Maryland's Pioneering AI Employment Law (HB 1106)

The landscape of artificial intelligence (AI) regulation is rapidly evolving, and Maryland is at the forefront, particularly concerning the use of AI in employment decisions. For compliance officers, general counsel, and CTOs operating in or with connections to the Free State, understanding the nuances of the new Maryland AI Employment Law (HB 1106) is not just prudent—it's imperative for mitigating legal and reputational risks. As organizations increasingly adopt AI for hiring, performance management, and other HR functions, the demand for robust AI compliance software has never been higher. Proactive engagement with these new mandates is critical for ensuring operational continuity and avoiding significant penalties.

Maryland's HB 1106, officially effective October 1, 2025, marks a significant step towards regulating the deployment of AI in the workplace. This legislation aims to protect employees and job applicants from discriminatory or opaque practices enabled by automated employment decision tools (AEDTs). It mandates specific requirements for employers using AI, ranging from robust notice provisions to detailed bias audits and the assurance of meaningful human review. Compliance in this nascent field requires more than just legal review; it demands integrated technical and procedural controls, making an AI compliance platform an indispensable asset.

Key Provisions of Maryland HB 1106

The Maryland AI Employment Law (Bill HB 1106) targets employers who utilize automated employment decision tools. An "automated employment decision tool" is defined broadly as any "computational process, methodology, or model that is derived from machine learning, statistics, or other data processing or artificial intelligence techniques" that issues an output, including a score, classification, or recommendation, used to assist or replace discretionary decision-making for employment decisions.

Here’s a breakdown of the core requirements businesses must adhere to:

Notice and Transparency: Employers must provide clear and conspicuous notice to job applicants and employees that an automated employment decision tool will be used in evaluating their candidacy or performance. This notice must inform them of the characteristics that the AI tool assesses and how those characteristics relate to job performance. This transparency is key to fostering trust and accountability.
Bias Audits: Crucially, HB 1106 mandates that before using an AEDT, employers must conduct an independent bias audit. This audit must assess the tool's disparate impact on individuals based on sex, race, ethnicity, and other protected characteristics. Furthermore, these audits must be repeated periodically as specified by regulations to ensure ongoing fairness. The findings of these audits must be made publicly available, subject to certain privacy considerations. This requirement poses a significant technical challenge for many organizations, necessitating specialized tools and expertise to perform thorough, reproducible analyses.
Human Review and Override: The law emphasizes the importance of human oversight. Employers must ensure that a human being reviews and can override any employment decision solely made by an AEDT. This provision aims to prevent situations where an applicant or employee is disadvantaged without the possibility of human intervention or reconsideration.
Data Security and Privacy: While not explicitly detailed in the same way as notice or bias audits, the underlying principles of secure data handling and privacy are implicitly critical. Employers must ensure that data used by AEDTs is collected, stored, and processed in compliance with broader data privacy regulations, safeguarding sensitive personal information.
Documentation and Record-Keeping: Maintaining meticulous records of AI system deployments, bias audits, decision-making processes, and any human overrides will be essential for demonstrating compliance during potential investigations.

Who Must Comply and What Are the Penalties?

The Maryland AI Employment Law (HB 1106) applies to any employer operating in Maryland that uses an automated employment decision tool for screening or evaluating job applicants or employees for employment-related decisions, including hiring, promotion, demotion, or termination.

Non-compliance carries significant financial consequences. The Maryland Commissioner of Labor and Industry, the enforcer of this law, can impose penalties of up to $10,000 per violation. Given the potential for multiple violations across a large workforce or numerous hiring processes, these penalties can quickly escalate, presenting a substantial financial risk for non-compliant organizations. The effective date of October 1, 2025, means businesses have a limited window to implement the necessary technical and procedural changes.

Navigating the Broader AI Regulatory Landscape for Maryland Businesses

While Maryland's HB 1106 is a critical piece of local legislation, the regulatory environment for AI extends far beyond state borders. Mid-to-large companies, even those primarily based in Maryland, often operate nationally or globally, interact with diverse customer bases, and engage with vendors subject to various jurisdictions. This necessitates a comprehensive understanding of a multi-layered regulatory framework. An integrated AI compliance platform is essential for tracking and managing these complex, overlapping obligations.

