Connecticut's big 2026 AI law covers frontier model safety, hiring tools, content provenance, AI companions, social media, and more. Most of it won't touch a small business. If you've read early coverage saying it regulates every AI subscription sold to Connecticut residents, that coverage is out of date. The legislature narrowed the subscription rule before it took effect.
How the law got here
The law started as Substitute Senate Bill 5. It became Public Act 26-15, formally titled “An Act Concerning Online Safety.” Its sponsors call it the Connecticut Artificial Intelligence Responsibility and Transparency Act, or CART Act. The legislative record, compiled on LegiScan's SB 5 page, shows Governor Ned Lamont signed it on May 27, 2026. He held a public signing ceremony on June 2, 2026, which is why some coverage gives the later date.
June 2 matters for another reason. That same day, the Governor signed House Bill 5222, which became Public Act 26-100. According to the Office of Legislative Research's public act summary of PA 26-100, that act repealed Section 1 of the CART Act, the subscription rule, and substituted “substantially similar provisions” with a much narrower scope. The original Section 1 never took effect.
The dates that matter to a small business
- October 1, 2026: The replacement AI subscription rule takes effect. So do the frontier-developer whistleblower protections and a new requirement that employers say whether a WARN layoff notice is related to AI.
- January 1, 2027: The AI companion rules take effect. Large frontier developers must also have an anonymous internal reporting process in place by this date.
- October 1, 2027: According to law-firm summaries of the act, the principal obligations for automated employment decision tools apply from this date, although the statutory framework took effect a year earlier.
- January 1, 2028: The provisions for social media platforms and minors take effect.
Question one: “We sell an AI product on a subscription. Are we covered?”
For most small businesses, no.
As originally enacted, Section 1 of the CART Act would have reached almost anyone. It applied to a “subscription-based provider,” defined as a person doing business in Connecticut who provides, or offers to provide, “an artificial intelligence technology to a consumer pursuant to a subscription.” A scheduling app with an AI-drafting feature would have been covered.
The replacement rule in PA 26-100 is far narrower. The OLR summary says the disclosure requirements now apply to “publicly accessible generative AI systems for personal use with more than a million monthly users.” It defines generative AI as “any technology that uses machine learning to generate images, audio, or video.” Law-firm summaries of the enrolled text, including Covington's analysis, describe a covered provider as one that creates or produces the generative AI system and offers it to consumers by subscription.
Put those pieces together and three filters knock most small businesses out:
- Scale. The system needs more than one million monthly users. A small company selling its own tool will rarely be anywhere near that.
- Creating the system. The rule targets the company that creates or produces the generative AI system. A business that resells or builds a thin product layer on top of a large vendor's model raises a harder question. The most natural reading is that the vendor, not the reseller, is the covered provider, but that point should be confirmed against the enrolled text.
- Output type. The definition names images, audio, and video. Whether a text-only product, such as a chat-based writing assistant, falls inside it is not clear from the summaries. Treat that as an open question rather than an exemption.
Two other limits carry over from the original. The rule protects only a “consumer,” meaning an individual who is a Connecticut resident, so business-to-business subscriptions fall outside it. And it is specific to AI. Ordinary subscriptions, including AI subscriptions that fall outside the narrow rule, remain subject to Connecticut's general automatic-renewal law, which was overhauled by legislation that took effect October 1, 2023.
What the notice has to say, if you are covered
For the large platforms that are covered, the rule is a notice-and-acceptance requirement. Before entering into or renewing a covered subscription, or collecting a fee for one, the provider must give the consumer written notice of the subscription's key terms and conditions, and the consumer must give written acceptance. The notice must give a reasonable consumer enough material information to decide whether to buy or keep the subscription, including:
- quantitative or qualitative limits on use, such as caps on tokens, generated images, or transcription, including limits triggered by the consumer's own conduct, and
- whether the provider has discretion to limit or remove access to functionality, or to reduce its quantity or quality.
At renewal, the notice must identify limits and provider discretion that are new for the renewal term, or that existed before but have changed.
Connecticut is targeting the “unlimited plan that quietly throttles you” problem.
Consider a typical scenario
Consider a four-person software company in Ohio that sells a monthly AI writing assistant to freelancers nationwide. It has about 30,000 subscribers, a few hundred of them in Connecticut. The product is built on a large model provider's API. Its terms of service say the company “may modify features at any time,” and its fair-use policy caps generations per day.
On the October 2026 law, this company is very likely outside the AI subscription rule. It is nowhere near one million monthly users, its product generates text rather than images, audio, or video, and it did not create the underlying model. What it cannot ignore is Connecticut's general automatic-renewal law and federal consumer protection law, which govern how it discloses renewal terms and handles cancellation.
Even so, it would be wise to put the generation cap and the “may modify features” discretion in a clear summary at checkout. Undisclosed throttling is the kind of thing a state attorney general can pursue as a deceptive practice without any AI-specific statute.
Who enforces it
A violation of the subscription rule is an unfair or deceptive trade practice under the Connecticut Unfair Trade Practices Act (CUTPA). Enforcement is solely by the Attorney General, and the provision creates no private right of action. That limits class-action risk. It does not limit state enforcement. Under the general CUTPA framework, the state can seek injunctions, and courts can impose civil penalties of up to $5,000 for willful violations.
Question two: “We have a chatbot on our website. Is that an 'AI companion'?”
For most businesses, no, but read the definition and exclusions carefully.
