Massachusetts State GenAI Policy AI.001: Rules for Commonwealth Staff and Contractors

On October 6, 2025, Australia's Department of Employment and Workplace Relations confirmed that Deloitte Australia would repay the final installment of an AU$440,000 government contract (exact refund amount undisclosed) after an academic caught AI-fabricated judicial quotes and nonexistent papers inside a welfare-compliance report (The Register, Oct 6, 2025). Eight months earlier in Boston, the Commonwealth of Massachusetts Executive Office of Technology Services and Security (EOTSS) converted its April 2024 interim guidelines into a binding statewide standard: the Enterprise Use and Development of Generative Artificial Intelligence Policy (AI.001, Version 1.1, effective January 31, 2025) (Mass.gov Policy PDF). Yet contractors, nonprofits, and state staff who read only the top-ranked Mass.gov summary webpage see broad principles while missing the operative PDF prohibitions governing daily work.

Violating AI.001 exposes vendors and staff to far more than an IT warning. Commonwealth Standard Contract Form and RFR security flow-downs permit suspension, termination for cause, and indemnification claims when a contractor leaks non-public records. Silently inviting an unapproved AI meeting bot onto a state call also implicates the Massachusetts all-party wiretap statute (M.G.L. c. 272, s. 99), carrying statutory minimum damages of $100 per day or $1,000 plus fees (MA Legislature s. 99). Across the wider market, IBM's 2026 Cost of a Data Breach study (n = 602 breached organizations, vendor-sponsored Ponemon research) found unapproved staff AI tools in 43% of security incidents (IBM, Jul 29, 2026). Part of our safe use of AI tools at work hub and paired with our source-checking and AI report disclosure guide, this operational translation is general compliance information, not legal advice.

Who is bound by Massachusetts state GenAI policy AI.001 v1.1?

AI.001 Version 1.1 binds every Massachusetts Executive Department secretariat, agency, board, division, and commission, along with all "Personnel" explicitly defined to include full-time and part-time state employees, interns, consultants, contractors, and vendors, plus external entities using EOTSS services such as Mass.gov (Mass.gov Policy PDF).

Think of the badge-and-magnetometer checkpoint inside One Ashburton Place or a state courthouse. Whether you are a career analyst, a summer policy intern, or an outside engineering contractor carrying a toolbox, crossing that perimeter subjects your tools to the same building rules. Where that physical analogy breaks is remote cloud delivery. Most IT vendors, research firms, and human-services nonprofits draft state deliverables on company laptops miles from downtown Boston. Teams forget that EOTSS security and GenAI rules follow Commonwealth data, networks, and contracted deliverables wherever the keyboard sits.

Entities outside the Governor's direct Executive chain also enter scope via contract clauses:

• Constitutional offices, courts, and authorities: While the Legislature, Judiciary, Attorney General, Treasurer, Auditor, and Secretary of the Commonwealth maintain separate governance, joint systems hosted on EOTSS infrastructure must honor EOTSS boundaries.
• Municipalities and grant sub-recipients: Cities, towns, workforce boards, and 501(c)(3) providers enter scope whenever a grant agreement, ISA, or IT procurement incorporates Commonwealth Enterprise Information Security Policies (IS.000 series and AI.001).
• Subcontractors: Prime vendors under the Commonwealth Standard Contract Form must flow down identical confidentiality and AI restrictions to every downstream subcontractor.

Which Commonwealth data classes are barred from public GenAI tools under FIPA and EOTSS rules?

Under AI.001 v1.1, personnel are barred from entering confidential, regulated, or non-public Commonwealth data into public generative AI tools, must consult agency legal, privacy ([email protected]), and security teams before using personally identifiable information (PII) in an approved tool, and must restrict approved inputs to the minimum necessary PII (Mass.gov Policy PDF).

Consumer-tier AI services retain prompts for abuse review or model training unless governed by an EOTSS-vetted enterprise zero-data-retention contract. Pasting one spreadsheet row into an unvetted tool can implicate five statutory regimes at once:

1. Fair Information Practices Act (M.G.L. c. 66A): Massachusetts FIPA binds every Executive agency "holder" and contracted data-system vendor, barring unauthorized access to or dissemination of identifiable "personal data" (MA Legislature c. 66A). Uploading constituent names, case histories, or employee files to a public LLM is an unauthorized dissemination.
2. Massachusetts Data Security Regulation (201 CMR 17.00): Covers resident names paired with Social Security, driver's license, state ID, or financial account numbers, mandating encryption and vetted vendor controls (Mass.gov 201 CMR 17.00 PDF).
3. Health, substance-use, and shelter records (HIPAA, 42 CFR Part 2, VAWA): Protects MassHealth, DMH, DPH, and domestic-violence shelter records (see our small nonprofit AI policy for client, shelter, and grant records).
4. Tax, wage, and criminal-justice records (M.G.L. c. 62C, s. 21; CJIS; CORI): DOR tax files, EOLWD wage records, and CORI/CJIS data carry statutory penalties and cannot touch unapproved external endpoints.
5. Commonwealth email rule: State personnel opening approved work GenAI accounts must register with their official @mass.gov email, never personal email, and never reuse network passwords (see what not to paste into an AI tool at work).

