AI Compliance in MD: What Businesses Need to Know in 2025

The rapid proliferation of Artificial Intelligence (AI) across industries has ushered in an equally swift wave of regulatory activity. For businesses operating in Maryland, understanding this evolving landscape is no longer optional but a critical component of risk management and operational continuity. This article serves as an essential guide for compliance officers, general counsel, and CTOs at mid-to-large companies, detailing the specific AI compliance requirements in Maryland, alongside the broader federal and international mandates that often impact multi-jurisdictional operations.

Maryland's proactive stance on AI regulation, particularly in employment, signals a trend towards greater scrutiny of algorithmic decision-making. Navigating these new rules demands not just awareness but also robust operational frameworks and often, sophisticated AI compliance software.

Maryland's Pioneering AI Employment Law: HB 1106

Maryland has taken a significant step in regulating the use of AI in employment decisions with the enactment of the Maryland AI Employment Law (HB 1106). This legislation, effective October 1, 2025, marks a crucial date for employers utilizing AI-powered tools in hiring, promotion, or termination processes. The law aims to ensure fairness, transparency, and accountability in the application of AI within the employment lifecycle.

Key Requirements of Maryland HB 1106

Under HB 1106, employers in Maryland who use "automated decision tools" (ADT) for employment-related decisions must comply with several key provisions:

• Notice and Consent: Employers must provide clear and conspicuous notice to applicants or employees when an ADT is used in the employment decision-making process. This notice must inform them about the AI's use, the job qualifications and characteristics the AI will use to assess them, and allow them to request an alternative selection process or accommodation. Consent must be obtained where necessary.
• Bias Audits: The law mandates that employers ensure their ADTs are audited for bias annually by an independent auditor. This audit must assess the tool's impact on different demographic groups and identify any disparate impacts based on race, gender, or other protected characteristics. The results of these audits must be made available upon request.
• Transparency and Explanation: Individuals affected by an ADT's decision must be provided with an explanation of the basis of the decision upon request. This requires employers to understand how their AI systems arrive at conclusions and be able to articulate this in an understandable manner.
• Human Review: The law emphasizes the importance of human oversight. While not explicitly banning fully automated decisions, it necessitates a framework where human review can intervene and override AI-generated recommendations, particularly in cases of adverse decisions.

Who Must Comply with HB 1106?

The Maryland AI Employment Law applies to any "employer" (as defined under state labor laws) that uses an "automated decision tool" to screen, assess, or make decisions about employment candidates or employees. This includes tools that analyze resumes, evaluate video interviews, or conduct personality assessments using AI.

Penalties for Non-Compliance

Non-compliance with Maryland HB 1106 carries significant risks. The Maryland Commissioner of Labor and Industry is tasked with enforcement, and violations can result in penalties of up to $10,000 per violation. For mid-to-large companies that process numerous applications or manage a large workforce, these penalties can quickly accumulate, underscoring the necessity for robust AI compliance automation.

Beyond Maryland: Navigating the Broader AI Regulatory Landscape

While Maryland's HB 1106 is a critical local concern, businesses, especially those operating across state lines or internationally, must contend with a much broader and complex web of AI regulations. A comprehensive AI compliance platform is essential for maintaining oversight and adherence in this multi-jurisdictional environment.

Federal Scrutiny and Emerging U.S. Standards

At the federal level, the U.S. lacks a single, overarching AI law, but various agencies are actively asserting their authority over AI. The Federal Trade Commission (FTC), for instance, has leveraged its Section 5 authority to pursue enforcement actions against companies using AI in ways that are unfair, deceptive, or discriminatory. Violations of FTC Section 5 can lead to penalties of up to $50,000 per violation per day. While not a direct mandate, the NIST AI Risk Management Framework (AI RMF 1.0) offers voluntary guidance for managing risks associated with AI, which can inform best practices and demonstrate due diligence.

Key State-Level Developments Affecting Multi-State Operations

Maryland businesses with operations or customers outside the state will likely encounter other significant AI regulations:

Colorado AI Act (SB 24-205)

The Colorado AI Act (SB 24-205) represents one of the most comprehensive state-level AI regulations in the U.S. and will be effective June 30, 2026. This law targets "developers" and "deployers" of "high-risk artificial intelligence systems." It requires:

• Reasonable Care: Developers and deployers must exercise reasonable care to avoid algorithmic discrimination.
• Impact Assessments: Deployers of high-risk AI must conduct impact assessments, including identifying potential harms, mitigation strategies, and disparate impacts.
• Transparency and Disclosure: Consumers must be informed when interacting with an AI system and have a right to access, correct, or delete personal data processed by AI.
• Notice to Attorney General: Developers must notify the Colorado Attorney General of certain high-risk AI system failures.

For a Maryland company deploying AI nationally, adhering to Colorado AI Act compliance is paramount if their systems are used in Colorado or by Colorado residents. Non-compliance can lead to penalties of up to $20,000 per violation. Understanding Colorado SB 205 requirements is crucial for any business with a national footprint.

