Connecticut AI Laws and Regulation (2026)

Connecticut regulates AI through four enacted laws: Public Act 23-16 (SB 1103) requires state agencies to conduct impact assessments before deploying AI, Public Act 25-113 adds a large language model training disclosure to the CTDPA privacy notice starting July 1, 2026, Public Act 25-168 criminalizes synthetic intimate images, and Public Act 26-15 (SB 5), signed May 27, 2026, regulates AI companion chatbots, frontier AI developers, and automated employment-related decision technology, and creates a legislative AI working group.

Connecticut has emerged as one of the more active states in regulating artificial intelligence. After its 2024 and 2025 comprehensive AI bills (SB 2) stalled in the House, the state enacted a comprehensive AI statute in 2026: Public Act 26-15 (SB 5), signed May 27, 2026, layered on top of earlier targeted measures on government AI use, data privacy, and deepfake crimes.

This guide covers all enacted Connecticut AI laws, the outcome of the 2026 session's AI bills, and how federal policy may affect the state's regulatory landscape. If you have specific questions about how these laws apply to your situation, consult an attorney for advice specific to your situation.

Enacted AI Laws in Connecticut

Connecticut has passed several laws that directly address or significantly impact artificial intelligence, including a comprehensive private-sector AI statute enacted in 2026. Together, these laws create important obligations for businesses, government agencies, and individuals.

Public Act 23-16: Government AI Accountability (SB 1103)

Connecticut took its first major step into AI regulation with Public Act 23-16, signed by Governor Ned Lamont on June 7, 2023. This law established a framework for how state agencies may use artificial intelligence and automated decision-making tools.

The law requires state agencies to conduct impact assessments before deploying AI systems. Agencies cannot use AI systems that have been shown to result in unlawful discrimination or disparate impact against individuals or groups based on protected characteristics.

Key provisions of Public Act 23-16 include:

• Impact assessment requirements for any AI system used in government decision-making
• Anti-discrimination safeguards preventing deployment of AI tools shown to produce disparate impacts
• Inventory mandate requiring state agencies to catalog their use of AI and automated systems
• AI Bill of Rights working group tasked with developing ethical guidelines and best practices for AI governance

The law also created a permanent working group appointed by legislative leaders and the governor. This group includes representatives from AI development companies, academics with technology and public policy expertise, and members of the Connecticut Academy of Science and Engineering. Their mandate is to develop an AI bill of rights and recommend best practices for ethical AI use in state government and private-sector regulation.

Source: Connecticut General Assembly, Public Act 23-16

Public Act 25-113: AI Data Privacy Disclosures (SB 1295)

Governor Lamont signed Public Act 25-113 on June 24, 2025, amending the Connecticut Data Privacy Act (CTDPA). The privacy notice amendments take effect on July 1, 2026.

Under this law, businesses subject to the CTDPA must add one new item to their consumer-facing privacy notices: "a statement disclosing whether the controller collects, uses or sells personal data for the purpose of training large language models." That is the only AI-related notice element the act adds. The enacted text never uses the term "artificial intelligence," so the duty is tied to large language model training specifically, not to AI systems generally.

The amendments also broadened the CTDPA's applicability thresholds significantly. The law now applies to entities doing business in Connecticut that:

Additional AI-related provisions in Public Act 25-113 include:

• Impact assessments for controllers engaging in automated profiling that produces significant effects on consumers, effective August 1, 2026
• Opt-out rights allowing consumers to prevent automated systems from using their personal data for significant decisions in housing, insurance, healthcare, education, criminal justice, and employment
• Minor protections with categorical prohibitions on processing minors' data for targeted advertising or sale

Source: Connecticut General Assembly, Public Act 25-113

Attorney General's AI Guidance Memorandum

Connecticut Attorney General William Tong released a memorandum clarifying that existing state laws, including anti-discrimination statutes, consumer protection laws, and data privacy requirements, apply to artificial intelligence in the same way they apply to traditional business practices. The memorandum emphasizes that businesses cannot use AI as a shield against liability for discrimination in employment, housing, insurance, or lending based on protected characteristics.

