Connecticut AI Act (PA 26-15) carries 12 tracked obligations for companies in scope. This guide lists who is covered, the duty tiers, and every obligation with its deadline and statutory citation — all from Shieldra's versioned regulation pack, verified 2026-07-29.
What are the duty tiers under Connecticut AI Act (PA 26-15)?
Employment AI (AEDT) duties (Conn. Pub. Act No. 26-15, §§ 7–14, 26 (2026))
Citation: Conn. Pub. Act No. 26-15, §§ 7–14, 26 (2026) — https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00015-R00SB-00005-PA.PDF
No company-size threshold anywhere in this branch. Two enforcement tracks: §§ 8–11 notice duties are enforced solely by the Attorney General as CUTPA violations (CGS 42-110b), with a discretionary 60-day notice-and-cure for violations occurring on or before 31 December 2027 and no private right of action (§ 12); the §§ 13–14 rule that AEDT use is not a defense runs through ordinary CHRO discrimination complaints, which DO reach damages and have no cure window. The §§ 8–10 notice duties attach to technologies deployed on or after 1 October 2027; the no-defense rule applies from 1 October 2026 regardless of when the tool was deployed.
Consumer-facing AI duties (Conn. Pub. Act No. 26-15, §§ 1, 4–6 (2026))
Citation: Conn. Pub. Act No. 26-15, §§ 1, 4–6 (2026) — https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00015-R00SB-00005-PA.PDF
Both branches are enforced solely by the Attorney General as CUTPA unfair or deceptive practices; §§ 1(c) and 5(c) expressly exclude private CUTPA suits (CGS 42-110g) and disclaim any private right of action, and § 6(c) is likewise 'enforced solely by the Attorney General'. Early summaries describing a private right of action with punitive damages for companion violations do not match the enrolled text. Subscription notices apply from 1 October 2026; companion duties from 1 January 2027.
Frontier / large-scale provider duties (Conn. Pub. Act No. 26-15, §§ 2, 15 (2026))
Citation: Conn. Pub. Act No. 26-15, §§ 2, 15 (2026) — https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00015-R00SB-00005-PA.PDF
These branches are confined by their thresholds — more than 10^26 training FLOPs (§ 2), over $500,000,000 group revenue for the large-frontier channel duty, and more than 1,000,000 monthly users with public consumer access (§ 15) — to frontier labs and mass-market consumer products. Frontier whistleblower violations carry a civil penalty up to $1,000 per violation plus injunctive relief and state cost/fee recovery (§ 2(e)); the provenance duty is AG-only CUTPA (§ 15(c)).
In scope — no current PA 26-15 duty branch (Conn. Pub. Act No. 26-15 (2026))
Citation: Conn. Pub. Act No. 26-15 (2026) — https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00015-R00SB-00005-PA.PDF
You have a Connecticut nexus but no operative branch triggered: no AI tool is a substantial factor in Connecticut employment decisions, no AI subscriptions are sold to individual Connecticut residents, your chatbot sits inside the § 4 operational-purpose carve-out (which holds only while it is not marketed to consumers as a companion), and the frontier (§ 2: >10^26 FLOPs) and provenance (§ 15: >1,000,000 monthly users, B2B distribution exempt) thresholds exclude you. The § 39 minors personalized-feed rules (from 1 January 2028) reach only platforms whose significant function is recommending user-generated media. Re-screen if you adopt AI in hiring for Connecticut roles, launch consumer AI subscriptions, or reposition a chatbot as a companion.
What should you do about each obligation?
Run and document anti-bias testing — AEDT use is no defense in discrimination claims (Conn. Pub. Act No. 26-15, §§ 13–14 (2026), amending CGS 46a-60(b) and 46a-81c)
From 1 October 2026, using an automated employment-related decision technology is expressly NOT a defense to a discrimination complaint before the CHRO or a Connecticut court (§§ 13–14, amending CGS 46a-60(b)(1) and 46a-81c). The commission or court may consider evidence of anti-bias testing or similar proactive efforts — including the quality, efficacy, recency, and scope of the testing, its results, and your response to those results. Stand up a documented, recurring bias-testing program for every AI tool that is a substantial factor in employment decisions about Connecticut employees or applicants, and remediate and re-test when results show disparities. This exposure runs through the ordinary CHRO complaint process with its existing remedies, including damages — it is separate from the Attorney General's CUTPA track and has no 60-day cure window. It applies to tools already in use; there is no deployment-date gate on the no-defense rule.
Deployer: written pre-decision notice for employment AI (Conn. Pub. Act No. 26-15, §§ 10–12 (2026))
For AEDTs deployed on or after 1 October 2027, before making an employment-related decision in which the tool's output is used or is a substantial factor, give each Connecticut employee or applicant a written notice disclosing: (1) that an AEDT is deployed; (2) its purpose and the nature of the decision; (3) the tool's trade name; (4) the categories of personal data it will analyze or process and how that data will be assessed in reaching a decision; (5) the sources of that personal data; and (6) your contact information (§ 10). Trade secrets may be withheld, but you must send a notice stating that information is withheld and the basis (§ 11). The act does not say whether a tool first put into use before 1 October 2027 and still in use afterward is 'deployed on or after' that date — plan to comply for every tool in use on that date unless counsel advises otherwise. A developer can contractually assume this duty; the contract must clearly state which duties it covers (§ 8(c)). Enforcement: solely by the Attorney General as a CUTPA violation (CGS 42-110b), with a discretionary 60-day notice-and-cure for violations occurring on or before 31 December 2027 and no private right of action (§ 12).
