Duty LXD-5696
Generates video with AI, in Massachusetts
Each law's tag says when it binds: since in force proposed proposed
Standards for disposal of records containing personal informationsince 4 lines
Mass. Gen. Laws ch. 93I, sec. 2 · Read the law's page
- This binds each agency or person that disposes of records containing personal information.
- Dispose of paper documents containing personal information by redacting, burning, pulverizing or shredding them so that personal data cannot practicably be read or reconstructed.
- Destroy or erase electronic media and other non-paper media containing personal information so that the personal information cannot practicably be read or reconstructed.
- If you are a third party hired to dispose of material containing personal information, implement and monitor compliance with policies and procedures that prohibit unauthorized access to or acquisition of or use of personal information during the collection, transportation and disposal of personal information.
Standards for the Protection of Personal Information of Residents of the Commonwealthsince 5 lines
201 CMR 17.01-17.05 · Read the law's page
- This binds any person that owns or licenses personal information about a Massachusetts resident, meaning any person or business that receives, stores, maintains, processes, or otherwise has access to it in connection with providing goods or services or in connection with employment; it reaches a business outside Massachusetts that holds a Massachusetts resident's personal information the same as one located here.
- Develop, implement, and maintain a comprehensive written information security program (WISP), in one or more readily accessible parts, with administrative, technical, and physical safeguards appropriate to your size, scope, resources, amount of stored data, and the sensitivity of the personal information you hold.
- Designate one or more employees to maintain the WISP; identify and assess foreseeable internal and external risks to personal information and evaluate whether your safeguards limit them; train employees; discipline violations; cut off a terminated employee's access to records; restrict and secure physical access to records; review the WISP's scope at least annually or after a material change in business practice; document your response to any security-breach incident; and select only third-party service providers capable of maintaining appropriate security measures, requiring those measures by contract.
- For personal information you store or transmit electronically, build a computer-system security program with secure user authentication, access controls limiting records to those who need them, encryption of records transmitted across public networks or wirelessly and of personal information stored on a laptop or other portable device, up-to-date firewalls and operating-system security patches for any internet-connected system, up-to-date malware protection, and employee training on the security system.
- There is no compliance runway left to build against: every covered person has been required to be in full compliance since .
Massachusetts Attorney General Advisory on AI and Existing State Lawsince 4 lines
Mass. AG Advisory (); auth. Mass. Gen. Laws ch. 93A; 201 CMR 17.00; Mass. anti-discrimination statutes
- Do not use AI to deceive consumers.
- Do not market AI products or services while concealing known deficiencies.
- Do not use AI in ways that discriminate against people in protected classes.
- Safeguard personal information processed by AI systems under the state's breach notification framework.
An Act to Protect Against Election Misinformation (H.5093)proposed2 lines
H.5093, 194th General Court (2025-2026) · Read the law's page
- Do not distribute deceptive audio or visual media about a candidate or an election within 90 days of that election, where the media is intended to injure a candidate's reputation, deceive a voter, disrupt the election's safety or operation, or mislead voters about voting dates, methods, deadlines, certification, or an endorsement.
- Media outlets that air or report on such content while acknowledging authenticity questions, websites, newspapers, periodicals, and satire or parody would be exempt.
An Act enhancing disclosure requirements for synthetic media in political advertising (H.5094)proposed2 lines
H.5094, 194th General Court (2025-2026) · Read the law's page
- Disclose at the beginning and end of any AI-generated synthetic media audio or video communication intended to influence a vote on a candidate or ballot question that it contains AI-generated material.
- A violation would be punishable by a fine of not more than $1,000.
An Act relative to artificial intelligence disclosure — H.81 (194th Gen. Ct.)proposed4 lines
Mass. H.81, 194th Gen. Ct. (2025–2026)
- This measure is in committee and binds nobody yet; what follows is what it would require if it is enacted in this form.
- Include a clear and permanent disclosure label identifying AI-generated audio, video, text, and print content as AI-generated.
- Embed metadata in AI-generated content specifying the AI system used, the creation date, and the time.
- Do not remove a required AI-generation disclosure.
An Act relative to artificial intelligence in behavioral health and utilization review — S.2632 (194th Gen. Ct.)proposed4 lines
Mass. S.2632, 194th Gen. Ct. (2025–2026)
- This measure is in committee and binds nobody yet; what follows is what it would require if it is enacted in this form.
- Do not let AI make independent therapeutic decisions in a mental health or behavioral health setting.
- Get patient disclosure and consent before using AI to interact with or record a patient.
- Have a human physician oversee AI-driven insurance utilization review decisions.
An Act establishing protections for consumers interacting with artificial intelligence chatbots — S.264 (194th Gen. Ct.)proposed3 lines
Mass. S.264, 194th Gen. Ct. (2025–2026)
- This measure is in committee and binds nobody yet; what follows is what it would require if it is enacted in this form.
- Clearly and conspicuously disclose when a consumer is interacting with an AI chatbot rather than a human.
- Do not use a disclaimer to avoid legal responsibility for a chatbot's communications.