This guidance is significant because it signals that Connecticut will enforce existing legal frameworks against AI-driven harm, even in the absence of AI-specific legislation.

Source: Connecticut Attorney General's Office

Deepfake Laws in Connecticut

Public Act 25-168: Synthetic Intimate Images

Connecticut criminalized the dissemination of AI-generated intimate images through Public Act 25-168, effective October 1, 2025. The law creates the crime of "unlawful dissemination of an intimate synthetically created image."

The offense is codified at Connecticut General Statutes section 53a-189d. Under Section 261(a) of the act, the prosecution must prove that the defendant intentionally disseminated an intimate image of another person, that the dissemination was without that person's consent, that the defendant knew the image was synthetically created and disseminated it intending viewers to be deceived into believing it was an actual depiction of that person, and that the depicted person suffered harm as a result. There is no threat offense: the statute reaches actual dissemination only. A statutory aggravator applies where the defendant also acquired, created, or had created the image with intent to harm the depicted person.

Penalties for Deepfake Intimate Images in Connecticut:

Two points are easy to get wrong. Wide distribution by itself does not make the offense a felony: the felony grade applies only when wide distribution is combined with the intent-to-harm aggravator in Section 261(a)(5). And the baseline offense is a class D misdemeanor, the lowest misdemeanor grade in Connecticut, not a class A misdemeanor. Sentence and fine ceilings come from Connecticut General Statutes sections 53a-35a, 53a-36, 53a-41, and 53a-42.

The section also states that it does not impose liability on the provider of an interactive computer service, information service, or telecommunications service for content provided by another person.

Source: Connecticut General Assembly, Public Act 25-168, Section 261

Public Act 26-55: Civil Remedies and Platform Takedowns

Connecticut added a civil layer on top of the crime in 2026. Public Act 26-55 (Substitute HB 5312), approved May 26, 2026 and effective October 1, 2026, does three things:

• Private right of action. A person harmed by unlawful dissemination of a synthetically created intimate image may sue in Superior Court for an injunction, economic and noneconomic damages including emotional distress, and punitive damages, with costs and reasonable attorney's fees available to the prevailing party. The action lies against someone who knowingly disseminated the image with intent to harm.
• Two-year discovery limitation. Suit must be brought within two years from the date the plaintiff discovered the dissemination. The court may also conduct proceedings in a way that protects the plaintiff's identity.
• Notice and removal by covered platforms. A covered platform must maintain a written process for a harmed individual or the Attorney General to request removal, must post a clear and conspicuous notice describing that process, and must remove the image and make reasonable efforts to remove copies within 48 hours of a valid request. The Attorney General may petition the Superior Court for civil penalties of up to $25,000 per day.

Source: Connecticut General Assembly, Public Act 26-55

Election-Related Deepfakes

Connecticut considered legislation requiring disclosure of AI-generated content in political communications as part of SB 2 in 2025. While SB 2 did not pass, the proposed provisions would have required disclosure of deceptive AI-generated political communications, with requirements focused on paid campaign advertisements where the creator intended to influence election results.

Public Act 26-15 did not enact a general synthetic-content labeling or detection mandate. Section 15, effective October 1, 2026, does require a covered provider of a generative AI system with more than one million users per month that is publicly accessible to consumers for personal use to include provenance data, to the extent commercially and technically reasonable, in audio, image or video content its system creates or materially alters; only the Attorney General enforces it. The act's AI working group is also charged with proposing legislation that would require social media platforms to signal when they are displaying synthetic digital content. Connecticut therefore still has no general statute requiring disclosure of AI-generated political content.

AI in Employment and Hiring

Connecticut does not yet have a standalone law specifically regulating AI in employment decisions, but several measures address this area.

