Connecticut enacts sweeping AI legislation addressing multiple AI applications and use cases

Introduction

Despite ongoing discussion at the federal level of preempting at least some state AI laws, states continue to adopt regulatory frameworks to address perceived risks in the AI space at a significant pace.  The Connecticut legislature went from zero to 60 by stitching together in a single bill what likely would have been six distinct bills in most states.  Indeed, when Connecticut Governor Ned Lamont signed the Connecticut Artificial Intelligence Responsibility and Transparency (CART) Act into law on May 27, 2026, it became the nation’s most comprehensive state AI law to date.  Notably, Colorado replaced the Colorado AI Act (CAIA), which was previously the most comprehensive state AI law, with the decidedly narrower regulatory framework in the Colorado Automated Decision-Making Technology Act (ADMTA) the same month (see DPW update). 

The breadth of the CART Act stems from its coverage of multiple AI applications and use cases, including automated employment-related decision technology (AEDT), AI companion chatbots, frontier AI models, synthetic content transparency, AI subscription products and social media.  Connecticut is not the first state to regulate these areas; companion chatbots and frontier models, for instance, have been a significant driver of recent state legislation in California, New York and beyond (see DPW updates here, here and here).  As a result, Connecticut was able to borrow extensively from existing state regulatory frameworks in developing its own comprehensive legislation. 

This update, the first in a series, focuses on the portions of the 74-page CART Act related to AEDT and companion chatbots as well as related compliance deadlines and enforcement mechanisms.  Our second update will focus on frontier models and synthetic content transparency. The third and final update will discuss the CART Act’s AI subscription requirements and social media rules.

AEDT disclosures

Applicability and requirements

The CART Act defines AEDT as any technology that processes personal data and uses computation to generate any output – for example, a prediction, recommendation or ranking score – that is a substantial factor used to make or materially influence an employment-related decision.  Employment-related decisions under the CART Act include decisions to hire, promote, discipline or discharge, renew employment or select an individual for training or apprenticeship.

The contours of the CART Act’s AEDT provisions are similar to the automated decision-making technology (ADMT) provisions in the Colorado ADMTA and the California Consumer Privacy Act (CCPA), although the scope of the employment actions the CART Act covers is broader, as shown in Table 1 below.  NYC Local Law 144 also addresses AEDT used for hiring and promotion.

Table 1. Select AEDT/ADMT frameworks

Like many state AI laws, the CART Act distinguishes between the developers and the deployers of AI technology.  Beginning October 1, 2027, AEDT deployers must notify each applicant or employee interacting with AEDT that they are interacting with such technology unless that fact would be obvious to a reasonable person.  To the extent an AEDT deployer intends to use the technology to make an employment-related decision, a deployer must provide advanced, written notice to the employee or applicant about the use and purpose of the AEDT, the trade name of the AEDT, the types and sources of personal data the technology will process, how that data will be used in reaching employment-related decisions and the contact information for the deployer.  AEDT developers must provide AEDT deployers with all information necessary to comply with these requirements.  AEDT deployers, however, may delegate the notice requirements to the AEDT developer via contract.  In either scenario, the CART Act does not compel the disclosure of any information that is a trade secret, or that is otherwise protected from disclosure by law.

The CART Act’s pre-decision notice requirements are arguably broader than comparable requirements in Colorado and California.  The Act, however, does not require additional disclosures in the event of an adverse employment decision as the Colorado ADMTA does, as shown in Table 2 below.

Table 2. Select AEDT/ADMT frameworks

Enforcement

The Connecticut Attorney General has exclusive authority to enforce violations of the AEDT provisions with no private right of action.  Violations are deemed unfair or deceptive trade practices under the Connecticut Unfair Trade Practices Act (CUTPA) (Conn. Gen. Stat. Ann. § 42-110b). Under CUTPA, the Attorney General may seek injunctive relief and impose civil penalties of up to $5,000 per violation.  

Effective October 1, 2026, the CART Act also amends Connecticut law prohibiting employment discrimination (Conn. Gen. Stat. 46a-60(b)) to make clear that the use of AEDT is not a defense against employment discrimination claims.  At the same time, evidence of anti-bias testing or similar proactive efforts to avoid the discriminatory practice may be considered in defense of such claims.

WARN Act notices

The CART Act breaks new ground in supplementing employers’ responsibilities under the federal Worker Adjustment and Retraining Notification (WARN) Act, which requires, for example, written notice to the Connecticut Labor Department of certain workforce reductions.  Beginning October 1, 2026, employers issuing such notices must disclose whether the workforce reductions that are the subject of the notice are related to the employer’s use of AI or another technological change.

Companion chatbots

Connecticut joins a long list of states that have enacted legislation regarding conversational or “companion” chatbots, including California, Colorado, Georgia, Hawaii, Idaho, Iowa, Nebraska, New York, Oregon, Rhode Island and Washington.  More than 20 other states have introduced similar legislation.  California and New York were among the first movers with the California Companion Chatbot law and the New York AI Companion Models law (see DPW update on both), respectively.  The CART Act is more closely aligned with the California law, including because it addresses minors’ use of this technology.  The CART Act, however, goes further by imposing a two-tiered escalation protocol to expressions of self-harm or suicide.

