MD SB294

Changes Council leadership from Attorney General appointment to elected chair and vice chair (one state employee, one non-state employee), beginning October 1, 2025, with elections every 2 years

Expands Council membership to include representatives from critical infrastructure sectors (banking, hospitals, water systems, electric companies), privacy organizations, and nine higher education institutions with cybersecurity and AI/quantum computing expertise

Adds new mandate for the Council to assess and address cybersecurity threats from artificial intelligence and quantum computing, including adversarial AI, deepfakes, cyber attacks, and fraud

Requires the Council to address sensitive privacy interests of state residents related to cybersecurity risks

Council must review its subcommittee structure and implement bylaws by December 1, 2025; effective date October 1, 2025