Connecticut's new AI law: what Public Act 26-15 actually requires

Connecticut's Public Act 26-15, signed into law May 27, 2026, is not a single AI Responsibility Act despite that nickname circulating in commentary — its official title is An Act Concerning Online Safety, and it bundles five separate AI rules into one 74-page bill: AI subscription disclosure (effective October 1, 2026), frontier AI developer whistleblower protections (effective October 1, 2026, with a January 1, 2027 compliance deadline for the largest developers), AI companion chatbot safety rules (effective January 1, 2027), automated employment-decision-technology disclosure (definitions effective October 1, 2026, duties binding on deployments from October 1, 2027), and generative-AI content-provenance labeling (effective October 1, 2026). All five are enforced solely by the Attorney General under the state's existing consumer-protection statute, with no private right of action.

What it's called, and what it isn't

The enacted text, Substitute Senate Bill No. 5, carries only the title An Act Concerning Online Safety and names no short title anywhere in its 74 pages — AI Responsibility Act and CART Act (Connecticut Artificial Intelligence Responsibility and Transparency Act) are both informal names used in outside commentary, not statutory language. One law firm alert, for example, calls the bill "also known as the Connecticut Artificial Intelligence Responsibility and Transparency Act." Readers searching either name are looking for this same act, Public Act 26-15.

AI subscription disclosure (Section 1, effective October 1, 2026)

A subscription-based provider of an AI technology cannot enter into, renew or bill for a subscription unless it has given the consumer written notice of the subscription's key terms — including any usage limitations and any discretion the provider holds to reduce the AI technology's functionality — and the consumer has acknowledged accepting those terms. A violation is an unfair or deceptive trade practice under the Connecticut Unfair Trade Practices Act (CUTPA), enforced solely by the Attorney General; the act states plainly that it creates no private right of action.

Frontier AI developer whistleblower protections (Section 2)

Starting October 1, 2026, a frontier developer — any company doing business in Connecticut that trains a foundation model using more than 10^26 floating-point or integer operations — cannot retaliate against an employee who reports, in good faith, that the company's AI work poses a catastrophic risk: a foreseeable risk of killing or seriously injuring more than fifty people, or causing more than one billion dollars in property damage, through an AI-enabled weapon, cyberattack or similarly severe single incident. Large frontier developers — those with more than $500 million in annual gross revenue — must additionally stand up, by January 1, 2027, an anonymous internal reporting channel for these covered employees and report each submission to their own officers and directors at least quarterly. The Attorney General can seek civil penalties of up to $1,000 per violation plus costs and attorneys' fees.

AI companion chatbot rules (Sections 4-6, effective January 1, 2027)

An artificial intelligence companion is defined as an AI with a natural-language interface that gives adaptive, human-like responses and can sustain a relationship across repeated interactions — a definition built to exclude ordinary customer-service bots, game chatbots, voice assistants and narrow clinical or educational tools. Any operator of one must build in a protocol that detects a user's expression of suicide, self-harm or imminent-violence risk, blocks the companion from encouraging it, and refers the user to resources including the 988 Suicide and Crisis Lifeline; the companion also cannot claim to be human once a user asks. For users an operator knows are minors, the law separately bans the companion from encouraging self-harm, discouraging a minor from seeking real mental-health help, any romantic or sexually explicit interaction, and a specific list of engagement-maximizing manipulation tactics — including guilt-tripping a minor who tries to leave a conversation, simulating loneliness or abandonment, or soliciting gifts to maintain the relationship. Operators must also give minors and their parents screen-time and account-management tools. As with Section 1, every one of these duties is enforced solely by the Attorney General as a CUTPA violation, with no private right of action.

Automated employment-decision technology (Sections 7-13)

An employer that uses software to help hire, promote, discipline, discharge or set the terms of someone's job has two sets of new duties once the tool counts as "automated employment-related decision technology" — any technology that processes personal data to produce an output that is a substantial factor in that decision, excluding tools like spreadsheets, spellcheckers or databases that merely happen to touch the process. The definitions in Section 7 take effect October 1, 2026, but the actual duties in Sections 8 through 10 bind only technology deployed in the state on or after October 1, 2027 — a one-year gap this entry's 2026-10-19 version left unverified, now confirmed directly from the statute rather than secondary commentary.