Applicability

A primary concern driving the recent wave of state legislation regarding companion chatbots is anthropomorphic deception, which occurs when an individual attributes human-like qualities or consciousness to AI systems that mimic human behavior.  The CART Act’s definition of companion chatbots largely mirrors that from the California Companion Chatbot law and New York AI Companion Models law, as shown in Table 3 below. 

Table 3. Select companion chatbot frameworks

Accordingly, statutes like the CART Act distinguish chatbots that simulate human behavior or relationships from chatbots that do not simulate human behavior and/or are only available in contexts where the risk of anthropomorphic deception is low (e.g., customer support and other business use cases).  In doing so, the CART Act borrows extensively from the California Companion Chatbot law.  The key differences include additional exclusions for certain healthcare and education uses and task-specific tools.

The CART Act specifically excludes AI chatbots used:

• For business operational purposes, including customer support, productivity and analysis, and internal research, and not marketed as a companion; 

• In stand-alone consumer devices with voice-activated virtual assistants, so long as they are not likely to elicit emotional attachment and cannot sustain relationships across interactions; 

• For certain, narrowly tailored educational and healthcare purposes, such as those used in schools or that provide medical treatment support functions; 

• Within video games, so long as they cannot discuss mental health, self-harm, sexually explicit conduct or maintain dialogue on non-game topics; and

• For any narrow, task-specific tool that only provides outputs related to a discrete topic or function, so long as it is not primarily to discuss mental health.

The CART Act also excludes entities that develop, license or provide AI to another individual or entity, so long as they do not solely determine the specific use case, interface or deployment context in which it then interacts with users.

Requirements

Like the laws in California, New York and elsewhere, the CART Act requires operators of covered AI companions (Operators) to take measures to prevent an AI companion from claiming it is a human being or generating any output that refutes or conflicts with that fact.  If an AI companion could cause a reasonable person to believe they are interacting with a human, the operator must provide notice to the user that they are communicating with AI.  This notice may either be provided as a static written notice in every interaction, or once at the start of every interaction during any 24-hour period, and every one or three hours thereafter (for minors and non-minor users, respectively).

Additionally, the CART Act requires Operators to incorporate a protocol that detects (using evidence-based methods) user expressions indicating a risk of suicide, self-harm or imminent violence and refer users to appropriate mental health evaluation and treatment resources upon detection.  The CART Act, however, goes one step further than California and New York by requiring that following the initial recommendation of mental health resources, subsequent detection triggers referrals to mental health services “in a manner that is consistent with clinical best practices and expertise,” as shown in Table 4 below.  The CART Act further requires that Operators publish these protocols prominently on their websites.

Table 4. Select companion chatbot frameworks

Minors

As noted above, the CART Act goes further than California’s Companion Chatbot law with respect to minors’ use of the technology.  At a high level, California’s law requires that Operators disclose that the chatbots may not be suitable for some minors, remind minor users every three hours that they are interacting with AI, and institute measures to prevent the production of sexually explicit conduct.  The CART Act’s requirements are more extensive.

Where Operators know or have reason to believe a user is under 18 years old, they must also provide screen-time and parental supervision controls.  They are also prohibited from providing AI companions to minors if it is “reasonably foreseeable” that the companion is capable of:

• Encouraging users to engage in self-harm, suicidal ideation, physical violence, disordered eating or the unlawful consumption of alcohol or drugs;

• Offering mental health services, unless it is designed for that purpose and meets additional requirements, such as utilizing “clinical best practices” and displaying recurring notices to users, and the operator has established clear lines of accountability to address any harms caused;

• Discouraging users from seeking mental health services or “assistance from an appropriate adult”; 

• Encouraging users to harm others;

• Engaging in any romantic, erotic or sexually explicit interactions;

• Engaging in any of a wide variety of “manipulative techniques” intended to extend interactions, such as excessive praise, mimicking a romantic relationship, simulating expressions of abandonment or loneliness, or generating outputs designed to isolate minor users, such as encouraging them to keep secrets from family or friends; or

• Otherwise optimizing user engagement in any manner that “disregards” these prohibitions.

Enforcement

Like the AEDT provisions, the Connecticut Attorney General has exclusive authority to enforce violations of the companion chatbot provisions with no private right of action.  Violations are deemed unfair or deceptive trade practices under CUTPA. 

In contrast, the California Companion Chatbot law provides a private right of action for any person harmed by a violation for injunctive relief, the greater of (i) actual damages or (ii) $1,000 per violation as well as reasonable attorney’s fees.

Key takeaways

• Companies operating in Connecticut should evaluate whether any AI tools utilized in the employment context constitute AEDT under the CART Act’s broad definition.

• Companies should engage any AEDT developers to align on requirements and roles in advance of the October 1, 2027 compliance deadline.

• Companies operating covered AI companions should implement evidence-based suicide and self-harm detection protocols, ensure companions cannot claim to be human, and build age-gating measures with minor-specific safeguards, leveraging existing compliance controls wherever possible.