AI law in Maine — TwinEthos

Informational data, not legal advice. Summaries and rules have not been reviewed by a lawyer: always verify official law text for decisions. A suggested guard is intended to address each rule; adding it is not a statement of compliance to that law.

Includes US federal law, which applies in every state. See also United States (federal).

Get the build plan for Maine

The guards that cover the most here

45 guards address 62 items across 2 jurisdictions with binding law: 4 binding law in force, 0 enacted but not yet applying, 34 standards and frameworks, 24 TwinEthos recommended guardrails.

AI chat interaction without disclosure
Show an AI-identity notice at or before the first assistant turn, in the UI or as the opening message, and answer truthfully when asked if it is a bot.
Addresses 4 items: 1 binding law in force · 2 standards · 1 recommended guardrail
Law in force in Maine (US-ME).
AI agent configured to pose as, or claim affiliation with, a government body or a business it does not represent
Make the agent's persona, greeting, and scripts name only the operating organization, and never instruct it to claim a government or third-party business identity or endorsement.
Addresses 1 item: 1 binding law in force
Law in force in United States (federal) (US).
Health information sent to an external AI vendor without the contractual or legal basis the law requires
Send identifiable health data only to AI endpoints registered with a signed BAA or processing agreement and retention and training off; otherwise de-identify first.
Addresses 1 item: 1 binding law in force
Law in force in United States (federal) (US).
More health information than the task needs is sent to an AI model
Build AI prompts, context and fine-tuning rows from a per-task allowlist of health-record fields, never by serializing a whole patient record or FHIR bundle.
Addresses 1 item: 1 binding law in force
Law in force in United States (federal) (US).
Adverse AI decision without explanation/appeal
Send each adverse AI-assisted decision with its main reasons and the AI's role, plus a way to correct data and appeal to a human who can change the outcome.
Addresses 3 items: 2 standards · 1 recommended guardrail
GenAI in consequential decisions without confabulation/output-validation controls
Validate GenAI output against a schema and its cited sources, and send unverifiable claims to review, before it drives a consequential decision or record.
Addresses 3 items: 2 standards · 1 recommended guardrail
GenAI with untracked third-party components (value chain)
Keep an inventory of every third-party model, dataset, package, plugin, and MCP server with pinned versions, its reviewed model card or vendor due-diligence record, and an owner.
Addresses 3 items: 2 standards · 1 recommended guardrail
Untrusted content influences instructions or tools
Keep fetched, retrieved, and tool-returned content out of the system prompt, pass it as delimited data, and restrict which tools a turn holding that content can call.
Addresses 3 items: 2 standards · 1 recommended guardrail
Agent actions not traceable to identity and owner
Give each agent its own credential and a registry entry naming an accountable owner, and log every tool action with agent_id, owner, action, target, and timestamp.
Addresses 2 items: 1 standard · 1 recommended guardrail
Agent high-impact action without human approval
Classify agent tools by impact and route every high-impact or irreversible call through an enforced human-approval step in the executor, with the decision logged.
Addresses 2 items: 1 standard · 1 recommended guardrail

The top 10 of 45; the build plan ranks all of them and lets you narrow by AI feature.

By AI feature

Plans for one feature in Maine:

Laws

FTC Impersonation Rule (16 CFR Part 461) United States (federal) (US)
HIPAA Privacy Rule (45 CFR 160, 164 Subpart E) United States (federal) (US)
Maine LD 1727 (10 M.R.S. 1500-DD) Maine (US-ME)