From Sidhant Tamrkar | Product & Market Analysis
Connecticut's AI Law Is Live. The Impact Assessment Duty Is Not in It
On this page
Connecticut's AI law took effect on 1 October 2026, and the duty most compliance teams prepared for is not in it. Public Act 26-15 asks private deployers for 0 impact assessments, no risk management programme and no annual review. Its notices for hiring and promotion tools apply only to tools deployed from 1 October 2027. What changed this month is narrower, and easy to miss.
Key takeaways
- Connecticut's AI law requires no impact assessment from private deployers. The Future of Privacy Forum states the act does not require automated employment tools to undergo bias audits or risk assessments. Those duties sat in the 2025 Senate Bill 2, which never passed.
- The deployer notice duties start on 1 October 2027, not 2026. Interaction disclosure and pre-decision written notice apply to automated employment tools deployed in Connecticut on or after that date, according to Troutman, Ogletree and FPF.
- What went live on 1 October 2026 is a set of narrower rules. Using an automated tool is no defence to a discrimination complaint, AI subscription terms need written acceptance, frontier model whistleblowers are protected and WARN filers must answer an AI question.
- Vendors carry a statutory information duty, not just a sales one. A developer whose tool is sold or configured to materially influence employment decisions must give deployers everything they need to issue the notices. Deployers stay ultimately responsible.
The short answer
No Connecticut statute requires a private company to complete an AI impact assessment before deployment or annually. Public Act 26-15 is a notice law for automated employment tools, and those notices start for tools deployed from 1 October 2027. Since 1 October 2026, the live duties cover discrimination defences, AI subscriptions, provenance, whistleblowers and WARN filings.
This post is for the operations or delivery lead, vendor or buyer side, who has to turn a law into a checklist.
What Connecticut's AI law requires on 1 October 2026
The act began as Substitute Senate Bill 5, sponsored by Senator James Maroney, according to Troutman. Governor Ned Lamont signed it in late May 2026. FPF describes it as a 39-section bill. It is not one AI framework but a set of targeted rules that start on different dates.
Several have applied since 1 October 2026. Here is what is live, grouped by who it reaches.
Rules that reach every Connecticut employer using AI in hiring
The act amends Connecticut's anti-discrimination law. Using an automated employment tool is now "not a defense" to a complaint alleging a discriminatory practice, as Ogletree quotes it. The Commission on Human Rights and Opportunities, or a court, may consider evidence of anti-bias testing or similar proactive efforts as a mitigating factor. ArentFox Schiff stresses that this is not a formal safe harbour.
The amendment shifts nothing about who can sue, but it removes the argument that the software made the call. If a tool screens out a protected group, your company owns that outcome under existing law, starting this month.
The WARN question also went live. Employers filing federal WARN notices with the state Labor Department must say whether the layoffs relate to their use of AI or another technological change. We covered it in the analysis of Connecticut's AI layoff disclosure.
Rules that reach AI providers rather than their customers
A provider selling AI technology on subscription must give a Connecticut consumer written notice of the key terms and get written acceptance, Hunton reports. BCLP adds that the notice covers qualitative or quantitative usage limitations. If you have read our work on quiet cuts to AI usage limits, you will see why a legislature wanted those limits written down.
Frontier developers gain whistleblower duties. Employees who report a specific and substantial danger from a catastrophic risk are protected from retaliation. Ogletree reports civil penalties of up to $1,000 per violation, recoverable by the Attorney General. Hunton defines large frontier developers by annual gross revenue above $500 million and models trained with more than 10^26 operations.
Providers of publicly accessible generative AI with more than 1 million monthly users must embed provenance data in audio, image and video output, where commercially and technically feasible, according to FPF and Hunton. Most B2B vendors sit well below that line.