The European Union's Landmark EU AI Act

For any Maryland-based business with operations, customers, or even data processing activities in the European Union, the EU AI Act (Regulation (EU) 2024/1689) represents the most comprehensive and far-reaching AI regulation globally. Effective August 1, 2024, with specific provisions phasing in over time, enforcement for high-risk AI systems will commence by August 2, 2026. The Act adopts a risk-based approach, imposing stringent requirements on "high-risk" AI systems, which include many AI applications in critical infrastructure, employment, law enforcement, and other sensitive areas.

Key requirements under the EU AI Act include:

Robust risk management systems.
Data governance and quality.
Detailed technical documentation and record-keeping.
Transparency and information to users.
Human oversight.
Accuracy, robustness, and cybersecurity.
Conformity assessments.

Non-compliance with the EU AI Act carries some of the steepest penalties in AI regulation, reaching up to $35,000,000 per violation or 7% of a company's annual worldwide turnover, whichever is higher. Developing an EU AI Act compliance checklist is a critical first step for affected organizations, and sophisticated AI compliance software can significantly streamline this process by automating documentation, risk assessments, and monitoring. You can learn more about its impact at /regulations/eu-ai-act.

Colorado AI Act (SB 24-205): A State-Level Precedent

Similar to Maryland, Colorado has enacted significant AI legislation. The Colorado AI Act (Bill SB 24-205), effective June 30, 2026, focuses on "high-risk" AI systems and places obligations on developers and deployers to exercise reasonable care to avoid algorithmic discrimination. This includes requirements for impact assessments, risk management programs, transparency to consumers, and mechanisms for correcting errors or appealing adverse decisions.

For a Maryland business operating or selling to customers in Colorado, or utilizing AI systems developed by Colorado-based entities, understanding Colorado AI Act compliance is crucial. Developers and deployers of high-risk AI systems must, among other things:

Implement a risk management program.
Conduct impact assessments for high-risk AI systems.
Provide clear disclosures to consumers.

The Colorado Attorney General, the enforcer, can impose penalties of up to $20,000 per violation. These provisions highlight the need for a granular approach to state-specific AI regulations. Businesses should carefully review Colorado SB 205 requirements to ensure their AI governance frameworks are sufficiently robust. More details are available at /regulations/colorado-ai-act.

NYC Local Law 144: Automated Employment Decision Tools

The precedent set by NYC Local Law 144 (Local Law 144 of 2021), effective July 5, 2023, is highly relevant for Maryland businesses that engage in hiring practices in New York City. This law was one of the first in the U.S. to specifically regulate automated employment decision tools (AEDTs), requiring bias audits, notice to candidates, and public reporting of audit results.

Key obligations for employers using AEDTs in NYC include:

Conducting independent bias audits before using the tool.
Providing notice to candidates about the use of an AEDT and the job qualifications it assesses.
Publishing audit results on their website.

Penalties for non-compliance can reach up to $1,500 per violation per day, enforced by the NYC Department of Consumer and Worker Protection (DCWP). This daily accrual mechanism underscores the urgency of achieving NYC Local Law 144 compliance and maintaining continuous adherence. Even if an MD-based company is not primarily in NYC, but has remote workers or specific hiring pipelines there, this law applies. Further information can be found at /regulations/nyc-local-law-144.

Other Notable State Regulations

Beyond Maryland, Colorado, and NYC, other states are also enacting AI-related legislation:

California AB 2013 (Training Data): Effective January 1, 2025, this bill focuses on the transparency and provenance of data used to train generative AI models. Penalties can reach up to $7,500 per violation.
Connecticut AI and Data Privacy (SB 1103): Effective October 1, 2025, this law includes provisions related to AI and data privacy, with penalties up to $5,000 per violation.
Illinois AI Video Interview Act (AIVIA) (HB 2557): Effective January 1, 2020, specifically regulates the use of AI in video interviews, requiring notice and consent, with penalties up to $1,000 per violation.
Utah AI Policy Act (SB 149): Effective May 1, 2024, mandates disclosure when interacting with generative AI that creates "deepfakes" and places obligations on developers. Penalties can be up to $10,000 per violation.