Approved agency testing runs through two sanctioned paths: Secretariat / Agency Chief Technology Officer (CTO) procurement sign-off (logged in the mandatory Generative AI Inventory) and the EOTSS AI Sandbox Program, a walled cloud testing environment (Mass.gov Policy PDF).

Why are AI meeting notetakers barred without counsel approval, and how must AI content be labelled?

Two binding rules inside Section 5 of the AI.001 v1.1 PDF catch consultants off guard because neither appears on the short Mass.gov summary page: a legal-counsel gate on AI recording or transcription, and mandatory conspicuous labelling paired with human fact-checking.

First, no unapproved AI recording or transcription bots. AI.001 v1.1 states that personnel must not use automated recording or transcription tools unless approved by agency legal counsel or authorized by an agency recording policy (Mass.gov Policy PDF). That covers Otter.ai, Fireflies.ai, Read.ai, Fathom, and unapproved Zoom or Teams AI transcription toggles. In Massachusetts, M.G.L. c. 272, s. 99 bars secret audio interception without all-party consent (see our Massachusetts all-party consent script for AI meeting notetakers), and verbatim transcripts create discoverable public records.

Second, conspicuous labelling and line-by-line verification. Personnel remain personally accountable for verifying every fact, primary citation, and copyright source before release, preventing fiascos like Deloitte Australia repaying the final installment of its AU$440,000 contract (The Register, Oct 6, 2025). Any AI-generated or AI-modified content must carry a conspicuous label disclosing AI involvement and human review.

How does the Massachusetts Public Records Law (M.G.L. c. 66, s. 10) treat AI prompts, logs, and drafts?

Under M.G.L. c. 66, s. 10 and M.G.L. c. 4, s. 7(26), records made or received by a state agency or contractor performing a core governmental function are presumptively public within 10 business days, unless a statutory exemption applies (MA Legislature c. 66, s. 10).

Four AI artifacts routinely enter public-records scope: (1) Agency Generative AI Inventory entries and CTO approvals, (2) enterprise prompt templates and Sandbox logs (redacted for c. 66A privacy or c. 4, s. 7(26)(n) security exemptions), (3) counsel-approved AI meeting transcripts, and (4) AI.001 deliverable disclosure labels inspected by reporters or rival bidders.

Worked contract example (assumptions labelled): A 22-person Boston research firm delivers a $320,000 EOHHS or EOLWD evaluation (40 interviews, 12,000 de-identified participant rows, 85 cited sources):

• Unvetted path: An analyst runs Fireflies on six calls without counsel sign-off, uploads participant ZIP/birth-date CSVs into a $20/month personal chatbot, and pastes 18 unchecked AI citations. Risk: s. 99 and AI.001 violations, c. 66A breach review, and holdback of a $64,000 final payment (assuming a standard 20% milestone holdback rate on contract schedules) if fabricated citations surface.
• Compliant path (~5 hours total, ~$425 labor at $85/hour): Confirm approved tools with the contract manager (30 min), keep meeting bots off ($0), run R/Python locally on encrypted drives, verify all 85 primary URLs by hand (3.5 hours), add the AI.001 disclosure line (15 min), and brief staff (45 min).

Why AI.001 has a training gap, and how teams close it in 60 minutes

AI.001 v1.1 holds every employee, intern, and vendor personally accountable for data security, citations, and labelling, yet includes no mandatory staff training requirement (Mass.gov Policy PDF). Bureau chiefs and contractor leads can close that gap in one lunch hour using our free 60-minute AI literacy session on the five DOL skill areas plus the ed.cafe Compliance Card below.

The ed.cafe Massachusetts Commonwealth Contractor & Staff GenAI Pre-Work Compliance Card

Attach the ed.cafe Massachusetts Commonwealth Contractor & Staff GenAI Pre-Work Compliance Card to Commonwealth task orders and onboarding packets. The ed.cafe Compliance Card puts AI.001 v1.1 checks, copy-ready labels, and subcontractor terms on one page.

THE ED.CAFE MASSACHUSETTS COMMONWEALTH STAFF & CONTRACTOR GENAI CARD (AI.001 v1.1)
Publisher: ed.cafe by No Worker Left Behind (Boston 501(c)(3), EIN 88-3268312)
Reference: MA EOTSS Policy AI.001 (v1.1, eff. Jan 31, 2025) | Not legal advice.