The Connecticut AI law obligations table, by effective date
The table below lists each obligation, who carries it, and when it starts. Section numbers follow the PAICE commentary on the chaptered text. Every date is as reported by at least two law firm alerts, except where the row says otherwise.
| Obligation | Who carries it | Starts | Enforcement |
|---|---|---|---|
| Written notice of key terms and written acceptance for AI subscriptions (s.1) | AI providers selling to Connecticut consumers | 1 Oct 2026 | Attorney General, as an unfair trade practice |
| Whistleblower protection for catastrophic risk reports (s.2) | Frontier developers | 1 Oct 2026 | Attorney General, up to $1,000 per violation |
| Anonymous internal reporting channel (s.2) | Large frontier developers, over $500 million revenue | 1 Jan 2027 | Attorney General |
| Automated employment tool definitions (s.7) | Sets scope for the rows below | 1 Oct 2026 | Not applicable on its own |
| Automated tool use is no defence to a discrimination complaint (s.13 to 14) | All employers | 1 Oct 2026 | CHRO and courts, under existing law |
| Provenance data in generated audio, image and video (s.15) | Generative AI providers over 1 million monthly users | 1 Oct 2026 | Attorney General |
| AI question on WARN notices | Employers filing federal WARN notices | 1 Oct 2026 | No penalty identified in alerts |
| Companion chatbot disclosures and safety protocols | Companion chatbot operators | 1 Jan 2027 | Attorney General |
| Give deployers the information needed for notices (s.8) | Developers of automated employment tools | Tools deployed from 1 Oct 2027 | Attorney General only, 60-day cure through 2027 |
| Plain-language disclosure that a person is interacting with the tool (s.9) | Deployers | Tools deployed from 1 Oct 2027 | Attorney General only, 60-day cure through 2027 |
| Written notice before each employment decision (s.10) | Deployers | Tools deployed from 1 Oct 2027 | Attorney General only, 60-day cure through 2027 |
| Age checks, recommender limits and default time limits for minors | Covered online platforms | 1 Jan 2028 | Attorney General |
| Risk management programme, impact assessment, annual review | Nobody in the private sector | Not in the act | Not applicable |
The last row is there because many summaries still attribute that duty to Connecticut. A vendor questionnaire that asks for your "Connecticut impact assessment" is asking for a document no Connecticut statute requires.
What Connecticut's AI law leaves out: no impact assessment, no risk programme
The brief behind this post assumed a different law. It had deployers of high-risk AI running risk management programmes, assessing impact before deployment and annually, and notifying consumers before consequential decisions. That describes a bill, not the law.
"Unlike other state frameworks, Connecticut does not require AEDTs to undergo bias audits or risk assessments," FPF says, under a heading that calls the act "a heads-up, not an audit or assessment". Troutman's reading agrees: the law "only requires notice" and creates no right to opt out or appeal. ArentFox describes it as prioritising disclosure over prescriptive design or audit obligations. Silberman Law states that the act does not specifically impose bias audits or impact assessments.
Connecticut's 2025 Senate Bill 2 did contain the high-risk deployer model. Its bill analysis described deployers completing impact assessments, with obligations beginning on 1 October 2026. FPF reports that SB 2 cleared the Senate but fell apart after a veto threat from Governor Lamont, over concerns that it could hamper innovation.
So the dates and the duties in circulation are a splice. The 1 October 2026 date belongs to the enacted act. The impact assessment belongs to the bill that died. Some secondary coverage still merges the two. I would not rely on any summary that does not quote the enacted text.
The words "high-risk" and "consequential decision" are not doing the work
Public Act 26-15 does not build its employment rules around a high-risk AI category. The operative term is automated employment-related decision technology. Troutman quotes the definition as technology that processes personal data and generates an output, such as a prediction, recommendation, ranking or score. It is covered "when that output is a substantial factor used to make or materially influence an employment-related decision".
A substantial factor is one that "meaningfully alters the outcome" of the decision. FPF notes this is narrower than the "capable of altering" language in Colorado's 2024 act. Covered decisions are hiring, promotion, discipline or discharge, renewal and selection for training. Lending, housing, insurance and healthcare decisions are outside this part of the act entirely.
