Regulon — MD-HB-1331 · MD HB 1331 (AI Consumer Protection)

WHAT THIS BILL REGULATES · 7 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

Attorney General enforcement under the Maryland Consumer Protection Act (Title 13, Commercial Law). Violations constitute unfair, abusive, or deceptive trade practices. The Attorney General may require disclosure of documentation in a form and manner the Attorney General prescribes. The bill excludes § 13–408 (class action provision). The bill preserves consumers' ability to pursue any other remedy provided by law.

Private Right of Action

No private right of action. Enforcement is exclusive to the designated authority.

Penalties

Enforcement and penalties are those available under the Maryland Consumer Protection Act (Title 13, Commercial Law), except § 13–408 (class actions). The bill preserves consumer access to any other remedy provided by law. Specific monetary penalty amounts are set by the existing CPA framework, not by this bill.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

Md. Code, Com. Law § 14–5001

Definitions

(A)–(G) IN THIS SUBTITLE THE FOLLOWING WORDS HAVE THE MEANINGS INDICATED. (B) (1) "ALGORITHMIC DISCRIMINATION" MEANS DIFFERENTIAL TREATMENT AS A RESULT OF THE USE OF ARTIFICIAL INTELLIGENCE THAT NEGATIVELY IMPACTS A PERSON BASED ON THE PERSON'S ACTUAL OR PERCEIVED AGE, COLOR, DISABILITY, ETHNICITY, GENETIC INFORMATION, PROFICIENCY IN THE ENGLISH LANGUAGE, NATIONAL ORIGIN, RACE, RELIGION, REPRODUCTIVE HEALTH, SEX, VETERAN STATUS, OR OTHER PROTECTED CLASS. (2) "ALGORITHMIC DISCRIMINATION" DOES NOT INCLUDE: (I) THE OFFER, LICENSE, OR USE OF A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM BY A DEVELOPER OR DEPLOYER FOR: 1. TESTING TO IDENTIFY, MITIGATE, OR PREVENT DISCRIMINATION OR ENSURE COMPLIANCE WITH A STATE OR FEDERAL LAW; OR 2. INCREASING DIVERSITY WITHIN AN APPLICANT, CUSTOMER, OR PARTICIPANT POOL; OR (II) AN ACTION THAT BENEFITS AN ESTABLISHMENT THAT: 1. IS SUBJECT TO 42 U.S.C. § 2000A(E); AND 2. IS NOT IN FACT OPEN TO THE PUBLIC. (C) "ARTIFICIAL INTELLIGENCE" HAS THE MEANING STATED IN § 3.5–801 OF THE STATE FINANCE AND PROCUREMENT ARTICLE. (D) "DATASET CARD" MEANS A FILE THAT: (1) IS USED TO INFORM USERS ABOUT HOW TO RESPONSIBLY USE THE DATA IN A DATASET; AND (2) CONTAINS INFORMATION ABOUT POTENTIAL BIASES OF THE DATA. (E) "DECISION THAT PRODUCES LEGAL OR SIMILARLY SIGNIFICANT EFFECTS CONCERNING THE CONSUMER" HAS THE MEANING STATED IN § 14–4701 OF THIS TITLE. (F) "HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM" MEANS ANY ARTIFICIAL INTELLIGENCE SYSTEM THAT, WHEN DEPLOYED, MAKES, OR IS A SUBSTANTIAL FACTOR IN MAKING, A DECISION THAT PRODUCES LEGAL OR SIMILARLY SIGNIFICANT EFFECTS CONCERNING THE CONSUMER. (G) "MODEL CARD" MEANS A FILE THAT ACCOMPANIES THE MODEL AND PROVIDES INFORMATION ABOUT DISCOVERABILITY, REPRODUCIBILITY, AND SHARING.

Section 14–5001 establishes the defined terms for Subtitle 50. The key operative definition is high-risk artificial intelligence system, which captures any AI system that, when deployed, makes or is a substantial factor in making a decision producing legal or similarly significant effects on a consumer. The definition of algorithmic discrimination is broadly framed to cover differential treatment based on protected characteristics, with carve-outs for testing and diversity purposes. The section cross-references the existing statutory definition of artificial intelligence from the State Finance and Procurement Article and the definition of consequential decisions from § 14–4701.

Md. Code, Com. Law § 14–5002

Developer obligations: precautions, disclosure, and notification

Developer

(A) 1 A DEVELOPER SHALL TAKE REASONABLE PRECAUTIONS TO PROTECT CONSUMERS FROM KNOWN OR REASONABLY FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION FROM THE INTENDED USES OF A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM PRODUCED BY THE DEVELOPER.

