WHAT THIS BILL REGULATES · 6 REQUIREMENT TYPES
How Is This Bill Enforced
Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.
(1)–(7) For the purposes of this Chapter: (1) Algorithmic DiscriminationAlgorithmic DiscriminationDifferential treatment or impact resulting from an artificial intelligence system that disadvantages individuals or groups based on actual or perceived age, race, ethnicity, gender, disability, national origin, religion, genetic information, reproductive health, veteran status, or any protected classification under Massachusetts or federal law.G.L. c. 93M, § 1(1): Differential treatment or impact resulting from an artificial intelligence systemArtificial Intelligence SystemAny machine-based system that processes inputs to generate outputs, including content, decisions, predictions, or recommendations, that influence physical or virtual environments.G.L. c. 93M, § 1(2) that disadvantages individuals or groups based on actual or perceived age, race, ethnicity, gender, disability, national origin, religion, genetic information, reproductive health, veteran status, or any protected classification under Massachusetts or federal law. (2) Artificial Intelligence SystemArtificial Intelligence SystemAny machine-based system that processes inputs to generate outputs, including content, decisions, predictions, or recommendations, that influence physical or virtual environments.G.L. c. 93M, § 1(2): Any machine-based system that processes inputs to generate outputs, including content, decisions, predictions, or recommendations, that influence physical or virtual environments. (3) High-Risk Artificial Intelligence SystemHigh-Risk Artificial Intelligence SystemAI systems that materially influence consequential decisions, including but not limited to: (a) Education opportunities; (b) Employment decisions; (c) Financial or lending services; (d) Housing access; (e) Healthcare services; (f) Insurance decisions; (g) Legal or government services.G.L. c. 93M, § 1(3): AI systems that materially influence consequential decisionsConsequential DecisionA decision with significant legal, financial, or personal implications for a consumer, such as denying housing, employment, or healthcare. For clarity, material influence refers to decisions where AI systems determine or heavily weigh inputs that directly affect such outcomes.G.L. c. 93M, § 1(4), including but not limited to: (a) Education opportunities; (b) Employment decisions; (c) Financial or lending services; (d) Housing access; (e) Healthcare services; (f) Insurance decisions; (g) Legal or government services. (4) Consequential DecisionConsequential DecisionA decision with significant legal, financial, or personal implications for a consumer, such as denying housing, employment, or healthcare. For clarity, material influence refers to decisions where AI systems determine or heavily weigh inputs that directly affect such outcomes.G.L. c. 93M, § 1(4): A decision with significant legal, financial, or personal implications for a consumerConsumerA resident of the Commonwealth of Massachusetts.G.L. c. 93M, § 1(7), such as denying housing, employment, or healthcare. For clarity, material influence refers to decisions where AI systems determine or heavily weigh inputs that directly affect such outcomes. (5) DeveloperDeveloperAn entity or individual developing, modifying, or making AI systems available in Massachusetts.G.L. c. 93M, § 1(5): An entity or individual developing, modifying, or making AI systems available in Massachusetts. (6) DeployerDeployerAn entity using AI systems to make decisions impacting consumers in Massachusetts.G.L. c. 93M, § 1(6): An entity using AI systems to make decisions impacting consumersConsumerA resident of the Commonwealth of Massachusetts.G.L. c. 93M, § 1(7) in Massachusetts. (7) ConsumerConsumerA resident of the Commonwealth of Massachusetts.G.L. c. 93M, § 1(7): A resident of the Commonwealth of Massachusetts.
Section 1 establishes the definitional framework for the chapter. It defines key terms including Algorithmic Discrimination (covering all Massachusetts and federal protected classifications), Artificial Intelligence System (broad, input-to-output functional definition), High-Risk Artificial Intelligence System (defined by consequential-decision domains), Consequential Decision, Developer, Deployer, and Consumer. The high-risk definition is non-exhaustive, covering seven enumerated domains.