If you sell a credit or claims model, Connecticut's notice rules do not reach it today. If you sell an applicant tracking system with a ranking feature, they almost certainly will.
The October 2027 deployer notices for automated hiring tools
The deployer duties apply to technology deployed in Connecticut on or after 1 October 2027, a point Silberman and PAICE both make explicitly. A deployer is the person doing business in the state who puts the technology into use.
The two notices a deployer must give
The first is an interaction disclosure. A deployer must tell an applicant or employee in plain language that they are interacting with the technology, unless that would be obvious to a reasonable person. Troutman notes this applies even when the tool is not a substantial factor in the decision.
The second is a written notice before the employment decision is made. Troutman lists six required elements: the fact of deployment, the purpose and nature of the decision, and the tool's trade name. The other three are the categories of personal data analysed and how they are assessed, the data sources, and the employer's contact information. ArentFox's reading also mentions the methodology by which data is evaluated.
Notice what is missing. There is no explanation after an adverse outcome, no human review right and no appeal. Colorado's replacement law keeps a 30-day adverse-outcome explanation, as our tracker of Colorado's SB 26-189 sets out. Connecticut asks for the heads-up only.
Troutman quotes exclusions for spreadsheets, word processors, databases, spam filters, calculators and similar tools, unless they themselves make or materially influence the decision. It also quotes an exclusion for "decisions made with respect to workplace health and safety, scheduling and planning, or productivity monitoring".
ArentFox reads scheduling systems as inside the definition. The two careful readings conflict directly. Until the Attorney General says otherwise, I would treat scheduling tools that rank or select individual workers as in scope. Planning tools that only forecast headcount are out.
The trade secret rule and enforcement
Neither developers nor deployers must disclose trade secrets. If a notice withholds information on that basis, it must say so and explain why. A vendor cannot quietly hollow out the notice and stay compliant.
The Attorney General enforces these sections exclusively, and there is no private right of action, according to Troutman and Ogletree. Violations are treated as unfair or deceptive trade practices. For violations on or before 31 December 2027, the Attorney General may give 60 days to cure before suing. ArentFox notes the route carries no specified per-violation ceiling.
What B2B vendors will be asked to provide for Connecticut AI compliance
The act gives vendors one narrow statutory duty and heavy commercial pressure. A developer must give deployers all the information they require to perform their notice duties, according to Troutman. It applies only where the tool was "advertised, marketed, configured, contracted for, sold, or licensed" to materially influence an employment decision.
A contract can go further. It may let the developer generate or deliver the notices itself. Troutman stresses that deployers remain ultimately responsible, and ArentFox says any reallocation must be set out expressly. ArentFox also notes the act does not prescribe the categories of information developers must hand over.
The questionnaire will ask for more than the law does
Procurement teams do not read statutes. They read summaries, and many summaries describe the bill that died. Expect Connecticut customers to ask for impact assessments, bias audit reports and risk programme documentation in 2027 renewals. I think vendors should answer those requests directly: say what the act requires, then decide separately whether to offer the extra document.
There is a sound commercial reason to offer some of it anyway. Anti-bias testing is the evidence that mitigates a discrimination complaint under the October 2026 amendment. A vendor who can hand over testing results makes the customer's defence cheaper, which is a better sales argument than compliance theatre.
| Request | Required by the act? | What to provide |
|---|---|---|
| Trade name, decision purpose and data categories for the notice | Yes, for tools deployed from 1 Oct 2027 | A notice data sheet per product, versioned with each release |
| Data sources and how data is assessed | Yes, same date | Plain-language description, with any trade secret withholding stated |
| Vendor delivers the notices on the customer's behalf | Optional, by express contract | A clause allocating delivery, leaving final responsibility with the deployer |
| Anti-bias testing results | No, but they mitigate liability under the 2026 amendment | Test method, sample, date and limits, if you have them |
| Impact assessment or annual risk review | No | A short statement that the act does not require one, plus any voluntary work |
| Where this approach concedes ground | Colorado's SB 26-189 asks for more from 1 Jan 2027 | One documentation pack built to the stricter state, reused here |
The last row is the practical answer for most vendors. Our AI agent procurement checklist shows what buyers already ask in general terms. The Connecticut notice data sheet slots into it.