This patchwork of regulations demonstrates why an overarching AI compliance platform is no longer a luxury but a necessity for any company leveraging AI across multiple jurisdictions.

Building an Effective AI Compliance Strategy with Automated Tools

Given the complexity and rapid evolution of AI regulations, a manual approach to compliance is increasingly untenable. Organizations need a structured, proactive strategy supported by advanced technology. An AI compliance tool can provide the necessary framework for continuous adherence.

1. Inventory and Risk Assessment of AI Systems

The first step in any robust strategy is to conduct a thorough inventory of all AI systems currently in use or planned for deployment. This includes internally developed models, third-party software, and embedded AI functionalities. For each system, a comprehensive risk assessment must be performed, identifying potential harms (e.g., discrimination, privacy breaches, safety risks) and mapping them against relevant regulatory requirements (like Maryland HB 1106, EU AI Act, or Colorado AI Act). Tools like AICompliant's /tools/compliance-checker can help streamline this process, providing structured assessments against a comprehensive library of global regulations.

2. Develop and Implement AI Governance Policies

Based on the risk assessments, organizations must develop clear, actionable AI governance policies and procedures. These policies should cover the entire AI lifecycle, from data acquisition and model development to deployment, monitoring, and decommissioning. Key policy areas include:

Ethical AI principles: Aligning with frameworks like the OECD AI Principles or NIST AI Risk Management Framework (AI RMF 1.0).
Data governance: Ensuring fair, unbiased, and secure data practices for AI training and deployment.
Transparency and explainability: Establishing standards for how AI decisions are communicated and understood.
Human oversight: Defining when and how human review and intervention are required.
Bias detection and mitigation: Implementing continuous monitoring and auditing processes.

3. Employee Training and Awareness

Compliance is a shared responsibility. All employees involved in the development, deployment, or oversight of AI systems, particularly those using AEDTs in HR, must receive comprehensive training on relevant AI laws and internal policies. This ensures that legal requirements are understood and integrated into daily workflows, from data scientists to HR professionals.

4. Vendor Management and Third-Party Risk

Many organizations rely on third-party vendors for AI solutions. It is crucial to implement stringent vendor due diligence to ensure that external AI providers also comply with applicable regulations. This includes reviewing their AI governance frameworks, bias audit reports, and data security practices. Contractual agreements should explicitly outline AI compliance responsibilities and liabilities.

5. Continuous Monitoring, Auditing, and Documentation

AI systems are not static; they evolve with new data and retraining. Therefore, compliance must be an ongoing process. Regular audits, performance monitoring, and re-assessments of bias are essential. Robust documentation of all compliance efforts—including risk assessments, audit reports, policy changes, and incident responses—is critical for demonstrating due diligence to regulators. An AI compliance platform can automate much of this continuous monitoring and documentation, providing real-time insights and audit trails.

Leveraging an AI Compliance Platform for Seamless Management

The multi-jurisdictional nature of AI regulation, coupled with the technical complexities of AI systems, makes traditional compliance methods insufficient. This is where an AI compliance platform like AICompliant becomes invaluable. Our solution is designed to simplify and accelerate your journey to automated AI compliance, ensuring your business stays ahead of emerging regulations, from Maryland's HB 1106 to the EU AI Act and beyond.

