Connecticut AI Laws: PA 26-15 (SB 5) and What Starts (2027)

As of November 2026, Connecticut has no comprehensive high-risk AI act, but it has enacted Public Act 26-15 (SB 5, signed May 27, 2026), a multi-part AI and online safety law, as changed by Public Act 26-100 (HB 5222, signed June 2, 2026). Some of its sections are in force and others start in 2027. Connecticut also has Public Act 23-16 on state agency AI, privacy-law rules in Public Act 25-113, and synthetic intimate image laws.

Status as of November 4, 2026: The PA 26-15 sections dated October 1, 2026 are in force, including the frontier developer whistleblower section, the discrimination evidence rule, the AI layoff disclosure, provenance data and state agency use. So is the generative AI subscription notice in PA 26-100 sec. 46. AI companion duties start January 1, 2027. Employment notice duties reach technology deployed on or after October 1, 2027. SB 2, the high-risk AI bill, passed the Senate in 2024 and 2025 and did not pass the House.

This page covers Connecticut state law on artificial intelligence. Deepfakes and AI meeting recorders get short summaries here and have their own pages. For other states and the national picture, see our guide to state and federal AI laws.

Connecticut AI Laws at a Glance

Public Act 26-15 (SB 5): Connecticut's 2026 AI Act

Public Act 26-15 is titled "An Act Concerning Online Safety." Its bill history shows Senate passage April 21, 2026, House passage May 1, 2026, and the Governor's signature May 27, 2026. Some law-firm coverage calls it the CART Act.

It is a set of separate duties with separate dates, not one rule for AI systems. The Office of Legislative Research has a summary of the act.

The enacted text does not create an AI policy office, an AI learning laboratory or a new technology advisory board. Section 39, which limits social media recommendations for minors from January 1, 2028, concerns covered platforms rather than AI.

AI Companion Chatbots (Sections 4-6)

These duties are scheduled for January 1, 2027. An "artificial intelligence companion" is AI with a natural language interface that gives adaptive, human-like responses and "is able to sustain a relationship across multiple interactions."

The definition has exclusions. They include chatbots used only for listed business purposes such as customer service and not marketed to consumers as companions, limited video game chatbots, and voice-assistant devices that do not sustain a relationship across interactions.

Under section 5, an operator may not provide a companion unless it has a protocol that:

• Uses evidence-based methods to detect user expressions clearly indicating a risk of suicide, self-harm or imminent physical violence
• Institutes measures to prevent output that encourages that conduct
• Refers the user to resources including the 9-8-8 National Suicide Prevention Lifeline

The operator must post the protocol on its website and take reasonable measures to stop the companion from claiming to be human. If a reasonable person would believe they were talking with a human, the operator must also give notice. That notice is either static and visible throughout, or given at the first interaction in any 24-hour period and then at least hourly for a user under 18, or at least every three hours for an adult.

Section 6 applies when an operator knows or has reason to believe a user is under 18. The operator must have measures that meet or exceed industry standards to prevent the companion from encouraging self-harm, offering mental health services (with a limited exception), engaging in romantic or sexually explicit interaction, or using listed manipulative engagement techniques. It must also make screen time and account tools available to minors and their parents.

A section 5 violation is an unfair or deceptive trade practice "enforced solely by the Attorney General," and section 5 says it provides no basis for a private right of action. Section 6 likewise says it is enforced solely by the Attorney General.

Frontier Developers and Whistleblowers (Section 2)

Section 2 has been in force since October 1, 2026. It is a whistleblower section. We found no safety framework, publication or incident report duty in it.

A "frontier developer" is a person doing business in Connecticut who trains, or intends to train, a foundation model using more than 10^26 integer or floating-point operations. A "large frontier developer" also had, with its affiliates, annual gross revenues above $500 million in the most recently completed calendar year.

The section defines "catastrophic risk" around a foreseeable and material risk that a frontier model will materially contribute to the death of or serious injury to more than 50 people, or more than $1 billion in property damage or loss, from a single incident of listed kinds.