CTDPA Automated Decision Protections

Under the amended CTDPA (Public Act 25-113), consumers have the right to opt out of automated decision-making systems that produce significant effects on them, including in the employment context. This means job applicants and employees in Connecticut can object to AI-driven decisions about hiring, promotions, or termination.

Controllers that use automated profiling to make decisions producing significant effects on consumers must conduct impact assessments under the law's provisions taking effect in August 2026.

SB 2's Employment Provisions (Did Not Pass)

The 2025 version of SB 2 would have created comprehensive obligations for employers using high-risk AI systems in employment decisions. Under the bill, if an AI system contributed to an adverse employment decision, the affected individual would have had:

• The right to an explanation of how the AI system reached its conclusion
• The right to know what personal data was used in the decision
• The right to correct personal data used in the decision
• The right to appeal the decision for human review

These provisions did not become law because SB 2 stalled in the House.

SB 5 Employment Provisions (Public Act 26-15)

Sections 7 through 12 of Public Act 26-15 create disclosure duties around "automated employment-related decision technology." They are not yet operative. The sections took effect October 1, 2026, but the duties attach only to technology deployed in Connecticut on or after October 1, 2027.

What the act actually requires:

• Developer to deployer information. A developer must give the deployer the information the deployer needs to meet its own duties, unless the technology was not marketed or licensed to materially influence employment decisions, or the developer has contracted to assume those duties.
• Interaction disclosure (Section 9). A deployer must disclose in plain language to an employee or applicant that they are interacting with the technology, unless a reasonable person would find it obvious.
• Pre-decision written notice (Section 10). Before an employment-related decision is made, the deployer must give written notice stating that it deployed the technology, the purpose of the technology and the nature of the decision, the technology's trade name, the categories and sources of personal data it will analyze and how that data will be assessed, and the deployer's contact information.
• Trade secret carve-out (Section 11). Nothing requires disclosure of a trade secret, but a person withholding information must say so and give the basis.

The act does not give applicants a right to appeal an automated employment decision or a right to human review. Under Section 12, a violation is an unfair or deceptive trade practice under the Connecticut Unfair Trade Practices Act "enforced solely by the Attorney General," and the act expressly provides no private right of action. For violations occurring on or before December 31, 2027, the Attorney General may issue a curable notice of violation with a 60-day cure period before bringing an action.

Insurance Industry AI Regulation

Connecticut has been proactive in regulating AI use in the insurance sector. The Connecticut Insurance Department requires all domestic insurers to complete an annual data certification confirming their use of Big Data and AI complies with applicable anti-discrimination laws.

This requirement predates much of the broader AI legislation, reflecting the insurance industry's early adoption of algorithmic underwriting and claims processing tools. Insurers must demonstrate that their AI systems do not produce discriminatory outcomes based on protected characteristics.

2026 Session AI Legislation

The Connecticut General Assembly's 2026 session ran from February 4 through May 6, 2026, and produced the state's first comprehensive AI law along with several other AI bills.

Public Act 26-15 (SB 5): Online Safety Act

SB 5 was the most comprehensive AI bill considered in the 2026 session. Governor Lamont signed it into law as Public Act 26-15 on May 27, 2026. The enacted act runs 74 pages and reaches AI subscriptions, frontier models, companion chatbots, employment technology, workforce training, and state study of AI policy.

Key provisions of the enacted act:

