Maryland AI and Deepfake Identity Fraud Law

Overview

Maryland Chapter 445 of 2026, enacted through Senate Bill 8 in the 2026 Regular Session, expands the State’s identity fraud statute to address harmful identity misuse and fraudulent uses of artificial intelligence or deepfake representations. Governor Wes Moore approved the Act on May 12, 2026. Section 2 establishes October 1, 2026 as the effective date, and the Act is in force as of that date. The principal amendments appear in Criminal Law § 8–301. Section 1 also reenacts State Finance and Procurement § 3.5–801(a) and (c) without amendments to incorporate the existing statutory definition of artificial intelligence. The chaptered Act establishes the offenses, penalties, civil remedy, and enforcement provisions.

This is a targeted criminal-law measure, not a general framework for AI development, procurement, or deployment. It addresses unauthorized use of identifying information to cause harm, harmful or coercive identity assumption, and specified fraudulent AI or deepfake conduct. Synthetic media are not prohibited merely because they depict an identifiable person: the statutory mental states and prohibited purposes remain essential. Victims of conduct covered by § 8–301(f)(2) also receive a direct civil action against the responsible persons, allowing courts to prevent or restrain prohibited acts and grant other appropriate relief.

Definitions

Artificial intelligence has the meaning in State Finance and Procurement § 3.5–801(c): a machine-based system that, for human-defined objectives, makes predictions, recommendations, or decisions influencing real or virtual environments; uses machine- and human-based inputs to perceive those environments and automatically abstract perceptions into models through analysis; and uses model inference to formulate options for information or action. A deepfake representation includes photographs, films, videos, audio recordings, digital images, pictures, and computer or computer-generated images or pictures, however produced, that are indistinguishable from an actual and identifiable human being. Drawings, cartoons, sculptures, and paintings depicting human beings are expressly excluded.

Indistinguishability uses an ordinary-person standard: an image an ordinary person would conclude is of an actual and identifiable human being. It includes computer-generated images created, adapted, or modified to appear as such a person. Audio recordings are included in the deepfake definition, but the related indistinguishability definition is phrased in terms of images; no separate audio-specific test is supplied. Harm means physical injury, serious emotional distress, or economic damages. Personal identifying information includes conventional identifiers, financial, account, payment, and health identifiers, digital signatures, and unique biometric data, including fingerprints and voice prints. Listed elements may operate alone or with other information to identify a specific natural or fictitious individual.

Governance and Institutional Framework

The Act uses existing police, prosecutorial, and judicial institutions rather than creating an AI regulator. Under renumbered § 8–301(l), the Department of State Police may investigate and enforce the section throughout Maryland notwithstanding otherwise applicable territorial limits within municipal corporations or other political subdivisions. Section 8–301(p) authorizes a State’s Attorney or the Attorney General to investigate and prosecute violations and crimes based on the acts establishing a violation. In exercising that authority, the Attorney General has the powers and duties of a State’s Attorney, including access to grand juries in any county or Baltimore City.

Section 8–301(m) permits specified transportation, port, park, municipal, and county police officers to investigate statewide, subject to State Police regulations and a local connection: a related act must have occurred in the investigating agency’s jurisdiction or the complaining witness must reside there. Those regulations are not subject to State Government Article Title 10, Subtitle 1. Section 8–301(n) requires notification to the appropriate police chief, sheriff, commissioner, or designee when this authority is exercised. Officers retain their employing-agency relationship and receive the specified State Police immunities and exemptions. Courts of competent jurisdiction separately adjudicate victim civil actions under § 8–301(h).

Key Prohibitions

New § 8–301(b–2) prohibits knowingly, willfully, and with fraudulent intent using an individual’s personal identifying information without that individual’s consent in order to cause harm. Amended § 8–301(c)(2)(iv) prohibits knowingly and willfully assuming another’s identity with fraudulent intent to harm, harass, intimidate, threaten, or coerce that person. These provisions extend identity fraud beyond existing objectives involving obtaining value, accessing health information or care, and avoiding debts or legal obligations. Neither makes AI or a deepfake representation an express element.

The technology-specific offense in § 8–301(f)(2) requires knowing and willful conduct with fraudulent intent. Subparagraph (i) prohibits using AI or a deepfake representation to cause harm to another by impersonating, falsely depicting, or claiming to represent that person or any other person. Subparagraph (ii) prohibits using either technology to create or distribute false records with intent to cause harm, induce another person to provide personal identifying information, or obtain a benefit, credit, good, service, or other thing of value. The false-records branch therefore covers specified purposes other than causing harm. The Act does not impose universal synthetic-media labeling or make every misleading synthetic depiction a standalone offense.

Implementation Framework

Section 1 reenacts Criminal Law § 8–301 with amendments and reenacts the referenced AI definition without changes; Section 2 supplies the effective date. No separate licensing process, conformity assessment, registration system, technical testing standard, or AI-specific agency approval is established. The prohibitions apply to persons engaging in specified conduct, not automatically to every AI developer, distributor, or user. Application requires identifying the relevant subsection and examining conduct, mental state, any consent requirement, prohibited purpose, and other elements. Synthetic-media production alone is not sufficient.

