🔒CT businesses face AI compliance deadlines under sweeping new law

Connecticut businesses that use artificial intelligence in hiring, customer interactions and other operations face new compliance requirements under a sweeping state law approved in the final days of the legislative session. After two failed attempts in prior years, lawmakers this session passed an AI bill with the approval of Gov. Ned Lamont. For the growing number of businesses in the state that use — or rely on — the technology, the first compliance deadline arrives quickly, with initial provisions taking effect Oct. 1. The good news, according to legal experts who specialize in data privacy and technology regulation, is that Connecticut narrowed the scope of its legislation considerably from earlier versions of the bill. “I think they did a really good job,” said Tim Plunkett, senior counsel at Harris Beach Murtha and a member of the law firm’s artificial intelligence team. “It’s very well focused on specific issues in a way that balanced innovation and safety.”

Sherwin Yoder, a technology attorney at Carmody Torrance Sandak & Hennessey in New Haven, said the playing field had shifted considerably from previous legislative sessions. This time, the debate over the bill was less about whether regulation should exist at all, and more about the technical provisions. “The truth is AI is here, those solutions are here, businesses are using them,” he said. “And it does make sense to try to come up with a way to address all the stakeholder concerns and not leave individuals out of the picture.”

Plunkett compares the legislation favorably with laws passed in California, New York and Colorado, all of which have more complex and comprehensive regulatory requirements. Still, Connecticut’s law is not entirely straightforward. The 71-page omnibus Connecticut Artificial Intelligence Responsibility and Transparency Act contains multiple key provisions. One that many employers may focus on addresses the use of AI in employment decision technology. It places responsibility on both AI developers and the companies that deploy the tools to disclose their use and purpose in hiring, promotion, discipline and termination decisions. The disclosure requirements are fairly detailed. Employers using the technology must tell applicants or employees when AI is being used in a hiring or employment decision, explain the purpose of the tool, disclose what categories of personal data it analyzes and where that information comes from, among other requirements. The law also amends the state’s anti-discrimination statutes to make clear that automated decision-making is not a defense to a discrimination claim.

“If you’re using AI and it’s having a discriminatory impact then it’s you, you are the employer, you are the one making the choice,” said Russell Anderson, a privacy and data security expert at law firm Pullman & Comley. Anderson said he is urging clients to inventory their AI platforms, policies and procedures quickly, not only to ensure compliance, but to make sure they can prove it. “A lot of compliance is not just having a good product, but having a good product that you can document is good in writing,” he said. That could include revamped employee handbooks and rewritten vendor policies, among other documentation. The fact that both employers and the AI developers they rely on are held liable under the law could become a source of future controversy, particularly if small businesses lack the technical knowledge or resources to hold vendors accountable for the AI models they use.

Compliance strategies

Not all of these processes and concepts will be entirely new to Connecticut businesses, many of which have already had to comply with provisions of the state’s Data Privacy Act. In effect, the new law extends similar protections to employees in addition to consumers. Harris Beach Murtha’s Plunkett said that because of AI’s pervasive role across industries, companies’ compliance strategies should begin with communication. “AI is really a team sport,” he said. “It covers a massive range of people. When you’re creating your policies you want to be able to take in a really diverse group of opinions.” One notable difference from some other states is that Connecticut’s law generally does not allow individuals to sue directly over alleged violations. Instead, enforcement will largely be handled by the state attorney general under the Connecticut Unfair Trade Practices Act. “They gave the attorney general a decent amount of control here, which I think brings clarity to businesses,” Plunkett said. “It gives you one centralized place to go to.” There is one potential exception. The bill includes social media protections for minors that take effect in January 2027. Under those provisions, platforms must obtain parental consent before exposing children to algorithmic feeds, enforce a one-hour daily limit and block sensitive content. The legislation does not clearly state whether individuals could sue under this section, though experts said it is more likely to affect large technology companies and Connecticut families than in-state businesses. Other consumer-focused provisions regulate AI chatbots intended as “companions,” requiring companies to disclose that users are interacting with AI and implement suicide and self-harm detection protocols. Large generative AI models also will be required to include identifiers, such as digital watermarks, in content they create or materially alter, so consumers know it was generated using AI.

Workforce development

The legislation also seeks to preserve innovation by creating a regulatory “sandbox.” The state Department of Economic and Community Development is tasked with developing a program that would allow companies to test new AI products under reduced regulatory requirements, with the goal of giving businesses a way to try out new ideas. The law also aims to support education and workforce development in the field, requiring a new K-12 curriculum focused on safe and responsible AI use while expanding access to AI skills training. That effort includes the creation of a Connecticut AI Academy, which will offer training resources for workers, educators, nonprofits and small and midsize businesses. Observers said that kind of upskilling could give the state a competitive advantage. In passing the bill, Connecticut joins a relatively small group of states that have adopted broader AI regulatory frameworks, though experts expect additional legislation as the technology evolves and regulatory gaps emerge. “I think you’re going to see these more atomized bills addressing specific harms over the next, say two, three, four years, to address these higher risk issues,” Anderson said. However, the evolving legal landscape could put the state in the firing line of the federal government. For example, Elon Musk’s AI company has challenged Colorado’s AI law in federal court, and the U.S. Department of Justice has intervened to pause enforcement of that state’s regulatory framework. “If I’m running a state right now, I’m keeping an eye on what’s happening within the federal agencies very closely,” Plunkett said. For the short term, however, Connecticut businesses are likely to focus on the immediate compliance burden, made more complicated by changes to the state’s Data Privacy Act that also take effect July 1, including new restrictions on how certain businesses use consumer data, limits on the sale of precise geolocation data, and added disclosure requirements around some automated pricing practices. That creates two significant deadlines within three months. “It is a little head-spinning right now,” said Carmody’s Yoder, who advocates a practical approach. “I try to help clients focus on what’s my most significant two or three risks. Let’s tighten our controls around that and make sure we’re addressing those compliance risks, and being proactive.”