AI compliance plan
Your AI compliance plan.
33 duties from 8 enacted laws in 1 state. Each one says who it falls on, when it starts and where in the law it comes from.
The plan at a glance
33duties from 8 laws
0start in the next 90 days
2laws let people sue over a violation
1law gives a set number of days to fix a violation before enforcement
Download CSV and calendar with Pro
Open as a checklist
Pro turns this plan into a spreadsheet for audit files and a calendar of every start date. The plan on this page stays open to everyone.
Already in effect 29 duties
These duties are in force today.
| Starts | Law | Who | What it requires | How often | Source |
|---|---|---|---|---|---|
| October 1, 2019 | Maryland ban on computer-generated child sexual abuse images (SB 736, 2019)Also enacted as HB1027 | Person | Do not knowingly possess and intentionally retain a real or computer-generated image indistinguishable from an identifiable child under 16 showing sexual conduct, sexual excitement or sadomasochistic abuse.Applies when: Any covered visual representation, including AI-generated or altered images of an actual and identifiable child. | Ongoing | Md. Code, Crim. Law § 11-208(b)(1) |
| October 1, 2020 | Maryland ban on facial recognition in job interviews without consent | Employer | Do not use a facial recognition service to create a facial template during an applicant's interview for employment unless the applicant consents by signing a waiver.Applies when: An employer interviews an applicant for employment. | Ongoing | Lab. & Empl. § 3-717(b), (c)(1) |
| July 1, 2022 | Maryland personal delivery device law (SB 726, 2021) | Personal delivery device operator | Before beginning operations in Maryland, file an emergency response plan with the Motor Vehicle Administrator describing the device and how first responders should handle it.Applies when: Before first operating in the State. | Once | Md. Code, Transp. § 21-104.5(f)(1) |
| July 1, 2022 | Maryland personal delivery device law (SB 726, 2021) | Personal delivery device operator | Mark each device with a unique identifying number and a means of identifying the operator, plus corporate contact information if acting for a corporate entity; repeat marked information in Braille.Applies when: Any device operated on a roadway, sidewalk, shoulder or crosswalk. The statute phrases these as requirements of the device. | Ongoing | Md. Code, Transp. § 21-104.5(d)(1)-(3), (e) |
| July 1, 2022 | Maryland personal delivery device law (SB 726, 2021) | Personal delivery device operator | Equip each device with a system enabling a controlled stop and with lighting the Motor Vehicle Administration requires after consulting industry stakeholders.Applies when: Any device operated on a roadway, sidewalk, shoulder or crosswalk. | Ongoing | Md. Code, Transp. § 21-104.5(d)(4), (6) |
| July 1, 2022 | Maryland personal delivery device law (SB 726, 2021) | Personal delivery device operator | Keep general liability coverage of at least $100,000, a policy meeting § 17-103, or other security acceptable to the Administration providing equivalent benefits.Applies when: Any device operated on a roadway, sidewalk, shoulder or crosswalk. | Ongoing | Md. Code, Transp. § 21-104.5(d)(5) |
| July 1, 2022 | Maryland personal delivery device law (SB 726, 2021) | Personal delivery device operator | Do not exceed 7 mph on sidewalks or crosswalks, unreasonably interfere with traffic, block public rights-of-way, or carry placarded hazardous materials in quantities posing unreasonable risk.Applies when: All operation of the device. | Ongoing | Md. Code, Transp. § 21-104.5(c) |
| July 1, 2022 | Maryland personal delivery device law (SB 726, 2021) | Personal delivery device operator | Keep devices off roadways with sidewalks or an adjacent shoulder, or posted limits above 35 mph; obey traffic and pedestrian control devices; follow applicable local permitting requirements.Applies when: All operation of the device. | Ongoing | Md. Code, Transp. §§ 21-1205.1(f), 21-104.5(d)(7), (8) |
| October 1, 2023 | Maryland ban on computer-generated child sexual abuse images (SB 736, 2019)Also enacted as HB1027 | Person | Do not knowingly or intentionally access and intentionally view such an image.Applies when: Added by SB 226 (2023); the same age limit and image categories apply. | Ongoing | Md. Code, Crim. Law § 11-208(b)(2) |
| October 1, 2024 | Maryland Age-Appropriate Design Code Act (Maryland Kids Code): algorithm, profiling and impact assessment provisionsAlso enacted as SB571 | Covered entity | Do not profile a child by default unless safeguards ensure it serves children's best interests and it is necessary for the requested product or justified by a compelling reason.Applies when: An online product accessed or reasonably likely to be accessed by children. Necessary profiling is limited to the aspects the child is actively and knowingly engaged with. | Ongoing | Commercial Law § 14-4606(a)(2) |
