Connecticut's CART Act: Inside SB5, One of the Nation's Most Comprehensive State AI Laws

On June 2, 2026, Governor Ned Lamont signed Senate Bill 5 into law as Public Act 26-15, formally the Connecticut Artificial Intelligence Responsibility and Transparency Act — the CART Act. The signature closed a two-year arc. In 2024, Connecticut’s SB2 passed the Senate but died in the House after Lamont signaled a veto, in part because it borrowed Colorado’s “algorithmic discrimination” framework and the duty-of-care and impact-assessment machinery that came with it. SB5 is the answer the administration was willing to sign: a sprawling, 39-section omnibus that regulates AI across employment, consumer chatbots, frontier model safety, synthetic-content provenance, and the online experiences of minors — while pointedly declining to import the “algorithmic discrimination” construct that drew the governor’s objection the first time around.

The result is one of the most comprehensive state AI statutes in the country, and one of the structurally most interesting. Rather than a single high-risk regime, CART is a bundle of discrete obligations aimed at different actors, with compliance deadlines staggered from October 1, 2026 through January 1, 2028. For any organization with employees, customers, or users in Connecticut, the practical question is not “does this apply to me” but “which sections apply to me, and when.”

Why This Matters Beyond Connecticut

Connecticut is not acting in a vacuum. It joins a fast-growing patchwork of state AI and privacy laws that compliance teams must now reconcile against one another. The two most cited comparators are Colorado’s AI Act — the first comprehensive state framework, built around “algorithmic discrimination” in high-risk systems — and the Texas Responsible Artificial Intelligence Governance Act (TRAIGA), which took a lighter-touch, intent-based approach. On the frontier-model side, Connecticut’s whistleblower and safety provisions echo developments like the New York RAISE Act and California’s Transparency in Frontier Artificial Intelligence Act.

What sets CART apart is breadth. Colorado regulates high-risk decision systems; Texas focuses on prohibited uses and government deployment. Connecticut legislates across the full stack at once — the model developer, the deployer, the chatbot operator, the social media platform, and the employer — in one act. That ambition is also the compliance challenge: there is no single “CART program.” There are six or seven, each with its own scope, trigger, deadline, and enforcer.

Scope and the Developer–Deployer Architecture

Like Colorado, CART distinguishes between those who build AI and those who use it. In the employment context, developers must supply deployers with the information necessary for the deployer to comply with its disclosure obligations — or contractually assume those obligations themselves. The practical effect is to push allocation of responsibility into procurement contracts: deployers will want representations, warranties, and indemnities; developers will want to define exactly what they are and are not on the hook for.

This is a recurring theme. CART is less interested in mandating internal risk assessments than in forcing disclosure and assigning responsibility along the supply chain. Employment provisions, notably, impose no risk-assessment or formal AI-governance program requirement of the kind Colorado built — a deliberate contrast that keeps the law’s center of gravity on transparency rather than internal documentation.

Employment: Automated Decision Tools and the RIF Notice

The employment provisions are the part of CART most companies will feel first.

Automated employment-related decision technology (AEDT). CART covers computational processes that are a “substantial factor in making or materially influencing” employment-related decisions — hiring, promotion, discipline, discharge, and terms of employment. The definition deliberately excludes ordinary productivity tools: word processors, spreadsheets, scheduling systems, and productivity-monitoring software do not trigger the law unless they are actually driving employment decisions. Decisions involving only nonmaterial changes are also out of scope.

Effective October 1, 2027, a deployer using AEDT must, before an adverse decision, give written notice that the technology is in use and disclose its purpose, the type of decision involved, the technology’s trade name, the categories of personal data analyzed, the data sources, and a point of contact. No disclosure is required where it would be obvious to a reasonable person that they are interacting with automated technology. Where an adverse decision results, the employer must provide a high-level statement of the principal reasons, the AEDT’s role, and the type and source of data used, plus an opportunity to examine and correct personal data. Developers must, by the same October 1, 2027 date, furnish deployers the information they need to satisfy these obligations.