California AI Regulations

California, a leader in tech and regulation, has enacted several AI-related laws:

• California AB 2013 (Training Data): Effective January 1, 2025, this bill focuses on the responsible use of training data for AI models. Non-compliance can result in penalties of up to $7,500 per violation, enforced by the California Attorney General.
• California SB 53 (Frontier AI / Incident Reporting): Effective September 29, 2025, this law addresses high-impact AI systems, including requirements for incident reporting and risk management. Penalties can be severe, reaching up to $1,000,000 per violation.
• California AI Transparency Act (SB 942): Effective January 1, 2026, this act mandates transparency for AI systems, particularly those interacting with consumers. Penalties for non-compliance can be up to $5,000 per violation per day.

Any Maryland business serving California consumers or operating within the state must factor these into their broader AI strategy.

NYC Automated Employment Decision Tools (AEDT) Law (Local Law 144)

For Maryland companies hiring in New York City, the NYC AEDT Law (Local Law 144 of 2021), effective July 5, 2023, is directly relevant. This law requires:

• Bias Audits: Annual independent bias audits for AEDTs used to screen candidates or employees for employment or promotion.
• Notice: Employers must notify candidates and employees of the use of AEDTs, the job qualifications and characteristics they assess, and allow them to request an alternative accommodation.
• Public Disclosure: Results of bias audits must be publicly available.

Adhering to NYC Local Law 144 compliance is essential to avoid penalties of up to $1,500 per violation per day.

Illinois AI Video Interview Act (AIVIA)

The Illinois AI Video Interview Act (HB 2557), effective January 1, 2020, mandates that employers using AI to analyze video interviews of applicants for Illinois-based positions must:

• Notify Applicants: Inform applicants that AI will be used to analyze their video interviews.
• Provide Information: Explain how the AI works and what characteristics it evaluates.
• Obtain Consent: Secure applicant consent to be evaluated by AI.

Non-compliance can lead to penalties of up to $1,000 per violation, enforced by the Illinois Department of Commerce and Economic Opportunity.

International Reach: The EU AI Act and GDPR

For Maryland businesses with a global footprint, particularly those with customers or operations in the European Union, international AI regulations pose significant compliance challenges.

EU AI Act (Regulation (EU) 2024/1689)

The EU AI Act (Regulation (EU) 2024/1689), which became effective August 1, 2024, is arguably the world's most comprehensive AI law. It adopts a risk-based approach, imposing stricter requirements on "high-risk" AI systems. While many provisions will roll out over time, the enforcement for high-risk AI systems becomes applicable by August 2, 2026. Key aspects include:

• Risk Categorization: AI systems are classified into unacceptable, high, limited, and minimal risk categories, with varying obligations.
• High-Risk Requirements: High-risk AI (e.g., in critical infrastructure, employment, law enforcement) must undergo conformity assessments, risk management systems, human oversight, data governance, and robust cybersecurity measures.
• Transparency and Information: Providers and deployers must ensure transparency about their high-risk AI systems.

Achieving EU AI Act compliance is critical for any Maryland company whose AI systems interact with the EU market. Penalties for non-compliance are substantial, reaching up to $35,000,000 per violation or 7% of global annual turnover, whichever is higher. Developing an EU AI Act compliance checklist is a vital first step for relevant businesses.

GDPR (AI Provisions)

Existing data privacy laws like the GDPR (Regulation (EU) 2016/679), effective May 25, 2018, also have significant implications for AI. GDPR's provisions on automated individual decision-making (Article 22) restrict decisions based solely on automated processing, including profiling, if they produce legal or similarly significant effects. This directly impacts AI systems used in areas like credit scoring, employment, or insurance. Non-compliance with GDPR's AI-relevant provisions can lead to penalties of up to $20,000,000 per violation or 4% of global annual turnover.

Challenges of Multi-Jurisdictional AI Compliance

The patchwork of AI regulations—from Maryland's specific employment focus to Colorado's broad high-risk framework and the EU's comprehensive approach—creates significant challenges for multi-state and international businesses:

• Varying Definitions: What constitutes "high-risk AI" or an "automated decision tool" can differ significantly across jurisdictions.
• Overlapping and Conflicting Requirements: Businesses may face situations where compliance with one regulation complicates adherence to another.
• Data Residency and Governance: Managing AI training data and outputs across different data sovereignty laws adds complexity.
• Enforcement Risk: The multiplicity of enforcers (state attorneys general, federal agencies, international bodies) increases the likelihood of penalties.

Effectively managing these challenges requires more than manual processes. It necessitates a centralized, dynamic, and intelligent AI compliance platform.

Leveraging Technology for Automated AI Compliance

Given the complexity and the severe penalties associated with non-compliance, manual tracking and ad-hoc solutions are insufficient. This is where dedicated AI compliance software becomes indispensable. Platforms like AICompliant are designed to provide the necessary tools for real-time monitoring, comprehensive risk assessment, and streamlined policy management across diverse regulatory landscapes.

