Law / United States / 
Massachusetts
Transparency in Frontier Artificial Intelligence Act (proposed chapter 93M, Senate version of House bill 5576)
H.5576 as amended by the Senate (S.3228), proposed M.G.L. c. 93M, 194th General Court (2025-2026)
An AI governance rule binding private bodies.
- Enforcement body
- Massachusetts Attorney General
- Audit expectation
- none
As of .
What it requires
- If you are a large frontier developer (a person that has trained a foundation model using more than 10^26 operations and, with its affiliates, has annual gross revenues above $500,000,000), write, implement, comply with, and publish a frontier AI framework describing how you assess and mitigate catastrophic risk, and review it at least annually.NIST AI RMFGOVERN 1.4NIST AI RMFGOVERN 1.5
- If you are a frontier developer, publish a transparency report before or concurrently with deploying a new or substantially modified frontier model; a large frontier developer adds summaries of its catastrophic risk assessments.NIST AI RMFMAP 2.2NIST AI RMFGOVERN 4.2
- If you are a frontier developer, report a critical safety incident to the attorney general within 15 days of discovering it, and within 24 hours to an appropriate authority when the incident poses an imminent risk of death or serious physical injury.NIST AI RMFMANAGE 4.3
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST AI RMF
- GOVERN 1.4The risk management process and its outcomes are established through transparent policies, procedures, and other controls based on organizational risk priorities.
- GOVERN 1.5Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities clearly defined, including determining the frequency of periodic review.
- GOVERN 4.2Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and they communicate about the impacts more broadly.
- MAP 2.2Information about the AI system’s knowledge limits and how system output may be utilized and overseen by humans is documented. Documentation provides sufficient information to assist relevant AI actors when making decisions and taking subsequent actions.
- MANAGE 4.3Incidents and errors are communicated to relevant AI actors, including affected communities. Processes for tracking, responding to, and recovering from incidents and errors are followed and documented.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
The proposed chapter requires a published framework and transparency report and a critical safety incident report to the attorney general, and states no duty to keep a log or record.
- Kind
- None
- As of
What this law does
The Senate's version of House bill 5576, an economic development bill, would insert a new chapter 93M, the Transparency in Frontier Artificial Intelligence Act, into the General Laws. A frontier developer is a person that has trained, or begun training, a foundation model using more than 10^26 integer or floating-point operations of computing power. A large frontier developer is a frontier developer that together with its affiliates has annual gross revenues above $500,000,000.
A large frontier developer would have to write, implement, comply with, and publish a frontier AI framework describing how it assesses and mitigates catastrophic risk. It would also have to review and update the framework at least annually. Before or concurrently with deploying a new or substantially modified frontier model, a frontier developer would have to publish a transparency report. A large frontier developer would add summaries of its catastrophic risk assessments to the report.
A frontier developer would have to report a critical safety incident to the attorney general within 15 days of discovering it. It would have to disclose an incident that poses an imminent risk of death or serious physical injury within 24 hours to an appropriate authority. A large frontier developer that fails to comply would face a civil penalty of up to $1,000,000 for a first violation and up to $3,000,000 for later ones. Only the attorney general could recover the penalty, in a civil action.
The Senate passed the bill as amended on . On the House did not concur in the Senate amendment. A committee of conference was appointed the same day.
When LexLint raises it
When your app profile says your app trains models.