Notably, CART does not grant the human-review or reconsideration (“appeal”) right that Colorado’s law contemplates, and there is no private right of action for the employment provisions — enforcement is the Attorney General’s alone, with a 60-day cure period available for violations occurring before December 31, 2027.

The anti-discrimination amendment. Separately, and earlier — effective October 1, 2026 — CART amends the Connecticut Fair Employment Practices Act so that an employer’s use of AEDT is expressly “not a defense” to a discriminatory-practice complaint. Courts may consider anti-bias testing as a mitigating factor. This is how Connecticut addresses discrimination without using the contested “algorithmic discrimination” label: it leaves liability under existing civil-rights law and forecloses the “the algorithm did it” defense.

The RIF / WARN notice rule. One of the most distinctive provisions requires employers covered by the federal WARN Act — generally those with 100 or more employees — to disclose to the Connecticut Department of Labor whether a covered workforce reduction “is related to the employer’s use of artificial intelligence or another technological change.” This took effect October 1, 2026, making it one of the first obligations to bite. It is, in effect, an AI-attribution requirement bolted onto mass-layoff notices, and it gives the state visibility into AI-driven displacement.

Consumer Chatbots: The AI Companion Rules

Effective January 1, 2027, CART regulates “AI companions” — models that communicate with individuals in natural language and simulate human conversation through text, audio, or video. Customer-service chatbots are carved out, as are “healthcare support systems without anthropomorphic features.” Operators must:

• Maintain protocols to detect expressions of suicide, self-harm, or imminent violence and refer users to crisis resources.
• Clearly and conspicuously disclose that the user is communicating with AI, not a human — initially and on a recurring basis. The disclosure cadence is hourly for users known to be minors and every three hours for adults, and operators are responsible for preventing the companion from claiming to be human or generating output that contradicts its non-human status.

For users under 18, the law goes further, prohibiting companions that could foreseeably encourage self-harm, suicidal ideation, violence, disordered eating, or substance abuse; offer mental-health services or discourage seeking professional help; engage in romantic or sexual interaction; prioritize user validation over factual accuracy; or implement reward systems engineered to maximize engagement. A narrow exception allows licensed mental-health professionals to deploy companions with patients only where supported by robust, independent, peer-reviewed clinical-trial data on safety and efficacy. Operators get a safe harbor where they reasonably determined a user was 18 or older.

The companion provisions are among the few in CART with teeth for individuals: in addition to Attorney General enforcement, users and parents may sue within three years for actual and punitive damages plus attorney’s fees.

Frontier Model Developers

CART imports the compute-based definition of a “frontier developer” now familiar from California and other frontier-safety laws: a person who trains, or intends to train, a foundation model using more than 10^26 integer or floating-point operations. It then layers a revenue distinction on top, defining “large frontier developers” as those with more than $500 million in annual gross revenue and reserving the most robust governance duties for them.

Effective October 1, 2026, frontier developers must establish anonymous internal channels for employees to report catastrophic-risk concerns, investigate those reports, take action to address identified dangers, provide updates to whistleblowers, and deliver regular (quarterly) reports to officers and directors. Retaliation against reporting employees is prohibited, with whistleblower protections tied to existing state statute. Unlike most of CART, the frontier-safety provisions are enforced by the Commissioner of Consumer Protection rather than the Attorney General, with civil penalties up to $1,000 per violation plus recovery of investigation costs and attorney’s fees.

Generative-AI Provenance and Synthetic Content

CART addresses synthetic media on two tracks.

First, developers of generative AI must ensure that AI-generated audio, image, and video content is marked and detectable as such, to the extent technically feasible. Text-only content is excluded, as is content unlikely to mislead a reasonable person; artistic, satirical, and assistive-editing uses receive limited or no marking obligations, and there are carve-outs for crime detection and prosecution.

Second, large platform providers — those exceeding one million monthly users — must embed tamper-resistant provenance data into audio, image, and video they distribute, to the extent commercially and technically reasonable, again excluding text and subject to privacy and trade-secret carve-outs. The marking and provenance obligations phase in over 2026–2027 alongside the rest of the transparency package. The design goal is detectability and traceability of synthetic media rather than outright restriction.

