- Maryland's SB 8 (2026 Chapter 445, amending Criminal Law section 8-301), effective October 1, 2026, prohibits knowingly, willfully, and with fraudulent intent using AI or a deepfake representation to cause harm by impersonating, falsely depicting, or claiming to represent a person, and separately covers specified false-record conduct. Victims of acts that would violate subsection (f)(2) may bring a civil action with injunctive or other appropriate relief. Counsel must check the precise elements and applicable jurisdiction.
- The statutory elements are intent-heavy. The intake file separates observable facts (what was posted, from which account, when, what was requested, what harm followed) from inferences such as intent, which remain counsel's legal judgment.
- Impersonation material is volatile: profiles get renamed, posts get deleted, accounts vanish. Capture URLs, media, account context, and timestamps early, and log every platform report and response.
- Harm documentation carries weight under these statutes: financial-loss records, professional documentation of distress, reputational-impact records, and cleanup costs need the same preservation discipline as the impersonation captures themselves.
Answer-engine summary
This page is news-aware: Maryland's SB 8 takes effect on October 1, 2026, adding a criminal prohibition on fraudulent AI impersonation and a civil action for victims, part of a wider wave of state statutes. The operational gap it exposes is familiar: claims under new statutes live or die on records captured before the impersonating accounts and posts disappear. Start from for law firms and the impersonation evidence workflow.
The statutory moment: Maryland SB 8 in context
Maryland's 2026 Senate Bill 8 (Chapter 445), effective October 1, 2026, amends Criminal Law section 8-301. Subsection (f)(2)(i) addresses knowingly, willfully, and with fraudulent intent using AI or a deepfake representation to cause harm by impersonating, falsely depicting, or claiming to represent a person. Subsection (f)(2)(ii) separately addresses creating or distributing false records for specified purposes. Harm is defined as physical injury, serious emotional distress or economic damages. The deepfake definition includes listed visual/audio media but excludes drawings, cartoons, sculptures and paintings. Subsection (h) permits a civil action for acts that would violate (f)(2), including injunctive and other appropriate relief. Criminal restitution under (j) follows a guilty or nolo contendere plea or finding of guilt and applies to specified costs, including reasonable attorney's fees; it is not a general civil fee entitlement.
- State law only: the statute reaches Maryland matters; conduct across state lines or platforms raises jurisdiction questions for counsel.
- A wave, not an outlier: multiple states have enacted AI-impersonation or deepfake provisions with varying scope and civil components, and some deepfake-related statutes have faced constitutional challenges, so current-law checks matter in every jurisdiction.
- Intent-heavy elements: knowledge, willfulness, and fraudulent intent are central, which shapes what intake records must preserve.
- Civil and criminal tracks can interact; coordination decisions belong to counsel, not to an intake template.
What intake records: elements as observable facts
| Element area | Observable record | Handling note |
|---|---|---|
| Impersonation instance | URLs, account handles, profile state, captured media, timestamps | Capture before rename or deletion; keep originals unmodified |
| False depiction or false records | Captured posts, messages, documents, or media as distributed | Record where each item was found and when |
| Fraudulent-request pattern | Requests for funds, credentials, personal data; who was contacted; through which channel; what followed | Log as observed sequence; do not characterize intent |
| Harm and damages | Financial records, professional documentation of distress, employment or reputational impact records, cleanup costs | Preserve with sources and dates; characterization stays with counsel |
| Distribution and reach | Shares, reposts, views where platforms expose them, spread across surfaces | Platform metrics change; capture what is visible, with timestamp |
| Identity context | What the impersonating material claims about the client | No identification of persons behind accounts; that stays with legal process |
A practical intake workflow
- Authorization gate: confirm the client relationship and scope before capturing sensitive material, per the firm's engagement rules.
- Statute scope header: jurisdiction, statute name and citation as enacted, effective date, and a note that claim evaluation belongs to counsel.
- Volatile capture first: impersonating profiles, posts, messages, and media captured with URLs, timestamps, and account context before deletion or renaming.
- Observed-fact log: a chronological record of events, requests, and responses, each entry labeled observation, with sources and dates.
- Damages log: financial-loss documents, professional documentation, impact records, and cleanup costs, each with source and capture date.