Deployer: disclose interactive employment AI to the people using it (Conn. Pub. Act No. 26-15, §§ 9, 12 (2026))
For AEDTs deployed on or after 1 October 2027 that are intended to interact with Connecticut employees or applicants, ensure it is disclosed, in plain language, to each person who interacts with the tool that they are interacting with it (§ 9(a)). No disclosure is required where a reasonable person would deem it obvious (§ 9(b)) — but do not rely on obviousness for a bot with a human-sounding persona. A developer can contractually assume the duty (§ 8(c)). Enforcement: AG-only CUTPA with the § 12 discretionary 60-day cure for violations on or before 31 December 2027; no private right of action.
Developer: supply deployers everything they need for the §§ 9–10 notices (Conn. Pub. Act No. 26-15, §§ 8, 11–12 (2026))
For AEDTs deployed in Connecticut on or after 1 October 2027, provide each deployer all information the deployer requires to perform its § 9 interaction-disclosure and § 10 pre-decision-notice duties (§ 8(a)). The duty attaches because the tool is advertised, marketed, configured, contracted for, sold, or licensed to materially influence employment decisions (§ 8(b)). Build a deployer-facing disclosure kit: purpose and decision types, trade name, categories and sources of personal data analyzed, and how the data is assessed. Alternatively, contract to assume the deployer's §§ 9–10 duties — the contract is binding and must clearly set out which duties you assumed (§ 8(c)). Trade-secret material may be withheld with a notice stating that it is withheld and why (§ 11). Enforcement: AG-only CUTPA (CGS 42-110b), discretionary 60-day cure for violations on or before 31 December 2027, no private right of action (§ 12).
Pre-sale key-terms notice and written acceptance for AI subscriptions (Conn. Pub. Act No. 26-15, § 1 (2026))
From 1 October 2026, do not enter into or renew an AI-technology subscription with an individual Connecticut resident, or collect any fee, remuneration, or compensation of any kind for one, until (1) you have given the consumer a written notice disclosing the key terms and (2) the consumer has given you written notice accepting them (§ 1(b)(1)). For an initial subscription the notice must contain material information sufficient for a reasonable consumer to decide whether to purchase or maintain it — at minimum any quantitative or qualitative limitations you may impose (including limits imposed in response to the consumer's conduct) and whether you have discretion to limit or eliminate access to, or reduce the quantity or quality of, any functionality (§ 1(b)(2)(A)). Renewal notices must cover limitations or discretion that are new for, or modified in, the renewal term (§ 1(b)(2)(B)). Wire the notice and recorded acceptance into checkout and renewal flows and retain the records. Enforcement: solely by the Attorney General as a CUTPA violation; private CUTPA suits are expressly excluded and there is no private right of action (§ 1(c)).
AI companion: published crisis protocol and no-human-claim measures (Conn. Pub. Act No. 26-15, § 5(a), (c) (2026))
From 1 January 2027, an AI companion may not be provided or operated without a protocol that, at minimum: uses evidence-based methods to detect user expressions clearly indicating a risk of suicide, self-harm, or imminent physical violence; institutes measures preventing outputs that encourage suicide, self-harm, or physical violence; refers detected users to mental-health evaluation and treatment resources including the 9-8-8 National Suicide Prevention Lifeline; and, on repeat detection after a referral, refers the user in a manner consistent with clinical best practices and expertise (§ 5(a)(1)(A)). Post the protocol in a prominent, publicly accessible location on your website (§ 5(a)(2)). Also implement reasonable measures preventing the companion from claiming to be human — including when asked directly — or generating output that refutes or conflicts with its not-a-human disclosure (§ 5(a)(1)(B)). Enforcement: solely by the Attorney General under CUTPA; § 5(c) expressly excludes private CUTPA suits and any private right of action.
AI companion: disclose non-human status on the statutory cadence (Conn. Pub. Act No. 26-15, § 5(b)–(c) (2026))
From 1 January 2027, if the companion would cause a reasonable user to believe they are interacting with another human being, provide a clear and conspicuous notice that the user is communicating with an AI companion — either (1) a static written notice visible throughout the entire interaction, or (2) an audible or written notice at the beginning of the first interaction in any 24-hour period plus, during continuous interaction, at least hourly for users under 18 or at least once every three hours for adults (§ 5(b)). A persistent on-screen banner is the simplest compliant design and moots the cadence tracking. Enforcement: AG-only CUTPA; no private right of action (§ 5(c)).