Connecticut against Colorado and the failed SB 2: state AI laws in 2026
Put Connecticut next to its neighbours and a pattern appears. The comprehensive high-risk model, with impact assessments and a duty of care, has lost ground in 2026. What is replacing it is notice.
Colorado repealed its 2024 act in May 2026 and replaced it with SB 26-189, effective 1 January 2027. That law drops impact assessments, the risk management programme and the algorithmic discrimination duty. Connecticut's enacted act never had them. The two states arrived at a similar place from opposite directions.
If you sell into both states, the common core is now developer documentation plus pre-decision notice. That is buildable as a product feature: a notice template, a data sheet and a log of what was sent to whom. California's rules, mapped in our breakdown for software vendors, add their own layers but do not change that core.
My view is that the notice model will spread faster than the assessment model ever did. It is cheaper to comply with, easier to enforce and harder to lobby against. Texas went lighter still. Its enforcement record so far shows how little a disclosure-first law can produce in its first months.
Where this reading is weakest
There are three honest reasons to hold this reading loosely.
The statute text was not opened during research
The Connecticut General Assembly's site refused connections from our research environment. Every quotation of statutory language here comes from law firm alerts that quote the act, chiefly Troutman, Ogletree, FPF and Hunton. They agree with each other on the core points, but four readings of one text are still one text. The section numbers come from a single commentary. Check them against the public act before citing them in a contract.
Two dates are contested too. ArentFox dates the developer information duty to 1 October 2026, while Troutman and FPF tie it to tools deployed from 1 October 2027. ArentFox wrote before signing, so I have followed the later readings. One commentary also describes a separate impact assessment duty for state agencies using AI. I could not confirm that from a second source. It is not in the table.
No statutory duty is not the same as no expectation
FPF puts it this way: SB 5 "may be notice-first, but it is not notice-only". The discrimination amendment makes anti-bias testing valuable evidence, and Ogletree advises employers to consider whether a bias audit should be conducted. In practice, a large employer facing a complaint may wish it had something that looks a lot like an impact assessment.
So a vendor who tells customers "nothing is required" is right on the statute and wrong on the risk. I think the correct line is narrower. Nothing is required by this act, yet testing is still worth doing.
The legislature may come back
Connecticut has now considered an AI bill in three consecutive sessions. FPF reports that the act directs a regulatory sandbox plan, with recommendations due 1 January 2028. A future session could add assessments back. Nothing on the public record says it will, but planning for a stable 2027 rulebook is a bet, not a certainty.
Frequently asked questions
What does the Connecticut AI law require?
Public Act 26-15, signed in late May 2026, is a 39-section act rather than one AI framework. Since 1 October 2026 it treats automated tool use as no defence to a discrimination complaint and requires AI subscription disclosures. It also protects frontier model whistleblowers, requires provenance data from large generative AI providers and adds an AI question to WARN notices. Notices for automated employment tools start on 1 October 2027.
Does the Connecticut AI law require an AI impact assessment?
No, not for private companies. The Future of Privacy Forum states that Connecticut does not require automated employment tools to undergo bias audits or risk assessments, and Troutman notes the law creates no right to opt out or appeal. Impact assessment and risk management duties appeared in the 2025 Senate Bill 2, which did not pass. Anti-bias testing still counts as mitigating evidence in discrimination cases.
When do Connecticut's high-risk AI deployer obligations take effect?