(B)(1)–(B)(3) 2 A DEVELOPER THAT OFFERS TO SELL A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM SHALL: (1) PROVIDE TO A PURCHASER OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM THE STANDARDIZED DISCLOSURE DOCUMENTATION PERTAINING TO THE USES OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM AS DESCRIBED IN SUBSECTION (C) OF THIS SECTION; (2) PROVIDE TO A DEPLOYER INFORMATION NECESSARY FOR THE DEPLOYER TO COMPLETE AN IMPACT ASSESSMENT UNDER § 14–5004 OF THIS SUBTITLE; AND (3) PUBLISH, ON THE DEVELOPER'S WEBSITE OR IN A PUBLIC USE CASE INVENTORY, STANDARDIZED INFORMATION PERTAINING TO EACH HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM THAT THE DEVELOPER OFFERS FOR PURCHASE.

(C)(1)–(10) 2 THE STANDARDIZED DISCLOSURE DOCUMENTATION REQUIRED UNDER SUBSECTION (B)(1) OF THIS SECTION SHALL INCLUDE: (1) THE PURPOSE OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM; (2) THE INTENDED USES, BENEFITS, AND OUTPUTS OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM; (3) A DESCRIPTION OF THE KNOWN AND REASONABLY FORESEEABLE: (I) USES AND MISUSES OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM, AND THE RISKS OF ALGORITHMIC DISCRIMINATION ARISING FROM THEM; AND (II) LIMITATIONS OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM; (4) A DESCRIPTION OF THE STEPS TAKEN BY THE DEVELOPER PRIOR TO OFFERING A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM FOR PURCHASE TO: (I) EVALUATE THE PERFORMANCE OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM; AND (II) MITIGATE KNOWN OR REASONABLY FORESEEABLE ALGORITHMIC DISCRIMINATION ARISING FROM THE USE OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM; (5) A SUMMARY OF THE DATA USED TO TRAIN THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM; (6) A DESCRIPTION OF THE DATA GOVERNANCE MEASURES THAT APPLIED TO THE DATA USED TO TRAIN THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM; (7) THE MEASURES TAKEN TO EXAMINE: (I) THE SUITABILITY OF DATA SOURCES; AND (II) POSSIBLE BIASES AND APPROPRIATE MITIGATION; (8) BEST PRACTICES FOR THE INTENDED USE, PREVENTION OF MISUSE, AND MONITORING OF A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM; (9) ANY INFORMATION NECESSARY FOR THE PURCHASER TO COMPLY WITH THE REQUIREMENTS UNDER § 14–5003 OF THIS SUBTITLE; AND (10) ANY INFORMATION REASONABLY NECESSARY TO ALLOW THE PURCHASER TO UNDERSTAND THE OUTPUTS OF AND MONITOR THE PERFORMANCE OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM.

(D) 2 THE INFORMATION REQUIRED UNDER SUBSECTION (C)(2) OF THIS SECTION SHALL, TO THE EXTENT FEASIBLE, BE PROVIDED IN THE FORM OF MODEL CARDS, DATASET CARDS, OR PREEXISTING IMPACT ASSESSMENTS.

(E)(1)–(3) 3 THE DOCUMENTATION REQUIRED TO BE PUBLISHED UNDER SUBSECTION (C)(3) OF THIS SECTION SHALL: (1) SUMMARIZE THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEMS THAT THE DEVELOPER OFFERS FOR SALE; (2) SUMMARIZE THE MEASURES TAKEN BY THE DEVELOPER TO MANAGE KNOWN AND REASONABLY FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION THAT THE DEVELOPER OFFERS FOR SALE; AND (3) BE UPDATED: (I) AS NECESSARY TO ENSURE THAT THE DOCUMENTATION REMAINS ACCURATE; AND (II) NOT LATER THAN 90 DAYS AFTER ANY CHANGE IS MADE TO A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM THAT WOULD NECESSITATE UPDATING THE RELEVANT DOCUMENTATION UNDER SUBSECTION (C)(3) OF THIS SECTION.

(F)(1)–(2) 4 A DEVELOPER THAT LEARNS THROUGH ONGOING INTERNAL TESTING, OR THROUGH A CREDIBLE REPORT, THAT A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM OFFERED FOR SALE BY THE DEVELOPER HAS CAUSED, OR IS LIKELY TO CAUSE, ALGORITHMIC DISCRIMINATION SHALL DISCLOSE THE POTENTIAL FOR ALGORITHMIC DISCRIMINATION TO: (1) THE ATTORNEY GENERAL IN A FORM AND MANNER DETERMINED BY THE ATTORNEY GENERAL; AND (2) ALL PURCHASERS OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM.

