How to Audit AI Screening for Bias: The Four-Fifths Rule, NYC Local Law 144 and EU AI Act Article 26

To audit an AI screening tool for bias, you take every applicant the tool assessed, group them by sex and by race or ethnicity, work out what share of each group the tool moved forward, and divide each group's rate by the rate of the group that did best. That number is the impact ratio. Under the US four-fifths rule in 29 CFR 1607.4(D), a ratio below 0.8 is generally treated as evidence of adverse impact. New York City's Local Law 144 makes that calculation an annual, published, independent audit; the EU AI Act makes the same tools high-risk and lists the deployer's duties in Article 26.

I run ScalingPPL, a recruitment agency, and I built Pickr, an AI recruiting platform with AI matching and data stored in Europe, so I deploy screening software and make it. This is not legal advice. What follows is the arithmetic, a worked example and the two rulebooks with paragraph numbers.

What is the four-fifths rule and where does it come from?

It is a US regulation from 1978, the Uniform Guidelines on Employee Selection Procedures, at 29 CFR 1607.4. Paragraph (D) says a selection rate for any race, sex or ethnic group which is less than four-fifths, or eighty percent, of the rate for the group with the highest rate "will generally be regarded by the Federal enforcement agencies as evidence of adverse impact", while a greater than four-fifths rate "will generally not be regarded" as such (29 CFR 1607.4, law.cornell.edu).

Smaller differences "may nevertheless constitute adverse impact" where they are significant in statistical and practical terms. Larger differences may not, where they rest on "small numbers and are not statistically significant". And where the numbers are too small to be reliable, the agencies may look at a longer period or at the tool's use elsewhere. Paragraph (C) adds the step that matters for software: if the overall process shows adverse impact, "the individual components of the selection process should be evaluated", and an AI screening stage is a component.

How do you calculate an impact ratio?

New York's rules write it out. Selection rate is "the rate at which individuals in a category are either selected to move forward in the hiring process or assigned a classification by an AEDT", the number moved forward divided by the number in the category who applied. Impact ratio is "the selection rate for a category divided by the selection rate of the most selected category" (6 RCNY 5-300, DCWP final rule, PDF). If the tool scores rather than selects, scoring rate replaces selection rate: "the rate at which individuals in a category receive a score above the sample's median score". A ranking tool is, for audit purposes, a scoring tool.

The comparator is always the group with the highest rate, so a correctly computed ratio sits between 0 and 1. And under 5-301(b)(3) the calculation runs separately for sex, for race and ethnicity, and for the intersections of the two, so a tool can pass on sex and race taken separately and fail on one intersectional cell.

A worked example: 500 applicants, four groups

Say your AI screening tool assessed 500 applicants for one role family over a year, all with a known demographic category, and moved some to a recruiter screen. The groups are labelled A to D; in a NYC audit they would be EEO-1 categories, with a table like this for each of the sex, race and intersectional runs.

Run 1: the tool passes.

Group	Applied	Moved forward	Selection rate	Impact ratio	Four-fifths
A	200	90	45.0%	1.000	Comparator
B	150	60	40.0%	0.889	Pass
C	120	45	37.5%	0.833	Pass
D	30	11	36.7%	0.815	Pass
Total	500	206	41.2%

Every ratio is at or above 0.8: under 1607.4(D), generally not evidence of adverse impact.

Run 2: the same tool, a different year, and it fails.

Group	Applied	Moved forward	Selection rate	Impact ratio	Four-fifths
A	200	90	45.0%	1.000	Comparator
B	150	60	40.0%	0.889	Pass
C	120	40	33.3%	0.741	Below 0.8
D	30	9	30.0%	0.667	Below 0.8
Total	500	199	39.8%

Group C lost five selections out of 120 and dropped from 0.833 to 0.741: a sizeable group, a clear gap, and under 1607.4(C) the screening component now gets evaluated on its own. Under Local Law 144 the number is published either way; the DCWP FAQ says the law "does not require any specific actions based on the results of a bias audit", while federal, state and city anti-discrimination law still applies (DCWP AEDT FAQ, PDF).

What about the small group? The caveat that decides most audits

Group D is the row to argue about. Thirty applicants is 6 percent of the data, well above the line in 5-301(d) that lets an independent auditor exclude "a category that represents less than 2% of the data being used for the bias audit" (10 people here), and even an excluded category must be reported with its count, its rate and the auditor's justification. D stays in, and look at how little moves it: nine of 30 moved forward gives 0.667, ten gives 0.741, eleven gives 0.815, twelve gives 0.889. Two extra people turn a failing ratio into a passing one. That is what 1607.4(D) means by "small numbers" that "are not statistically significant", and it cuts both ways: a 0.667 on 30 people is weaker evidence of a problem than a 0.741 on 120, and a 0.815 on 30 is not proof the tool is fine. The honest reading of run 2 is "C is a finding, D needs a longer window": pool more periods or more uses, as the regulation suggests, before concluding anything about D.

