AI Acceptable Use Policy & Governance for NH & MA Businesses

Almost everyone who calls us about AI governance wants one document, even when they do not use the term for it: an AI acceptable use policy telling staff which tools they may use and what they must never paste into one. That is two pages, not a program, and you can have it inside a month.

The part almost nobody covers is which rules reach a New Hampshire or Massachusetts business in the first place. It is less than you have probably been told, and one piece of it catches NH companies who have never heard of it.

Which rules actually reach a NH or MA business

Compliance is where IT providers do their worst selling, usually as vague warnings about “AI regulations” attached to a quote. The specifics matter, and they cut both ways.

New Hampshire has no AI law covering private businesses. HB 1725 would have established a Responsible AI Governance framework — an AI Council, consumer protections, a regulatory sandbox, and Attorney General enforcement with civil penalties reaching $200,000 per violation. The committee recommended it inexpedient to legislate and the House agreed in February 2026. It is dead. RSA 5-D covers how state Executive Branch agencies use AI, not how your company does. If a provider implies New Hampshire mandates an AI policy, that is a sales tactic.

Massachusetts named AI explicitly, and it reaches users, not just vendors. In April 2024 the Attorney General issued an advisory stating that existing Massachusetts law already applies to AI developers, suppliers, and users. Three pieces matter for a small business deploying tools rather than building them:

• Chapter 93A, the Consumer Protection Act, on unfair or deceptive practices — which the advisory extends to claims you make about an AI system’s reliability or freedom from bias.
• Chapter 93H and the data security standards under 201 CMR 17.00, on safeguarding personal information about Massachusetts residents.
• Chapter 151B, the anti-discrimination law, where an AI-influenced decision produces a discriminatory outcome in hiring or comparable areas.

And 201 CMR 17.00 attaches to the data, not the state line. This is the one that catches New Hampshire companies. Any business holding personal information about a Massachusetts resident is covered, wherever it sits, with no size or revenue exemption. So a Nashua or Salem firm with Massachusetts customers — or Massachusetts employees on payroll — needs a written security program that New Hampshire itself never asked for, and an AI tool quietly ingesting that data is squarely inside its scope.

Sector rules bind regardless of geography. A medical practice still answers to HIPAA, card payments still fall under PCI DSS, and firms fielding customer security questionnaires still need SOC 2 evidence. AI does not create a separate obligation there; it creates a new way to breach the one you already have.

We are not lawyers and none of this is legal advice. We will tell you which of it touches your business in a first conversation, for free.

Shadow AI is what you are really governing

The risk is rarely a deliberate policy violation. It is a well-meaning employee on a deadline.

Someone pastes a client list into a free chat tool to reformat it. Someone drops a patient summary in to shorten it. Someone uploads last quarter’s unreleased numbers to build a slide. None of them are being reckless — they are being efficient with a tool that is one browser tab away and has no warning label. That is why we run the usage audit before drafting anything: a policy written against imagined behavior regulates a company that does not exist.

The audit usually surfaces tools leadership had no idea were in play, and it changes what the policy needs to say. It also tells you something more useful than a compliance answer: which work your staff are trying to speed up. That is often where AI automation pays off, and a governance engagement is a cheap way to find it.

Where this service ends

Worth being blunt about the boundaries:

• We write policy; counsel reviews it. We identify which rules appear to apply and draft against them. For most small businesses the legal review that follows is a short one rather than a project, but it is not ours to skip for you.
• We cannot certify you to ISO/IEC 42001. The AI management system standard published in 2023 requires an accredited third-party body. We can align a framework to it and support the audit; the certificate is not ours to issue.
• We are not an AI vendor. We do not resell a platform, so the approved-tools list is not a product recommendation dressed up as a policy.
• We will not build a program you do not need. Two sanctioned tools and no regulated data means a page and a signature line, and we would rather say so than scope a project.

AI governance vs. the services next to it

Four pages here describe adjacent AI work, which is easy to confuse. The honest division:

Governance comes first in practice, because the other three all raise the question of what staff are allowed to feed a model. It is also the cheapest of the four to get wrong quietly.

What it costs

Governance-adjacent work sits inside the managed plans rather than being sold as a separate line:

• Standard, $100/user/mo — self-service template policies, cybersecurity risk assessment, identity and access management, real-time change documentation, and security awareness training.
• Premium, $125/user/mo — adds bi-annual simulated phishing, annual vulnerability scanning, and a monthly executive report.
• Enterprise, $150/user/mo — adds compliance audit support, advanced reporting for compliance, and a documented business continuity plan. This is the tier for businesses facing audits, security questionnaires, or regulated data.

Full inclusions are on the plans page. A bespoke framework build for a larger or heavily regulated environment is scoped as a project and quoted before you commit. We publish the plan numbers because comparison shopping a provider is close to impossible when nobody will put a figure in writing first.

Working with us in New Hampshire and Massachusetts

We are based in Tyngsboro, MA, which puts us inside the border zone this page keeps coming back to: onsite service within roughly 150 miles covers most of New Hampshire and Massachusetts, and a good share of our clients hold data on both sides of the line. Most are businesses between 1 and 100 employees in healthcare, legal, financial, manufacturing, and construction, where AI exposure is really a data-handling question with a compliance consequence attached.

Policy work pairs naturally with AI training, so the rules and the tools land together, and with vCISO if you want someone accountable for security decisions without hiring an executive.

If you want to know which AI tools are already running in your environment, the free cyber security audit covers that. Or get in touch and we will walk through which rules reach you before anyone talks about scope.