The duties are:

• A frontier developer may not adopt rules or contracts that allow retaliation against employees who engage in activity protected by section 31-51m, or against covered employees who report a specific and substantial danger to public health or safety due to a catastrophic risk
• Every frontier developer must give covered employees notice of their rights
• By January 1, 2027, a large frontier developer must maintain a reasonable internal process for anonymous reports, and share reports with officers and directors at least quarterly, except with an officer or director accused in the report

A violation carries a civil penalty of up to $1,000 per violation. The Attorney General may sue in Hartford superior court for the penalty and for injunctive or equitable relief.

AI in Hiring, Employment and Layoffs (Sections 7-14 and 26)

Connecticut has three employment rules. The evidence rule and a layoff disclosure are in force. The notice duties are scheduled.

In force since October 1, 2026 (sections 13-14). The use of an automated employment-related decision technology "shall not be a defense against a complaint" alleging a discriminatory practice. The commission or court "may consider evidence of anti-bias testing or similar proactive efforts." The act does not require a bias audit.

In force since October 1, 2026 (section 26). An employer that serves written notice on the state Labor Department under 29 USC 2102(a), the federal WARN Act, must also disclose to the department, in the form and manner the Labor Commissioner prescribes, whether the layoffs are related to its use of artificial intelligence or another technological change. The section states no penalty of its own.

Scheduled (sections 7-12). These sections took effect October 1, 2026, but the duties reach technology deployed on or after October 1, 2027.

The statutory term is "automated employment-related decision technology": technology that processes personal data and uses computation to generate output "that is a substantial factor used to make or materially influence an employment-related decision." Everyday software such as word processors and spam filters is excluded insofar as it does not make or materially influence such a decision. Systems used incidentally are excluded too.

An "employment-related decision" covers hiring, promotion, discipline, discharge and listed other decisions. It excludes nonmaterial changes in tasks, hours or assignments, and decisions on workplace health and safety, scheduling and planning, or productivity monitoring.

From that date, a deployer must:

• Disclose in plain language that an employee or applicant is interacting with the technology, unless a reasonable person would find that obvious
• Give written notice before the decision is made, stating that it deployed the technology, the purpose and the nature of the decision, the trade name, the categories of personal data and how they will be assessed, the sources of that data, and contact information

A developer must supply the information the deployer needs if the technology was advertised, marketed, configured, contracted for, sold or licensed to materially influence such a decision. A developer may assume the deployer's duties by contract. Trade secrets need not be disclosed, but a person withholding information must send a notice saying so and giving the basis.

Sections 7-12 give no right to appeal or to human review. Only the Attorney General enforces them, and the act provides no private right of action. For violations on or before December 31, 2027, the Attorney General may first give notice of a curable violation, with 60 days to cure.

Provenance Data in AI Content (Section 15)

Section 15 has been in force since October 1, 2026. A "covered provider" produces a generative AI system that has more than one million users per month and is publicly accessible to consumers for personal use. Government agencies are excluded.

"To the extent commercially and technically reasonable," a covered provider must include provenance data in audio, image or video content its system creates or materially alters. It must also use reasonable methods, including the Coalition for Content Provenance and Authenticity standard, to make that data hard to remove.

The section does not apply to business-to-business uses or to products that solely provide video game or interactive experiences, among other exclusions. Only the Attorney General enforces it, with no private right of action. It is not a general labeling rule for AI text.

AI in Connecticut State Agencies (Section 38)

Section 38 has been in force since October 1, 2026. A state agency may not use AI technology for a function related to delivering a public assistance benefit, or one that will have a material impact on individuals' rights, civil liberties, safety or welfare, unless the use complies with Office of Policy and Management and Department of Administrative Services policies. The same condition applies to procurement.

An agency authorized to buy AI technology must complete an impact assessment and post it on its website at least 60 days before deployment. The definition leaves out "any cybersecurity tool, data analytics tool or system where artificial intelligence is incidental and not determinative."

Studies and Programs in the Act

• Sandbox plan (section 3): From July 1, 2027, the economic development commissioner must plan an AI regulatory sandbox program, with recommendations by January 1, 2028. This is a plan, not a sandbox.
• Legislative leaders' fellows (section 16): Any legislative leader may ask for a Connecticut Academy of Science and Engineering fellow to evaluate business adoption of AI and related questions, with a report by January 1, 2027.
• Connecticut AI Academy (section 17): To be established by December 31, 2026, on behalf of Charter Oak State College, with courses for people aged 13 to 20 and for small businesses and nonprofits. Sections 19-21 add agency notices about it from January 1, 2027.
• AI working group (section 18): Reports by February 1, 2027, and is charged with proposing legislation on general-purpose AI models and on social media signals for synthetic digital content, and with a technology court proposal.
• Attorney General technology fellowship (section 35): A pilot program through June 30, 2029.
• Comptroller (section 32): May serve on a steering committee for an AI health equity competition in fiscal year 2027. That is permission, not a mandate.