(G)(1)–(3) NOTHING IN THIS SECTION MAY BE CONSTRUED TO REQUIRE A DEVELOPER TO DISCLOSE: (1) A TRADE SECRET; (2) INFORMATION PROTECTED FROM DISCLOSURE BY STATE OR FEDERAL LAW; OR (3) INFORMATION THAT WOULD OTHERWISE CREATE A SECURITY RISK TO THE DEVELOPER.

(H) 5 THE ATTORNEY GENERAL MAY REQUIRE A DEVELOPER TO DISCLOSE TO THE ATTORNEY GENERAL THE INFORMATION REQUIRED UNDER SUBSECTION (C) OF THIS SECTION.

Section 14–5002 imposes four distinct categories of obligation on developers of high-risk AI systems. First, developers must take reasonable precautions against algorithmic discrimination from intended uses. Second, developers offering a system for sale must provide purchasers with standardized disclosure documentation containing ten enumerated categories of information — from system purpose to data governance measures — and must supply deployers with impact assessment inputs. Third, developers must publish on their website or in a public use-case inventory standardized information about each high-risk system offered for sale, updated within 90 days of any material change. Fourth, developers who learn through internal testing or credible reports that a system has caused or is likely to cause algorithmic discrimination must notify both the Attorney General and all purchasers. Trade secret and security information protections apply to all disclosure obligations.

Compliance actions 5 items

Developers must take reasonable precautions to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination arising from intended uses of a high-risk AI system they produce.

H-02.1

Developers offering a high-risk AI system for sale must (1) provide purchasers with standardized disclosure documentation covering system purpose, intended uses, known risks of algorithmic discrimination, limitations, training data summary, data governance measures, bias mitigation steps, best practices, and monitoring information, and (2) provide deployers with information necessary to complete an impact assessment.

G-02.1

Developers must publish on their website or in a public use-case inventory a summary of each high-risk AI system offered for sale and the measures taken to manage algorithmic discrimination risks, and must update the publication within 90 days of any material system change.

G-02.4

Developers who learn through internal testing or credible reports that a high-risk AI system has caused or is likely to cause algorithmic discrimination must disclose the potential discrimination to the Attorney General and to all purchasers of the system.

R-01.3

Developers must provide the Attorney General with the standardized disclosure documentation required under § 14–5002(C) upon request by the Attorney General.

R-02.2

Md. Code, Com. Law § 14–5003

Deployer obligations: precautions and risk management policy

Deployer

(A) 6 A DEPLOYER SHALL TAKE REASONABLE PRECAUTIONS TO PROTECT CONSUMERS FROM KNOWN OR REASONABLY FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION POSED BY THE INTENDED USES OF A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM DEPLOYED BY THE DEPLOYER.

(B)–(E) 7 A DEPLOYER SHALL IMPLEMENT A RISK MANAGEMENT POLICY TO GOVERN THE DEPLOYMENT OF A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM. (C) A RISK MANAGEMENT POLICY UNDER SUBSECTION (B) OF THIS SECTION SHALL: (1) IDENTIFY, DOCUMENT, AND MITIGATE KNOWN AND REASONABLY FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION; (2) SPECIFY AND INCORPORATE PRINCIPLES, PROCESSES, AND PERSONNEL USED TO COMPLY WITH ITEM (1) OF THIS SUBSECTION; (3) BE PLANNED TO SPAN, AND BE IMPLEMENTED FOR, THE ENTIRE PERIOD DURING WHICH THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM IS TO BE DEPLOYED; AND (4) BE REGULARLY AND SYSTEMATICALLY REVIEWED AND UPDATED THROUGHOUT THE PERIOD DURING WHICH THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM IS DEPLOYED. (D) A RISK MANAGEMENT POLICY UNDER SUBSECTION (B) OF THIS SECTION MAY APPLY TO MORE THAN ONE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM. (E) IN CREATING A RISK MANAGEMENT POLICY UNDER SUBSECTION (C) OF THIS SECTION, A DEPLOYER SHALL CONSIDER AND REASONABLY ADDRESS: (1) (I) GUIDANCE SET FORTH IN THE MOST UP-TO-DATE VERSION OF THE "ARTIFICIAL INTELLIGENCE RISK MANAGEMENT FRAMEWORK" PUBLISHED BY THE NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY; (II) ISE/IEC 42001 OF THE INTERNATIONAL ORGANIZATION FOR STANDARDIZATION; (III) ANOTHER INTERNATIONALLY RECOGNIZED ARTIFICIAL INTELLIGENCE RISK MANAGEMENT FRAMEWORK THAT CONTAINS REQUIREMENTS AT LEAST AS STRINGENT AS THIS SUBTITLE; OR (IV) ANOTHER RISK MANAGEMENT FRAMEWORK DESIGNATED BY THE ATTORNEY GENERAL; (2) THE SIZE AND COMPLEXITY OF THE DEPLOYER; (3) THE NATURE, USES, AND SCOPE OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM; AND (4) THE SENSITIVITY AND VOLUME OF DATA PROCESSED BY THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM.

