WeVote
Log In

Bill

Bill

SB 936

Consumer Protection - High-Risk Artificial Intelligence - Developer and Deployer Requirements

2025 Regular Session Introduced by Dawn Gile and 2 co-sponsors

Requires developers and deployers of high-risk AI to prevent discrimination, disclose limits, conduct impact assessments, and implement risk management with enforcement.

Hearing 2/27 at 1:00 p.m.
0
WeVote Research Nonpartisan
Bill Summary · SB 936

SB 936 — Consumer Protection: High‑Risk Artificial Intelligence — Developer & Deployer Requirements

Status: Hearing scheduled Feb 27 at 1:00 p.m. | Introduced: Jan 2025
Primary focus: impose duties on developers and deployers of “high‑risk” AI to prevent algorithmic discrimination, require disclosures and risk management, and authorize enforcement by the Attorney General.

Purpose / Intent

To reduce unlawful “algorithmic discrimination” by requiring reasonable care, transparency, impact assessment, and risk‑management practices for AI systems that autonomously make or substantially contribute to consequential decisions affecting consumers.

Key definitions (high level)

  • High‑risk AI system: an AI intended to autonomously make, or be a substantial factor in making, a consequential decision.
  • Consequential decisions include parole/probation, education enrollment, employment, lending, healthcare access, housing, insurance, marital status, and legal services.
  • Algorithmic discrimination: differential treatment or impact that unlawfully disfavors individuals/groups on protected characteristics (race, sex, disability, age, etc.).

Major requirements

Developer obligations (effective Feb 1, 2026)
- Must use reasonable care to prevent known or reasonably foreseeable algorithmic discrimination.
- May not provide a high‑risk AI to a deployer unless accompanied by disclosures about intended use, known limitations, and documentation necessary to conduct an impact assessment.
- Must update disclosures after any intentional, substantial modification.
- Generative AI producing synthetic content must mark outputs in detectable ways (subject to practicability and trade‑secret limits).

Deployer obligations (effective Feb 1, 2026)
- Design, implement, and maintain a documented risk‑management policy/program addressing algorithmic discrimination.
- Complete an impact assessment before initial deployment and prior to significant updates (a new assessment at least 90 days before major updates).
- Notify consumers when a high‑risk AI will be used to make consequential decisions and, if a decision is adverse, provide plain‑language information including opportunities to correct data and appeal with human review.

Enforcement & remedies

  • Maryland Office of the Attorney General (OAG) may investigate, require disclosures, bring civil actions, and adopt implementing regulations.
  • Consumers are authorized to bring civil actions against deployers under specified circumstances.
  • The bill includes a presumption that compliance with applicable standards = reasonable care; trade secret protections are preserved for certain developer disclosures.

Exemptions & limits

  • Certain federal government‑procured systems (with exceptions), regulated insurers, and HIPAA‑covered entities are partially exempt.
  • The law does not override other legal obligations (e.g., compliance with federal/state law, law‑enforcement cooperation).

Fiscal & practical impact

  • State: OAG staffing/expenditures increase at least minimally beginning FY2026 to enforce the law; penalty revenue not expected to be material.
  • Private sector: potential meaningful impact on small businesses that develop or deploy high‑risk AI due to documentation, assessment, and compliance obligations.

Timeline / Effective date

  • Substantive requirements begin February 1, 2026 (per bill text).

Compiled from official sources — confirm details with the bill’s official record.

Sign in to ask a question.