MA H5114

Manufacturers of internet-connected consumer devices made on or after January 1, 2026 must disclose a minimum guaranteed support period for technical support, security updates, and bug fixes at point of sale, on packaging, and on product webpages.

Manufacturers cannot shorten the disclosed support period after sale and must notify consumers at least 6 months before end-of-life about features that will stop working and associated cybersecurity risks.

Internet service providers that supply or lease connected devices must either continue providing security updates for active products or replace end-of-life devices at no cost to consumers with comparable products that receive updates.

Violations constitute unfair or deceptive practices under Chapter 93A, with enforcement authority granted to the Attorney General.

Consumers who suffer financial losses from violations may sue to recover actual damages including repair/replacement costs, consequential damages, lost income, and attorney's fees.