AICompliant offers a robust solution for businesses grappling with the intricacies of AI regulation, from the Maryland AI Employment Law to the EU AI Act. Our platform facilitates:

• Real-time Regulatory Mapping: Continuously tracks changes in AI laws, including effective dates like October 1, 2025, for Maryland HB 1106, June 30, 2026, for the Colorado AI Act, and August 2, 2026, for EU AI Act high-risk enforcement.
• Automated Impact Assessments: Guides businesses through conducting the necessary bias and impact assessments required by laws such as Maryland HB 1106 and the Colorado AI Act. Link: /tools/compliance-checker
• Policy and Workflow Management: Centralizes the creation, deployment, and enforcement of AI governance policies tailored to specific regulations, ensuring automated AI compliance.
• Audit Trails and Reporting: Generates comprehensive documentation and audit trails, critical for demonstrating compliance to regulators, particularly for the bias audit requirements of Maryland HB 1106 and NYC Local Law 144.
• Risk Monitoring and Mitigation: Identifies potential compliance gaps and recommends mitigation strategies, helping businesses avoid penalties of up to $10,000 in Maryland or up to $35,000,000 under the EU AI Act.
• Intuitive Dashboard: Provides a clear overview of your AI compliance posture, risks, and tasks, accessible via a user-friendly interface. Link: /dashboard

By utilizing an advanced AI compliance tool like AICompliant, businesses can transform a daunting regulatory challenge into a manageable, integrated process. This not only mitigates legal and financial risks but also fosters trust and ethical AI deployment.

Key Steps for Maryland Businesses

To ensure preparedness and ongoing compliance, Maryland businesses should take the following actionable steps:

1. Conduct an AI Inventory: Identify all AI systems and automated decision tools currently in use or planned for deployment, especially those impacting employment decisions.
2. Assess Regulatory Exposure: Determine which specific regulations (Maryland HB 1106, Colorado AI Act, EU AI Act, NYC Local Law 144, etc.) apply to your AI systems based on your operational footprint and customer base. For comprehensive analysis, leverage tools like our /tools/compliance-checker.
3. Perform Impact Assessments: For each relevant AI system, conduct the necessary bias and impact assessments as mandated by applicable laws, like the annual audits for Maryland HB 1106.
4. Develop Internal Policies and Procedures: Create clear internal guidelines for AI development, deployment, transparency, data governance, and human oversight.
5. Implement a Continuous Monitoring Solution: Adopt an AI compliance platform like AICompliant to automate tracking, reporting, and risk management.
6. Train Staff: Educate legal, HR, IT, and product development teams on their responsibilities under the new AI regulations.

Conclusion

The regulatory landscape for AI is evolving rapidly, with Maryland's HB 1106 setting a precedent for state-level action in employment. For mid-to-large companies, simply reacting to each new law is unsustainable. A proactive, technology-driven approach, powered by effective AI compliance software, is essential for navigating this complexity. By understanding specific requirements like the Maryland AI Employment Law and preparing for broader impacts from regulations like the Colorado AI Act and EU AI Act, businesses can not only mitigate risks but also build a foundation for responsible and ethical AI innovation.

Take Control of Your AI Compliance Journey Today

Don't let the complexity of AI regulation expose your organization to unnecessary risk. AICompliant provides the intelligent solutions needed to master the evolving AI compliance landscape, ensuring your business is prepared for all current and upcoming mandates, from Maryland to the EU.

Discover how AICompliant can streamline your AI compliance strategy. Visit https://aicompliant.ai/pricing to learn more about our comprehensive plans.

---

Frequently Asked Questions

Does the Maryland AI Employment Law apply to all businesses in MD?

The Maryland AI Employment Law (HB 1106) applies to any "employer" (as defined under state labor laws) that uses an "automated decision tool" to screen, assess, or make decisions about employment candidates or employees for positions located in Maryland. This means if you are an employer using AI in your HR processes within Maryland, you must comply.

What are the key deadlines for AI compliance in Maryland?

The Maryland AI Employment Law (HB 1106) officially becomes effective on October 1, 2025. Businesses must ensure they have implemented all necessary compliance measures, including notice provisions, bias audits, and explanation capabilities, by this date.

How does the Maryland law interact with federal AI guidelines like NIST?

While the NIST AI Risk Management Framework (AI RMF 1.0) offers voluntary guidance for managing AI risks, it is not a binding law. The Maryland AI Employment Law (HB 1106) is a specific, enforceable state law with mandatory requirements and penalties. Businesses in Maryland can use NIST guidelines to inform their internal AI governance practices and demonstrate due diligence, but they must still directly comply with all provisions of HB 1106.

Can AICompliant help us with EU AI Act compliance as well as MD regulations?

Yes, AICompliant is designed as a comprehensive AI compliance platform to manage multi-jurisdictional AI regulations. It provides features like real-time regulatory mapping, automated impact assessments, policy management, and audit trails that are applicable to diverse laws, including the Maryland AI Employment Law, the Colorado AI Act, NYC Local Law 144, and the EU AI Act. This allows businesses with an international footprint to streamline their compliance efforts across various legal frameworks.

What are the penalties for non-compliance with Maryland's AI law?

Non-compliance with the Maryland AI Employment Law (HB 1106) can result in penalties of up to $10,000 per violation. Enforcement is handled by the Maryland Commissioner of Labor and Industry. For mid-to-large companies, multiple violations could lead to substantial financial repercussions.