| October 1, 2024 | Maryland Age-Appropriate Design Code Act (Maryland Kids Code): algorithm, profiling and impact assessment provisionsAlso enacted as SB571 | Covered entity | Do not process a child's personal data in a way that is inconsistent with the best interests of children.Applies when: An online product accessed or reasonably likely to be accessed by children. | Ongoing | Commercial Law § 14-4606(a)(1) |
| July 1, 2025 | Maryland revenge porn law extended to computer-generated images (SB 360, 2025) | Person | Do not knowingly distribute a real or computer-generated image showing an identifiable person's intimate parts or sexual activity, intending harm, without their consent, where privacy was reasonably expected.Applies when: All three conditions must be met: intent to harm, harass, intimidate, threaten or coerce; knowledge of, or reckless disregard for, lack of consent; and a reasonable expectation of privacy. | Ongoing | Md. Code, Crim. Law § 3-809(a)(6), (c) |
| October 1, 2025 | Maryland law on AI in health insurance utilization review (HB 820) | Carrier, pharmacy benefits manager or private review agent | Ensure the tool bases determinations on the enrollee's medical or clinical history, the requesting provider's clinical circumstances, or other relevant clinical record information, and not solely on a group dataset.Applies when: A carrier, pharmacy benefits manager or private review agent uses an artificial intelligence, algorithm or other software tool for utilization review. | Ongoing | Md. Code, Ins. § 15-10B-05.1(c)(1), (2) |
| October 1, 2025 | Maryland law on AI in health insurance utilization review (HB 820) | Carrier, pharmacy benefits manager or private review agent | Ensure the tool's criteria and guidelines comply with Title 15 of the Insurance Article.Applies when: A carrier, pharmacy benefits manager or private review agent uses an artificial intelligence, algorithm or other software tool for utilization review. | Ongoing | Md. Code, Ins. § 15-10B-05.1(c)(3) |
| October 1, 2025 | Maryland law on AI in health insurance utilization review (HB 820) | Carrier, pharmacy benefits manager or private review agent | Ensure the tool does not replace the role of a health care provider in the determination process.Applies when: A carrier, pharmacy benefits manager or private review agent uses an artificial intelligence, algorithm or other software tool for utilization review. The provider role is the one set by § 15-10B-07. | Ongoing | Md. Code, Ins. § 15-10B-05.1(c)(4) |
| October 1, 2025 | Maryland law on AI in health insurance utilization review (HB 820) | Carrier, pharmacy benefits manager or private review agent | Ensure the tool does not result in unfair discrimination and is fairly and equitably applied, including under applicable federal health department regulations and guidance.Applies when: A carrier, pharmacy benefits manager or private review agent uses an artificial intelligence, algorithm or other software tool for utilization review. | Ongoing | Md. Code, Ins. § 15-10B-05.1(c)(5), (6) |
| October 1, 2025 | Maryland law on AI in health insurance utilization review (HB 820) | Carrier, pharmacy benefits manager or private review agent | Keep the tool open to inspection by the Insurance Commissioner for audit or compliance reviews.Applies when: A carrier, pharmacy benefits manager or private review agent uses an artificial intelligence, algorithm or other software tool for utilization review. | Ongoing | Md. Code, Ins. § 15-10B-05.1(c)(7) |
| October 1, 2025 | Maryland law on AI in health insurance utilization review (HB 820) | Carrier, pharmacy benefits manager or private review agent | Include written policies and procedures in the utilization plan describing how the tool is used and what oversight is provided.Applies when: A carrier, pharmacy benefits manager or private review agent uses an artificial intelligence, algorithm or other software tool for utilization review. The plan is the one filed under § 15-10B-05. | Ongoing | Md. Code, Ins. § 15-10B-05.1(c)(8) |
| October 1, 2025 | Maryland law on AI in health insurance utilization review (HB 820) | Carrier, pharmacy benefits manager or private review agent | Review the tool's performance, use and outcomes at least quarterly, and revise it as needed to maximize accuracy and reliability.Applies when: A carrier, pharmacy benefits manager or private review agent uses an artificial intelligence, algorithm or other software tool for utilization review. | Ongoing | Md. Code, Ins. § 15-10B-05.1(c)(9) |
| October 1, 2025 | Maryland law on AI in health insurance utilization review (HB 820) | Carrier, pharmacy benefits manager or private review agent | Do not use patient data beyond its intended and stated purpose, consistent with HIPAA where applicable.Applies when: A carrier, pharmacy benefits manager or private review agent uses an artificial intelligence, algorithm or other software tool for utilization review. | Ongoing | Md. Code, Ins. § 15-10B-05.1(c)(10) |