Once that date arrives, the developer of the technology must give the deploying employer everything it needs to meet its own duties, unless the tool was never marketed or configured to influence an employment decision. The deploying employer must then disclose to any employee or applicant who interacts with the tool that they are doing so, in plain language, unless that would be obvious anyway; and before the decision is made, give the person a written notice naming the tool, its purpose, what categories of their personal data it analyzes, where that data came from, and how to contact the employer. A trade-secret exception excuses withholding specific details, but only if the employer separately notifies the person that information is being withheld and why.

Section 13 adds a second, separate change to Connecticut's existing anti-discrimination law: using an automated employment-decision tool is no longer, by itself, a defense against a discrimination complaint, though a court or the state's Commission on Human Rights and Opportunities may weigh evidence of anti-bias testing the employer actually ran. As with the rest of the act, violations of Sections 8-11 are enforced solely by the Attorney General under CUTPA, with a 60-day cure period for violations through the end of 2027 and no private right of action.

Generative-AI content provenance (Section 15)

Starting October 1, 2026, any generative AI system with more than one million monthly users that is publicly available to consumers — a "covered provider" — must, to the extent commercially and technically reasonable, embed provenance data in any AI-generated or AI-altered audio, image or video content, so a consumer can tell the content was machine-made. The provider must also use reasonable methods, naming the Coalition for Content Provenance and Authenticity's (C2PA) standard as one acceptable approach, to keep that provenance data from being easily stripped out or tampered with.

The duty has real limits. It does not require embedding anyone's personal identity in the metadata, disclosing trade secrets, or complying at all for business-to-business AI products, video-game and interactive content, or systems used solely for upscaling, denoising or compression. Minor edits — a brightness or color change, cropping, resizing, format conversion — do not count as "materially altering" content and so do not themselves trigger the duty. Enforcement again runs solely through the Attorney General as a CUTPA violation, with no private right of action.

Does Connecticut's AI law create a private right of action?

No. Every AI-specific duty in Public Act 26-15 — the subscription-disclosure rule, the frontier-developer whistleblower protections and the AI companion safety rules — is enforced solely by the Connecticut Attorney General under CUTPA, and each section says explicitly that it creates no private right of action. That is a direct contrast with California's SB 243 companion-chatbot law, which lets an injured user sue directly for actual damages or $1,000 per violation.

When does Connecticut's AI law take effect?

In stages. The AI-subscription-disclosure rule (Section 1) and the frontier-developer anti-retaliation protection (Section 2) both take effect October 1, 2026. The large-frontier-developer whistleblower-channel deadline and the AI companion chatbot rules (Sections 4 through 6) take effect January 1, 2027. The 74-section act has other, non-AI provisions on separate effective dates ranging from passage through January 1, 2028, which this entry does not cover.

What security leaders should do

If your company sells a subscription AI product to Connecticut consumers, confirm your subscription-disclosure language covers any usage limits or functionality the company can unilaterally reduce, since that is the specific gap Section 1 targets. If your company trains foundation models at frontier compute scale, check whether your internal AI-safety reporting channel is anonymous and reaches your board on a quarterly cadence, the standard Section 2 sets for January 1, 2027; smaller AI developers below the compute threshold are not covered, but the anti-retaliation protection for any employee reporting a catastrophic risk applies more broadly starting October 1, 2026. If your company operates or embeds a conversational AI companion feature, map its self-harm detection, human-disclosure and minor-protection behavior against Sections 5 and 6 before the January 1, 2027 deadline; California's SB 243, which this site already covers, sets a similar but not identical bar and carries real financial exposure through its own private right of action, which Connecticut's law does not. If your company builds or buys software that screens, scores or ranks job applicants or employees, treat October 1, 2027 as the real compliance deadline for Sections 8-10's disclosure duties, and note that Section 13 already took away "the algorithm decided" as a stand-alone defense to a discrimination claim, effective now. If your company runs a public-facing generative AI product with over a million monthly users, check now, not in 2027, whether your image, audio or video outputs carry C2PA-compatible provenance data, since that duty is already in effect as of October 1, 2026.

See the regulation tracker for how this compares to other state AI activity, Connecticut AG William Tong's February 2026 memorandum for how the same office maps AI harm onto the state's pre-existing law, a separate document from this enacted statute, and this site's explainer on the state-by-state AI patchwork for how Connecticut's approach fits the wider pattern of state legislatures acting without federal AI law.