• Subscription disclosures (Section 1, effective October 1, 2026): A subscription-based AI provider may not enter or renew a consumer subscription without written notice of the key terms, including any limits it may impose and any discretion it holds to reduce access, quality, or functionality. Violations are a Connecticut Unfair Trade Practices Act matter enforced solely by the Attorney General, with no private right of action.
• Frontier developers and catastrophic risk (Section 2, effective October 1, 2026): Defines "catastrophic risk" around incidents causing death or serious injury to more than 50 people or more than $1 billion in property damage, and requires large frontier developers to maintain an anonymous internal reporting channel for covered employees by January 1, 2027, share reports with officers and directors at least quarterly, and give employees notice of their rights. Civil penalties run up to $1,000 per violation, enforced by the Attorney General.
• AI regulatory sandbox plan (Section 3, effective July 1, 2027): Directs the Department of Economic and Community Development to develop a plan for an AI regulatory sandbox and to report recommendations by January 1, 2028.
• AI companion safety (Sections 4 to 6, effective January 1, 2027): An operator may not provide an "artificial intelligence companion" unless it uses evidence-based methods to detect user expressions indicating a risk of suicide, self-harm, or imminent physical violence, prevents outputs encouraging that conduct, and refers the user to resources including the 988 Suicide and Crisis Lifeline. Additional restrictions apply where the operator knows or has reason to believe the user is under 18.
• Automated employment-related decision technology (Sections 7 to 12, effective October 1, 2026, duties attaching to technology deployed on or after October 1, 2027): Developer-to-deployer information duties, an interaction disclosure, and a pre-decision written notice. See the employment section above.
• Connecticut AI Academy (Section 17, effective July 1, 2026): The Board of Regents for Higher Education must establish the academy on behalf of Charter Oak State College by December 31, 2026, offering online AI courses and resources aimed at people aged 13 to 20 and at small businesses and nonprofits.
• AI working group (Section 18, effective July 1, 2026): Establishes a working group in the Legislative Department, chaired by the consumer protection committee chairs and the executive director of the Connecticut Academy of Science and Engineering. Appointments were due by July 31, 2026 and the first meeting by August 31, 2026. Its charges include proposing legislation on general-purpose AI models and on social media signaling of synthetic digital content, developing a technology court proposal, and recommending the establishment and membership of a permanent AI advisory council. It reports by February 1, 2027 and terminates on filing.

The act does not create an AI policy office, an AI learning laboratory program, or a new technology advisory board. The only "Technology Advisory Board" references in the act are to the pre-existing Connecticut Data Analysis Technology Advisory Board, in an amended open-data section.

Source: Connecticut General Assembly, Public Act 26-15

Senate Bill 86: AI for Economic Development

SB 86 focused on using AI to advance economic development in Connecticut; the 2026 session ended without it advancing. The bill would establish an AI regulatory sandbox program, allowing companies to test AI innovations in a controlled regulatory environment.

Senate Bill 417: AI Small Business Program (Enacted)

SB 417, signed June 2, 2026 as Special Act 26-23, requires the Department of Economic and Community Development to develop a plan for an AI small business program, aimed at helping smaller companies adopt and benefit from AI technologies.

Legislative History: The SB 2 Saga

Understanding Connecticut's current AI legislative landscape requires knowing the history of SB 2, which has been the state's most ambitious AI regulation attempt.

In 2024, the Connecticut Senate passed the first version of SB 2, which would have been comparable in scope to the EU AI Act. Governor Lamont opposed the measure, and House Speaker Matt Ritter declined to bring it to the House floor.

In 2025, a revised SB 2 passed the Senate on a 32-4 bipartisan vote, with all 25 Democrats and seven of 11 Republicans supporting it. The revised version included amendments that watered down initial requirements for impact assessments and algorithmic discrimination mitigation. Despite these concessions, Lamont again threatened a veto, and the bill was never called in the House.

The core disagreement has been between pro-regulation Senate Democrats who want comprehensive AI accountability and Governor Lamont's administration, which has expressed concern that strict AI regulations could damage Connecticut's technology sector.

Source: CT Mirror, Will CT Pass AI Legislation?

Federal AI Policy and Connecticut

Executive Order 14365: State Preemption Concerns

On December 11, 2025, President Trump signed Executive Order 14365, "Ensuring a National Policy Framework for Artificial Intelligence," which aims to establish a federal framework for AI regulation and discourage state-level AI laws.

The order directs federal agencies to identify state laws that may conflict with federal AI policy and contemplates using Department of Justice litigation, administrative reinterpretation of existing laws, and conditional federal funding to challenge state regulations.