The other trap is the people who are not in the table. 5-301(b)(5) requires the audit to state how many individuals the tool assessed who fall "within an unknown category", and the FAQ says imputed or inferred demographic data "cannot be used to conduct a bias audit". A FAccT 2025 study of the 116 Local Law 144 audits published from July 2023 to early November 2024 found that 53 percent included at least one impact ratio below 0.8, and 83 percent reported missing race or sex data for some applicants (Gerchick et al., FAccT 2025). Their point: published ratios could often sit below 0.8 depending on who the missing applicants were.

What does NYC Local Law 144 actually require?

The law prohibits an employer or employment agency from using an automated employment decision tool (AEDT) unless the tool "has been subject to a bias audit within one year of the use of the tool, information about the bias audit is publicly available, and certain notices have been provided to employees or job candidates". DCWP began enforcement on 5 July 2023 (DCWP, Automated Employment Decision Tools); the FAQ gives 1 January 2023 as the date the law took effect. Per the rules and the FAQ:

• What counts as an AEDT. A tool using machine learning, statistical modelling, data analytics or AI that helps make employment decisions and "substantially assists or replaces discretionary decision-making". A tool that helps "assess or screen candidates at any point in the hiring or promotion process" is covered; one that only converts "a resume from a PDF" to text is not, in the rule's own example.
• "In the city". The job sits in a NYC office at least part time, or is remote with a NYC office as its location, or the agency using the tool is in NYC.
• Independent auditor. Someone "capable of exercising objective and impartial judgment" with no role in using, developing or distributing the tool and no employment relationship with, or financial interest in, the employer or the vendor. The vendor "is not responsible for a bias audit of the tool"; the employer or agency is.
• Publication and notice. Before use, on the employment section of your website: the audit date, a summary with the data source, the unknown-category count and the numbers, rates and impact ratios for all categories, and the date you began using the tool, kept up for six months after the last use (5-303). NYC-resident candidates get notice 10 business days before use, naming what the tool assesses, with instructions for requesting a reasonable accommodation; a standing notice on the careers page suffices.

What does the EU AI Act require from a deployer?

Annex III point 4(a) lists as high-risk "AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates" (Annex III, artificialintelligenceact.eu). The employer or agency using such a system is the deployer; the vendor is the provider.

On timing: the high-risk obligations were originally set to apply from 2 August 2026. The AI Omnibus, Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026; it moves the obligations for stand-alone Annex III systems, recruitment included, to 2 December 2027 (Cooley client alert, 3 August 2026; Future of Privacy Forum, 28 July 2026, updated 5 August 2026). The artificialintelligenceact.eu implementation timeline shows the same date for Article 6(2) and Annex III systems. Our guide to the EU AI Act for recruiting walks through the duties in full; the extra time changes the deadline, not the duties. Not moved: the Article 5 prohibitions, in force since 2 February 2025, including 5(1)(f), which bans AI systems "to infer emotions of a natural person in the areas of workplace and education institutions" except for medical or safety reasons (Article 5).

Article 26 is the deployer's chapter (Article 26): follow the provider's instructions for use (26(1)); give human oversight to natural persons "who have the necessary competence, training and authority" (26(2)); where you control the input data, keep it "relevant and sufficiently representative in view of the intended purpose" (26(4)); monitor the system, and inform the provider and suspend use if it presents a risk under Article 79(1) (26(5)); keep the system's logs, so far as they are under your control, for at least six months (26(6)); inform workers' representatives and affected workers before putting it into service (26(7)); use the provider's Article 13 information for your GDPR Article 35 impact assessment (26(9)); and tell the people concerned that they are subject to the system (26(11)).

Article 86 gives the rejected candidate a right to "clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken" (Article 86). If the tool only gave you a number, you cannot produce one, which is also what creates the match quality gap: good candidates rejected for reasons nobody can state.

The practical gap between the regimes is data. The NYC audit needs sex and race data; the AI Act asks the deployer for no impact-ratio table. From our work at ScalingPPL, application forms in Germany and Austria do not collect ethnicity, so run the 1607.4 logic on what you do have, sex and age at minimum, inside the Article 26 process.

The deployer checklist

Run this before go-live, once a year, and after any material change to the tool or the roles it screens.