| October 1, 2025 | Maryland law on AI in health insurance utilization review (HB 820) | Carrier, pharmacy benefits manager or private review agent | Ensure the tool does not directly or indirectly cause harm to an enrollee.Applies when: A carrier, pharmacy benefits manager or private review agent uses an artificial intelligence, algorithm or other software tool for utilization review. | Ongoing | Md. Code, Ins. § 15-10B-05.1(c)(11) |
| October 1, 2025 | Maryland law on AI in health insurance utilization review (HB 820) | Carrier, pharmacy benefits manager or private review agent | Do not let an artificial intelligence, algorithm or other software tool deny, delay or modify health care services.Applies when: A carrier, pharmacy benefits manager or private review agent uses an artificial intelligence, algorithm or other software tool for utilization review. | Ongoing | Md. Code, Ins. § 15-10B-05.1(d) |
| October 1, 2025 | Maryland law on AI in health insurance utilization review (HB 820) | Carrier | State in the quarterly report to the Commissioner whether an artificial intelligence, algorithm or other software tool was used in making each adverse decision.Applies when: Each quarterly carrier report on adverse decisions, filed on the form the Commissioner requires. | Ongoing | Md. Code, Ins. § 15-10A-06(a)(3)(vi), as printed in Chapter 747, Acts of 2025, § 1 |
| April 1, 2026 | Maryland Age-Appropriate Design Code Act (Maryland Kids Code): algorithm, profiling and impact assessment provisionsAlso enacted as SB571 | Covered entity | Prepare a data protection impact assessment for each online product reasonably likely to be accessed by children.Applies when: Due by April 1, 2026 for a product offered to the public on or before that date and still offered after July 1, 2026; within 90 days after launch for a product first offered after April 1, 2026. | Once | Commercial Law § 14-4604(a) |
| April 1, 2026 | Maryland Age-Appropriate Design Code Act (Maryland Kids Code): algorithm, profiling and impact assessment provisionsAlso enacted as SB571 | Covered entity | In each assessment, determine whether the product serves children's best interests, considering its algorithms, targeted advertising systems, engagement-extending design features, data practices and sensitive data.Applies when: Preparing a data protection impact assessment. It must also state the product's purpose, how it uses children's data and the steps taken and planned to comply. | Ongoing | Commercial Law § 14-4604(b) |
| June 1, 2026 | Maryland election misinformation, disinformation and deepfakes law (SB 141, 2026) | Person | Do not knowingly or with reckless disregard create, use or disseminate a deepfake to produce materially false information meant to affect voting, election facts or petition signing.Applies when: The person intends to impede or influence a voter's decision to cast a ballot or how to vote, misrepresent facts about registration, voting methods, results, processes or officials' duties, or induce petition signing; and the act results or is intended to result in harm to a voter, potential voter or petition. | Ongoing | Election Law 16-905(c) |
| June 1, 2026 | Maryland election misinformation, disinformation and deepfakes law (SB 141, 2026) | Person, campaign, political action committee or other legal entity | Do not create, use or disseminate election disinformation, or election misinformation with reckless disregard; the State Board may sue to recover damages, court costs and attorney's fees.Applies when: The State Board finds the conduct and incurs costs to publish accurate correcting information. Recovery requires clear and convincing evidence. | Ongoing | Election Law 2-110(c)(2)(ii), (3), (4) |
| October 1, 2026 | Maryland identity fraud law: artificial intelligence and deepfake representations (SB 8, 2026) | Person | Do not knowingly, willfully and with fraudulent intent use AI or a deepfake to harm someone by impersonating, falsely depicting or claiming to represent them or another person.Applies when: Conduct on or after October 1, 2026. | Ongoing | Md. Code, Crim. Law § 8-301(f)(2)(i) |
| October 1, 2026 | Maryland identity fraud law: artificial intelligence and deepfake representations (SB 8, 2026) | Person | Do not knowingly, willfully and with fraudulent intent use AI or a deepfake to create or distribute false records meant to cause harm, obtain personal information, or obtain value.Applies when: Conduct on or after October 1, 2026. | Ongoing | Md. Code, Crim. Law § 8-301(f)(2)(ii) |
Triggered by an event 4 duties
These apply when something happens, such as a request, an incident or a decision about a person. Each row says what triggers it.