(a) 1 Duty of Care: DevelopersDeveloperAn entity or individual developing, modifying, or making AI systems available in Massachusetts.G.L. c. 93M, § 1(5) must use reasonable care to identify, mitigate, and disclose risks of algorithmic discriminationAlgorithmic DiscriminationDifferential treatment or impact resulting from an artificial intelligence system that disadvantages individuals or groups based on actual or perceived age, race, ethnicity, gender, disability, national origin, religion, genetic information, reproductive health, veteran status, or any protected classification under Massachusetts or federal law.G.L. c. 93M, § 1(1).
(b) 2 Documentation Requirements: DevelopersDeveloperAn entity or individual developing, modifying, or making AI systems available in Massachusetts.G.L. c. 93M, § 1(5) must provide deployersDeployerAn entity using AI systems to make decisions impacting consumers in Massachusetts.G.L. c. 93M, § 1(6) with: (1) A summary of intended and foreseeable uses of the AI system; (2) Known limitations and risks, including algorithmic discriminationAlgorithmic DiscriminationDifferential treatment or impact resulting from an artificial intelligence system that disadvantages individuals or groups based on actual or perceived age, race, ethnicity, gender, disability, national origin, religion, genetic information, reproductive health, veteran status, or any protected classification under Massachusetts or federal law.G.L. c. 93M, § 1(1); (3) Information on the datasets used for training, including measures taken to mitigate biases.
(c) 3 Disclosure of Risks: DevelopersDeveloperAn entity or individual developing, modifying, or making AI systems available in Massachusetts.G.L. c. 93M, § 1(5) must notify the Attorney General and deployers of any known or foreseeable risks of discrimination within 90 days of discovery.
(d) 4 Public Statement: DevelopersDeveloperAn entity or individual developing, modifying, or making AI systems available in Massachusetts.G.L. c. 93M, § 1(5) must publish a plain-language summary on their website, detailing: (1) Types of AI systems they develop; (2) Measures to mitigate algorithmic discriminationAlgorithmic DiscriminationDifferential treatment or impact resulting from an artificial intelligence system that disadvantages individuals or groups based on actual or perceived age, race, ethnicity, gender, disability, national origin, religion, genetic information, reproductive health, veteran status, or any protected classification under Massachusetts or federal law.G.L. c. 93M, § 1(1); (3) Contact information for inquiries.
Section 2 imposes four distinct obligations on developers of AI systems. Subsection (a) establishes a general duty of care to identify, mitigate, and disclose risks of algorithmic discrimination. Subsection (b) requires developers to provide deployers with documentation covering intended uses, known risks and limitations, and training data details. Subsection (c) mandates notification of the Attorney General and deployers within 90 days of discovering discrimination risks. Subsection (d) requires public posting of a plain-language summary describing system types, discrimination mitigation measures, and contact information.
The duty-of-care obligation in (a) is notable for its generality — it applies to all AI systems, not just high-risk systems. The 90-day notification obligation in (c) mirrors incident-reporting requirements seen in other state frameworks, but here it is triggered by discovery of discrimination risk rather than by a safety incident.
(a) 5 Risk Management Policy: Deployers of high-risk AI systems must implement and maintain a risk management program that: (1) Identifies and mitigates known or foreseeable risks of algorithmic discriminationAlgorithmic DiscriminationDifferential treatment or impact resulting from an artificial intelligence system that disadvantages individuals or groups based on actual or perceived age, race, ethnicity, gender, disability, national origin, religion, genetic information, reproductive health, veteran status, or any protected classification under Massachusetts or federal law.G.L. c. 93M, § 1(1); (2) Aligns with industry standards, such as the National Institute of Standards and Technology (NIST) AI Risk Management Framework.
(b)(1)–(2) 6 DeployersDeployerAn entity using AI systems to make decisions impacting consumers in Massachusetts.G.L. c. 93M, § 1(6) must complete an annual impact assessment for each high-risk AI system, including: (i) The purpose and intended use of the system; (ii) Data categories used and outputs generated; (iii) Potential risks of discrimination and mitigation measures. (2) Impact assessments must be updated after any substantial modification to the system. State-provided templates for these assessments will be made available to reduce compliance burdens.