Section 14–5003 imposes the deployer's core operating obligations. Deployers must take reasonable precautions against algorithmic discrimination and must implement a risk management policy that identifies, documents, and mitigates discrimination risks throughout the deployment period. The policy must reference the NIST AI RMF, ISO/IEC 42001, an equivalent international framework, or one designated by the Attorney General, and must be scaled to the deployer's size, the system's nature, and the sensitivity of data processed. The policy must be regularly and systematically reviewed and updated.

Compliance actions 2 items

Deployers must take reasonable precautions to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination posed by the intended uses of a deployed high-risk AI system.

H-02.1

Deployers must implement a risk management policy governing deployment of each high-risk AI system that (1) identifies, documents, and mitigates algorithmic discrimination risks, (2) specifies principles, processes, and personnel, (3) spans the entire deployment period, and (4) is regularly and systematically reviewed and updated, drawing on the NIST AI RMF, ISO/IEC 42001, or an equivalent framework.

G-01.1

Md. Code, Com. Law § 14–5004

Deployer obligations: impact assessment, consumer rights, and public disclosure

Deployer

(A)(1)–(2) 8 EXCEPT AS OTHERWISE PROVIDED IN THIS SUBTITLE, A DEPLOYER SHALL: (1) COMPLETE AN IMPACT ASSESSMENT OF ANY DEPLOYED HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM; (2) RETAIN ALL IMPACT ASSESSMENTS AND RECORDS RELATING TO AN IMPACT ASSESSMENT FOR AT LEAST 3 YEARS AFTER THE END OF THE DEPLOYMENT OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM;

(A)(3) 9 NOT LESS THAN ONCE EACH YEAR, ASSESS WHETHER A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM DEPLOYED BY THE DEPLOYER IS CAUSING ALGORITHMIC DISCRIMINATION;

(A)(4) 10 MAKE AVAILABLE, AT THE TIME OF DEPLOYMENT, A STANDARDIZED DISCLOSURE THAT MEETS THE REQUIREMENTS OF § 14–5005 OF THIS SUBTITLE;

(A)(5)(I)–(II) 11 PROVIDE A CONSUMER SUBJECT TO A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM DEPLOYED BY THE DEPLOYER AN OPPORTUNITY TO: (I) CORRECT ANY DATA PROCESSED BY THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM IN MAKING A DECISION ABOUT THE CONSUMER; AND (II) APPEAL AN ADVERSE DECISION MADE USING A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM, INCLUDING HUMAN REVIEW OF THE DECISION;

(A)(6)(I)–(IV) 12 MAKE A CLEAR AND PROMINENTLY DISPLAYED STATEMENT AVAILABLE ON THE DEPLOYER'S WEBSITE THAT: (I) SUMMARIZES THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEMS CURRENTLY DEPLOYED BY THE DEPLOYER; (II) SUMMARIZES THE DEPLOYER'S PRACTICES FOR MANAGING THE KNOWN OR REASONABLY FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION APPLICABLE TO DEPLOYED HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEMS; (III) DETAILS THE NATURE, SOURCE, AND EXTENT OF PERSONAL INFORMATION COLLECTED OR USED BY THE DEPLOYER; AND (IV) IS UPDATED PERIODICALLY.

(B) 11 A DEPLOYER MAY DECLINE TO PROVIDE AN OPPORTUNITY FOR APPEAL IF THE APPEAL WOULD BE AGAINST THE BEST INTERESTS OF THE CONSUMER, INCLUDING SITUATIONS IN WHICH THE DELAY CAUSED BY THE APPEAL COULD POSE A RISK TO THE SAFETY OF THE CONSUMER.