| Starts | Law | Who | What it requires | How often | Source |
|---|---|---|---|---|---|
| When triggered | Maryland Age-Appropriate Design Code Act (Maryland Kids Code): algorithm, profiling and impact assessment provisionsAlso enacted as SB571 | Covered entity | Keep documentation of each assessment for as long as the product is likely to be accessed by children, and review it within 90 days of material changes.Applies when: The covered entity is required to complete a data protection impact assessment. | Ongoing | Commercial Law § 14-4605(1), (2) |
| When triggered | Maryland Age-Appropriate Design Code Act (Maryland Kids Code): algorithm, profiling and impact assessment provisionsAlso enacted as SB571 | Covered entity | Give the Division a list of completed assessments within 5 business days, and any completed assessment within 7 business days, of a written request.Applies when: The Division of Consumer Protection asks in writing. The Division may extend the 7-day period. | Each time it happens | Commercial Law § 14-4607 |
| When triggered | Maryland ban on facial recognition in job interviews without consent | Employer | Use a waiver that states in plain language the applicant's name, the interview date, the applicant's consent to facial recognition during the interview, and whether the applicant read the waiver.Applies when: The employer relies on an applicant's consent to use a facial recognition service during an interview. | Each time it happens | Lab. & Empl. § 3-717(c)(2) |
| When triggered | Maryland personal delivery device law (SB 726, 2021) | Personal delivery device operator | Notify the governing body of each county and municipality at least 30 days before operating there, and comply with its local ordinances, regulations and rules.Applies when: Before starting operations in each county or municipality. | Each time it happens | Md. Code, Transp. § 21-104.5(g) |
Law by law
Who each law covers, who enforces it, the penalties, whether people can sue and what the text leaves open. Open a law to see it; every line cites its section.
Maryland Age-Appropriate Design Code Act (Maryland Kids Code): algorithm, profiling and impact assessment provisions
6 duties · checked November 14, 2026
Chapter 461 of the Acts of 2024 (HB 603), approved May 9, 2024; Commercial Law Article §§ 14-4601 to 14-4613 and § 13-301(14)(xlii). Official text · Full law page
Who it covers
- Covered entity. A for-profit legal entity that collects consumers' personal data or has it collected, determines the purposes and means of processing, does business in Maryland and meets at least one size test. Commonly branded affiliates and joint ventures with 40% interests are included. Threshold: At least one of: annual gross revenues above $25,000,000 (adjusted for inflation in odd-numbered years); buys, receives, sells or shares the personal data of 50,000 or more consumers, households or devices a year; or earns at least 50% of annual revenues from selling consumers' personal data. Commercial Law § 14-4601 (covered entity)
Enforcement
- Enforcer: Division of Consumer Protection of the Office of the Attorney General. A violation is an unfair, abusive or deceptive trade practice enforced under Title 13 of the Commercial Law Article, other than § 13-410. No court order blocking the law was found: in NetChoice v. Brown (D. Md., No. RDB-25-0322) the court denied the State's motion to dismiss and said the Kids Code remains in effect while the case proceeds.
- Penalty: Up to $2,500 per affected child for each negligent violation, a violation of the subtitle. Commercial Law § 14-4608(b)(1)
- Penalty: Up to $7,500 per affected child for each intentional violation, a violation of the subtitle. Commercial Law § 14-4608(b)(2)
- Can people sue? No Commercial Law § 14-4610(1); § 14-4608(a)(2) (Title 13 enforcement applies except § 13-410)
- Time to fix before enforcement: 90 days (none stated; available only to a covered entity in substantial compliance that completed the required assessments, gives the Division a written statement of cure and takes agreed measures to prevent future violations)
Exemptions
- Data subject to and in compliance with Title V of the Gramm-Leach-Bliley Act, HITECH or HIPAA regulations, including protected health information. Commercial Law § 14-4602
- HIPAA-governed covered entities, to the extent they maintain patient information the same way as protected health information. Commercial Law § 14-4602
- Information collected in a clinical trial under federal human subject protection rules. Commercial Law § 14-4602
- The subtitle may not be read to impose liability inconsistent with 47 U.S.C. § 230, to stop children from searching for content, or to require age-gating. Commercial Law § 14-4610
- A covered entity need not monitor or censor third-party content. Commercial Law § 14-4603
What the text leaves open
- The item number for algorithms within § 14-4604(b)(3) could not be fixed: the chapter law prints struck and replacement numbering together and the reader showed it as item (VII) or (VIII).
- The federal court opinion read does not print its date; it refers to a November 13, 2025 hearing. Any later order in NetChoice v. Brown was not checked.
- The codified sections on the General Assembly's site would not load, so any amendment made in the 2025 or 2026 sessions was not checked.
- The text read creates no rulemaking power for the Division.
- Other Title 13 remedies that may apply to an unfair, abusive or deceptive trade practice were not read.
Maryland ban on computer-generated child sexual abuse images (SB 736, 2019)
2 duties · checked November 15, 2026
Chapter 326, Laws of Maryland 2019 (SB 736), approved April 30, 2019; amends Md. Code, Crim. Law §§ 11-101, 11-105, 11-201 and 11-208. Official text · Full law page
Who it covers
- Person. Any person who possesses, retains, accesses or views a covered image. The section is not limited to businesses. Md. Code, Crim. Law § 11-208(b)
Enforcement
- Enforcer: Criminal prosecution; § 11-208 does not name the prosecuting office. No court order blocks the section: the Appellate Court of Maryland rejected a First Amendment overbreadth challenge in 2025.
