Massachusetts AI regulations are existing laws, not one AI statute. The Attorney General's April 16, 2024 advisory applies Chapter 93A, the anti-discrimination law and 201 CMR 17.00 to AI, and a 2025 settlement over AI lending models reached $2.5 million. What each law means for an AI agent.
Massachusetts AI regulations for business are, as of November 2026, existing laws rather than one AI statute. Attorney General Andrea Joy Campbell's advisory of April 16, 2024 says the Consumer Protection Act (Chapter 93A), the anti-discrimination law and the state's data security rules already apply to AI, and her office intends to enforce them.
That matters more now than it did in 2024, because the tools have changed. A chat window answers questions. An AI agent sends the email, updates the record and books the meeting. When software acts for a company, the company's legal duties travel with it, and the Attorney General has said so in writing.
In this article, "Massachusetts AI regulations" means the state laws and rules that govern how a business builds, buys or uses AI: the statutes the Attorney General named, the regulation that protects personal information, and the cases and settlements that show how they are enforced. This is general information, not legal advice.
Four bodies of existing law make up Massachusetts AI regulations today, and none of them was written for AI. The advisory addressed "developers, suppliers, and users of AI," according to Foley Hoag's April 2024 summary, so a Worcester company that only uses an AI product is inside the scope, not just the vendor that built it.
The scale of that audience is growing. The Census Bureau's Business Trends and Outlook Survey found that 19.8% of US businesses used AI as of May 3, 2026, and 37% of firms with at least 250 employees. Every one of those firms is a "user" in the advisory's sense.
| Law | What it says | Where an AI agent meets it |
|---|---|---|
| Chapter 93A, section 2 | Unfair or deceptive acts in trade or commerce are unlawful | Claims about what an AI product does; messages an agent sends to customers |
| Chapter 151B | Employers may not discriminate in hiring, pay or firing, directly or through an agent | AI screening of applicants and AI-scored reviews |
| Chapter 93H and 201 CMR 17.00 | Protect residents' personal information; notify after a breach | What records an agent can read, who can see its logs, which vendors hold the data |
| Chapter 149, section 19B | No lie detector tests as a condition of employment | AI interview tools that claim to judge honesty |
Read the table as a map of where to look, not a full list. Sector rules (health, lending, insurance, schools) add their own layers, and the call recording statute covered in Massachusetts call recording laws and AI notetakers applies the moment an agent listens to a phone call.
The advisory said that existing consumer protection, anti-discrimination and data security laws apply to AI the way they apply to anything else, which is why it is the starting document for Massachusetts AI regulations. In the Attorney General's own words, as quoted by Foley Hoag, it "serves as an important notice that our state's consumer protection, anti-discrimination, and data privacy laws apply to AI, just as they would within any other applicable context, and my office intends to enforce these laws accordingly."
The examples it gave of unfair or deceptive conduct include "false advertisement of AI systems, misrepresentations of the reliability or condition of AI systems," and "misleading audio or video content like deep fakes, voice cloning, or chatbots when used to engage in fraud." On discrimination, it named "algorithmic decision-making that relies on discriminatory inputs or produces discriminatory results." On data, it said AI systems must comply with the state's data security laws and breach notification duties.
Two features of Chapter 93A make the advisory carry weight. Section 2(b) tells Massachusetts courts to be "guided by the interpretations given by the Federal Trade Commission", so federal thinking on deceptive AI claims flows into state law. And for business-to-business claims, section 11 allows recovery of "up to three, but not less than two, times" actual damages for a willful or knowing violation, plus attorneys' fees. How that plays out in a vendor dispute is the subject of Chapter 93A and technology vendor disputes in Massachusetts.
An agent's words are the company's words, and Massachusetts AI regulations treat them that way. If an AI teammate tells a customer that an order shipped, that a price is final or that a service is covered, Chapter 93A asks the same question it would ask of an employee: was it unfair or deceptive?
That makes the outbound message the highest-risk moment in most agent workflows. A draft that sits inside the system harms nobody. A wrong promise that reaches a customer in Shrewsbury or Leominster is a record of what the business said. Brian put the working rule plainly in our October 23 webinar: drafts go ahead, and anything that leaves waits for a person.
The same section reaches the seller of the AI. A vendor that overstates what its agent can do is making the "misrepresentations of the reliability or condition of AI systems" the advisory warned about. That is also the core of agent washing and how to spot agentic AI slop: when a lookalike product calls a chat window an agent, that description is a claim a Massachusetts buyer can test against section 2.
Yes. If an agent can read a resident's name with a Social Security number, a driver's license number or a financial account number, every control in 201 CMR 17.00 applies to that access. The advisory itself says that AI developers, suppliers and users "must take the necessary and appropriate steps to safeguard personal information used by those systems," and it cites sections 17.03 and 17.04 by number.
Read against an agent, four provisions carry most of the data side of Massachusetts AI regulations. Section 17.04 requires "control of user IDs and other identifiers," which means the agent gets its own identity rather than a borrowed human login, the point made in what a non-human identity is for an AI agent. The same section requires restricting access to people "who need such information" to "perform their job duties," and "reasonable monitoring of systems, for unauthorized use of or access to personal information."
Section 17.03(2)(f) covers the vendor. A business must take reasonable steps to select providers capable of protecting the data and must require them "by contract to implement and maintain such appropriate security measures." An AI platform that stores your records, your prompts or your agent's logs is one of those providers. The written program behind all of this is covered in Massachusetts WISP requirements under 201 CMR 17.00, and section 17.03(2)(i) requires reviewing it "whenever there is a material change in business practices." Turning on an agent with access to customer records is that kind of change.