Minors and Social Media Platforms

The latest-effective and arguably most onerous piece arrives January 1, 2028, when CART’s social media provisions take effect. Covered platforms must use commercially reasonable age-verification methods or obtain verifiable parental consent before serving algorithmic recommendations to minors. For minor accounts, platforms must apply protective defaults: a one-hour daily usage limit, private-by-default accounts, an 8:00 a.m. to 9:00 p.m. notification curfew, and blocking of sensitive content. Platforms must also display the U.S. Surgeon General’s mental-health warning and annually disclose user counts and usage statistics. These provisions are enforced as unfair or deceptive trade practices by the Attorney General.

Healthcare Carveouts and Innovation Initiatives

CART treats healthcare AI with a mix of exemption and encouragement. The AI-companion rules exclude non-anthropomorphic healthcare support systems, preserving clinical decision-support and similar tools from the chatbot regime. At the same time, the act funds state-level innovation: an AI regulatory sandbox, an “AI Academy” and talent-pipeline programs (effective July 1, 2026), K–12 computer-science and AI education (effective January 1, 2027), and state-agency obligations including an AI inventory, procurement standards, an independent-verification pilot, and a chief data officer. CART is as much an industrial-policy and government-modernization statute as a regulatory one.

Effective-Date Timeline

CART’s staggered schedule is the single most important compliance fact about it. The headline obligations land as follows:

Enforcement is split. Most provisions — chatbots, employment AEDT, provenance, social media — are enforced exclusively by the Attorney General as unfair or deceptive trade practices under CUTPA, with a 60-day cure period for AEDT violations before December 31, 2027. The frontier-model provisions are enforced by the Commissioner of Consumer Protection with per-violation penalties up to $1,000. Only the AI-companion provisions carry a private right of action.

What Compliance Teams Should Do Now

The staggered structure means there is real, near-term work, not a single 2028 deadline.

1. Map the act to your business. Determine which of CART’s regimes you fall under — employer/AEDT deployer, AEDT developer, chatbot operator, frontier developer, large platform, social media platform — because each has its own trigger and deadline. Most organizations will land in more than one.

2. Handle the October 1, 2026 items first. If you are a WARN-covered employer, build AI attribution into your layoff-notice process now. If you operate or distribute generative-AI media, scope your marking and provenance obligations. If you train frontier models, stand up anonymous reporting channels and board-level reporting.

3. Rework AEDT procurement and notices for October 1, 2027. Inventory every tool that materially influences hiring, promotion, discipline, or discharge. Renegotiate vendor contracts to secure the developer-supplied compliance information CART requires, with clear allocation of responsibility and indemnities. Draft the pre-decision and adverse-decision notice templates now; they are detailed.

4. Audit chatbots against the January 1, 2027 companion rules. Classify each conversational system as a covered companion or an exempt customer-service or non-anthropomorphic health tool. Implement AI-disclosure cadence, crisis-detection protocols, and — critically — the under-18 prohibitions and age-determination safe harbor, given the private right of action.

5. Reconcile with the broader patchwork. Align Connecticut obligations with Colorado, Texas, California, and your other state programs. Transparency and disclosure controls built for one state can often be generalized, but Connecticut’s specific notice content, disclosure cadences, and the WARN attribution rule are not interchangeable.

6. Preserve anti-bias testing evidence. Because CART forecloses the “algorithm made the decision” defense while letting courts weigh anti-bias testing as mitigation, documented, defensible testing of employment tools is now directly relevant to litigation exposure.

Conclusion

The CART Act is Connecticut’s second swing at comprehensive AI regulation, and the differences from its failed 2024 predecessor are instructive. By dropping the “algorithmic discrimination” framework and the heavy duty-of-care and impact-assessment apparatus, and by leaning on transparency, supply-chain responsibility allocation, and existing civil-rights liability, the state built something the governor would sign — and something broader in raw scope than almost any state law that came before it. For compliance teams, the takeaway is not to wait for 2028. The first obligations are already live as of October 2026, the employment notice regime arrives in October 2027, and the work of mapping, contracting, and drafting needs to start against the earliest applicable date, not the latest.

This article is provided for informational purposes only and does not constitute legal advice.