(C)(1)–(5) A DEPLOYER NEED NOT PROVIDE A RISK MANAGEMENT POLICY, AN IMPACT ASSESSMENT, OR THE DISCLOSURES REQUIRED UNDER SUBSECTION (A)(6) OF THIS SECTION IF THE DEPLOYER: (1) EMPLOYS FEWER THAN 50 FULL-TIME EQUIVALENT EMPLOYEES; (2) TRAINS THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM ON DATA OTHER THAN DATA COLLECTED BY THE DEPLOYER; (3) DOES NOT TRAIN THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM ON DATA THAT THE DEPLOYER COLLECTS; (4) USES THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM AS INTENDED BY ITS DEVELOPER, AS DISCLOSED UNDER § 14–5002(C) OF THIS SUBTITLE; AND (5) MAKES AVAILABLE TO A CONSUMER AN IMPACT ASSESSMENT: (I) COMPLETED BY AND PROVIDED TO THE DEPLOYER BY THE DEVELOPER OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM; AND (II) THAT IS SUBSTANTIALLY SIMILAR TO AN IMPACT ASSESSMENT OTHERWISE REQUIRED UNDER THIS SECTION.

Section 14–5004 is the bill's most substantive deployer section. It requires deployers to complete impact assessments for every deployed high-risk AI system, retain them for at least three years post-deployment, and annually assess whether each system is causing algorithmic discrimination. Deployers must make standardized disclosures available at deployment, provide consumers the right to correct data used in decisions about them and to appeal adverse decisions with human review, and publish a clear website statement summarizing deployed systems, discrimination-management practices, and personal-information use. A deployer may decline to offer appeal where it would be against the consumer's best interests (e.g., safety delay). A small-deployer carve-out exempts entities with fewer than 50 employees that meet four additional conditions from the risk management policy, impact assessment, and website disclosure requirements.

Compliance actions 5 items

Deployers must complete an impact assessment for any deployed high-risk AI system and retain all impact assessments and related records for at least 3 years after the end of deployment.

H-02.3

Deployers must assess at least annually whether each deployed high-risk AI system is causing algorithmic discrimination.

H-02.8

Deployers must make available at the time of deployment a standardized disclosure meeting the requirements of § 14–5005, notifying consumers that a high-risk AI system is in use.

H-01.3

Deployers must provide consumers subject to a high-risk AI system the opportunity to (1) correct any data used by the system in making a decision about the consumer, and (2) appeal an adverse decision, including human review. A deployer may decline to provide appeal where the delay would pose a risk to the consumer's safety.

H-01.2

Deployers must publish and periodically update a clear, prominently displayed statement on their website summarizing deployed high-risk AI systems, discrimination risk management practices, and the nature, source, and extent of personal information collected or used.

G-02.4

Md. Code, Com. Law § 14–5005

Standardized disclosure requirements

Deployer

(1)–(13) 13 A STANDARDIZED DISCLOSURE UNDER § 14–5004(A)(4) OF THIS SUBTITLE SHALL: (1) NOTIFY A CONSUMER SUBJECT TO THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM THAT A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM IS IN USE; (2) DISCLOSE THE PURPOSE OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM IN USE, INCLUDING THE NATURE OF A DECISION ABOUT A CONSUMER THAT IS MADE BY THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM; (3) PROVIDE THE CONTACT INFORMATION OF THE DEPLOYER; (4) PROVIDE A PLAIN LANGUAGE DESCRIPTION OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM; (5) PROVIDE INSTRUCTIONS REGARDING HOW TO ACCESS THE STATEMENT REQUIRED UNDER § 14–5004(C)(5) OF THIS SUBTITLE; (6) DISCLOSE THE DECISION THAT THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM IS DEPLOYED TO MAKE OR CONTRIBUTE TO MAKING; (7) DISCLOSE THE REASON FOR THE DECISION THAT THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM IS DEPLOYED TO MAKE OR CONTRIBUTE TO MAKING; (8) DISCLOSE THE DEGREE TO WHICH THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM IS INVOLVED IN MAKING THE DECISION DISCLOSED UNDER ITEM (6) OF THIS SECTION; (9) DISCLOSE THE DATA THAT THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM USES IN MAKING OR CONTRIBUTING TO MAKING THE DECISION AND ITS SOURCE; (10) BE PROVIDED DIRECTLY TO THE CONSUMER, OR IN A MANNER REASONABLY CALCULATED TO BE ACCESSIBLE BY THE CONSUMER IF PROVIDING THE DISCLOSURE DIRECTLY IS NOT POSSIBLE; (11) BE IN PLAIN LANGUAGE; (12) BE MADE AVAILABLE IN EACH LANGUAGE THAT THE DEPLOYER REGULARLY USES IN CONTRACTS, DISCLAIMERS, SALE ANNOUNCEMENTS, AND OTHER INFORMATION PROVIDED TO CONSUMERS; AND (13) BE MADE AVAILABLE IN A FORMAT THAT IS ACCESSIBLE TO CONSUMERS WITH DISABILITIES.