(c)(1)–(2) 7 ConsumerConsumerA resident of the Commonwealth of Massachusetts.G.L. c. 93M, § 1(7) Protections: DeployersDeployerAn entity using AI systems to make decisions impacting consumers in Massachusetts.G.L. c. 93M, § 1(6) must: (1) Notify consumersConsumerA resident of the Commonwealth of Massachusetts.G.L. c. 93M, § 1(7) when an AI system materially influences a consequential decisionConsequential DecisionA decision with significant legal, financial, or personal implications for a consumer, such as denying housing, employment, or healthcare. For clarity, material influence refers to decisions where AI systems determine or heavily weigh inputs that directly affect such outcomes.G.L. c. 93M, § 1(4); (2) Provide consumersConsumerA resident of the Commonwealth of Massachusetts.G.L. c. 93M, § 1(7) with: (i) The purpose of the system; (ii) An explanation of how the system influenced the decision; (iii) A process to appeal or correct adverse decisions.
(d) 8 Transparency: DeployersDeployerAn entity using AI systems to make decisions impacting consumers in Massachusetts.G.L. c. 93M, § 1(6) must publicly disclose the types of high-risk AI systems in use and their risk mitigation strategies.
Section 3 imposes the core deployer-side obligations for high-risk AI systems. Subsection (a) requires a risk management program that identifies and mitigates algorithmic discrimination risks and aligns with the NIST AI Risk Management Framework. Subsection (b) mandates annual impact assessments covering purpose, data categories, outputs, discrimination risks, and mitigation measures, with updates after substantial modifications. The bill notes that state-provided templates will be made available to reduce compliance burdens.
Subsection (c) requires consumer-facing protections: notification when AI materially influences a consequential decision, disclosure of the system's purpose and how it influenced the decision, and an appeal or correction process. Subsection (d) requires public disclosure of the types of high-risk AI systems in use and risk mitigation strategies.
(a)(1)–(3) 9 Disclosure of AI Use: Any corporation operating in Massachusetts that uses artificial intelligence systemsArtificial Intelligence SystemAny machine-based system that processes inputs to generate outputs, including content, decisions, predictions, or recommendations, that influence physical or virtual environments.G.L. c. 93M, § 1(2) or related tools to target specific consumerConsumerA resident of the Commonwealth of Massachusetts.G.L. c. 93M, § 1(7) groups or influence behavior must disclose: (1) Purpose of AI Use: The methods, purposes, and contexts in which AI systems are used to identify or target specific classes of individuals; (2) Behavioral Influence: The specific ways in which AI tools are designed to influence consumerConsumerA resident of the Commonwealth of Massachusetts.G.L. c. 93M, § 1(7) behavior; (3) Third-Party Partnerships: Details of any third-party entities involved in the design, deployment, or operation of AI systems used for targeting or behavioral influence. Proprietary information will be safeguarded and exempt from public disclosure under state confidentiality laws.
(b)(1)–(2) 9 Public Disclosure Requirements: Corporations must make these disclosures: (1) Publicly available on their website in a manner that is easily accessible and comprehensible; (2) Included in terms and conditions provided to consumersConsumerA resident of the Commonwealth of Massachusetts.G.L. c. 93M, § 1(7) prior to significant interaction with an AI system.
(c)(1)–(2) 10 ConsumerConsumerA resident of the Commonwealth of Massachusetts.G.L. c. 93M, § 1(7) Notification: ConsumersConsumerA resident of the Commonwealth of Massachusetts.G.L. c. 93M, § 1(7) must be notified when: (1) They are being targeted or influenced by AI systems in a way that materially impacts their decisions; (2) Algorithms are used to determine pricing, eligibility, or access to services.
Section 4 creates a separate set of disclosure obligations for any corporation operating in Massachusetts that uses AI to target specific consumer groups or influence behavior — a broader scope than the high-risk focus of Sections 2–3. Subsection (a) requires disclosure of the purpose of AI use, methods of behavioral influence, and third-party partnerships involved in targeting or behavioral influence, with a proprietary-information safeguard.
Subsection (b) requires these disclosures to be publicly available on the corporation's website and included in terms and conditions prior to significant AI interaction. Subsection (c) requires direct consumer notification when consumers are being targeted or influenced by AI in a way that materially impacts their decisions, or when algorithms determine pricing, eligibility, or access to services.
