WHAT THIS BILL REGULATES · 5 REQUIREMENT TYPES
How Is This Bill Enforced
Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.
The purpose of this chapter is to regulate generative artificial intelligence models, such as ChatGPT, in order to protect the public's safety, privacy and intellectual property rights.
This section states the legislative purpose of Chapter 93A½: to regulate generative artificial intelligence models in order to protect the public's safety, privacy, and intellectual property rights. It creates no compliance obligation.
(a) A "large-scale generative artificial intelligence modelLarge-scale generative artificial intelligence modelA "large-scale generative artificial intelligence model" shall mean a machine learning model with a capacity of at least one billion parameters that generates text or other forms of output, such as ChatGPT.Ch. 93A½, § 2(a)" shall mean a machine learning model with a capacity of at least one billion parametersParameter"Parameter" shall mean any variable or value used to control the operation or output of a generative artificial intelligence model.Ch. 93A½, § 2(b) that generates text or other forms of output, such as ChatGPT.
(b) "ParameterParameter"Parameter" shall mean any variable or value used to control the operation or output of a generative artificial intelligence model.Ch. 93A½, § 2(b)" shall mean any variable or value used to control the operation or output of a generative artificial intelligence model.
This section defines the two key terms for the chapter. A large-scale generative artificial intelligence model is any machine learning model with at least one billion parameters that generates text or other output. Parameter is defined broadly as any variable or value used to control a model's operation or output. The one-billion-parameter threshold was a relatively rough proxy in early 2023; many commercially significant models exceed it by orders of magnitude.
(1) 1 the model shall not be used to engage in discrimination or bias against any individual or group based on protected characteristics, as defined by state or federal law;
(2) 2 in order to prevent plagiarism, the model shall be programmed to generate all text with a distinctive watermark or offer an authentication process that allows a user to determine whether a particular output was generated by the model;
(3) 3 the company shall implement reasonable security measures to protect the data of individuals used to train the model;
(4) 4 the company shall obtain informed consent from individuals before collecting, using or disclosing their data;
(5) 5 the company shall delete or de-identify any data collected from individuals if it is no longer needed for the intended purpose of the model; and
(6) 6 the company shall conduct regular risk assessments to identify, assess and mitigate reasonably foreseeable risks and cognizable harms related to their products and services, including in the design, development and implementation of such products and services.
Section 3 imposes six operating standards on any company operating a large-scale generative AI model. The obligations span non-discrimination, content watermarking or authentication, training-data security, informed consent for data collection, data minimization, and regular risk assessments. The provisions are broadly drafted — for example, the watermarking requirement applies to "all text" generated by the model, and the risk-assessment obligation uses general "reasonably foreseeable risks" language without specifying methodology or frequency beyond "regular."
(a) 7 Any company operating a large-scale generative artificial intelligence modelLarge-scale generative artificial intelligence modelA "large-scale generative artificial intelligence model" shall mean a machine learning model with a capacity of at least one billion parameters that generates text or other forms of output, such as ChatGPT.Ch. 93A½, § 2(a) shall register with the attorney general within 90 days of the effective date of this act.
(b)(1)–(3) 7 The registration shall include the following information: (1) the name and contact information of the company; (2) a description of the large-scale generative artificial intelligence modelLarge-scale generative artificial intelligence modelA "large-scale generative artificial intelligence model" shall mean a machine learning model with a capacity of at least one billion parameters that generates text or other forms of output, such as ChatGPT.Ch. 93A½, § 2(a), including its capacity, training data, intended use, design process and methodologies; and (3) information on the company's data collection, storage and security practices.
(c) The attorney general shall maintain a public registry of all companies registered under this act.
Section 4 requires companies operating a large-scale generative AI model to register with the attorney general within 90 days of the act's effective date. The registration must include company contact information, a description of the model (covering capacity, training data, intended use, design process, and methodologies), and information on data practices. The attorney general must maintain a public registry. This is an early example of a mandatory AI registration requirement — functionally similar to later pre-market registration obligations but framed as a post-effective-date compliance deadline rather than a pre-deployment gate.
(a) The attorney general shall adopt regulations for the purposes of carrying out this chapter.
(b) To remedy violations of this chapter and for other relief that may be appropriate, the attorney general may bring an action pursuant to section 4 of chapter 93A against a person.
Section 5 establishes the enforcement framework. The attorney general is directed to adopt implementing regulations and may bring enforcement actions under the existing chapter 93A, § 4 authority — the Commonwealth's consumer-protection enforcement statute. This leverages the well-established 93A enforcement apparatus rather than creating a bespoke penalty regime. No private right of action is created by this chapter.
Chapter 93A½. of the General Laws shall take effect on the ninetieth day following the passage of this act.
The act takes effect on the ninetieth day following passage. This creates a 90-day implementation window for all obligations, and separately, Section 4 provides an additional 90 days from the effective date for the registration requirement — meaning companies would have had approximately 180 days from passage to complete registration.
This act has been drafted with the help of ChatGPT and any errors or inaccuracies in the bill should not be attributed to the language model but rather to its human authors.
An unusual disclaimer provision acknowledging that the bill was drafted with the assistance of ChatGPT and attributing any errors to the human authors rather than the language model. This creates no compliance obligation.