AI controls
New York: the dates, and the controls that answer them
Part 500’s final milestones since 1 November 2025, certified every 15 April. A bias audit of every hiring tool, every year, in New York City.
The dates
The last milestones of the New York Department of Financial Services cybersecurity regulation, Part 500, took effect on 1 November 2025: multifactor authentication for every user and a documented asset inventory, certified for the first time in the filings due 15 April 2026. Class A companies owe independent audits of their programs at a frequency their own risk assessment sets. Separately, New York City’s Local Law 144 requires an annual independent bias audit of any automated tool used in hiring or promotion decisions, with notice to the people it screens.
The control test
The control test: for a bank, insurer or fintech licensed in New York, we map the Part 500 requirements to the controls that exist, test the ones that matter (access, multifactor authentication, the asset inventory, logging, vendor oversight, the incident plan) the way an examiner reads them, and write the gap list and the evidence file behind the April certification. For a company that uses an automated tool in hiring, we document the tool, the data it sees and the decisions it shapes, design the notice and the human review around it, and prepare the population and the evidence the bias audit will test. The bias audit itself is a separate statistical engagement; the readiness is ours.
Send the date on your calendar and a sentence on what is coming up.
hello@faulknergrc.com