Public Act 26-100: What It Changed in SB 5

Six days after SB 5 was signed, PA 26-100 repealed two of its sections. Section 67 reads: "Sections 1 and 33 of public act 26-15 are repealed." A summary describing those sections as enacted is out of date.

Subscription notice (now PA 26-100 sec. 46, in force since October 1, 2026). No "subscription-based provider" may start or renew a subscription, or collect a fee for one, unless it gave written notice of the key terms and the consumer gave written notice of accepting them. The term covers a person producing a generative AI system with more than one million users per month that is publicly accessible to consumers for personal use, and offering it by subscription. The section says such a system "means any technology that uses machine learning to generate images, audio or video" and "includes, but is not limited to," systems using deep learning, natural language processing or other computational techniques of similar or greater complexity. The definition does not name text generation, and the Office of Legislative Research describes it as image, audio and video technology, but the required notice covers limits "on tokens." The text does not settle whether a text-only product is covered. Government agencies are excluded.

The notice covers limits the provider may impose and any discretion to limit or reduce access or quality. Only the Attorney General enforces it, with no private right of action.

Independent verification pilot (now PA 26-100 sec. 47, from October 1, 2027). The Department of Consumer Protection must, within available appropriations, run a pilot on independent third-party verification of AI models. The pilot ends March 31, 2031. Verification evidence is admissible solely in a private civil action for personal injury or property damage caused by an AI model, within the verification's approved scope.

Connecticut Data Privacy Act: AI and Profiling (PA 25-113)

The Connecticut Data Privacy Act is a privacy law, not an AI law. PA 25-113 (SB 1295, signed June 24, 2025) reaches AI through two routes, both operative in 2026.

Who is covered. Since July 1, 2026, the act applies to persons doing business in Connecticut, or targeting its residents, who in the preceding year processed personal data of at least 35,000 consumers (excluding payment-only data), who process consumers' sensitive data, or who offer consumers' personal data for sale. Exclusions include state and local government bodies, nonprofit organizations, institutions of higher education, HIPAA covered entities and business associates, and insurers.

A "consumer" is a Connecticut resident. The definition excludes an individual "acting in a commercial or employment context."

Training notice. A privacy notice must include "a statement disclosing whether the controller collects, uses or sells personal data for the purpose of training large language models." The term is large language models, not AI in general.

Profiling rights. A consumer may opt out of "profiling in furtherance of any automated decision that produces any legal or similarly significant effect concerning the consumer." After such a decision, the consumer may, if feasible, question the result, be told the reason, and review the personal data used. If the decision concerned housing, the consumer may also correct incorrect data and have it reevaluated. PA 26-64 restated these rights effective October 1, 2026.

Impact assessments. Controllers must assess profiling for such decisions. The requirement applies to activities created or generated on or after August 1, 2026.

Surveillance Pricing and Facial Recognition

These two laws do not use the words "artificial intelligence," but they reach automated data practices.

Surveillance pricing (PA 26-130 sec. 11, from July 1, 2027). The law defines surveillance pricing as a customized price based, in whole or in part, on personal data collected through technology such as biometric monitoring, cameras, device tracking or sensors, by the person setting the price or acquired from a third party.

A retail seller or third-party delivery service may not engage in it, subject to exceptions that include discounts and cost-based or supply-and-demand differences. A person doing business in Connecticut who advertises online a price set this way, other than a discount or the bona fide market price, must state "THIS PRICE WAS INCREASED USING YOUR PERSONAL DATA" or a substantially similar disclosure, and must tell consumers their rights under section 42-518.

Licensed insurers and certain credit decisions are exempt. Only the Attorney General enforces it, with no private right of action.

This section went through three versions in one session. PA 26-64 sec. 11 was repealed by PA 26-100 sec. 66, and PA 26-100 sec. 44 was repealed by PA 26-130 sec. 19, signed June 4, 2026. Dates of October 1, 2026 and February 1, 2027 for this law come from those two repealed versions. The second reached retail sellers only for in-person sales; the current text has no such limit.