- Penalty: Misdemeanor: up to 5 years in prison, a fine up to $2,500, or both, a violation of § 11-208. Md. Code, Crim. Law § 11-208(c)(1)
- Penalty: Felony: up to 10 years in prison, a fine up to $10,000, or both, a violation after a prior conviction under § 11-208. Md. Code, Crim. Law § 11-208(c)(2)
- Penalty: Felony: up to 10 years in prison, from October 1, 2026, possessing 100 or more images in violation of § 11-208(b)(1); each video counts as 20 images. Md. Code, Crim. Law § 11-208.2(a), (b)
- Penalty: Felony: up to 10 years in prison, from October 1, 2026, a violation of § 11-208(b)(1) or (2) involving any image of a child under 13. Md. Code, Crim. Law § 11-208.2(c)
- Can people sue? The law does not say Md. Code, Crim. Law § 11-208
- Time to fix before enforcement: The law does not say
Exemptions
- Drawings, cartoons, sculptures and paintings depicting minors are outside the computer-generated image definition. Md. Code, Crim. Law § 11-208(a)(3)
- A parent possessing nude images of the parent's own child, unless they show sadomasochistic abuse, or sexual conduct in a state of sexual excitement. Md. Code, Crim. Law § 11-208(d)
What the text leaves open
- Brasse v. State, No. 1070, Sept. Term 2023 (Appellate Court of Maryland, reported opinion filed March 27, 2025) upheld § 11-208 against a facial overbreadth challenge; whether further review was sought was not checked.
- Section 11-208 does not separately define computer-generated image, identifiable child or visual representation.
- SB 226 (2023) was cross-filed with HB 233; the House bill's chapter was not read.
- The automated reader showed Chapter 759 adding an access-with-intent-to-view clause to (b)(1); the current codified text does not have it, so the codified text is used.
Maryland ban on facial recognition in job interviews without consent
2 duties · checked November 14, 2026
Chapter 446, Laws of Maryland 2020 (HB 1202); Labor and Employment Article § 3-717. Official text · Full law page
Who it covers
- Employer. An employer that interviews applicants for employment. Section 3-717 does not define employer or applicant. Lab. & Empl. § 3-717(b)
Enforcement
- Enforcer: The law does not name one
- Penalty: the law does not set an amount.
- Can people sue? The law does not say Lab. & Empl. § 3-717 (silent)
- Time to fix before enforcement: The law does not say
Exemptions
- Use is allowed when the applicant consents by signing a waiver that meets subsection (c). Lab. & Empl. § 3-717(b), (c)(1)
What the text leaves open
- Section 3-717 states no penalty, enforcer or private right of action. Whether another section of Title 3 of the Labor and Employment Article supplies one was not read.
- Section 3-717 does not define employer or applicant; Title 3 definitions that may apply were not read.
Maryland election misinformation, disinformation and deepfakes law (SB 141, 2026)
2 duties · checked November 14, 2026
Senate Bill 141, 2026 Regular Session, ch. 444, approved May 12, 2026; amends Election Law Article 2-110 and adds 16-905. Official text · Full law page
Who it covers
- Person. Any person who knowingly or with reckless disregard creates, uses or disseminates a deepfake to produce materially false information, with one of the listed election-related intents and actual or intended harm to a voter, potential voter or petition. Election Law 16-905(c)
- Person, campaign, political action committee or other legal entity. An entity the State Board finds created, used or disseminated election disinformation, or election misinformation with reckless disregard, where the Board incurred costs to publish correcting information. Election Law 2-110(c)(2)(ii)
Enforcement
- Enforcer: Criminal prosecution for the deepfake offense (section 16-905 does not name the prosecutor). The State Administrator of Elections must publish correcting information and may seek an injunction to remove content from an online platform and issue subpoenas; the State Board of Elections may bring a civil action. A web search on November 14, 2026 found no report of a court order blocking this law; court dockets were not searched.
