# Session 3 Handout: Rules and Software

<p class="meta">FAST-07 Industry-Specific AI Applications for Massachusetts Sectors · 7formations · Instructor: Wadood Chaudhary · All examples fictional · Training, not legal advice</p>

## Why this session matters

Rules written for paper records and human decisions still apply when AI is involved. Regulators in Massachusetts have said so directly. At the same time, the software your industry already uses (EHR, ERP, claims, POS, WMS, construction project tools) is adding AI features, often switched on by default. This session turns your sector's rules into short, testable do/don't lines and gives you the questions to ask before an AI feature touches your data.

## Key concepts

### 1. Rules that already apply to AI

| Rule or guidance | What it means for AI use |
| --- | --- |
| **G.L. c. 93H and 201 CMR 17.00** | Personal information of MA residents needs a written security program and safeguards; breaches trigger notice duties. Applies to what you paste and to vendors you share data with. |
| **MA Attorney General advisory (April 2024)** | Existing consumer-protection, civil-rights, and data-privacy laws apply to AI, including misleading AI claims and discriminatory outcomes. |
| **HIPAA Privacy Rule** | PHI goes only into tools covered by a business associate agreement, using the minimum necessary. Removing a name is not de-identification. |
| **MA Division of Insurance Bulletin 2024-10** | Insurers remain responsible for decisions made or supported by AI and must govern, document, and oversee AI systems. |
| **ECOA / CFPB Circular 2022-03** | A lender using a complex model must still give specific, accurate reasons for an adverse action. |
| **OSHA safety program practices** | Safety content (toolbox talks, SOPs) must fit your safety program and be reviewed by a competent person. |
| **Food allergen practice (FDA's nine major allergens)** | Allergen statements come from recipes and suppliers, checked by the kitchen lead. |

### 2. Regulation to rule

A good do/don't line is **short, specific, and testable**: someone either did it or did not.

| Too vague | Testable |
| --- | --- |
| "Be careful with customer data." | "Never paste a name with an account, card, SSN, or license number into any AI tool." |
| "Use AI responsibly." | "Use only tools on the approved list; check the list before first use." |
| "Make sure outputs are good." | "A licensed adjuster reviews every AI-drafted claim letter before it is sent." |

Confirm your list with your compliance lead. This course is training, not legal advice.

### 3. What to ask a vendor about an AI feature

1. **Data:** What data does the feature use? Where is it stored and for how long? Is it used to train or improve models? Can we opt out at the account level?
2. **Testing:** Was it tested on businesses like ours? With what results? Can we see them?
3. **Control:** Can we review and edit outputs before they are saved or sent? Can an administrator turn it off? Is use logged?
4. **Responsibility:** What does the contract say about errors and data incidents?

Get the answers **in writing** before switching the feature on.

## Worked example: Cape Harbor Inn's "SmartReply" (fictional)

The reservation vendor emails: "Turn on SmartReply today. It learns from your guest conversations to personalize offers."

| Question | Vendor answer | Decision |
| --- | --- | --- |
| Training on our data? | "Yes, by default, to improve the model." | Opt-out required in contract before use |
| Offers to guests? | "It can suggest discounts." | Disable offers; manager approves any comp |
| Review before send? | "Optional." | Make review mandatory |
| Off switch? | "Admin setting." | Note who holds admin rights |

Result: pilot only after the opt-out is in writing and review is mandatory.

## Checklist: before you use an AI feature in industry software

- [ ] Data use, storage, retention, and training answered in writing.
- [ ] Opt-out confirmed if our data trains models.
- [ ] Outputs reviewable before they are saved or sent.
- [ ] Admin off switch and logging confirmed.
- [ ] Do/don't list applied to the feature's inputs.
- [ ] Compliance lead or owner signed off.

## Do and don't

| Do | Don't |
| --- | --- |
| Apply the list before you prompt | Check for violations only afterward |
| Ask vendors for results from comparable businesses | Accept "tested extensively" |
| Keep coverage, credit, and safety decisions with qualified people | Let a model's draft become the decision |

## Try this before session 4

Pick one task at your workplace for your use-case brief. Time it the current way at least three times. That is your baseline.