Connecticut's omnibus AI law, SB 5, began taking effect on October 1, 2026, making it one of the broadest state AI statutes now on the books. Governor Ned Lamont signed the bill, titled "An Act Concerning Online Safety," on May 27, 2026. Its obligations roll out in stages through January 2028, so companies that serve Connecticut users are working through a compliance calendar rather than a single deadline.
What Took Effect October 1
According to law-firm summaries from Morrison Foerster and WilmerHale, several provisions began on October 1, 2026.
- Subscription disclosures: Businesses offering AI technologies under subscriptions must give consumers clear written notice of key terms before collecting payment. The notice covers limits on access and changes at renewal. Only the Attorney General can enforce this provision.
- Generative AI provenance: Providers with more than one million monthly users of publicly accessible generative AI systems must embed tamper-resistant provenance data in AI-generated or materially altered audio, image and video content where commercially and technically reasonable. Text is excluded, and there are carve-outs, including for video games and certain business-to-business arrangements.
- Frontier developer protections: Developers training models above 10 to the 26th power FLOPs may not retaliate against employees who report catastrophic risks. Developers with more than $500 million in annual revenue must also create anonymous internal reporting channels by January 1, 2027.
- Employment decision tools: The anti-discrimination amendments now apply, and using an automated employment decision tool is not a defense to a discrimination claim.
- Layoff reporting: The law adds an AI-related disclosure obligation to the state WARN Act. The summaries we reviewed describe it only briefly.
What Comes Later
Other duties are staggered. Rules for AI companions take effect on January 1, 2027. Operators must detect risk of suicide, self-harm and violence, refer users to crisis resources, post their safety protocols and disclose at set intervals that users are talking to an AI, more often for minors. For users under 18, operators must restrict harmful content and manipulative engagement tactics and provide screen-time tools.
An independent verification pilot begins July 1, 2027. The deployer notice obligations for automated employment tools become operational on October 1, 2027, requiring employers to give written pre-decision notice of a tool's use, purpose, data categories and contact information. Social media requirements for minors arrive on January 1, 2028, including limits on personalized algorithmic recommendations without age verification or parental consent, and a default one-hour daily feed limit.
The law also creates a Connecticut AI Academy, several advisory groups, workforce studies and a plan for an AI regulatory sandbox.
How It Is Enforced
Enforcement is mostly in the hands of the Attorney General. Frontier developers face civil penalties of up to $1,000 per violation, pursued in Hartford Superior Court. Companion, provenance, social media and subscription provisions are enforced solely by the Attorney General under the state's consumer protection act. For automated employment tools there is no private right of action, and a notice-and-cure provision gives recipients 60 days to fix violations through the end of 2027. Individuals can still raise discrimination claims through the state human rights commission's administrative process.
Why It Matters
Connecticut shows a state choosing breadth over depth. The law touches consumer subscriptions, content authenticity, hiring, minors and frontier models in one package. Yet its frontier provisions are narrower than some other states': they center on whistleblower protection and internal reporting rather than detailed safety plans, evaluations or public reports.
For employers, the most concrete change is liability. Because relying on an automated tool is no defense, the employer rather than the vendor carries the risk if a tool produces discriminatory outcomes. The law lets courts and the state commission consider evidence of anti-bias testing, which gives companies a reason to document their testing.
For AI providers, provenance and subscription rules add engineering and product work. Embedding tamper-resistant provenance in media and clearly disclosing usage caps are concrete tasks with dates attached, and they apply to any large provider with Connecticut users.
What to Watch Next
- Whether the Attorney General issues early guidance or begins enforcement of the subscription and provenance rules.
- How providers interpret "commercially and technically reasonable" provenance.
- How the January 2027 companion rules interact with other states' chatbot safety laws.
- Whether federal preemption efforts affect state statutes like this one.
Companies should read the full statute and consult counsel; the summaries here come from law-firm analyses and may not capture every definition or exception. The practical takeaway is that Connecticut's compliance clock has started, and the largest obligations are still ahead.
