What does Massachusetts AG AI Advisory (April 2024) say about AI in banking?

What are the key points of Massachusetts AG AI Advisory (April 2024)?

• Issued April 16, 2024 by Attorney General Andrea Joy Campbell to 'developers, suppliers, and users of artificial intelligence and algorithmic decision-making systems'; it defines AI using the definition in Executive Order 14110, section 3(b), and also covers generative AI.
• Chapter 93A, §2 and 940 CMR 3.00 et seq.: it is unfair or deceptive to falsely advertise the quality, value or usability of an AI system (940 CMR 3.02(2)) and to supply an AI system that is defective, unusable or impractical for the purpose advertised (940 CMR 3.02(4)(d)).
• 940 CMR 3.05(1): misrepresenting an AI system's reliability, performance, safety or condition is unfair or deceptive; the advisory's examples include claiming a system is fully automated when humans perform its functions, and untested claims that it is as accurate as a human, free from bias, not susceptible to malicious use, or compliant with state and federal law.
• 940 CMR 3.08(2): offering an AI system in breach of warranty is unfair or deceptive; the advisory's example is a system not robust enough to perform in a real-world environment as compared with a testing environment.
• 940 CMR 3.05(1) also reaches deepfakes, voice cloning and chatbots used to deceive a person into a business transaction or into giving up personal information; 940 CMR 3.16(3) and (4) make violating protective Massachusetts statutes or federal consumer-protection law, including the FTC Act, a c. 93A violation.
• G.L. c. 151B, §4: the Anti-Discrimination Law bars deploying technology that discriminates on a legally protected characteristic, including algorithmic decision-making that relies on discriminatory inputs and produces discriminatory results; violations of c. 151B may also be charged under c. 93A.
• G.L. c. 93H and 201 CMR 17.03 and 17.04: AI developers, suppliers and users must safeguard personal information used by AI systems and are expected to meet breach-notification requirements; c. 93H violations are enforceable under c. 93A (G.L. c. 93H, §6).
• Federal law: the Attorney General may enforce certain federal laws (12 U.S.C. §§5481, 5552); the advisory says ECOA adverse-action notices must give accurate and specific reasons even when AI models make the decision. The CFPB circular it cites for this point (Circular 2023-03) has since been withdrawn, but the duty is statutory (15 U.S.C. §1691(d)).

What did Massachusetts AG AI Advisory (April 2024) change for banks?

Before April 2024 Massachusetts had issued no AI-specific position, and lenders treated AI as a model-risk question under federal guidance. The advisory told the market that the Attorney General would use c. 93A, c. 151B and c. 93H against AI directly, with no new statute needed, and that marketing claims about an AI system's accuracy, fairness or legal compliance are themselves enforceable representations. Fifteen months later the same office settled with Earnest Operations LLC over AI underwriting, which shows the advisory is an enforcement roadmap rather than commentary.

What does the Massachusetts Attorney General's AI advisory require of banks and lenders?

The advisory, issued April 16, 2024, adds no new obligations; it says that Massachusetts's existing consumer-protection, anti-discrimination and data-security laws apply to artificial intelligence exactly as they apply to any other product. For a bank or lender that means five things in practice: do not overstate what an AI system can do (including claims that it is unbiased or legally compliant) without testing; make sure an AI system performs as advertised in the real world, not only in a test environment; do not deploy algorithms that rely on discriminatory inputs or produce discriminatory results under G.L. c. 151B, §4; protect the personal information AI systems use under G.L. c. 93H and 201 CMR 17.00; and give accurate, specific reasons for credit denials even when a model made the decision. The Attorney General enforces these through G.L. c. 93A, and the July 2025 Earnest Operations settlement shows the office will bring AI underwriting cases.

The advisory is deliberately framed as an application of settled law. It reminds the market that the Attorney General's consumer-protection regulations (940 CMR 3.00 and 5.00) already define product and service broadly, so an AI system sold to or used on consumers is within them, and that the 'novelty, complexity and claimed inscrutability' of AI does not take it outside c. 93A. Its list of unfair or deceptive practices is expressly non-exhaustive, and the office says it expects to amend or expand the advisory as the technology and the governing laws evolve.

For banks the most consequential passages are the ones on representations and on discrimination. A lender that tells customers, regulators or counterparties that a model is fair, accurate or compliant must be able to substantiate the claim, because an untested assertion is itself treated as a misrepresentation. And because c. 151B reaches practices that are 'fair in form, but discriminatory in operation', disparate-impact exposure does not depend on intent. The July 2025 Earnest settlement applied both ideas, alleging that the lender failed to test its models for disparate impact and sent inaccurate adverse-action notices, and it is covered in the Earnest Operations document.

The advisory sits alongside federal expectations rather than replacing them. A national bank or federal savings association answers first to its prudential regulator, and the advisory does not analyse preemption; state-chartered banks, licensed lenders and non-bank fintechs have the most direct exposure. Banks that buy AI from vendors should note that the advisory addresses suppliers as well as users, so contractual allocation of responsibility does not remove the bank's own c. 93A exposure as the user.

WHAT THIS MEANS IN PRACTICE

• Inventory every marketing, disclosure and vendor-contract statement about an AI system's accuracy, fairness, automation or legal compliance, and keep substantiation for each.
• Test models in conditions that resemble production before launch and monitor them afterwards, since the advisory treats real-world underperformance as a potential warranty and c. 93A problem.
• Run disparate-impact testing on credit models and the variables that drive them, and document the search for less discriminatory alternatives.
• Check that adverse-action notices name the actual principal reasons a model produced, not the nearest item on a drop-down list.
• Confirm AI systems that touch Massachusetts residents' personal information are covered by the written information security program required by 201 CMR 17.00.