Massachusetts AI Regulatory Guidance: What Exists Today

An attorney general doesn't need a new statute to go after a company that oversells what its AI product can do. Massachusetts proved that in April 2024 — a full two years before anything AI-specific got anywhere near passing in the state legislature. Attorney General Andrea Campbell's office issued an advisory making one point unmistakably clear: Massachusetts doesn't need an AI law to regulate AI, because it already has three laws that reach AI conduct directly. That advisory, not any statute, is still the operative compliance baseline for most companies doing business in the state today.

This matters because "Massachusetts has no AI law" is the kind of half-true statement that gets compliance programs into trouble. It's accurate in the narrow sense that there's no Massachusetts AI Act sitting on the books the way there's a Colorado AI Act. It's badly misleading in the sense that matters: existing consumer protection, anti-discrimination, and data security law already applies in full to AI systems, with real enforcement teeth attached. Connecticut went through a similar reckoning when its broad duty-of-care bill died twice and lawmakers reached for narrower tools instead — Massachusetts never got as far as writing the broad bill in the first place.

Three existing laws, pointed at AI

The AG's advisory doesn't invent anything new. It takes three bodies of law that predate the current AI wave by years or decades and states, formally, that they apply to "developers, suppliers, and users" of AI and algorithmic decision-making systems.

The first is Chapter 93A, the state's consumer protection statute, which bars unfair or deceptive acts or practices under Section 2 and is reinforced by the Attorney General's own false-advertising regulation, 940 CMR 3.02. The advisory gives concrete examples of what that means for AI specifically: a company claiming its product has AI functionality it doesn't actually have, or misrepresenting an AI system's reliability, safety, or performance — including claiming a system is free of bias or immune to manipulation when that hasn't actually been tested. A vendor selling a hiring-screening tool as "bias-free" without having run a real bias audit is squarely in this territory, not in some AI-specific gray zone.

The second is Chapter 151B, the state's anti-discrimination law, which already covers decisions made with the help of an algorithm the same way it covers decisions made without one. The advisory connects the two statutes directly: a 151B violation that's also an unfair or deceptive practice can trigger 93A liability on top of whatever remedies 151B provides on its own, which widens the exposure for anyone using AI in employment, housing, lending, or similar decisions.

The third is data security — Chapter 93H and its implementing regulation, 201 CMR 17.00, which impose specific technical and administrative safeguards on anyone that owns or licenses personal information about a Massachusetts resident. AI systems that train on, store, or process that kind of data inherit those obligations regardless of how the data got there.

Why the advisory has real teeth

None of this would matter much if Chapter 93A were purely a regulatory formality. It isn't. Section 9 gives consumers a private right of action — an individual doesn't need to wait for the Attorney General to act, and can bring a claim directly. A court that finds a willful or knowing violation can award double or treble damages, on top of actual damages, though a plaintiff has to send a 30-day demand letter before filing suit, giving a business a real chance to resolve the dispute or make a reasonable settlement offer first.

That combination — a modest procedural hurdle paired with multiplied damages for willful conduct — is what turns an "advisory" into something closer to an enforcement program. The AG's office has been explicit that it doesn't see a gap here: the advisory states plainly that Massachusetts doesn't need additional AI legislation to bring enforcement actions, because the existing authority already covers the conduct that matters.

What the state's own agencies can and can't do with AI

Separately from anything binding on business, Massachusetts has its own internal policy governing how state government uses AI. The Executive Office of Technology Services and Security's "Enterprise Use and Development of Generative AI" policy, which took effect in early 2025, sets minimum requirements for how executive branch agencies adopt generative AI tools — every proposed use case gets reviewed and categorized by risk before it's approved, and agencies are expected to weigh concerns like bias, data integrity, and disinformation before deployment. The state has also rolled out an internal AI assistant to executive branch employees on a phased, voluntary basis.

It's worth being precise about what this policy is not: it's not a statute, and it doesn't touch private companies at all. A compliance team that stumbles on references to the Commonwealth's "AI policy" while researching Massachusetts obligations can easily mistake this for something that governs their own product. It governs the state's own internal IT decisions, full stop.

The frontier AI bill sitting in conference committee

The closest thing Massachusetts has to a genuine AI-specific statute in progress is the "Transparency in Frontier Artificial Intelligence Act" — provisions added by the Legislature's economic development committee to a larger economic development bond bill, built on language originally filed by Senator Barry Finegold. As reported, the obligations are narrow by design: they'd apply only to "large frontier developers," defined by two thresholds that have to both be met — more than $500 million in annual gross revenue, and models trained using roughly 10^26 floating-point operations of compute. Developers that clear both bars would have to publish a frontier AI safety framework, report critical safety incidents to the Attorney General, and submit to independent third-party safety audits on a cycle reported at roughly every 120 days.

The bill split the AI industry in a way that's unusual to see so publicly: Anthropic endorsed the measure, while OpenAI reportedly pushed for a lighter, audit-only version without the safety-framework and incident-reporting pieces. The Senate passed its version in the summer of 2026, but the House's version differs, and as of this writing a conference committee is still reconciling the two — meaning this is not enacted law, and its final shape (or whether it survives at all) isn't settled. The thresholds are also worth sitting with: a company has to be both very large and training at a scale only a handful of labs currently operate at before this provision reaches it at all.

The rest of the legislative picture

Two other AI bills worth tracking illustrate how selectively Massachusetts has been moving. H.81, an AI disclosure bill, and H.90, covering AI content provenance, were both sent for further study in February 2026 — in Massachusetts legislative practice, that's usually a quiet way of shelving a bill for the session rather than advancing it. By contrast, a pair of election-related AI bills, H.5093 and H.5094, passed the House that same month and remain pending in the Senate, and a healthcare AI bill, S.2632, was reported favorably out of committee in October 2025. There's no single pattern connecting all of these except that Massachusetts is legislating AI in narrow, specific slices rather than reaching for one comprehensive act — the same approach New York and Washington have taken with their own patchworks of AI-adjacent statutes.

Where this lands on a real company

Take Beacon Hill Analytics, a hypothetical Worcester-based HR-tech company selling an AI resume-screening tool to employers across New England. Beacon Hill's most pressing obligation today has nothing to do with any bill moving through the State House — it's the AG's advisory. If its marketing describes the tool as free of demographic bias without having run a real audit to back that up, it's exposed to a Chapter 93A claim the moment a rejected applicant or a competitor notices the gap between the claim and the testing. If the tool's scoring disproportionately screens out a protected class, Chapter 151B liability attaches on top of whatever Chapter 93A adds through the deceptive-practices overlap. None of that requires Massachusetts to pass a single new law.

What Beacon Hill doesn't have to worry about yet is the frontier AI bill — it's nowhere near a $500 million revenue company training frontier-scale models, so even a finalized version of that provision wouldn't reach it. And the EOTSS policy is irrelevant to it entirely, since that governs only the state's own internal AI use.

What to watch

The conference committee's resolution of the frontier AI provisions is the one development that could actually change this picture, since it's the first thing moving through Massachusetts's legislature that looks like real AI-specific law rather than an application of existing statutes. Whether H.81 or H.90-style disclosure bills get revived in a future session, now that several neighboring states have enacted their own versions, is worth tracking too. And the broader fight over whether a future federal AI law could preempt state statutes matters here as much as anywhere else — though in Massachusetts's case, what's most exposed to federal preemption wouldn't be a comprehensive AI statute, since the state has never passed one, but the AG's enforcement reach under laws that predate the AI conversation entirely.