audit published on the company website
Written candidate notice delivered 10 business days before AEDT use
Maintaining an alternative selection process for candidates who opt out
Cross-functional AI governance committee with external legal or ethics review
Vendor contract clause requiring audit cooperation and data access rights
Training programme for hiring managers on interpreting AI scores
Rachel:
“LL144 is one regulation. The CO law is different. The EEOC is writing rules. The SEC has a draft proposal on AI-influenced employment decisions for public companies. If we build a LL144-only framework, we’ll be rebuilding it next year. What’s your design?”
What governance structure do you propose?
Your choice
Cross-functional AI Governance Committee + Tool RegistryStanding committee: People Ops, GC, Procurement, Data, Risk. Quarterly cadence. Every candidate AI tool logged in a registry with risk tier, applicable regulations, bias audit status, notice status, vendor data agreement. Scales across regulations, not just LL144.
Your choice
Procurement checklist — compliance clause in standard MSAAdd a LL144-compliance clause to the standard vendor contract. Procurement runs a checklist before sign-off. Lower overhead. Solves today’s problem.
Your choice
Case-by-case — review each tool when it comes upKeep it light. Each new AI tool gets reviewed by People Ops + GC at the time of procurement. Don’t create new bureaucracy.
NYC LL144 is the beginning, not the endpoint. Colorado’s SB 24-205, Illinois’s AI Video Interview Act, California’s proposed FEHA AI rules, the EEOC’s guidance, and draft federal legislation all regulate the same class of tools differently. A registry-based governance model absorbs new rules without rebuilding. A clause-based model does not.
A contract clause binds new procurement. It does not automatically re-examine tools already in production. Each new regulation requires a manual re-review of the tool estate. A registry structure does this crosswalk by design.
A case-by-case review process is what existed before LL144 enforcement. It failed because procurement timelines compressed compliance review, and because no single owner held the tool estate. Re-adopting it after a consent order signals that the organisation has not internalised what went wrong.
The committee’s first real test: how does Vantage select AI vendors going forward? Kari’s pitch is the best-case version of compliance-in. The other two vendors are pitching cheaper options.
What is the vendor selection standard?
Your choice
Compliance-built-in required — pre-published audit, data-access clause, committee-approved vendor listVendor must provide: (a) independent bias audit published in the last 12 months, (b) candidate-level data access in the MSA, (c) clear AEDT/non-AEDT classification with evidence, (d) commitment to notify Vantage of regulatory developments. Pays 10–20% premium. Saves the compliance overhead on every tool.
Your choice
Compliance-ready — vendor cooperates but Vantage runs the complianceVendor provides data access and audit support. Vantage commissions and publishes the audit, handles notice, manages the alternative process. Cheaper on vendor side. More overhead internally.
Your choice
Lowest-cost compliant — whoever meets the letter at the best priceAny vendor that meets the MSA compliance clause at procurement qualifies. Price is the primary criterion. Keep overheads low, let the committee clean up edge cases.
Building compliance into vendor selection is more expensive than running compliance on top. But the downstream cost of a non-compliant tool — enforcement, remediation, staff time, reputational damage — is almost always higher. Regulators recognise and credit this posture.
Running compliance internally on each new AI tool does not scale linearly. Compliance-ready vendors reduce the multiplier but still require proactive Vantage workflow. Compliance-in vendors absorb more of the workflow into the product.
An MSA clause creates contractual liability but does not prevent compliance failures. Low-cost vendors who merely agree to the clause often lack the internal discipline to execute it. The clause becomes the basis for vendor-blaming when the employer’s exposure lands first.
The committee is constituted. The vendor standard is set. Three tools are in procurement. The last question is the one the VP will ask on Monday:
How will you know if the framework is working?
There’s no § 20-872 analog for framework monitoring. This is where Vantage writes the compliance posture it will be known for.
Last call. How does the committee monitor the framework, and what does Vantage commit to publishing?
What monitoring and transparency regime do you design?
Your choice
Continuous monitoring + annual public AI transparency reportQuarterly registry review. Continuous flagging of demographic drift. Annual public report: which tools, which audits, what findings, what remediation. Goes beyond LL144. Positions Vantage as a reference in the market.
Your choice
Annual internal review — publish only what LL144 requiresCommittee meets annually to review the tool estate. Bias audits are published per LL144 requirement. No additional voluntary transparency. Meets the letter. Doesn’t move the market.
Your choice
Triggered review only — committee convenes when issues ariseNo standing cadence. Committee reviews when a complaint, regulation, or vendor change triggers it. Reduces overhead. Increases reactivity.
Voluntary AI transparency reports are not required under LL144 or any current law. But the EEOC, FTC, and SEC have all indicated that published voluntary disclosure is a mitigating factor in future enforcement. Employers who publish early are cited as examples rather than cases.
Doing exactly what LL144 requires, annually, keeps Vantage out of enforcement. It does not position the company ahead of the next regulation, the next scrutiny, or the next market expectation.
A governance framework that only activates on trigger is not a framework — it is an escalation procedure. The core insight of LL144 and its successors is that periodic, systematic review catches the issues a triggered review cannot see coming.
Course Complete
The framework scales.
You have navigated classification, audit, notice, enforcement, and governance. Vantage is not the cautionary tale. It is the reference. Every module’s compliance file held. The framework now absorbs the next regulation as it lands.
Course Complete
Ready for next cycle of upgrades.
Vantage is compliant. The next regulation will require an upgrade cycle. You will run it. The lesson stuck.
Course Complete
Eighteen months out.
The consent order stopped the last investigation. The governance decisions you made after it made the next one a matter of time.