AI companion: minor-user safeguards and parental tools (Conn. Pub. Act No. 26-15, § 6 (2026))
From 1 January 2027, where you know or have reason to believe a user is under 18, you must have instituted measures meeting or exceeding industry standards that prevent the companion from: encouraging self-harm, suicidal ideation, physical violence, disordered eating, or unlawful alcohol or drug consumption; offering mental-health services unless the narrow § 6(a)(1)(B) clinical exception is satisfied (clinical best practices, clear accountability lines, accessible function/limitation/privacy documentation, a not-a-licensed-professional statement at the start of every interaction, and no marketing as a substitute for a licensed professional); discouraging the user from seeking help from a licensed mental-health professional or an appropriate adult; encouraging harm to others; any romantic, erotic, or sexually explicit interaction; manipulative engagement techniques — emotional-support use reminders, excessive praise, mimicking romance, simulating distress, loneliness, guilt, or abandonment when the user tries to leave, isolating the user from family or friends, encouraging secrecy from parents or trusted adults, discouraging breaks, or soliciting purchases as necessary to maintain the 'relationship'; and engagement optimization that disregards any of these (§ 6(a)(1)(A)–(G)). Also make screen-time and account-management tools available to minor users and their parents or guardians (§ 6(b)). Safe harbor: no § 6(a) violation if before providing the companion you knew or had reason to believe the user was 18 or older (§ 6(a)(2)) — implement age assurance to earn it. Enforcement: solely by the Attorney General under CUTPA (§ 6(c)).
Disclose AI-related layoffs when filing a federal WARN notice with CT DOL (Conn. Pub. Act No. 26-15, § 26 (2026))
From 1 October 2026, every employer serving a federal WARN Act written notice (29 U.S.C. § 2102(a)) on the Connecticut Labor Department must also disclose, in the form and manner prescribed by the Labor Commissioner, whether the layoffs are related to the employer's use of artificial intelligence or another technological change (§ 26). Add this determination to your reduction-in-force checklist and document the basis for the answer — it creates a public, discoverable record about AI-driven job elimination, so align the disclosure with internal communications and any workforce-transition narrative.
Frontier developer: whistleblower anti-retaliation and rights notices (Conn. Pub. Act No. 26-15, § 2(b), (d)–(e) (2026))
From 1 October 2026, a frontier developer (more than 10^26 training FLOPs) may not make, adopt, enforce, or enter into any rule, regulation, policy, or contract that allows discharging, disciplining, or otherwise penalizing employees for whistleblowing activity protected under CGS 31-51m, or that allows retaliation against a covered employee who reports, with reasonable cause, activity posing a specific and substantial danger to public health or safety due to a catastrophic risk (§ 2(b)) — review employment agreements, NDAs, and severance templates for offending clauses. Also give covered employees clear notice of their rights: an always-posted workplace notice with equivalents for new hires and remote workers, or an annual written notice with recorded acknowledgment (§ 2(d)). 'Catastrophic risk' means a foreseeable, material risk of death or serious injury to more than 50 people or more than $1,000,000,000 in property damage or loss from a single incident involving CBRN expert assistance or unsupervised conduct amounting to a cyberattack, murder, assault, extortion, or theft (§ 2(a)(1)). Penalty: up to $1,000 per violation plus injunctive relief, with the state recovering investigation costs and attorneys' fees when it prevails; the Attorney General sues in the Hartford judicial district (§ 2(e)).
Large frontier developer: anonymous internal catastrophic-risk reporting channel (Conn. Pub. Act No. 26-15, § 2(c), (e) (2026))
Not later than 1 January 2027, a large frontier developer (a frontier developer whose corporate control group had annual gross revenues above $500,000,000 in the most recent calendar year) must establish and maintain a reasonable internal process through which covered employees can anonymously report, in good faith, activity posing a specific and substantial danger to public health or safety due to a catastrophic risk, with reasonable updates to each reporter on the status of the investigation and the actions taken in response (§ 2(c)(1)). Reports and updates must be shared with officers and directors at least quarterly — except with any officer or director the report alleges committed wrongdoing (§ 2(c)(2)). Enforcement mirrors § 2(e): civil penalty up to $1,000 per violation, injunctive relief not stayed pending appeal, and state recovery of investigation costs and attorneys' fees.
Covered generative AI provider: embed tamper-resistant provenance data (Conn. Pub. Act No. 26-15, § 15 (2026))
From 1 October 2026, a covered provider must, to the extent commercially and technically reasonable, include provenance data in any audio, image, or video content (or combination) created or materially altered by its generative AI system, in a manner that lets a consumer assess whether the content was AI-created or AI-altered, and must use commercially and technically reasonable methods — the act names the Coalition for Content Provenance and Authenticity (C2PA) standard — to make that data difficult to tamper with, remove, or disassociate (§ 15(b)(1)). You are not required to embed information about identifiable individuals, trade secrets, or confidential system-design information (§ 15(b)(2)(A)). The duty does not apply to business-to-business use, sale, licensing, or distribution, to products solely providing video-game or interactive experiences, or to systems used solely for upscaling, noise reduction, or compression (§ 15(b)(2)(B)); 'materially alter' excludes minor edits such as brightness, contrast, filters, resizing, cropping, or denoising (§ 15(a)(4)). Enforcement: solely by the Attorney General as a CUTPA violation; private suits are expressly excluded (§ 15(c)).