Section 14–5005 specifies the content and form requirements for the standardized disclosure that deployers must make available at deployment under § 14–5004(A)(4). The disclosure must notify consumers that a high-risk AI system is in use, disclose the system's purpose, the nature of the decision, deployer contact information, a plain language system description, the specific decision being made, the reason for the decision, the degree of AI involvement, and the data used and its source. The disclosure must be provided directly to the consumer (or in a reasonably accessible manner), in plain language, in each language the deployer regularly uses, and in a format accessible to consumers with disabilities.

Compliance actions 1 item

Deployers must provide consumers with a standardized disclosure that (1) notifies the consumer a high-risk AI system is in use, (2) discloses the purpose of the system and the nature, reason, and degree of the AI's involvement in the decision, (3) identifies the data used and its source, (4) includes deployer contact information, and (5) is delivered directly to the consumer in plain language, in all languages the deployer regularly uses, and in an accessible format.

H-01.1

Md. Code, Com. Law § 14–5006

Impact assessment timing and contents

Deployer

(A)(1)–(2) 14 AN IMPACT ASSESSMENT SHALL BE COMPLETED: (1) AT LEAST ONCE EACH YEAR; AND (2) WITHIN 90 DAYS AFTER AN INTENTIONAL AND SUBSTANTIAL MODIFICATION OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM.

(B)(1)–(11) 14 AN IMPACT ASSESSMENT UNDER THIS SECTION SHALL INCLUDE: (1) THE PURPOSE, INTENDED USE CASES, AND BENEFITS OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM; (2) THE CONTEXT IN WHICH THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM WAS DEPLOYED; (3) AN ANALYSIS OF KNOWN OR REASONABLY FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION POSED BY THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM; (4) A DESCRIPTION OF STEPS TAKEN TO MITIGATE KNOWN OR REASONABLY FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION POSED BY THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM; (5) A DESCRIPTION OF THE INPUTS AND OUTPUTS OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM; (6) A DESCRIPTION OF ANY DATA USED BY A DEVELOPER TO CUSTOMIZE THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM; (7) A DESCRIPTION OF ANY METRICS USED TO EVALUATE THE PERFORMANCE OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM; (8) A DESCRIPTION OF KNOWN LIMITATIONS OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM; (9) A DESCRIPTION OF TRANSPARENCY MEASURES IMPLEMENTED REGARDING THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM, INCLUDING MEASURES TAKEN TO DISCLOSE THAT THE SYSTEM IS IN USE TO A CONSUMER WHEN THE SYSTEM IS IN USE; (10) A DESCRIPTION OF THE DEPLOYER'S OVERSIGHT PROCESSES, INCLUDING: (I) USER SAFEGUARDS PROVIDED; AND (II) THE DEPLOYER'S PROCESS FOR ADDRESSING ISSUES ARISING FROM THE DEPLOYMENT OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM; AND (11) FOR ANY IMPACT ASSESSMENT FOLLOWING THE INITIAL IMPACT ASSESSMENT OF A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM, A DESCRIPTION OF THE EXTENT TO WHICH THE USE OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM WAS CONSISTENT WITH THE DEVELOPER'S INTENDED USES.

(C)(1)–(2) AN IMPACT ASSESSMENT UNDER SUBSECTION (B) OF THIS SECTION MAY: (1) ADDRESS MULTIPLE SUBSTANTIALLY SIMILAR HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEMS; AND (2) HAVE BEEN CREATED IN ORDER TO COMPLY WITH ANOTHER REQUIREMENT OTHER THAN THIS SUBTITLE IF THE IMPACT ASSESSMENT SATISFIES THE REQUIREMENTS OF THIS SUBTITLE.

Section 14–5006 specifies the frequency and substantive requirements for impact assessments. Assessments must be completed at least annually and within 90 days of any intentional and substantial modification. The required contents are detailed across eleven elements, covering purpose, deployment context, algorithmic discrimination risk analysis, mitigation steps, system inputs and outputs, customization data, performance metrics, known limitations, transparency measures, oversight processes, and (for post-initial assessments) a comparison to intended uses. Impact assessments may cover multiple substantially similar systems and may satisfy equivalent obligations under other regulatory regimes.

Compliance actions 1 item

Deployers must complete an impact assessment at least annually and within 90 days of any intentional and substantial modification, covering system purpose, deployment context, algorithmic discrimination risk analysis, mitigation steps, inputs and outputs, customization data, performance metrics, known limitations, transparency measures, oversight processes, and (for subsequent assessments) consistency with intended uses.

