Connecticut AI Governance — Trustible

Connecticut Artificial Intelligence Responsibility and Transparency Act (CART Act) · SB 5 · Public Act 26-15

Connecticut AI Governance

Connecticut spent three legislative sessions trying to pass a broad, Colorado-style AI act before landing on a different approach. Alongside the CART Act, Connecticut significantly expanded its existing data privacy law’s automated decision-making provisions. Organizations should track both.

CART Act CTDPA Trustible Capabilities First 90 Days FAQs

← Back to Full List

Requirement

What It Means

Subscription AI Disclosures (effective Oct. 1, 2026)

Providers of subscription-based generative AI with more than one million monthly users must give written pre-contract disclosure of usage limits and the ability to reduce functionality.

Frontier Developer Whistleblower Protections (reporting channels required by Jan. 1, 2027)

Frontier developers (models trained above 10^26 FLOPs) and large frontier developers (over $500 million in annual revenue) must prohibit retaliation against employees reporting catastrophic risk, and establish anonymous internal reporting channels with regular reports to leadership.

Automated Employment-Related Decision Technology, or AEDT (effective Oct. 1, 2027)

Employers must disclose AEDT use to applicants and employees, give pre-decision notice of purpose and data sources, and explain the principal reasons for adverse decisions. Notably, there is no mandatory risk or impact assessment, a deliberate contrast with Colorado and California.

AI Companion Disclosure (effective Jan. 1, 2027)

Operators of AI companions must never claim to be human, must disclose that fact on a recurring basis, and must implement a self-harm detection and referral protocol. Minors trigger stricter disclosure frequency and additional prohibitions.

Synthetic Content Watermarking (effective Oct. 1, 2026)

Covered generative AI providers with more than one million monthly users must embed tamper-resistant, C2PA-aligned provenance data in AI-generated or altered audio, image, or video.

Enforcement runs almost entirely through the Connecticut Attorney General under the state’s unfair trade practices law, with no general private right of action, except for the AI companion provisions, where minors and their parents or guardians can bring a private claim. The frontier developer whistleblower provision carries its own penalty of up to $1,000 per violation. The Connecticut Department of Economic and Community Development must also produce a plan for an AI regulatory sandbox by July 1, 2027.

Requirement

What It Means

Expanded Automated Decision-Making Opt-Out

The opt-out right now extends to any automated decision, not only fully automated ones, that produces a legal or similarly significant effect, including decisions made on a controller’s behalf by third parties.

Right to Explanation and Review

Consumers gain the right to an explanation of the decision and to review the data used.

Profiling Impact Assessment

A new, dedicated profiling impact assessment is required for legally significant profiling activity, effective August 1, 2026.

No Cure Period

The prior mandatory cure period has sunset, meaning enforcement is active without a grace period.

Enforcement sits with the Connecticut Attorney General.

How Trustible Supports Connecticut Compliance

Compliance

Trustible Capability

AI Inventory

Tracks every AI system against Connecticut’s staggered effective dates, so employment, companion, and frontier-model obligations are triggered on schedule rather than discovered late.

Automated Workflows

Orchestrates AEDT notice-and-disclosure steps and AI companion safeguards as part of intake, without requiring a separate compliance project for each new deadline.

Risk Management

Documents profiling impact assessments required under the amended CTDPA, with inherent and residual risk tracked against legally significant automated decisions.

Insights Taxonomies

Keeps definitions of frontier developer, large frontier developer, and AI companion current as Connecticut’s DECD and AG issue further guidance.

Policy Management

Connects internal AI policy to the disclosure and watermarking obligations that apply to customer-facing generative AI products.

Reporting & Dashboards

Produces the documentation trail Connecticut’s AG would expect in an unfair trade practices inquiry, across every bundled obligation in one place.

Your First 90 Days

Day 30: Inventory Against the Effective-Date Calendar

Map every AI system against Connecticut’s staggered timeline, from the October 2026 subscription and watermarking obligations through the 2027 employment and companion rules.

Day 60: Assess Profiling and Employment AI Risk

Launch profiling impact assessments under the amended CTDPA and prepare AEDT notice, data-source, and adverse-decision documentation ahead of the October 2027 deadline.

Day 90: Operationalize Companion Safeguards and Reporting

Confirm AI companion disclosure frequency and self-harm referral protocols are live, and connect frontier-model whistleblower channels and incident documentation to ongoing governance reporting.

Connecticut AI FAQs

No. Earlier bills (often referenced as SB 2) followed a Colorado-style universal high-risk AI framework and did not pass. SB 5, enacted as Public Act 26-15, is a narrower, sector-bundled law without a general impact assessment mandate.

No. The AEDT provisions require disclosure, notice, and adverse-decision explanations, but deliberately do not include a risk or impact assessment mandate.

January 1, 2027. Minors trigger more frequent disclosure and additional prohibitions, including a ban on romantic or sexual interaction with a known or suspected minor.

Only for the AI companion provisions, where minors and their parents or guardians can bring a private claim. Every other obligation is enforced solely by the Connecticut Attorney General.

It lowers the applicability threshold to 35,000 consumers, extends the opt-out right to any automated decision with a legally significant effect, and adds a dedicated profiling impact assessment requirement effective August 1, 2026.

Platform

Features

By Framework