Law / United States / 
Maryland
SB 8 / Ch. 445 (2026), AI and Deepfake Identity Fraud
Md. Code Ann., Crim. Law §8-301(f)(2)
In force since .
An AI prohibited practices rule binding public and private bodies.
- Obligation class
- Prohibition
- Audit expectation
- none
- Setting the rule reaches
- General
What it requires
- Do not knowingly, willfully, and with fraudulent intent use artificial intelligence or a deepfake representation to impersonate, falsely depict, or claim to represent another person with intent to defraud, mislead, or cause physical injury, serious emotional distress, or economic damages to that person or anyone else.
- A victim of this conduct may bring a civil action and seek an injunction and other appropriate relief.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
- NIST AI 600-1
- GAI-RISK-08Information Integrity
- GAI-RISK-11Obscene, Degrading, and/or Abusive Content
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- ETSI EN 304 223
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
A violation involving one victim is a felony punishable by imprisonment not exceeding 5 years or a fine not exceeding $10,000, or both; a violation involving two or more victims is a felony punishable by imprisonment not exceeding 10 years or a fine not exceeding $15,000, or both.
Penalty structure
The maximum fine for a violation of subsection (f)(2) involving two or more victims, with imprisonment not exceeding 10 years; a violation involving one victim carries a fine not exceeding $10,000 and imprisonment not exceeding 5 years.
- Rule
- Fixed only
- As of
- Currency
- USD
- Fixed cap
- 15,000
Who enforces it
Enforcement body
A State's Attorney or the Attorney General, who may investigate and prosecute a violation, and a victim, through a civil action under Crim. Law § 8-301(h).
Settledness
- As of
- Open questions
- Does any other appropriate relief in Crim. Law § 8-301(h)(2)(II) include money damages, when subsection (h)(2)(I) names only an injunction?
What it makes you log
Logging duty
Section 8-301(f)(2) prohibits using artificial intelligence or a deepfake representation to impersonate or falsely depict a person, and a companion clause in the same subsection separately prohibits creating or distributing false records with intent to defraud or harm. That second clause criminalizes fabricating records as part of the offense; neither clause imposes a duty on anyone to create or keep a genuine log or record.
- Kind
- None
- As of
What this law does
Enacted as Chapter 445 and taking effect , this law extends Maryland's identity-fraud statute to bar knowingly, willfully, and with fraudulent intent using artificial intelligence or a deepfake representation to impersonate, falsely depict, or claim to represent another person with intent to defraud, mislead, or cause harm. A victim of that conduct may bring a civil action and seek an injunction and other appropriate relief.
A first-tier violation involving one victim is a felony, and a violation involving two or more victims carries a higher penalty tier.
When LexLint raises it
When your app profile says your app generates audio with AI, generates images with AI or generates video with AI.
Back to the example · Lint your app
Page updated .