The act does not use a high-risk AI category. Its deployer duties cover automated employment-related decision technology and apply to tools deployed in Connecticut on or after 1 October 2027. From that date deployers must disclose interactions with the tool and give written notice before each employment decision. The WARN question and the discrimination amendment have applied since 1 October 2026.
What must a deployer's notice say under Connecticut's AI law?
Before the employment decision is made, the individual must receive written notice that the technology is in use. It must state the purpose and nature of the decision, the tool's trade name, the categories of personal data analysed and how they are assessed, the sources of that data, and the deployer's contact details. Trade secrets may be withheld, but the notice must say so and explain why.
Who enforces Connecticut's AI law and what are the penalties?
The Attorney General enforces the employment technology sections exclusively, as unfair or deceptive trade practices, and there is no private right of action for them. For violations on or before 31 December 2027, the Attorney General may offer a 60-day cure period before suing. Separately, frontier developers face civil penalties of up to $1,000 per violation under the whistleblower section, according to Ogletree.
Do AI vendors have obligations under Connecticut's AI law?
Yes. A developer whose tool was advertised, marketed, configured, contracted for, sold or licensed to materially influence employment decisions must give deployers all the information they need to meet their notice duties. A contract may let the developer deliver the notices itself, but the deployer stays ultimately responsible. Most law firm readings date this duty to tools deployed from 1 October 2027.
Where to start before the 2027 notices
Vendors should start with the product list. Find every feature that ranks, scores or recommends people for hiring, promotion, discipline or training. For each one, draft the six-element notice data sheet now, while the deadline is a year away.
If you are a buyer, pull your 2027 renewal calendar and find every HR tool whose contract renews before October 2027. Add a clause that names who delivers the Connecticut notices and obliges the vendor to supply the notice data. That clause costs nothing to ask for this quarter and a great deal to negotiate under deadline.
If you answer security and compliance questionnaires
Most AI questionnaires borrow their structure from federal guidance rather than any state law. Our walk-through of NIST AI RMF questions in RFPs shows how to answer them once and reuse the answers across states.
References
- Connecticut General Assembly, Substitute Senate Bill No. 5, Public Act No. 26-15, 2026. The primary source; it could not be retrieved during research, see the note below.
- Future of Privacy Forum, Justine Gluck and Daniel Hales, SB 5 in Five: What to Know About Connecticut's New AI Law, 27 May 2026, updated 14 October 2026. Used for the absence of audits and assessments, section count, provenance threshold, SB 2 history and dates.
- Troutman Pepper Locke, Brianna Dally, Analyzing Connecticut's New Employment AI Law, 27 May 2026. Used for the definition, exclusions, notice contents, developer duty, enforcement and cure.
- Ogletree Deakins, New Connecticut Law Restricts Employer AI Use, Mandates Notice for AI-Caused RIFs, 29 May 2026. Used for the discrimination amendment, frontier penalty and 2027 dates.
- Hunton Andrews Kurth, Connecticut Signs Comprehensive AI Bill into Law, 11 June 2026. Used for subscription notices, frontier thresholds, provenance and companion chatbots.
- ArentFox Schiff, Matthew Berlin and Natasha Weis, Connecticut Takes Aim at AI in Employment Decisions With SB 5, 28 May 2026. Used for the no-safe-harbour reading, contract allocation, Colorado comparison and conflicting dates.
- Silberman Law, Connecticut Enacts the Artificial Intelligence Responsibility and Transparency Act, 2026. Used to corroborate the 2027 deployment trigger and the absence of impact assessments.
- PAICE, Next Week's Connecticut AI Responsibility Act, September 2026. Used only for section numbering; Tier 3, not the sole source for any duty or date.
The weakest point in this source base: the enacted text of Public Act 26-15 could not be retrieved from the legislature's site. Statutory language is quoted as reproduced in law firm alerts, and section numbers rest on one commentary. Sources also disagree on the signing date and on when the developer information duty starts.
Related reading