1. Scope. Is the tool an AEDT (NYC) or an Annex III 4(a) system (EU)? If it ranks, scores, tags or filters applicants and a human reads the output top-down, assume yes for both.
2. Roles. Who is provider and who is deployer under your contract? Get the provider's instructions for use and its Article 13 information (26(1), 26(9)).
3. Applicant flow. For every applicant the tool assessed: category, moved forward or not, the score if it scores. Record the number with unknown category; never infer it.
4. The ratios. Selection or scoring rates and impact ratios by sex, by race and ethnicity, and for the intersections, with the highest group as comparator.
5. The reading. Flag every ratio below 0.8, then read the sample size next to it. Decide in advance how you treat categories under 2 percent and unstable small groups: pool periods, pool uses, report with a caveat, never drop silently.
6. NYC audit. An independent auditor, historical data from your own or contributed pooled use, test data only with a written reason.
7. Before go-live. Inform workers' representatives and affected workers (26(7)). For NYC, the notice 10 business days before use with accommodation instructions, and the audit summary and distribution date on your careers site.
8. Oversight. Name who holds human oversight, confirm they can override the tool, and write down what "override" means in your pipeline (26(2)).
9. Logs and monitoring. Keep the logs; six months is the 26(6) floor. Watch the ratios as the tool runs: the tool above passed run 1 and failed run 2 without anyone changing a setting.
10. Explanations and the off switch. Be able to explain any rejection the tool played a role in: what it said, why, and what the human did with it (Article 86). Know who can suspend it and what the manual process is meanwhile (26(5)).

Where does the ATS fit in?

Most of this checklist is data your ATS either holds or does not: who applied, what category they disclosed, which stage they reached, what the tool scored and why, and who overrode it. If the screening tool hands back a bare number, items 4, 5 and 10 cannot be done.

In Pickr, the matching score comes with its reasoning: which requirements the candidate meets, which they partly meet and what is missing, written so a recruiter can send it to a client, and kept on record so it can be read back later. Matching runs on a professional skills graph rather than exact keywords, the design choice an auditor asks about when looking at who got filtered out. Candidates are informed before matching is used, no hiring decision is fully automated, names and emails are redacted from AI prompts by default, and the product comes with data stored in Europe and a data processing agreement included. The audit, the demographic data, the auditor and the oversight roles are yours; AI matching gives you a reasoned score on record for every candidate the tool touched, and AI interview evaluation has to show its work one stage later for the same reasons.

Sources

• 29 CFR 1607.4, Information on impact (Uniform Guidelines on Employee Selection Procedures), law.cornell.edu: https://www.law.cornell.edu/cfr/text/29/1607.4 (accessed 2026-10-14)
• NYC Department of Consumer and Worker Protection, "Automated Employment Decision Tools (AEDT)": https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page (accessed 2026-10-14)
• NYC DCWP, Notice of Adoption of Final Rule, Use of Automated Employment Decisionmaking Tools, 6 RCNY 5-300 to 5-304 (PDF): https://rules.cityofnewyork.us/wp-content/uploads/2023/04/DCWP-NOA-for-Use-of-Automated-Employment-Decisionmaking-Tools-2.pdf (accessed 2026-10-14)
• NYC DCWP, "Automated Employment Decision Tools: Frequently Asked Questions", 29 June 2023 (PDF): https://www.nyc.gov/assets/dca/downloads/pdf/about/DCWP-AEDT-FAQ.pdf (accessed 2026-10-14)
• EU AI Act, Annex III, High-Risk AI Systems Referred to in Article 6(2), artificialintelligenceact.eu: https://artificialintelligenceact.eu/annex/3/ (accessed 2026-10-14)
• EU AI Act, Article 26, Obligations of Deployers of High-Risk AI Systems, artificialintelligenceact.eu: https://artificialintelligenceact.eu/article/26/ (accessed 2026-10-14)
• EU AI Act, Article 86, Right to Explanation of Individual Decision-Making, artificialintelligenceact.eu: https://artificialintelligenceact.eu/article/86/ (accessed 2026-10-14)
• EU AI Act, Article 5, Prohibited AI Practices, artificialintelligenceact.eu: https://artificialintelligenceact.eu/article/5/ (accessed 2026-10-14)
• EU AI Act, Implementation Timeline, artificialintelligenceact.eu: https://artificialintelligenceact.eu/implementation-timeline/ (accessed 2026-10-14)
• Cooley, "Digital AI Omnibus Delays Key Deadlines, Introduces New Rules", client alert, 3 August 2026: https://cdp.cooley.com/digital-ai-omnibus-delays-key-deadlines-introduces-new-rules/ (accessed 2026-10-14)
• Future of Privacy Forum, "The AI Act implementation timeline: What changes under the AI Omnibus?", 28 July 2026, updated 5 August 2026: https://fpf.org/blog/the-ai-act-implementation-timeline-what-changes-under-the-ai-omnibus (accessed 2026-10-14)
• Gerchick, Encarnación, Tanigawa-Lau, Armstrong, Gutiérrez and Metaxa, "Auditing the Audits: Lessons for Algorithmic Accountability from Local Law 144's Bias Audits", FAccT 2025, doi 10.1145/3715275.3732004: https://facctconference.org/static/docs/facct2025-206archivalpdfs/facct2025-final14-acmpaginated.pdf (accessed 2026-10-14)