Generative artificial intelligence (“GenAI”) is often praised for its ability to improve work output and business efficiency. These efficiencies, however, often come with tradeoffs and unknown (or unintended) consequences. There is presently a significant push for companies to incorporate GenAI into their business practices because of a fear of falling behind. Before doing so, Massachusetts companies should be aware of the legal implications and risks associated with GenAI integration. This article serves to inform business owners of what to know and best practices for using AI in the workplace.
The Hallucination Problem
GenAI platforms such as ChatGPT, Claude, Copilot, and Gemini process complex requests from users and provide substantive, thorough, and detailed output. However, there is an inherent issue: sometimes (indeed, many times), that output is wrong.
It is important to note that these Large Language Models (or “LLMs”) are word predictors. When utilizing an LLM, a user provides a prompt requesting an output. In response, the LLM sorts through its dataset and, using a proprietary algorithm, provides an output that is based upon its prediction as to what words should be used to respond to the prompt. There may be instances, however, when the LLM does not have enough information or source material to provide a verifiable response. For example, an LLM may know what a statute looks like and how it is written as well as how to cite to a statute, but it may not have in its dataset the actual statute. If the user asks for an interpretation of, say, a Massachusetts statute on the legality of wearing white after Labor Day, the LLM may provide a response that looks and reads like a real statute even though (much to the chagrin of you fashionistas), no such statute exists. When GenAI provides this fabricated information, it is often referred to as a hallucination.
Businesses must consider this when relying on GenAI models to answer business questions or to draft documents or correspondence with employees, clients, or consumers. If your company is already using GenAI, then it is imperative that employees are instructed (and, if possible, trained) to verify any GenAI output through reliable independent sources before relying on the information for any work functions or client matters.
Employment Decisions
Many companies utilize AI systems to assist in finding and hiring talent or in making employment-based decisions for promotions. GenAI platforms have the capability to greatly assist businesses in reviewing a large amount of data (including resumes and performance reviews) in a short period of time and can significantly streamline this process. These efficiencies, once again, come with significant risks, including bias and potential discrimination.
Because AI tools are taught based on data input into the system, the tool can become biased in employment decisions if fed non-diverse data, even unintentionally. Under the Massachusetts Anti-Discrimination Law, G.L. c. 151B §4, employers are prohibited from discriminating on the basis of a legally protected characteristic. If a company is accused of hiring, promoting, or firing employees in a discriminatory manner through its use of GenAI, that company cannot assert as a defense that the decision was made by an algorithm or GenAI platform. The decision to use that GenAI system rested with the company, and therefore any liability associated with its use falls on the business as well. Businesses using GenAI systems must ensure that the algorithms do not create a disparate impact on hiring decisions. Companies should implement and conduct thorough and frequent audits of algorithms and train employees involved in employment-related decisions on recognizing the signs of inconsistent or potentially biased outputs from GenAI systems before making any employment-based decision. Using GenAI in employment decisions does not eliminate the need to keep humans involved in human resources.
If your company decides to use AI as part of hiring practices, it is wise to ensure that such use is disclosed to potential employees. Failure to do so could subject a business to liability. In an interesting case filed in the U.S. District Court for the District of Massachusetts back in 2024, a person applying for a job at CVS filed suit against the company alleging it violated the Massachusetts Lie Detector Statute. The plaintiff alleged that CVS used video-interviewing technology with AI to analyze candidates’ facial expressions, eye contact, and voice intonation and inflection to draw conclusions about cultural fit and competencies such as honesty and reliability. CVS never disclosed its use of the AI platform. The case ultimately settled, but not before the court issued an order finding that the plaintiff asserted a colorable claim for CVS violating the Lie Detector Statute by not disclosing its use of the AI system.
This case serves as a good reminder that disclosure is often in the best interests of a company when it comes to the use of algorithm-based decision-making tools in employment decisions.
Data Privacy & Security
Companies should pause before inputting any proprietary or confidential information into a GenAI platform. If your business does not have a licensing or service agreement with an LLM provider, then your employees are likely using these platforms through personal accounts. Many of these providers, including ChatGPT, Claude, and Gemini, state in their terms and conditions that they have the right to use any information input into their systems for purposes of training their models. In other words, once a person puts something into one of these chatbots, it could be used by that chatbot moving forward. Even if your company has a licensing or service agreement with a GenAI entity, the confidentiality of your data depends a great deal on the terms and conditions of your agreement.
Companies in Massachusetts also must ensure that their use of GenAI systems complies with the Standards for the Protection of Personal Information under Chapter 93H of the Massachusetts General Laws. This includes personal information such as addresses and Social Security numbers. Importantly, if a business’s GenAI system suffers from a security breach, that company is required to inform the affected Massachusetts residents, the Office of the Attorney General, and the Office of Consumer Affairs and Business Regulation as soon as practicable and without delay after the breach occurred.
Using these GenAI systems to streamline your business processes can save you and your company a great deal of time (and sometimes a great amount of money). But remember: once the data or information is provided to an LLM, the company may lose control over how it is used and who has access to it. Businesses should treat any information sent into a GenAI system as if it will become publicly available and should train employees on how to ensure their use of an LLM does not result in the inadvertent disclosure of confidential or proprietary information.
Consumer Protection
Companies using GenAI to interact with customers in Massachusetts should also ensure that proper guardrails exist. The Office of the Attorney General previously published an on the application of existing law in Massachusetts to the use of GenAI, including the Consumer Protection Act, G.L. c. 93A. This Advisory serves as a helpful guide to help businesses avoid and mitigate the regulatory risks associated with utilizing AI for business practices. Under Chapter 93A, Massachusetts consumers are protected from unfair and deceptive practices. This extends to the sale and use of AI. Businesses should avoid making unsubstantiated claims about the reliability, safety, performance, or condition of implemented AI systems. These misrepresentations may include, but are not limited to, claiming that the AI system is fully automated when some functionality depends on humans, untested claims that the AI functions with equal accuracy to a human, is superior to non-AI products, is free from bias, or is compliant with state and federal law.
Understanding and Training Are Key
It is understandable that businesses want to rush into the use of GenAI given the sales pitch these platforms provide about efficiencies and cost saving capabilities. This, combined with the fear of getting “left behind” by competitors’ use and implementation of GenAI has caused many companies to use these systems without fully understanding their abilities and associated risks.
It is not too late to take a step back and ensure your company uses GenAI in a way that benefits your business rather than exposing it to risk and liability. We at RIW are here to ensure that your company’s use of GenAI is safe, secure, and legally sound and that your employees are properly trained to meet today’s demanding needs while properly leveraging available technologies.
Adam Gutbezahl is a shareholder in the firm’s Litigation Department and its Commercial Real Estate, Construction Law, and Employment Law Groups, where he handles complex commercial, employment, land use, and real estate disputes with extensive jury and bench trial experience. He is also a recognized thought leader on Generative AI’s legal implications, publishing the monthly newsletter ChatAdamG on AI’s impact in the workplace. Adam can be reached at agg@riw.com or (617) 570-3502.
Devin Scarborough is a 2026 summer law clerk at the firm, where she has gained hands-on experience across both litigation and transactional matters, including construction, employment, M&A, banking, commercial real estate, and trusts and estates.Devin is a rising 3L at the University of Cincinnati Collee of Law where she is a member of the University of Cincinnati Law Review and an award winner for research and writing.
