AI in Job Interviews: What Maryland Has Required Since 2020

A 2020 Maryland rule that still bites today

On 1 October 2020 Maryland brought into force Section 3-717 of its Labor and Employment Code, the state provision governing facial recognition during hiring interviews.

The text arrived four years before the European regulation on artificial intelligence. It remains in force today and binds any employer interviewing candidates in that state.

An account of those obligations published on LexBlog on 19 September 2026 reminds Maryland employers of the rule's reach^[1]. The point matters to anyone governing risk: legal exposure from AI in recruiting has existed for six years, inside US state jurisdictions.

Six years of state precedent give the Chief Compliance Officer a useful data point. The obligation lives inside short, technical, highly specific texts.

What the statute prohibits, and how consent is collected

The rule bars an employer from using a facial recognition service to create a facial template during an applicant's interview. The prohibition falls away once the applicant has given consent.

The two definitions matter more than the prohibition. A facial recognition service is technology that analyses facial features and serves to identify or persistently track people, in still images or in video. A facial template is the machine-readable pattern of facial features extracted from those images.

The pivot of the rule is the creation of the template, that precise technical step.

Consent counts when it arrives in writing, through a waiver signed by the applicant. The document requires plain language and four elements:

• the applicant's name
• the date of the interview
• a statement consenting to the use of facial recognition during the interview
• confirmation that the applicant has read the waiver

Form here is substance. Consent collected verbally, or buried in the general terms of the application portal, falls outside the standard set by the text. An organisation that keeps signed waivers bearing the interview date holds proof; one that keeps a system log holds a clue.

The statute speaks in terms of technology rather than purpose. That approach makes the obligation verifiable: a reviewer checks the behaviour of the software, rather than the intentions of whoever bought it.

A narrow perimeter, and that is where the reading pays off

Section 3-717 covers a restricted area. Automated résumé screening, algorithmic aptitude tests and pre-screening chatbots stay outside its field, unless they incorporate facial recognition as defined by the text.

The protections run to applicants, meaning people sitting an interview for a job. Employees already on the payroll and the other stages of the employment relationship remain foreign to the text. A grey zone stays open: the employee applying for another position inside the same organisation.

That ambiguity is a question for the General Counsel before it is one for a judge. The prudent reading treats an internal interview as an interview, and applies the same waiver.

A recurring objection describes the rule as marginal, on account of its narrow perimeter. The objection holds so long as the video interview vendor keeps the facial analysis module switched off.

Illinois, California and state-level fragmentation

The Illinois Artificial Intelligence Video Interview Act has been effective since 1 January 2020 and covers a wider area. It applies when the employer asks the applicant to record a video and then runs artificial intelligence analysis on that material.

The difference is operational. A vendor compliant in Maryland stays exposed in Illinois when the video analysis dispenses with the facial template. Two states, two technical perimeters, one hiring process.

The direction of travel continues. California's legislature has passed a bill to ban AI tracking of workers' neural data, as Bloomberg Law reports^[2].

American regulatory fragmentation is the pattern, rather than the accident. States legislate according to political position, and a coherent federal law stays distant.

The comparison with the European framework

Regulation (EU) 2024/1689 follows a different logic. Article 5 prohibits systems that infer emotions in the workplace, applicable from 2 February 2025 across the Union.

Annex III classifies as high-risk the systems used to select and evaluate candidates. The attendant obligations (risk management, technical documentation, human oversight, event logging) fall on the provider and, in part, on the deployer. The Digital Omnibus proposal, still under discussion, pushes application of the high-risk rules back to December 2027.

The governance signal is this: Maryland asks for signed consent, Brussels asks for a risk classification.

The two logics converge on one practical point: both demand documentary proof produced before the interview. Whoever builds the consent archive and the risk classification now arrives ready for both deadlines.

The audit stays mandatory, the perimeter changes

An organisation that has calibrated its policies on the GDPR arrives in Baltimore with the wrong instrument. Consent under the European regulation and the Maryland waiver share a name, and diverge in form.

The audit of the recruiting stack starts from three factual questions. Which vendor runs facial analysis, at which stage, with what output. Where the generated templates end up, how long they stay, who accesses them.

Many video interview tools switch facial analysis modules on by default. A compliance position built on the text of the master agreement stays exposed when the product's behaviour changes with an update.

The audit stays mandatory; the perimeter has changed.

Three decisions for the board

The picture produces three decisions, all of them prior to deployment.

1. Vendor mapping. Which tool in the hiring process creates a facial template, by product name and by version, in Maryland and elsewhere.
2. Accountable role. Which internal role answers in writing for the collection and retention of signed waivers, before the first interview.
3. Disclosure. What reporting the audit and risk committee receives on the use of biometrics in recruiting, and how often.

A framework that omits the name of the responsible role produces documentation, which is a different thing from governance.

The Chief Risk Officer updates the risk register with an entry dedicated to biometrics applied to hiring. The CEO decides which labour market stays accessible with the current stack.

Regulatory horizon

Section 3-717 has been in force in Maryland since 1 October 2020. The Illinois AIVIA has been in force since 1 January 2020.

In the European Union, Article 5 of Regulation 2024/1689 applies from 2 February 2025; the high-risk obligations under Annex III follow a timetable the Digital Omnibus proposal is reopening. California has a passed bill on workers' neural data. The American federal framework stays fragmented.

The question about the use of biometrics in interviews has had a written answer since 2020. A second question has opened: which role, by name and in writing, answers for the waivers when the interview happens over video and the vendor is based in Europe.