Md. Code, State Fin. & Proc. § 3.5-803

(a) On or before December 1, 2025, and regularly thereafter, each unit of State government shall: (1) conduct an inventory of systems that employ high–risk artificial intelligence; and (2) provide the inventory to the Department in a format required by the Department. (b) For each system, the inventory required by this section shall include: (1) the name of the system; (2) the vendor that provided the system, if applicable; (3) a description of the capabilities of the system; (4) a statement of the purpose and the intended uses of the system; (5) whether the system underwent an impact assessment prior to being deployed; (6) whether the system is used to independently make a decision or judgment or to inform or support a decision or judgment determined by the Department to involve high–risk artificial intelligence; and (7) a summary of the results of the most recent impact assessment. (c) The Department shall make an aggregated statewide inventory publicly available on its website. (d) (1) The Department may not make publicly available on the Department’s website information from the inventories required by this section that relate to the safety and security of State systems if the publication of the information is likely to compromise the security or integrity of the system. (2) On request, the Department shall provide to the Governor, members of the General Assembly, and law enforcement the information described in paragraph (1) of this subsection. (e) (1) On or before December 31, 2026, each unit of State government shall conduct an impact assessment of a system procured on or after February 1, 2026, that involves high–risk artificial intelligence. (2) On or before July 1, 2027, each unit of State government shall conduct an impact assessment of a system procured before February 1, 2026, that involves high–risk artificial intelligence.