(1)–(3) The following entities and circumstances are exempt from certain provisions of this Chapter: (1) Small Businesses: Businesses with fewer than 50 employees that do not use proprietary data to train AI systems. (2) Low-Risk Systems: AI systems performing procedural tasks (e.g., spell-checkers, calculators) or those not influencing consequential decisionsConsequential DecisionA decision with significant legal, financial, or personal implications for a consumer, such as denying housing, employment, or healthcare. For clarity, material influence refers to decisions where AI systems determine or heavily weigh inputs that directly affect such outcomes.G.L. c. 93M, § 1(4). (3) Federal Compliance: Entities subject to equivalent or stricter federal AI regulations, such as those governed by the Federal Trade Commission or Department of Health and Human Services.
Section 5 carves out three categories of exemptions from certain provisions of the chapter. Small businesses with fewer than 50 employees that do not use proprietary data to train AI systems are exempt. Low-risk AI systems performing purely procedural tasks (spell-checkers, calculators) or not influencing consequential decisions are exempt. Entities already subject to equivalent or stricter federal AI regulations (such as FTC or HHS oversight) are also exempt.
The exemption language is broad — it exempts from 'certain provisions' without specifying which, leaving scope to be clarified by Attorney General rulemaking.
(a) Attorney General Authority: The Attorney General has exclusive authority to enforce this Chapter. Violations are deemed unfair or deceptive trade practices under Chapter 93A.
(b)(1)–(2) Affirmative Defense: A developerDeveloperAn entity or individual developing, modifying, or making AI systems available in Massachusetts.G.L. c. 93M, § 1(5) or deployerDeployerAn entity using AI systems to make decisions impacting consumers in Massachusetts.G.L. c. 93M, § 1(6) may defend against enforcement if: (1) They identify and remedy violations through testing, internal review, or consumerConsumerA resident of the Commonwealth of Massachusetts.G.L. c. 93M, § 1(7) feedback; (2) They demonstrate compliance with recognized AI risk management standards.
(c) No Private Right of Action: This Chapter does not create a private right of action for consumersConsumerA resident of the Commonwealth of Massachusetts.G.L. c. 93M, § 1(7).
Section 6 designates the Attorney General as the exclusive enforcer and classifies violations as unfair or deceptive trade practices under Chapter 93A. This channels enforcement through Massachusetts' existing consumer protection enforcement infrastructure. An affirmative defense is available where a developer or deployer identifies and remedies violations through testing, internal review, or consumer feedback, or demonstrates compliance with recognized AI risk management standards. The statute expressly bars any private right of action.
The Attorney General may issue rules to: (1) Define documentation and impact assessment requirements (2) Set standards for risk management programs and consumerConsumerA resident of the Commonwealth of Massachusetts.G.L. c. 93M, § 1(7) notifications; (3) Designate recognized AI risk management frameworks.
Section 7 grants the Attorney General rulemaking authority to define documentation and impact assessment requirements, set standards for risk management programs and consumer notifications, and designate recognized AI risk management frameworks. This is a delegation provision that will shape the operational details of the substantive obligations in Sections 2–4.
The Attorney General, in collaboration with relevant state agencies, shall establish a public education campaign to inform residents of their rights under this Chapter and to increase awareness of the role of AI in decision-making processes.
Section 8 directs the Attorney General, in collaboration with relevant state agencies, to establish a public education campaign informing Massachusetts residents of their rights under the chapter and increasing awareness of AI in decision-making. This is a government-directed obligation, not a private-sector compliance duty.
Sections 1, 4, 5, and 8 shall take effect 180 days after passage of this Act.
Section 9 provides the first tier of the staged effective-date framework: definitions, corporate disclosure requirements, exemptions, and the public education campaign take effect 180 days after passage.
Sections 2, 3, 6, and 7 shall take effect 1 year after passage of this Act.
Section 10 provides the second tier: developer responsibilities, deployer responsibilities, enforcement, and rulemaking authority take effect one year after passage.
The Amendment to Chapter 93A shall take effect 180 days after passage of this Act.
Section 11 makes the Chapter 93A integration (classifying violations as unfair or deceptive trade practices) effective 180 days after passage, aligning it with the corporate-disclosure and definitions effective date rather than the one-year developer/deployer obligation timeline.