AI governance in Baltimore

A sector framework can attach because of the activity. Naming ISO/IEC 42001, the NIST AI Risk Management Framework, or HITRUST here names the framework and stops. The name is not a requirement, and it is not a statement that the organization holds a certification. A contract can ask for a control, a notice, or an inventory that this page never attributes to Maryland. Reading the clauses that were actually signed is part of the assessment. Treating a signed clause as a statewide duty is not.

Other states write their own rules, and the inventory can note a decision, a patient, a student, a shipment, or a customer in one of them. Those rules are not the same from one state to the next. They are written up, one state at a time, on the regulations hub. A headquarters in Baltimore does not, by itself, pick which of them apply. The activity does.

Port and logistics organizations tend to meet these tools as routing, scheduling, document handling, and a customer-line assistant, often because a vendor enabled a feature. Financial-services organizations tend to meet them in servicing, in fraud review, and inside a platform a vendor already operates for the institution. No Maryland duty is being described. The practical question is whether someone can name the system, the information it uses, and the agreement that came with it.

A health system here can also run a teaching campus. A laboratory can move material through the port. A university can look like a financial-services buyer when it runs payroll, benefits, and the vendor platforms those functions sit on. Each inventory row names the work a system is doing and the contract or sector framework already attached to that work. Folding all of that into one program, because the buildings share a city, is how the wrong framework gets scoped.

Life-sciences work here is not only the science. It is sample tracking, quality records, vendor platforms, and the messages that sit beside a study. A feature switched on inside one of those systems belongs on the list even when nobody bought it as an AI product. The same pattern shows up on the port, where a documentation feature or a yard-scheduling feature arrives inside software the organization already pays for. The person who can describe what the feature does is often in operations, not on a central register.

Universities add a further split. Employment systems, campus systems, and research platforms are three lists. A tool that screens applicants is not the tool that answers a student, and a research platform is not either of those. Treating the campus as one system, because one organization owns all three, hides the one that can affect a person.

A shipper or a lender that does business outside Maryland should expect rules from those other states to travel with the business. The statutes are on the regulations hub. What belongs in the inventory, on this page’s terms, is a mark for where the activity happens, not a mark for the headquarters alone.

The governance readiness assessment produces the inventory, the note on the certification boundary, the reading of the contracts, and a gap list against ISO/IEC 42001 and the NIST AI Risk Management Framework. That reading happens with the teams who run the systems, in the rooms where the systems are used. The service page is where that engagement is specified. Someone who wants a free diagnostic, rather than that inventory, uses the AI Academy readiness assessment. It is a scorecard. It does not read contracts.

A legitimate outcome of the governance assessment is a conclusion that a larger program is not called for. The document is written so it can stand alone. When a finding supports a next step, that step is named, including when the step is training and not a build.