- Penalty: Misdemeanor: fine of up to $5,000, imprisonment of up to 5 years, or both, a violation of the deepfake prohibition in 16-905(c). Election Law 16-905(d)
- Can people sue? The law does not say Election Law 2-110(c); 16-905 (only the State Administrator and State Board are given civil remedies)
- Time to fix before enforcement: The law does not say
Exemptions
- A deepfake that is satire or parody. Election Law 16-905(b)(1)
- Radio and television broadcasters, including cable and satellite operators, where federal law requires the broadcast, where it is bona fide news that clearly discloses the content may be deceptive, or where they were paid and made a good-faith effort to check it. Election Law 16-905(b)(2)
- Websites and regularly published periodicals of general circulation that routinely carry news and commentary, if they clearly state the media does not accurately represent the candidate's speech or conduct. Election Law 16-905(b)(3)
- Online publishers and service providers for acts immune under 47 U.S.C. 230; the State Administrator may not seek an injunction against an interactive computer service for another person's content. Election Law 16-905(b)(4); 2-110(c)(1)(ii)
- The State Board may not bring its civil action against a person exempt from 16-905, or against a person working to detect, report, prevent, investigate or prosecute security breaches, fraud, harassment or other illegal activity. Election Law 2-110(c)(2)(i), (3)(ii)
What the text leaves open
- The chapter law PDF (ch. 444) refused automated access; the enrolled bill was read instead and should match it.
- Existing 2-110(b) lets the State Board refer reports to the State Prosecutor; 16-905 itself does not say who prosecutes.
- The exemptions in 16-905(b) refer to a deceptive and fraudulent deepfake, a phrase the section does not separately define.
- The definition of influence comes from Election Law 16-201, which was not opened.
Maryland identity fraud law: artificial intelligence and deepfake representations (SB 8, 2026)
2 duties · checked November 15, 2026
Chapter 445, Laws of Maryland 2026 (SB 8), approved May 12, 2026; amends Md. Code, Crim. Law § 8-301. Official text · Full law page
Who it covers
- Person. Any person who uses artificial intelligence or a deepfake representation with fraudulent intent as described. Md. Code, Crim. Law § 8-301(f)(2)
Enforcement
- Enforcer: A State's Attorney or the Attorney General may investigate and prosecute; victims may also sue. No court challenge was found.
- Penalty: Felony: up to 5 years in prison, a fine up to $10,000, or both, a violation of § 8-301(f)(2) involving one victim. Md. Code, Crim. Law § 8-301(g)(5)(i)
- Penalty: Felony: up to 10 years in prison, a fine up to $15,000, or both, a violation of § 8-301(f)(2) involving two or more victims. Md. Code, Crim. Law § 8-301(g)(5)(ii)
- Penalty: Restitution, including attorney's fees, for clearing the victim's credit history or rating and related records, a violation of § 8-301, in addition to other restitution. Md. Code, Crim. Law § 8-301(j)
- Can people sue? Yes Md. Code, Crim. Law § 8-301(h) (victim may sue; court may issue an injunction and grant other appropriate relief)
- Time to fix before enforcement: The law does not say
Exemptions
- Drawings, cartoons, sculptures and paintings depicting human beings are not deepfake representations. The section has no satire, news or platform exemption. Md. Code, Crim. Law § 8-301(a)(3)(ii)
What the text leaves open
- The chapter law printed (f)(2)(i) with struck and new wording run together; the codified section was used for its final wording.
- The section states no statute of limitations.
- The civil action names injunctions and other appropriate relief but no damages amount.
Maryland law on AI in health insurance utilization review (HB 820)
11 duties · checked November 12, 2026
Chapter 747, Acts of 2025 (HB 820); adds Md. Code, Insurance § 15-10B-05.1 and amends § 15-10A-06. Official text · Full law page
Who it covers
- Carrier. An insurer, nonprofit health service plan, health maintenance organization, dental plan organization or other person providing state-regulated health benefit plans, that uses an artificial intelligence, algorithm or other software tool for utilization review, or contracts with or works through an entity that does. Md. Code, Ins. § 15-10B-05.1(a)(3), (b)(1)
- Pharmacy benefits manager. A pharmacy benefits manager that contracts with a carrier to conduct utilization review and uses such a tool to do so on the carrier's behalf. Md. Code, Ins. § 15-10B-05.1(b)(2)
- Private review agent. A private review agent that contracts with a carrier to conduct utilization review and uses such a tool to do so on the carrier's behalf. Md. Code, Ins. § 15-10B-05.1(b)(2); § 15-10B-01(k)
Enforcement
- Enforcer: Maryland Insurance Commissioner, who may inspect the tools for audit or compliance review and imposes the penalties in Subtitle 10B. A web search on November 12, 2026 found no report of a court order blocking this law; court dockets were not searched.