H-02.3

Md. Code, Com. Law § 14–5007

Rebuttable presumption and Attorney General regulatory authority

DeployerDeveloper

(A)(1)–(2) THERE IS A REBUTTABLE PRESUMPTION THAT A DEVELOPER TOOK REASONABLE PRECAUTIONS UNDER § 14–5002(A) OF THIS SUBTITLE IF THE DEVELOPER COMPLIED WITH: (1) § 14–5002 OF THIS SUBTITLE; AND (2) REGULATIONS ADOPTED BY THE ATTORNEY GENERAL.

(B)(1)–(2) THERE IS A REBUTTABLE PRESUMPTION THAT A DEPLOYER TOOK REASONABLE PRECAUTIONS UNDER § 14–5003(A) OF THIS SUBTITLE IF THE DEPLOYER COMPLIED WITH: (1) § 14–5003 OF THIS SUBTITLE; AND (2) REGULATIONS ADOPTED BY THE ATTORNEY GENERAL.

(C)(1)–(4) 15 THE ATTORNEY GENERAL MAY, IN A FORM AND MANNER PRESCRIBED BY THE ATTORNEY GENERAL, REQUIRE A DEVELOPER OR DEPLOYER TO PROVIDE DISCLOSURES OTHERWISE REQUIRED UNDER THIS SUBTITLE FOR PURPOSES OF EVALUATING THE DISCLOSURE'S COMPLIANCE WITH THIS SUBTITLE. (2) A DEVELOPER OR DEPLOYER MAY DECLINE TO PROVIDE THE ATTORNEY GENERAL WITH INFORMATION THAT WOULD REQUIRE THE DISCLOSURE OF TRADE SECRETS OR INFORMATION OTHERWISE PROTECTED BY STATE OR FEDERAL LAW. (3) INFORMATION PROVIDED TO THE ATTORNEY GENERAL UNDER THIS SUBSECTION IS NOT SUBJECT TO DISCLOSURE UNDER THE MARYLAND PUBLIC INFORMATION ACT. (4) DISCLOSURE OF INFORMATION UNDER THIS SUBSECTION THAT IS SUBJECT TO ATTORNEY-CLIENT PRIVILEGE OR WORK-PRODUCT PROTECTION DOES NOT WAIVE THAT PRIVILEGE OR PROTECTION.

Section 14–5007 creates rebuttable presumptions of compliance with the reasonable-precautions duties for both developers and deployers who satisfy the full statutory requirements and any regulations adopted by the Attorney General. It also grants the Attorney General authority to require developers and deployers to produce disclosures otherwise required under the subtitle for compliance evaluation, with protections for trade secrets, attorney-client privilege, and work-product doctrine. Materials provided to the Attorney General are exempt from the Maryland Public Information Act.

Compliance actions 1 item

Developers and deployers must produce disclosures otherwise required under the subtitle to the Attorney General upon request for compliance evaluation, subject to trade secret and privilege protections. Materials provided are exempt from public records disclosure.

R-02.2

Md. Code, Com. Law § 14–5008

Enforcement

(A)(1)–(2) EXCEPT AS PROVIDED IN SUBSECTION (B) OF THIS SECTION, A VIOLATION OF THIS SUBTITLE IS: (1) AN UNFAIR, ABUSIVE, OR DECEPTIVE TRADE PRACTICE WITHIN THE MEANING OF TITLE 13 OF THIS ARTICLE; AND (2) SUBJECT TO THE ENFORCEMENT AND PENALTY PROVISIONS CONTAINED IN TITLE 13 OF THIS ARTICLE, EXCEPT FOR § 13–408 OF THIS ARTICLE.

(B) THIS SECTION DOES NOT PREVENT A CONSUMER FROM PURSUING ANY OTHER REMEDY PROVIDED BY LAW.

Section 14–5008 designates violations of Subtitle 50 as unfair, abusive, or deceptive trade practices under the Maryland Consumer Protection Act (Title 13), subject to Title 13's enforcement and penalty provisions — except for § 13–408, which is the class-action provision. The bill preserves consumer access to any other remedy available by law, signaling that common-law and other statutory claims remain available.

Md. Code, Com. Law § 14–5101

Voice and likeness clone definitions

(A)–(C) IN THIS SUBTITLE THE FOLLOWING WORDS HAVE THE MEANINGS INDICATED. (B) "ARTIFICIAL INTELLIGENCE" HAS THE MEANING STATED IN § 3.5–801 OF THE STATE FINANCE AND PROCUREMENT ARTICLE. (C) "DIGITAL COPY" MEANS A NEWLY CREATED, ELECTRONIC REPRESENTATION OF THE IDENTITY OF AN ACTUAL INDIVIDUAL CREATED USING A COMPUTER, AN ALGORITHM, SOFTWARE, A TOOL, ARTIFICIAL INTELLIGENCE, OR ANY OTHER TECHNOLOGY THAT IS: (1) FIXED IN A SOUND RECORDING OR AUDIOVISUAL WORK IN WHICH THE INDIVIDUAL DID NOT ACTUALLY PERFORM OR APPEAR; AND (2) SO REALISTIC THAT A REASONABLE PERSON WOULD BELIEVE THE DIGITAL COPY IS A PERFORMANCE BY THE INDIVIDUAL BEING PORTRAYED AND NOT ANOTHER INDIVIDUAL.