Under Section 4 of the CART Act, an AI companion is an AI system with a natural-language interface that provides adaptive, human-like responses to user inputs and is able to sustain a relationship across multiple interactions. The act then excludes several categories, including:
- chatbots used for business operations, customer service, internal research, and similar purposes that are not marketed to consumers as companions,
- video game chatbots limited to game-related replies that cannot discuss mental health, self-harm, sexually explicit conduct, or unrelated topics,
- standalone voice-command speakers that don't sustain a relationship or generate outputs likely to elicit emotional attachment,
- narrowly tailored educational tools that aren't designed for open-ended companionship,
- health care tools limited to clinical or treatment support that don't present as human, use anthropomorphic features, or aim to meet social or emotional needs,
- narrow, task-specific tools whose primary function isn't discussing mental health, and
- developers or licensors that don't solely determine the use case, user interface, or deployment context.
A bot that answers shipping questions or books appointments sits comfortably inside the business-operations exclusion, as long as you don't market it as a companion. The risk sits with products that drift: a “wellness buddy” in a fitness app, a named persona that remembers users and checks in on how they're feeling, or a coaching bot sold as “someone to talk to.” Those features look a lot like sustaining a relationship, and marketing them that way can take you out of the exclusion.
What operators of AI companions must do starting January 1, 2027
If your product is an AI companion, Section 5 requires the operator to:
- adopt a protocol, using evidence-based methods, to detect user expressions clearly indicating a risk of suicide, self-harm, or imminent physical violence, and to prevent outputs that encourage that conduct,
- refer at-risk users to mental health resources, including the 988 Suicide & Crisis Lifeline, and to mental health services if those expressions continue after a referral,
- post the protocol in a prominent, publicly accessible place on the operator's website,
- take reasonable measures to stop the companion from claiming to be human, including when a user asks directly, and
- where a reasonable person could believe they're talking to a human, give a clear AI disclosure. That can be a static notice visible throughout the interaction, or a notice at the start of the first interaction in any 24-hour period that repeats at least every three hours of continuous interaction for adults and at least hourly for minors.
Section 6 adds protections when the operator knows or has reason to believe the user is a minor, including limits on romantic or sexual interactions and engagement-maximizing manipulation, and tools for managing screen time and account settings. Both sections are enforced by the Attorney General under CUTPA.
Even if your support bot is not a companion, your disclosure duties don't disappear. Other states have their own bot-disclosure rules, collected in our guide to website chatbot disclosure laws.
Question three: “Do the whistleblower provisions apply to us as an employer?”
Almost certainly not.
The whistleblower rules in Section 2 apply to “frontier developers,” meaning persons doing business in Connecticut that train, or intend to train, a foundation model using more than 10^26 integer or floating-point operations of computing power, counting fine-tuning and other material modifications. That is the scale of the largest model labs. A business that uses an AI model, or builds an app on top of one, is not a frontier developer.
For the companies that are covered:
- Frontier developers may not prevent or retaliate against covered employees for reporting catastrophic-risk concerns.
- “Large frontier developers,” those that, with affiliates, had more than $500 million in annual gross revenue in the prior calendar year, must have an anonymous internal reporting process by January 1, 2027, and share reports with officers and directors at least quarterly.
- The Attorney General may seek civil penalties of up to $1,000 per violation.
The employment provision that midsize employers are more likely to meet is Section 26. Starting October 1, 2026, an employer that serves a federal WARN Act notice on the Connecticut Labor Department must also disclose whether the layoffs relate to its use of AI or other technological change. WARN generally reaches only larger employers, but if you're at that size and automating roles, plan for the disclosure.
How this fits with the rest of the patchwork
Colorado repealed and replaced its AI Act this year, and state privacy laws already govern much of the data flowing through AI tools. Connecticut's subscription rule, as narrowed, is aimed at the largest consumer generative AI platforms. The Future of Privacy Forum's overview of SB 5 maps the remaining provisions, though it predates the June 2 amendment.
Frequently Asked Questions
I read that the CART Act covers any subscription to a product with AI in it. Is that wrong?
It described the original Section 1. PA 26-100 repealed that section upon passage and replaced it, effective October 1, 2026, with the narrower rule. Commentary published before June 2026 generally doesn't reflect the change.
Is a customer-service chatbot regulated as an AI companion?
Not if it is used for business operations or customer service and isn't marketed to consumers as a companion. That exclusion is in the act's definition. A bot with a persona built to form an ongoing emotional relationship with users is a different matter and should be reviewed against the January 1, 2027 requirements.
Can a customer sue me under the new law?
The subscription rule and Section 5 of the companion rules expressly create no private right of action, and Section 6 is enforced solely by the Attorney General. Some summaries have described a private remedy for the companion rules. The act text points to AG enforcement, though counsel should watch for any court reading it differently. The separate social media provisions taking effect in 2028 are a different story and are reported to carry a private right of action.
For ongoing tracking
State AI laws are changing quickly, and Connecticut amended this one within days of signing it. We track developments at silvertonpublishing.com/ai-current.
This article reflects Connecticut Public Acts 26-15 and 26-100 as of October 2026. State AI law is moving quickly, and Connecticut has already amended this act once. Confirm the current text of both acts and any guidance from the Connecticut Attorney General before relying on it. Nothing in this article is legal advice for your specific situation.
This article is for educational purposes only and does not constitute legal, tax, or financial advice. Consult a qualified professional for guidance specific to your situation.