AICompliant offers a comprehensive suite of features engineered to address the core challenges of AI governance and compliance:

Centralized Regulatory Tracking: Our platform maintains an up-to-date repository of global AI regulations, including the Maryland AI Employment Law, Colorado AI Act (SB 24-205), EU AI Act, and NYC Local Law 144. It provides detailed breakdowns of requirements, effective dates, and penalties, ensuring you're always informed.
Automated Risk Assessments: Conduct systematic risk assessments for all your AI systems against relevant legal frameworks. Our /dashboard provides a holistic view of your AI inventory and associated compliance risks, enabling quick identification and remediation.
Bias Audit Management: Streamline the process of conducting and documenting independent bias audits, a critical requirement for Maryland HB 1106 and NYC Local Law 144. Our platform helps you track audit schedules, store results, and generate public reports where required.
Policy and Documentation Generation: Generate customized AI governance policies, notices, and procedural documents that align with specific regulatory mandates. The platform facilitates version control and easy access for audit purposes.
Continuous Monitoring and Alerting: Implement automated monitoring for changes in regulatory requirements or deviations in your AI system's performance that could impact compliance. Receive proactive alerts to address issues before they become violations.
Audit Trail and Reporting: Maintain an immutable audit trail of all compliance activities, decisions, and documentation. Generate comprehensive reports for internal stakeholders or external regulators with ease.

By integrating AICompliant into your governance framework, you can transform your approach from reactive to proactive, ensuring that your AI initiatives are not only innovative but also responsible and compliant. Our AI compliance software empowers compliance officers, general counsel, and CTOs to confidently navigate the complex world of AI regulation, reducing legal exposure and building trust with employees, customers, and regulators.

Conclusion

The emergence of the Maryland AI Employment Law (HB 1106) and other significant regulations like the EU AI Act and Colorado AI Act underscores a universal truth: AI innovation must be paired with robust governance and compliance. For businesses in Maryland and beyond, understanding and proactively addressing these requirements is not optional. The looming effective dates and substantial penalties demand immediate action.

Implementing an effective strategy for AI compliance automation is crucial for mitigating risks, maintaining operational integrity, and fostering a responsible AI ecosystem. By leveraging specialized solutions like AICompliant, organizations can navigate this intricate regulatory landscape with confidence, ensuring they meet their obligations and harness the transformative power of AI ethically and legally.

Ready to Streamline Your AI Compliance?

Don't let the complexity of AI regulations slow down your innovation. Explore how AICompliant can provide the automated AI compliance solutions you need to meet Maryland's HB 1106 requirements and navigate the global AI regulatory landscape with confidence.

Get Started with AICompliant Today

Frequently Asked Questions

What is the Maryland AI Employment Law (HB 1106) and when does it take effect?

The Maryland AI Employment Law (Bill HB 1106) regulates the use of automated employment decision tools (AEDTs) by employers in Maryland for hiring, promotion, and termination decisions. It requires notice to applicants/employees, independent bias audits, and human review capabilities. The law is effective October 1, 2025.

Do other AI laws like the EU AI Act or Colorado AI Act affect Maryland businesses?

Yes, absolutely. Maryland businesses operating internationally, selling products/services to customers in other states (like Colorado or New York City), or using vendors located in regulated jurisdictions, must comply with those respective laws. For example, the EU AI Act applies to Maryland companies offering AI systems or services in the EU, and the Colorado AI Act (SB 24-205) applies to companies deploying high-risk AI systems in Colorado. NYC Local Law 144 impacts hiring practices for jobs performed in NYC, even if the employer is based in Maryland.

What are the penalties for non-compliance with Maryland's AI Employment Law?

The Maryland Commissioner of Labor and Industry, the enforcer of HB 1106, can impose penalties of up to $10,000 per violation for non-compliance with the law's provisions.

How can an AI compliance platform help with Maryland's AI laws and other regulations?

An AI compliance platform like AICompliant provides a centralized system to track regulatory requirements (including Maryland HB 1106), conduct automated risk assessments, manage bias audits, generate necessary documentation and policies, and monitor AI systems for ongoing compliance. It helps automate processes to reduce manual effort and ensure continuous adherence across multiple jurisdictions.

What are the key requirements for an employer using an Automated Employment Decision Tool (AEDT) under Maryland HB 1106?

Under Maryland HB 1106, employers using AEDTs must provide clear notice to applicants/employees about the tool's use, conduct independent bias audits before deployment and periodically thereafter, and ensure that human review and override capabilities are available for any employment decisions made by the AI tool.

AI Compliance Requirements in MD 2026: What Businesses Need