Section 14–5101 establishes the definitions for Subtitle 51 governing agreements concerning voice and likeness clones. It cross-references the same AI definition from the State Finance and Procurement Article and defines digital copy as a newly created electronic representation of an individual's identity using AI or other technology, fixed in an audiovisual or sound work, so realistic a reasonable person would believe it is a genuine performance.

Md. Code, Com. Law § 14–5102

Unenforceability of digital copy agreements without proper disclosure and representation

Deployer

(1)–(3) 16 AN AGREEMENT TO PERFORM PERSONAL OR PROFESSIONAL SERVICES IS UNENFORCEABLE IF: (1) THE AGREEMENT ALLOWS FOR THE CREATION OR USE OF A DIGITAL COPY OF A PERSON'S VOICE OR IMAGE INSTEAD OF WORK PERFORMED LIVE BY THE PERSON; (2) THE AGREEMENT DOES NOT INCLUDE: (I) A DESCRIPTION OF THE INTENDED USES OF THE DIGITAL COPY THAT IS EASILY UNDERSTANDABLE; AND (II) THE LICENSING TERMS GOVERNING THE USE OF THE DIGITAL COPY; AND (3) THE PERSON WAS NOT REPRESENTED BY: (I) A LAWYER WHO NEGOTIATED ON BEHALF OF THE PERSON LICENSING THE RIGHTS TO A DIGITAL COPY; OR (II) A LABOR UNION REPRESENTING WORKERS WHO PERFORM SIMILAR WORK WITH A COLLECTIVE BARGAINING AGREEMENT THAT EXPRESSLY COVERS THE USE OF DIGITAL COPIES.

Section 14–5102 renders unenforceable any personal or professional services agreement that authorizes creation or use of a digital copy of a person's voice or image unless the agreement includes an easily understandable description of intended uses and the applicable licensing terms, and the individual was represented by either a lawyer or a labor union with a collective bargaining agreement covering digital copies. This is a contract-formation requirement designed to protect performers and service providers from unknowing consent to AI-generated replications of their voice or likeness.

Compliance actions 1 item

Any agreement authorizing the creation or use of an AI-generated digital copy of a person's voice or image in lieu of live performance is unenforceable unless it includes (1) an easily understandable description of the digital copy's intended uses, (2) the licensing terms governing use, and (3) the person was represented by a lawyer or a union with a collective bargaining agreement covering digital copies.

CP-02.4

Md. Code, Com. Law § 13–301(14)(xliv)

UDAP integration

(xliv) TITLE 14, SUBTITLE 50 OF THIS ARTICLE; OR

This amendment to § 13–301 adds Subtitle 50 to the enumerated list of provisions whose violation constitutes an unfair, abusive, or deceptive trade practice under the Maryland Consumer Protection Act. This is the statutory hook that brings the new AI obligations into the existing CPA enforcement framework.

Deceptive Conduct AI-generated likeness · consent requirements

1 item

CP-02.4

Human Oversight Decision review · appeal pathways

8 items

H-02.1

Deployers must take reasonable precautions to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination posed by the intended uses of a deployed high-risk AI system.

H-02.3

Deployers must complete an impact assessment for any deployed high-risk AI system and retain all impact assessments and related records for at least 3 years after the end of deployment.

H-02.8

Deployers must assess at least annually whether each deployed high-risk AI system is causing algorithmic discrimination.

H-01.3

Deployers must make available at the time of deployment a standardized disclosure meeting the requirements of § 14–5005, notifying consumers that a high-risk AI system is in use.

H-01.2

H-01.1

H-02.3

Governance Risk management · accountability programs

4 items

G-02.1

G-02.4

G-01.1

G-02.4

Regulatory Reporting · disclosure · audit

3 items

R-01.3

R-02.2

Developers must provide the Attorney General with the standardized disclosure documentation required under § 14–5002(C) upon request by the Attorney General.

R-02.2

Passage Likelihood

Failed

Status Failed

Final action Hearing 3/04 at 1:00 p.m.

Legislative History

2025-02-07 First Reading Economic Matters

2025-02-07 Hearing 3/04 at 1:00 p.m.

Sources

Full Text ↗

Entry Last Reviewed

2026-05-20

AI generated