- Platform report log: every report submitted, to which platform, when, with what response or status change, including inaction.
- Witness and communications log: who else received impersonation contact, when, and what they retained.
- Sensitivity controls: restricted storage for intimate or highly sensitive material with access logging and minimization.
- Counsel-review export: a sealed pack with manifest, hashes, custody log, and the mapping between exhibits and records.
Harm documentation discipline
These statutes tie relief to harm, which makes damages documentation an evidence problem, not just a pleading problem. Financial-loss records (transfer requests, fraudulent invoices, credit impacts), professional documentation of emotional distress, employment consequences, and reputational-impact records all decay or get overwritten as quickly as the impersonation posts do. Capture and log them with the same discipline: source, date, method, hash, custody.
- Keep client narratives in a dated log with author, separate from the observed-fact record
- Preserve third-party communications about the impersonation as received, with headers or metadata intact
- Record remediation steps and costs as they happen, not reconstructed later
- Route medical, psychological, or employment documentation through the client's own professionals; the file records existence and source, not conclusions
Coordination boundaries
Privacy minimization applies throughout: capture only what the matter needs, restrict sensitive material, and log every access. Where the client fears further exposure, handling rules for their address and personal details follow the firm's protective procedures.
Where an evidence desk fits
Finium is built for the capture-and-structure layer of this workflow: source-aware preservation of volatile impersonation material, hashes at capture, custody and access logs, restricted handling for sensitive items, and sealed counsel-review exports. The evidence standard describes the integrity rules, security covers handling controls, and how it works walks through the pipeline. Related workflows: the evidence intake workflow for online harm and the executive impersonation evidence handoff. Finium is a tool, not a law firm; the firm remains the legal actor.
Disclaimers and operating boundary
This workflow is evidence-operations guidance, not legal advice, and not a survey of any jurisdiction's law. The Maryland SB 8 summary reflects the publicly enacted text as of October 2026 and is provided for workflow context only; counsel reads the statute and checks current law, including any amendments or constitutional rulings. Nothing here predicts any legal, platform-action, or case outcome, and Finium does not identify persons behind accounts, file claims, or promise results. Statutes in other jurisdictions differ; several deepfake-related laws remain subject to ongoing legal challenge.
Questions
What did Maryland's SB 8 change?
Effective October 1, 2026, section 8-301(f)(2) prohibits knowingly, willfully, and with fraudulent intent using AI or a deepfake representation to cause harm by impersonating, falsely depicting, or claiming to represent a person, or to create or distribute false records for the specified harmful, identifying-information or value-seeking purposes. Harm is defined as physical injury, serious emotional distress or economic damages. Subsection (h) allows a civil action for acts that would violate (f)(2), with injunctive or other appropriate relief. The separate restitution provision applies to guilty pleas, nolo contendere pleas or findings of guilt and specified costs; it is not an automatic civil attorney-fee award. Counsel reads the enacted text and checks current law.
Is this page legal advice about a specific claim?
No. It is an intake workflow reference. Whether conduct violates a statute, which claims to bring, and how to plead them are decisions for counsel licensed in the relevant jurisdiction, based on the current text of the law.
What should the intake file record first?
The impersonation instances (URLs, accounts, timestamps, captured media), any fraudulent-request pattern (funds transfers, credential changes, solicitations to third parties), harm documentation, platform report history with responses, and the client's own communication log. All as observed facts with sources and dates.
How should intent be handled at intake?
Record observable indicators and label them as observations: the sequence of events, who was contacted, what was requested, what followed. Intent conclusions are legal judgments for counsel. An intake file that mixes inference into observation makes the record harder to rely on later.
Does Finium identify the impersonator?
No. Finium records observable source material and context: what was posted, where, when, and how handling proceeded. Identification of a person behind an account stays with courts, platforms, and lawyers through their own legal processes.
Do other states have similar statutes?
Several states have enacted AI-impersonation or deepfake provisions with varying scope, and some include civil components while others do not; some deepfake-related statutes have also faced constitutional challenges. This workflow uses Maryland as a timely worked example and deliberately does not survey other statutes. Counsel checks the law of each relevant jurisdiction and its current status.