- Penalty: Up to $5,000 per violation, administrative penalty the Commissioner may impose for each violation of any provision of Subtitle 10B, in an action against a person who violates § 15-10B-11. Md. Code, Ins. § 15-10B-12(b)(4)
- Penalty: Penalty of up to $1,000 on conviction; each day a violation continues after the first conviction is a separate offense, misdemeanor for violating § 15-10B-11, which lists prohibited acts of private review agents, including violating any provision of the subtitle. Md. Code, Ins. § 15-10B-12(a); § 15-10B-11(1)
- Penalty: Denial, suspension or revocation of the private review agent certificate; restitution by a private review agent to a patient for actual economic damage, other actions the Commissioner may take against a person who violates § 15-10B-11. Md. Code, Ins. § 15-10B-12(b)(1), (3)
- Can people sue? The law does not say Chapter 747, Acts of 2025 (no provision on private lawsuits)
- Time to fix before enforcement: The law does not say
What the text leaves open
- The penalty sections read (§§ 15-10B-11 and 15-10B-12) are written for private review agents. Which penalties reach a carrier or pharmacy benefits manager that breaks § 15-10B-05.1 is not stated in the sections opened; other Insurance Article penalty sections were not opened.
- The paragraph label for the quarterly report item on AI use in adverse decisions is given as printed in the chapter law, read twice; the current statute page was read once with a different label, so check the label before quoting it.
- Subsection (c) applies subject to subsection (d): the tool may support review, but may not itself deny, delay or modify health care services.
- The statute pages show no amendment history; whether a 2026 act changed these sections was checked only by comparing the current § 15-10B-05.1 with the 2025 chapter law, which matched.
Maryland personal delivery device law (SB 726, 2021)
7 duties · checked November 15, 2026
Chapter 351, Laws of Maryland 2021 (SB 726), approved May 18, 2021; adds Md. Code, Transp. § 21-104.5 and amends §§ 8-409, 11-135, 11-176, 13-402, 17-103, 21-501.1, 21-1201 and 21-1205.1. Official text · Full law page
Who it covers
- Personal delivery device operator. An entity, or its agent, with active or passive physical control or monitoring over a device's navigation and operation. People who request or receive the service, or arrange and dispatch a device, are excluded. Md. Code, Transp. § 21-104.5(a)(3)
Enforcement
- Enforcer: The law does not name one
- Penalty: the law does not set an amount.
- Can people sue? The law does not say Chapter 351 (2021)
- Time to fix before enforcement: The law does not say
Exemptions
- A personal delivery device is not a motor vehicle or a vehicle, and needs no registration when operated in accordance with § 21-104.5. Md. Code, Transp. §§ 11-135(b)(5), 11-176(b)(2), 13-402(c)(15)
What the text leaves open
- Chapter 351 states no penalty. Whether the general Maryland Vehicle Law penalty provisions apply to these rules was not read.
- The current codified § 21-104.5 could not be opened, so any amendment after 2021 was not checked; a web search found none.
- Section 17-103(a)(3) lets the Administration accept other security from an operator, but its conditions as printed appear written for transportation network companies; how they apply here is unclear.
- A lawsuit search found no court challenge to this law.
Maryland revenge porn law extended to computer-generated images (SB 360, 2025)
1 duty · checked November 15, 2026
Chapter 219, Laws of Maryland 2025 (SB 360), approved April 22, 2025; amends Md. Code, Crim. Law § 3-809. Official text · Full law page
Who it covers
- Person. Any person who distributes a covered visual representation of another identifiable person. Md. Code, Crim. Law § 3-809(c)
Enforcement
- Enforcer: Criminal prosecution (§ 3-809 does not name the prosecuting office), plus civil suits by the person depicted. No court challenge was found.
- Penalty: Misdemeanor: up to 2 years in prison, a fine up to $5,000, or both, a violation of § 3-809. Md. Code, Crim. Law § 3-809(d)
- Can people sue? Yes Md. Code, Crim. Law § 3-809(f) (defamation per se or invasion of privacy against any distributor; the court may award reasonable attorney's fees to a prevailing plaintiff)
- Time to fix before enforcement: The law does not say
Exemptions
- Lawful law enforcement practices, reporting unlawful conduct, legal proceedings, and voluntary exposure in public or commercial settings. Md. Code, Crim. Law § 3-809(b)(1)
- An interactive computer service, as defined in 47 U.S.C. § 230(f)(2), is not liable under this section for content provided by another person. Md. Code, Crim. Law § 3-809(b)(2)
- Drawings, cartoons, sculptures and paintings are not visual representations. Md. Code, Crim. Law § 3-809(a)(6)(iii)
What the text leaves open
- The automated reader showed separate computer-generated definitions, a separate (c)(2) without the privacy element, and a new Courts Article § 3-505 in the chapter law; the codified § 3-809 has none of these, so they may be text struck by amendment. Check the printed chapter.
- Section 3-809(e) makes violators subject to Courts Article § 5-106(b), which was not read.
- The Attorney General's April 21, 2025 bill-review letter found the bill not clearly unconstitutional but saw a minor overbreadth risk in the civil action, which reaches any distributor.