PART 1: 7-POINT PRE-WORK GATE (CHECK BEFORE ANY STATE TASK)
[ ] 1. SCOPE: Executive Branch staff, interns, consultants, contractors, vendors,
    and EOTSS/Mass.gov users are bound by AI.001 v1.1 today.
[ ] 2. CTO & INVENTORY GATE: Confirm Secretariat/Agency CTO approval (or EOTSS AI
    Sandbox onboarding) and agency Generative AI Inventory logging.
[ ] 3. ACCOUNT EMAIL: State staff must register approved tools with @mass.gov
    email (never personal email) and unique passwords.
[ ] 4. ZERO PUBLIC-AI PII LEAKAGE: Never paste M.G.L. c. 66A personal data, 201
    CMR 17.00 SSN/ID/bank numbers, MassHealth/DMH, DOR tax, CJIS/CORI, or drafts
    into consumer AI. Consult legal ([email protected]) & security before
    using PII in approved tools; use minimum necessary PII only.
[ ] 5. NO UNAPPROVED RECORDING BOTS: Keep Otter, Fireflies, Read.ai, Zoom AI, and
    Teams transcription OFF unless approved in writing by agency legal counsel
    AND announced for M.G.L. c. 272, s. 99 all-party consent.
[ ] 6. HUMAN FACT CHECK: Open and verify every statute, case, number, and URL.
[ ] 7. PUBLIC RECORDS (M.G.L. c. 66, s. 10): Assume enterprise prompts, inventory
    logs, and approved transcripts are producible within 10 business days.

PART 2: COPY-READY AI.001 CONSPICUOUS DISCLOSURE LINES
- External Report / Memo: "Generative AI Disclosure (MA Policy AI.001): Portions
  of this document were [drafted/copy-edited] using [Approved Tool]. All facts,
  data, and primary citations were verified by [Name, Title, Org] on [Date]."
- Slide Deck / Handout Footer: "Prepared with [Approved GenAI Tool] assistance
  and human-verified for accuracy by [Agency/Vendor Team] per MA Policy AI.001."
- Code / PR Header: "AI-Assisted Code (MA EOTSS AI.001): Generated with [Approved
  Tool]; logic, license, and security verified by [Engineer] on [Date]."

PART 3: SUBCONTRACTOR DELIVERABLE CITATION & AI CLAUSE
"Subcontractor shall comply with MA EOTSS Policy AI.001 (v1.1 or successor), bar
non-public Commonwealth or M.G.L. c. 66A data from unapproved AI tools, prohibit
AI recording/transcription without prior written Agency Legal Counsel approval,
verify every citation against primary sources, and conspicuously label AI outputs."

Where this stops being true

1. Non-Executive constitutional branches: The Legislature, Judiciary, Attorney General, Secretary of the Commonwealth, Treasurer, Auditor, and autonomous authorities enforce independent IT governance unless AI.001 attaches via contract or EOTSS hosting.
2. Stricter agency or federal data rules: AI.001 sets the floor; IRS Pub 1075, FBI CJIS, CMS MARS-E, or EOHHS contracts can ban GenAI outright on specific datasets.
3. Version updates & privacy bills: Check Document Control on the Mass.gov AI.001 PDF for revisions after v1.1 (Jan 31, 2025), and track pending privacy conference bill S.2619/H.5479 in our Massachusetts Data Privacy Act prep guide.
4. Not legal advice: Operational reference from ed.cafe at No Worker Left Behind; direct official questions to secretariat counsel, your contract manager, or [email protected].

Questions people ask

Key terms

• AI Sandbox Program (EOTSS): The walled Commonwealth cloud environment where Executive agencies pilot generative AI tools before production procurement.
• Enterprise Generative AI Policy (AI.001 v1.1): The binding EOTSS standard effective January 31, 2025 governing Executive branch staff, interns, contractors, and vendors.
• Fair Information Practices Act (M.G.L. c. 66A): The Massachusetts statute barring agencies and data contractors from unauthorized dissemination of identifiable personal data.
• Generative AI Inventory: The mandatory agency registry under AI.001 tracking approved generative AI tools, use cases, and CTO sign-offs.
• Massachusetts Public Records Law (M.G.L. c. 66, s. 10): The statute requiring inspection or copies of non-exempt public records within 10 business days.
• Minimum necessary PII: The AI.001 rule limiting approved inputs to the smallest personal data fields strictly needed for the task.

Sources

1. Massachusetts EOTSS, "Enterprise Use and Development of Generative AI Policy (AI.001, v1.1)" (Jan 31, 2025): Mass.gov Policy PDF
2. Massachusetts EOTSS, "Policy Advisory: Enterprise Generative AI Policy (Web Summary)" (2025): Mass.gov Advisory
3. The Register, "Deloitte to refund Australian govt over AI errors in AU$440K report" (Oct 6, 2025): The Register
4. Massachusetts General Court, "M.G.L. c. 66A: Fair Information Practices Act": MA Legislature c. 66A
5. Massachusetts General Court, "M.G.L. c. 66, s. 10: Public Records Law": MA Legislature c. 66, s. 10
6. Massachusetts General Court, "M.G.L. c. 272, s. 99: Wiretap Statute": MA Legislature c. 272, s. 99
7. Massachusetts OCABR, "201 CMR 17.00: Standards for Protection of Personal Information": Mass.gov PDF
8. IBM Newsroom, "2026 Cost of a Data Breach Report (n = 602)" (Jul 29, 2026): IBM