Connecticut's response has been firm. Attorney General William Tong has stated that "Attorneys general are united in staunch opposition to any effort to restrain states' abilities to pass commonsense AI regulations to fill the vacuum left by federal inaction."

However, legal experts note important limitations on the executive order's practical impact:

• Federal preemption typically requires congressional action, not executive orders alone
• The order provides guidance for federal agencies but does not independently displace state laws
• State AI laws remain in force unless courts enjoin them or Congress passes preemptive legislation
• Connecticut lawmakers have signaled they will continue pursuing AI regulation regardless

The tension between federal preemption efforts and state regulatory ambitions is likely to shape Connecticut's AI policy debates throughout 2026 and beyond.

Source: Federal Register, Executive Order 14365, Ensuring a National Policy Framework for Artificial Intelligence

Key Dates and Timeline

More Connecticut Laws

Explore other Connecticut legal guides on Recording Law:

• Connecticut Data Privacy Laws
• Connecticut Biometric Privacy Laws
• Connecticut Data Breach Notification Laws
• Connecticut Surveillance Camera Laws
• Connecticut Background Check Laws
• Connecticut Whistleblower Laws
• Connecticut Sexting Laws
• Connecticut Medical Records Retention Laws

Frequently Asked Questions

Does Connecticut have a comprehensive AI law?

Connecticut's broadest AI law is Public Act 26-15, which Governor Lamont signed on May 27, 2026. It sets safety duties for AI companion chatbots, catastrophic-risk and whistleblower duties for frontier AI developers, and disclosure duties for automated employment-related decision technology, and it creates an AI working group in the Legislative Department. It does not create an AI policy office. Connecticut also has earlier targeted measures: government AI accountability (Public Act 23-16), a large language model training disclosure in privacy notices (Public Act 25-113), and criminalization of synthetic intimate images (Public Act 25-168). A separate, broader private-sector AI bill (SB 2) passed the Senate twice, in 2024 and 2025, but failed to advance in the House both times.

Are AI-generated deepfakes illegal in Connecticut?

Yes, certain types. Since October 1, 2025, Connecticut law (Public Act 25-168, Section 261, codified at General Statutes section 53a-189d) criminalizes the dissemination of synthetically created intimate images without consent. Dissemination to one person is a class D misdemeanor, punishable by up to 30 days and a $250 fine. Dissemination to more than one person through an interactive computer service or similar service is a class C misdemeanor, up to 3 months and $500. Each grade rises, to a class A misdemeanor and a class D felony respectively, only if the defendant also acquired or created the image with intent to harm the depicted person. Since October 1, 2026, Public Act 26-55 also gives victims a private right of action and requires covered platforms to remove reported images within 48 hours.

Do Connecticut businesses need to disclose AI use to consumers?

Starting July 1, 2026, businesses subject to the Connecticut Data Privacy Act must state in their privacy notices whether they collect, use, or sell personal data for the purpose of training large language models. That is the specific duty Public Act 25-113 added; the act does not impose a broader disclosure duty for AI systems generally.

Can employers in Connecticut use AI for hiring decisions?

Yes, but existing anti-discrimination laws apply to AI-driven employment decisions just as they do to traditional hiring practices, and the Connecticut Attorney General has clarified this position. Public Act 26-15 adds disclosure duties for automated employment-related decision technology, but they are not yet operative: they attach only to technology deployed in Connecticut on or after October 1, 2027. The act requires an interaction disclosure and a written pre-decision notice. It does not give applicants a right to appeal an automated decision, and it provides no private right of action, leaving enforcement solely with the Attorney General under the Connecticut Unfair Trade Practices Act.

How does the federal AI executive order affect Connecticut's AI laws?

Executive Order 14365, "Ensuring a National Policy Framework for Artificial Intelligence" (signed December 11, 2025), aims to discourage state AI regulation, but its practical impact on Connecticut is limited. Federal preemption typically requires congressional action, not just executive orders. Connecticut's existing AI laws remain in effect, and state officials have publicly opposed federal efforts to restrict state AI regulation.