AI Regulation Tracker  /  State legislation

Maryland Makes Knowing Use of AI Deepfakes for Identity Fraud a Crime

Maryland Senate Bill 8, "Identity Fraud - Artificial Intelligence and Deepfake Representations," was approved by the Governor on May 12, 2026 as Chapter 445 and took effect October 1, 2026. It creates criminal identity-fraud liability, in effect since October 1, 2026, for knowingly, willfully, and with fraudulent intent using AI or a deepfake representation to cause harm to another by impersonating, falsely depicting, or claiming to represent a person, or to create or distribute false records for listed harmful purposes, with penalties reaching 10 years and $15,000 when there are two or more victims. This is a live statute with a fixed activation date, not a proposal.

By Anthony Guerriero  ·  The Leveraged Years Regulatory Research  ·  Published July 16, 2026  ·  Last updated October 2, 2026

Maryland has moved AI and deepfakes squarely into its criminal identity-fraud law. Senate Bill 8 of the 2026 Regular Session, titled "Identity Fraud - Artificial Intelligence and Deepfake Representations," was approved by the Governor on May 12, 2026 and carried into the code as Chapter 445. On the General Assembly's own bill page the status line reads "Approved by the Governor - Chapter 445." The law took effect on October 1, 2026.

What the statute actually does

The core move is simple and deliberate. Maryland already had an identity-fraud statute that punished using another person's identifying information to defraud or to represent yourself as someone you are not. SB 8 pulls AI-generated content and deepfakes into that same framework. It makes it a crime to knowingly, willfully, and with fraudulent intent use artificial intelligence or a deepfake representation to cause harm to another by impersonating, falsely depicting, or claiming to represent that person or any other person, or to create or distribute false records for listed harmful purposes.

Three elements do the work: the person has to act knowingly, willfully, and with fraudulent intent. This is not a strict-liability rule that sweeps in anyone who ever made a synthetic video. It targets the person who knows what they are doing and does it to deceive, to impersonate, or to injure. That intent requirement is what keeps the statute aimed at bad actors rather than at ordinary creative or business uses of the technology.

The penalty structure scales with how many people got hurt. Where the offense involves a single victim, it carries a term of up to 5 years in prison and a fine of up to $10,000. Where there are multiple victims, the ceiling rises to up to 10 years and a fine of up to $15,000. Those are criminal penalties, and they attach to the conduct of using the AI or the deepfake. Separately, new subsection (H) lets a victim of conduct that would violate subsection (f)(2) bring a civil action, in which the court may issue an injunction and grant other appropriate relief.

Who this reaches

The practical reach is broad because the technology is broad. Anyone deploying deepfakes, face-swaps, synthetic video, or voice-cloning in Maryland is now operating against a criminal backstop. That includes the obvious cases, the scammer who clones an executive's voice to authorize a wire transfer, the fraudster who spins up a fake video of a real person to trick a victim, and it includes less obvious ones where a synthetic likeness is used to impersonate someone in a transaction or a communication meant to deceive.

It is worth being clear about what the statute does not do. It does not ban AI or deepfakes as a category. On our reading, the subsection (f)(2) offense turns on knowing, willful and fraudulent intent; the chapter does not mention disclosure as a defense to it. The line the legislature drew is intent-based. Use the tools to defraud or impersonate, and you are exposed. Use them openly and honestly, and the statute is not aimed at you.

Do not confuse this with Maryland's insurer AI bill

There is a second Maryland AI measure moving in the same period, and it is easy to run the two together. House Bill 1563 deals with insurers and their use of AI, including reporting expectations around how AI systems are used in the insurance context. That is a different subject, a different chamber of origin, and a different mechanism. SB 8, the subject of this briefing, is a criminal identity-fraud statute about deepfakes and impersonation. HB 1563 is an insurance-regulatory measure about AI reporting. If you are tracking Maryland AI law, keep them in separate columns. They do not amend each other and they answer different questions.

Where this sits in the national picture

SB 8 is another data point in a wave of state deepfake-liability laws. States have been building criminal and civil exposure around synthetic media for a couple of years now, hitting election deepfakes, non-consensual intimate imagery, and fraud one bill at a time, because there is no single federal statute that does the whole job. Maryland's contribution is a net-new state criminal statute that plugs AI and deepfakes into an existing identity-fraud framework rather than standing up a brand-new offense from scratch. That is a common and durable drafting pattern, and it makes the law easier for prosecutors to use because they already know how to charge identity fraud.

For anyone operating across state lines, the takeaway is that the deepfake-liability map is filling in, and the rules are not identical from state to state. What is a disclosure question in one state can be a criminal-intent question in another. Maryland has now planted a clear intent-based criminal marker with a fixed October 1, 2026 start.

What to do now that it is in force

If you build or deploy synthetic media that could touch Maryland, note that the statute took effect on October 1, 2026. Confirm that any use of AI likenesses, voice-cloning, or deepfake representations in your products or campaigns is consented, disclosed where appropriate, and never used to impersonate a real person in a way meant to deceive. Tighten the controls that keep your tools from being used for fraudulent impersonation, since the statute reaches the knowing, intentional use of these representations. Brief your legal and compliance teams on the single-victim and multiple-victim penalty tiers so the stakes are understood internally. And keep SB 8 separate from HB 1563 in your tracking so you do not misread which obligations apply to whom. None of this is legal advice, and how the statute applies to a specific product or situation is a question for Maryland counsel, but the direction is unambiguous: the AI and deepfake identity-fraud offenses described above have been in force in Maryland since October 1, 2026.

Browse the full AI Regulation News tracker

Informational analysis for working professionals, not legal advice. Confirm how any statute or requirement applies to your situation with qualified counsel in the relevant jurisdiction.