Organizations can review identity-sensitive workflows involving personal identifiers, representations, and AI-generated or distributed records as preventive measures, but these are recommendations rather than express statutory audit duties. Consent is an explicit element of § 8–301(b–2); § 8–301(f)(2) does not establish consent as a general safe harbor. Disclosure that media are AI-generated likewise creates no express exemption from fraudulent conduct. Controls should distinguish permitted production from conduct satisfying the prohibited elements. Chapter 445 does not prescribe retention periods, compulsory incident notifications, mandatory employee training, implementation reports, or universal labeling requirements.

Monitoring and Evaluation

Monitoring takes the form of ordinary investigation, prosecution, and judicial adjudication under § 8–301. The Act creates no recurring compliance reports, AI performance metrics, periodic independent evaluations, or scheduled legislative review. Investigative powers remain distributed among State Police and other authorized agencies, with coordination requirements for certain statewide investigations. Under § 8–301(q), proceedings for a violation, or a crime based on the act establishing it, may commence in any county where an element occurred or where the victim resides. This is a venue rule, not unlimited jurisdiction over every out-of-state AI activity.

Evaluation must distinguish offense structures. Relevant issues include whose identity was depicted or assumed, whether personal information was used without consent where required, whether the actor acted knowingly and willfully with fraudulent intent, and whether the specified conduct or purpose is established. These considerations arise from statutory elements, not a legislated evidence checklist. Victim count determines the AI/deepfake felony tier, while monetary value determines certain existing identity fraud tiers. The ordinary-person indistinguishability standard matters when a case relies on a deepfake representation. No detection tool or technical authenticity-testing method is mandated.

Penalties, Liability, and Appeals

Under § 8–301(g)(5), a violation of § 8–301(f)(2) involving one victim is a felony punishable by up to five years’ imprisonment, a fine up to $10,000, or both. A violation involving two or more victims is a felony punishable by up to ten years, a fine up to $15,000, or both. New offenses under subsections (b–2) and (c)(2)(iv) fall within subsection (g)(4), carrying misdemeanor maximums of one year and $500, or both. Existing specified value-based offenses retain these tiers: $100 to less than $1,500, up to one year and $500; $1,500 to less than $25,000, up to five years and $10,000; $25,000 to less than $100,000, up to ten years and $15,000; and $100,000 or more, up to twenty years and $25,000. Each permits imprisonment, a fine, or both.

Subsection (g)(3) separately provides felony maximums of ten years and $25,000, or both, for violations under circumstances reasonably indicating intent to manufacture, distribute, or dispense another individual’s identifying information without consent. Subsection (g)(6) permits one-scheme treatment and value aggregation. Under subsection (h), victims of acts that would violate (f)(2) may sue the perpetrators in a court of competent jurisdiction; a prior conviction is not stated as a prerequisite. Courts may issue injunctions and grant other appropriate relief, but no fixed civil damages or general fee-shifting award is specified. Subsection (j) retains restitution for specified reasonable identity-repair costs, including attorney’s fees, in qualifying criminal cases. Sentences may be separate and consecutive or concurrent with sentences for other crimes. Subsection (i) cross-references Courts Article § 5–106(b) for designated misdemeanors. No special appeal procedure is created.

Relationship to Other Instruments

Chapter 445 modifies Criminal Law § 8–301 while preserving the surrounding identity fraud framework. Retained provisions address fraudulent acquisition of identifying information, malicious disclosure of listed identifiers through interactive computer services, identity assumption for specified purposes, credit-card re-encoding and skimming, and unauthorized claims of representation intended to obtain identifying information or payment device numbers. The new AI/deepfake offense does not replace every other potential identity fraud charge. The separate-sentencing provision expressly contemplates other crimes based on the same acts.

State Finance and Procurement § 3.5–801 supplies the AI definition without substantive amendment. Other express connections include Criminal Law § 8–213 for payment device numbers, Courts Article § 5–106(b) for designated misdemeanors, and Criminal Procedure Article Title 11, Subtitle 6 for restitution. Investigation provisions refer to State Police regulations and an exception to State Government Article Title 10, Subtitle 1. The General Assembly bill record identifies HB 184 as the cross-filed bill and SB 905 of the 2025 session as a prior-session introduction. These legislative relationships do not change Chapter 445’s operative requirements.

National and Federal Alignment

This Maryland statute is not a federal AI regulation or nationwide synthetic-media standard. It does not incorporate a federal AI definition, refer enforcement to a federal agency, or establish an express federal harmonization or preemption clause. The AI definition comes from Maryland’s State Finance and Procurement Article. Enforcement rests with designated Maryland police agencies, State’s Attorneys, the Attorney General, and courts, using State criminal and civil remedies rather than federal certification, disclosure, or product-safety systems.

The Act does not determine whether particular conduct also violates federal identity fraud, fraud, communications, privacy, or other law; that requires examination of independently applicable instruments and their elements. Its interactive computer service definition does not adopt or resolve federal intermediary-liability rules, and no such cross-reference or determination appears in the Act. Permission for separate sentences for crimes based on acts establishing a § 8–301 violation does not resolve every State–federal interaction. Maryland requirements should therefore remain distinct from federal duties: compliance with one regime does not itself establish compliance with the other.

Implementation Timeline

Sources and References