Under Massachusetts AI regulations, the business owns the outcome of any AI it uses to decide who gets hired or who gets credit. Chapter 151B's employment section opens with conduct by "an employer, by himself or his agent," according to the statute text on malegislature.gov, and a screening tool acting for the employer sits comfortably inside that phrase.
The clearest enforcement example so far came on July 10, 2025. The Attorney General reached a $2.5 million settlement with student lender Earnest Operations, alleging that its AI underwriting models harmed Black and Hispanic applicants and that underwriters "frequently bypassed the models without clear standards or documentation." Earnest denied the allegations. The settlement requires a written governance system covering "internal controls, and risk assessments for the use of AI models," and DLA Piper's August 8, 2025 analysis lists "written policies, risk assessments, testing, inventories" and documentation among its requirements.
Hiring has its own Massachusetts twist. In Baker v. CVS Health, decided February 16, 2024, Judge Saris denied CVS's motions to dismiss a claim that an AI video interview, which analyzed "facial expressions, eye contact, voice intonation, and inflection," fell under the state's lie detector statute. Section 19B sets damages at "a minimum of five hundred dollars for each such violation." Any Massachusetts employer using an AI interview product should ask the vendor, in writing, whether it claims to assess honesty or integrity.
Not one that changes a typical small business's duties yet. As of September 18, 2026, NBC Boston reported that the "Mass Wins" economic development bill "is currently being negotiated by the Legislature," with Governor Healey asking the conference committee for "independent reviews of the most powerful AI models" and faster reporting of serious safety incidents.
Those provisions aim at the companies that build frontier models, not the dental practice in Grafton or the machine shop in Millbury that uses them. For users, the practical Massachusetts AI regulations remain the four laws above, and they apply today without any new bill. Watch for the final text, but do not wait for it.
Turn Massachusetts AI regulations into written lines: write down what the agent may do alone, what waits for a person, and what it may never touch, then make the system enforce those lines. Policy that lives only in a document does not stop an agent at 2am. Here is the order we recommend to companies around Worcester and Shrewsbury:
The vendor questions in step 5 are expanded in questions to ask an agentic AI provider before you sign. If an incident does happen, the separate duties in Massachusetts data breach notification requirements apply to agent logs the same way they apply to any other file.
LTFI enforces these lines in the system rather than in a binder. We have run LTFI, our agentic business operating system, in live production for a year and a half: the CRM, projects, content, sites, security and AI staff in one place, on a dedicated server Kief Studio runs for each company. No shared hosting.
Here is how the parts line up with the laws above.
The moment that shows Massachusetts AI regulations working in practice happened live. During the October 23 webinar, Brian asked the system to email a client about a late project. The draft was written from the records already in the system, and it went out only after he approved it. Nobody had to write the email, and nobody had to wonder later who sent it.
Lookalike products are arriving fast, many of them wrappers around a free open-source agent framework or a chat window. LTFI was built from scratch by Kief Studio as one whole system and works with the AI tools a team already uses. A walkthrough is at ltfi.ai, and the replay of What is an agentic business operating system? shows the approvals working in real time. We set LTFI up remotely for businesses anywhere, the way we have worked with clients around the world for more than 13 years, and we meet teams in Worcester, Shrewsbury and the surrounding towns in person.
Not a single AI statute for ordinary businesses as of November 2026. Massachusetts AI regulations come from existing law: the Attorney General's April 16, 2024 advisory applies Chapter 93A, the anti-discrimination law and the data security rules to AI, and a frontier-model safety bill was still being negotiated in September 2026.
Yes. The advisory speaks to developers, suppliers and users of AI. A company that uses an AI agent to email customers, screen applicants or read personal information carries the same duties it would carry if a person did that work.
Yes, when the data includes a resident's personal information. Section 17.03(2)(f) requires choosing providers capable of protecting it and binding them by contract to do so, and that includes vendors that store prompts, records or agent logs.
It can, but the employer owns the result. Chapter 151B covers discrimination by an employer "or his agent," and Baker v. CVS shows that an AI interview tool claiming to judge honesty can raise a claim under the lie detector statute.
It depends on the law. Under Chapter 93A section 11, a business harmed by a willful or knowing violation can recover two to three times its damages plus attorneys' fees, and the Attorney General's 2025 Earnest settlement was $2.5 million plus governance requirements.
An AI acceptable use policy for small business now has to cover agents that act, not just people who paste. ISACA's May 2026 poll found only 38 percent of organizations had a formal, comprehensive AI policy. Seven parts to write, from approval lines to Massachusetts law.
Only 17% of U.S. firms with fewer than 20 employees used AI in spring 2026. An owner's guide to AI agents for small business: a readiness check, the first jobs and the never list, who owns each agent, day-one governance and the first 90 days.
AI agent drift is the slow change in what an agent does after launch. Researchers found one model's prime number accuracy fell from 84% in March 2023 to 51% in June 2023 on the same questions. The four causes, five checks that catch it, and how we handle it in LTFI.
Work With Us
Kief Studio builds, protects, automates, and supports full-stack systems for businesses up to $50M ARR.
Newsletter
Strategy, psychology, AI adoption, and the patterns that actually compound. No spam, easy to leave.
Subscribe