Facial recognition (PA 26-100 sec. 45, in force since October 1, 2026). A controller using facial recognition on its premises for security or fraud purposes must match only against a database it maintains itself. It must also post signs at each entrance, other than employee-only areas, with a link or QR code to its policy, unless it has the consumer's consent in the course of a commercial transaction.

Connecticut Regulators: Attorney General and Insurance

Attorney General memorandum. On February 25, 2026, Attorney General William Tong released a memorandum on how existing law applies to AI, covering civil rights laws, privacy and data security laws, the Connecticut Unfair Trade Practices Act and antitrust laws. It is the office's guidance, not a new law.

Insurance Department Bulletin MC-25. Bulletin MC-25, dated February 26, 2024, tells insurers licensed in Connecticut that decisions made or supported by AI systems must comply with insurance law. It updates and replaces an April 20, 2022 notice. Domestic insurers must complete an Artificial Intelligence Certification by September 1 each year. The bulletin states the regulator's expectations under existing law.

AI in Connecticut State Government (PA 23-16)

PA 23-16 (SB 1103, approved June 7, 2023) requires the Department of Administrative Services to inventory state agency systems that employ AI each year. Since February 1, 2024, no state agency may implement such a system without an impact assessment. The Judicial Department has its own inventory duty.

PA 26-15 sec. 37 amended the inventory section. The next inventory is due by December 31, 2026, with added fields on impact assessments, personal information and known risks, and it must be published on the state's open data portal.

The act's working group was temporary. It ended on submitting its report or on February 1, 2024, whichever was later.

Connecticut Deepfake Laws (PA 25-168, PA 26-55)

PA 25-168 sec. 261, in force since October 1, 2025, makes it a crime to intentionally disseminate an intimate synthetically created image of a person without consent, knowing it is synthetic and intending viewers to be deceived, where the person suffers harm. It is a class D misdemeanor at the base grade. It reaches a class D felony only with dissemination to more than one person through an interactive computer or similar service plus intent to harm.

PA 26-55, in force since October 1, 2026, adds a civil action against a person who knowingly disseminates such an image with intent to harm, within two years of discovery. Covered platforms must remove images within 48 hours of a valid request, with Attorney General penalties of up to $25,000 per day. Details are on our Connecticut deepfake laws page.

AI Note-Takers and Recording in Connecticut

Connecticut requires everyone's consent only for phone calls, and that rule is enforced civilly. For how that applies to meeting bots, see our Connecticut AI meeting recording laws page.

How Federal AI Policy Affects Connecticut

As of November 4, 2026, we found no federal statute in the public laws of the 119th Congress that sets general rules for private AI systems or generally preempts state AI laws. In December 2025, Executive Order 14365 directed federal agencies to challenge or discourage state AI laws the administration views as conflicting with national policy, and called for a federal framework from Congress. The order itself does not declare any state law invalid. See our state AI law preemption tracker.

Connecticut AI Bills That Did Not Pass: SB 2 and SB 86

SB 2 (2024 and 2025). The high-risk AI bill passed the Senate both years and was not taken up in the House. The 2025 bill history shows Senate passage May 14, 2025, and a last action of "Favorable Report, Tabled for the Calendar, House" on May 16, 2025. SB 2 of 2026 is an unrelated bill.

SB 86 (2026). The Governor's bill on "innovations in and the responsible use of artificial intelligence" shows a last action of April 2, 2026, tabled on the Senate calendar.

Enacted instead: SB 417. Special Act 26-23, signed June 2, 2026, requires the Department of Economic and Community Development to plan an AI small business program and report by January 1, 2027. It creates a plan, not the program.

We searched the text of all 151 public acts and 34 special acts on the General Assembly's list of 2026 acts, searching for artificial intelligence, automated, algorithm, machine learning, chatbot and related terms, as of November 4, 2026. Our search of 2025 acts covered named bills only, and we did not check for special sessions.

What Changes in Connecticut AI Law in 2027

These dates come from the acts named above, as read on November 4, 2026.

We did not check for 2027 bills. The working group's report is the named channel for new proposals, and any bill it leads to would be a proposal until enacted.