- Whether the civil action requires the criminal elements to be met is not stated beyond its reference to a distribution in violation of this section.
Other enacted laws to check
These 13 enacted AI laws are in the states you chose, but they are not yet mapped duty by duty, so they are not in the plan above. Each page has a summary and the official source.
- Maryland HB338: Criminal Procedure – Facial Recognition Technology – Requirements, Procedures, and Prohibitions (effective October 1, 2024)
- Maryland HB376: Maryland Cybersecurity Council - Alterations (effective October 1, 2025)
- Maryland HB504: Excellence in Maryland Public Schools Act (effective July 1, 2025)
- Maryland HB806: Vehicle Laws - Autonomous Vehicle Converters - Sale of Autonomous Vehicles (effective July 1, 2023)
- Maryland HB956: Consumer Protection - Workgroup on Artificial Intelligence Implementation (effective July 1, 2025)
- Maryland SB1068: Department of Information Technology - Evaluation and Development of a 3-1-1 Portal Using Artificial… (effective July 1, 2024)
- Maryland SB114: 3-1-1 Systems - Expansion Program and Oversight Board - Establishment (effective July 1, 2026)
- Maryland SB182: Criminal Procedure - Facial Recognition Technology - Requirements, Procedures, and Prohibitions (effective October 1, 2024)
- Maryland SB597: Higher Education - Maryland Artificial Intelligence Partnership (effective July 1, 2026)
- Maryland SB655: Courts - Artificial Intelligence Evidence Clinic Pilot Program - Establishment (effective January 15, 2026)
- Maryland SB685: Vehicle Laws - Autonomous Vehicle Converters - Sale of Autonomous Vehicles (effective July 1, 2023)
- Maryland SB720: Education - Artificial Intelligence - Guidelines, Professional Development, and Collaborative (Artificial… (effective June 1, 2026)
- Maryland SB818: Information Technology - Artificial Intelligence - Policies and Procedures (Artificial Intelligence… (effective July 1, 2024)
Information, not legal advice. This plan summarizes what the official texts of the laws listed say. It does not decide whether a law applies to your organization; that turns on facts such as your size, your role as a developer or deployer, and how you use AI. Laws change, and courts and regulators can read them differently. Check the official text linked with each duty and talk to a qualified lawyer before acting. Using this page does not create an attorney-client relationship. See our terms of service.
How the plan is built
Each law in the plan was read from its official text, on the legislature’s or state’s own website. 265 of the 326 have also been read a second time to confirm every date, threshold, penalty and enforcer; the rest have had one full read, and each shows the date it was last checked. Each duty is written in plain English in 30 words or fewer and carries the section it comes from, with a link.
Where a law is silent, the plan says so. It does not borrow a penalty from another statute or guess at a deadline. A law that is repealed or replaced on a known date shows that end date, and its duties leave the plan once the date passes. The date each law was last checked appears with it.
The plan is built fresh from these records every time the page loads, so it changes as soon as a law is added or re-checked. To report an error, use the corrections page. For how we find laws and decide what counts as an AI law, see our methodology. If you are not sure which laws touch your business at all, start with Am I Affected?
Common questions
What does an AI compliance plan cover?
Each duty an enacted state AI law places on a business or other regulated party: who it applies to, what it requires, when it starts, how often it recurs, who enforces it, the penalties and whether people can sue. The builder covers 1,235 duties in 326 enacted laws across 50 states, and every duty links to the section of law it comes from.
Where does the information come from?
From the official text of each law: the enrolled bill, session law or codified statute, opened on the legislature's or state's own website. 265 of the 326 laws have also been read a second time to confirm every date, threshold, penalty and enforcer, and the date each law was last checked is shown with it. Where a law is silent on a point, such as a penalty amount, the plan says the law does not say rather than filling the gap. Law firm summaries and news reports are never used as sources.
Does the plan include every AI law in a state?
Not yet. It includes the enacted laws we have mapped duty by duty. When you choose a state, its other enacted AI laws are listed separately with links, so nothing is left out of view. New laws are added as they are read. When a law is repealed or replaced on a set date, its duties show that end date and leave the plan once it passes.
How do I know which duties apply to my company?
Start with the 'who it covers' entry for each law: many apply only above a size or revenue threshold, only to developers or only to deployers, or only in one industry. The plan quotes those conditions from the text. Whether your company meets them depends on facts only you and your counsel know.
Is this legal advice?
No. It is information drawn from official legal texts, organized so you can see what each law requires. Use it to brief your team and your lawyers, not in place of them.
What does Pro add?
The same plan as a CSV file for spreadsheets and audit files, and as a calendar file (.ics) with every dated duty as an event that links back to the law. Both are built from the states and uses you pick. The plan on this page, and printing it, are open to everyone.