Connecticut's AG tells businesses: existing law already covers AI

Connecticut's Attorney General told businesses and consumers on February 25, 2026 that no new AI law is needed to hold AI developers and users accountable — the state's existing civil-rights, privacy, data-security, consumer-protection and antitrust statutes already reach AI-driven harm, and the office intends to enforce them that way.

What the memorandum says

Attorney General William Tong's office addressed the memorandum to all state officials, agencies and concerned parties, laying out in four sections the primary statutes the office already has available to enforce existing state law against AI-driven harm. It opens by pointing to the spread of AI-generated nonconsensual sexual abuse images on xAI's Grok platform as an example of AI-enabled harm, alongside uses in tenant screening, employment, credit, insurance and targeted advertising.

The memo covers four statutory areas: Connecticut's civil-rights and antidiscrimination laws, which it says apply to algorithmic discrimination the same way they have long applied to other discriminatory conduct in housing, employment, healthcare, insurance and lending; the Connecticut Data Privacy Act (CTDPA), including a provision effective July 1, 2026 restricting profiling of minors' data in automated decisions about financial services, housing, education, employment, health care and similar essential services; Connecticut's Safeguards and Breach Notification Laws, which it says require the same vigilance against an AI system leaking or exposing personal data as against outside threat actors; and the Connecticut Unfair Trade Practices Act (CUTPA) and Connecticut Antitrust Act, which it says reach AI-driven false advertising, fabricated reviews, deepfake endorsements, algorithmic price-fixing and AI-facilitated collusion such as the RealPage rental-pricing litigation the office is already party to.

The memo is explicit about its own limits: it states plainly that it is "neither binding nor precedential," does not constitute legal advice, does not address criminal statutes, and focuses on existing law rather than creating new obligations.

Why it matters to security leaders

This is a template other states' AGs can reuse without waiting on new AI-specific legislation: map an AI harm to an existing statute the office already enforces. It also puts a data-security obligation in writing that security leaders can act on directly — Connecticut's Safeguards Law and Breach Notification Law apply to personal data an AI system leaks or exposes, regardless of whether a new AI law ever passes. Compare this reuse-existing-law approach to Texas's and Pennsylvania's actual settlements under their own consumer-protection and licensing statutes, both already on this tracker.

See the regulation tracker for how this compares to other state and federal AI enforcement activity, and Colorado's SB24-205/SB26-189 record for a state that took the opposite path: writing a dedicated AI statute, then narrowing it substantially before it took effect. Connecticut itself took that path three months later: Public Act 26-15, signed May 27, 2026, is the actual new AI statute this memorandum's reuse-existing-law approach preceded.