This page is general legal information about Connecticut law as of November 4, 2026, not legal advice. Whether a law applies to a particular person or business depends on the facts, so consult a lawyer licensed in Connecticut for advice about your situation.

More Connecticut Laws

Explore other Connecticut legal guides on Recording Law:

• Connecticut Data Privacy Laws
• Connecticut Biometric Privacy Laws
• Connecticut Data Breach Notification Laws
• Connecticut Surveillance Camera Laws
• Connecticut Background Check Laws
• Connecticut Whistleblower Laws
• Connecticut Sexting Laws
• Connecticut Medical Records Retention Laws
• Connecticut Deepfake Laws
• Connecticut AI Meeting Recording Laws

Frequently Asked Questions

Does Connecticut have an AI law?

Yes, several targeted ones, and no comprehensive high-risk AI act. The broadest is Public Act 26-15 (SB 5), signed May 27, 2026, as changed by Public Act 26-100. It covers AI companions, frontier developer whistleblowers, employment technology, AI-related layoffs, provenance data and state agency use, and start dates vary by part.

What is Connecticut SB 5?

SB 5 became Public Act 26-15, An Act Concerning Online Safety, signed May 27, 2026. Parts took effect October 1, 2026, AI companion duties start January 1, 2027, and employment notice duties reach technology deployed on or after October 1, 2027. PA 26-100 repealed and replaced its sections 1 and 33.

Did Connecticut SB 2 pass?

No. The high-risk AI bill passed the Senate in 2024 and 2025 and was not taken up in the House. The 2025 version was last tabled on the House calendar on May 16, 2025. SB 2 of 2026 is an unrelated bill.

When do Connecticut's AI chatbot rules take effect?

January 1, 2027. PA 26-15 secs. 4-6 require operators of AI companions to have a self-harm protocol with a 988 referral and a not-human notice where a reasonable person would think otherwise, plus added protections when the operator knows or has reason to believe a user is under 18. Customer service chatbots not marketed as companions are excluded. Only the Attorney General enforces these sections.

Does Connecticut regulate AI in hiring?

Yes, in three parts. Since October 1, 2026, using an automated employment-related decision technology is not a defense to a discrimination complaint, anti-bias testing evidence may be considered, and employers giving federal WARN Act notice must tell the state Labor Department whether the layoffs relate to AI or another technological change. Written notice duties reach technology deployed on or after October 1, 2027. The act requires no bias audit, gives no appeal right, and gives no private right of action under its notice sections.

Can I sue under Connecticut's AI law?

The notice, companion, provenance and subscription sections are enforced solely by the Attorney General. A person may still bring a discrimination complaint under existing law, where use of the technology is not a defense. PA 26-55 gives a private civil action over synthetic intimate images.

Does Connecticut require AI labels?

Not in general. PA 26-15 sec. 15 requires large generative AI providers to include provenance data in audio, image and video content to the extent commercially and technically reasonable. It covers systems with more than one million users per month that are publicly accessible for personal use. The legislative working group is charged with proposing a rule on social media signals for synthetic content.

Does Connecticut have a frontier AI safety law?

It has a frontier whistleblower section, PA 26-15 sec. 2, not a safety framework law. It protects covered employees and requires large frontier developers, those above $500 million in annual gross revenue, to have an anonymous reporting process by January 1, 2027. Penalties reach $1,000 per violation, enforced by the Attorney General.

Can Connecticut consumers opt out of AI decisions?

Under the Connecticut Data Privacy Act, a consumer may opt out of profiling in furtherance of any automated decision with a legal or similarly significant effect, and may question the result if feasible. The act applies only to covered controllers and excludes nonprofits, higher education, insurers and others. Its definition of consumer excludes people acting in a commercial or employment context.

Is surveillance pricing banned in Connecticut?

From July 1, 2027, PA 26-130 sec. 11 bars retail sellers and third-party delivery services from surveillance pricing, subject to exceptions including discounts and cost differences. A person doing business in Connecticut who advertises such a price online must display the statutory disclosure or a substantially similar one unless the price is a discount or the bona fide market price. Licensed insurers and certain credit decisions are exempt.

Will Connecticut AI law change in 2027?

Yes, on scheduled dates. AI companion duties start January 1, 2027, the working group reports by February 1, surveillance pricing limits start July 1, and employment notice duties reach technology deployed from October 1, 2027. We did not check for 2027 bills.