Connecticut AI Regulation: Where the Bill Actually Stands

If you've been waiting for Connecticut's AI bill to pass, it already did. It just isn't the one most compliance trackers were watching. For two legislative sessions, "Connecticut's AI bill" meant Senate Bill 2 — a broad, Colorado-style statute that would have imposed a duty of reasonable care on anyone developing or deploying a "high-risk" AI system. SB 2 died in 2024, died again in 2025, and was never revived in that form. What actually became law in 2026 is a different bill entirely: Senate Bill 5, now Public Act 26-15, which drops SB 2's duty-of-care framework and instead regulates four specific things — employment AI, AI companions, frontier models, and online safety for minors — each on its own timeline.

That distinction isn't academic. A compliance program built around the expectation that Connecticut would eventually adopt something like Colorado's SB 205 has been planning for the wrong statute. SB 5's obligations look nothing like a general risk-tiering exercise, and several of them already took effect before this article was written.

Why SB 2 kept dying

Senator James Maroney introduced SB 2 in 2024 as Connecticut's answer to Colorado's AI Act: developers and deployers of "high-risk" AI systems — those that make or are a substantial factor in a "consequential decision" — would owe a duty of reasonable care to avoid algorithmic discrimination, enforceable solely by the Attorney General. The Senate passed it in 2024. The House didn't vote on it before the session ended. In 2025, SB 2 came back, cleared the Senate again, and collapsed a second time when Governor Lamont signaled he'd veto it over the breadth of the algorithmic-discrimination duty and its potential drag on the state's AI industry.

Two vetoes-in-waiting is a pattern, not bad luck, and it shaped what came next. Rather than bring back a third version of the same duty-of-care bill, the 2026 session produced SB 5 — a bill that pointedly does not import the "consequential decision" and algorithmic-discrimination language that sank SB 2 twice. It passed the Senate 32-4 in April 2026, cleared the House shortly after, and Lamont signed it into law in late May (most reporting puts the date at May 27, 2026). The core trade that got it past the governor's desk was scope: four specific, bounded obligations instead of one broad standard covering any AI system that touches a consequential decision.

What SB 5 actually covers

SB 5's official title is "An Act Concerning Online Safety" — a title that undersells just how much ground the statute actually covers, which is itself a reason the law gets misdescribed. Rather than one duty-of-care standard, it sets up four largely independent tracks, each with its own trigger and its own start date: AI used in employment decisions, AI companion chatbots, frontier AI model development, and online-platform safeguards for minors. A company can be inside zero, one, or all four tracks depending entirely on what it builds — there's no single "are you covered by Connecticut's AI law" test that applies across all of them.

Employment AI: what changes for employers

Two employment-related pieces took effect October 1, 2026. First, SB 5 amended the Connecticut Fair Employment Practices Act to state directly that an employer's use of an automated employment decision tool is not a defense to a discriminatory-practice complaint — whatever liability would attach to a human-made decision attaches the same way when the tool made it. Second, employers covered by the federal WARN Act now have to disclose, as part of their layoff notice to the state Department of Labor, whether the layoff relates to the employer's use of AI or other technological change.

A third employment obligation isn't live yet. Starting October 1, 2027, a deployer of a covered automated employment decision tool — defined broadly as technology that processes personal data and uses computation to generate output that's a substantial factor in an employment decision, with ordinary tools like spreadsheets and word processors carved out — has to tell applicants and employees, in plain language, when that tool is part of the interaction. The duty doesn't apply where the AI's involvement would be obvious to a reasonable person anyway, which gives some room for an interface that's already transparent about what it is.

AI companions, frontier models, and minors' online safety

The remaining three tracks arrive on their own schedules. AI companion rules take effect January 1, 2027, reaching systems built to communicate in natural language in a way that simulates human conversation and sustains an ongoing relationship with a user — not a narrow transactional chatbot, which New York's comparable companion-chatbot statute draws the same line around.

The frontier-model track took effect earliest, on October 1, 2026, and runs on whistleblower protections rather than a safety-framework filing requirement. It applies to "frontier developers" training models above roughly 10^26 floating-point operations of compute and doing business in Connecticut; developers above $500 million in annual revenue count as "large frontier developers" with added duties, including an anonymous internal reporting channel, mandatory investigation of reports, and quarterly reporting to officers and directors. The protected trigger is an employee reporting a "catastrophic risk" — defined by a threshold of foreseeable death or serious injury to more than 50 people, or more than $1 billion in property damage — and retaliating against that employee is barred, with civil penalties of up to $1,000 per violation enforced by the Commissioner of Consumer Protection.

Minors' online safety is the farthest-out track, effective January 1, 2028: notification limits, parental controls, warning labels, and restrictions on algorithmic feeds designed to maximize engagement for users the platform knows are minors.

A compliance timeline for one company

Take Nutmeg Workforce, a hypothetical New Haven-based HR technology company with two products sold into Connecticut. Its core product is an applicant-screening tool that scores resumes and interview responses for employer clients — squarely a covered automated employment decision tool. Nutmeg doesn't owe candidates a disclosure about that tool today, but it has until October 1, 2027 to build the plain-language notice the law will require by then, and as of October 1, 2026 its client employers already can't point to the tool's use as a defense if a candidate brings a discrimination claim.

Nutmeg's second product is a "virtual career coach" — a chatbot that holds ongoing, personalized conversations with job seekers across multiple sessions, tracking their goals and checking back in over time. That's close enough to SB 5's AI-companion definition that Nutmeg needs a clear, conspicuous non-human disclosure built in before January 1, 2027, three full quarters before its screening tool's notice duty kicks in. Two products, two tracks, two different deadlines — and if Nutmeg's parent company were separately training a large general-purpose model for enterprise clients, it would need to be thinking about the frontier-developer whistleblower channel today, since that obligation has already been in effect since October 2026.

Enforcement and the cure period

SB 5 funnels most enforcement through CUTPA, Connecticut's unfair-trade-practices statute, with the Attorney General holding exclusive authority — there's no general private right of action for a consumer to sue directly over a violation. For violations occurring on or before December 31, 2027, the Attorney General has discretion to offer a 60-day cure period before pursuing a penalty, which gives companies still building out compliance for the later-effective tracks a real grace window rather than strict-liability exposure from day one. The frontier-developer whistleblower provisions run on a separate enforcement track through the Commissioner of Consumer Protection, with per-violation civil penalties capped at $1,000.

What this means for a compliance program

The practical task is building a timeline, not a policy memo. Treat SB 5 as four separate questions to ask about every Connecticut-facing AI system: does it make employment decisions, does it sustain a companion-like relationship with users, was it trained at frontier scale, and does it reach minors on a platform with algorithmic feeds. Each "yes" comes with its own effective date, and the earliest ones — the CFEPA amendment, the WARN disclosure, and the frontier whistleblower rules — have already been in force since October 2026. A company still planning around SB 2's duty-of-care model, or around the assumption that Connecticut has no AI-specific law at all, is behind on obligations that are either already live or arriving within the next year. It's also worth watching the broader fight over whether a future federal AI law could override state statutes like this one: nothing currently in effect preempts SB 5, but Connecticut's decision to abandon a Colorado-style duty-of-care model in favor of narrower, named obligations is itself a data point in how states are diverging rather than converging on how to regulate AI at the state level.