On 1 October 2026, Connecticut becomes one of the most consequential testing grounds for American AI and data-privacy regulation. Two new laws take effect simultaneously: the Connecticut Artificial Intelligence Responsibility and Transparency (CART) Act, and companion legislation expanding the Connecticut Data Privacy Act. Together they create a compliance regime that reaches AI subscriptions, hiring algorithms, data brokers, facial recognition, geolocation tracking and personalized pricing — and their influence will extend well beyond state borders, because most companies build once and sell everywhere.
This guide walks through what changes, who is affected, and the concrete steps businesses should take now. It is general information, not legal advice — and as the state's own lawmakers stress, more regulation is on the way.
The CART Act: what it covers
The Connecticut Artificial Intelligence Responsibility and Transparency Act introduces several first-order requirements:
- AI subscription disclosures. Providers of generative AI subscriptions must give consumers written notice of key subscription terms and obtain written acceptance before the subscription begins. If your business sells a chatbot, image generator or AI assistant on a subscription, your checkout and onboarding flows need rebuilding.
- Frontier-model whistleblower protections. The law protects whistleblowers working on large frontier AI models, a provision aimed at safety researchers and engineers who flag risks in the most powerful systems.
- Statutory definitions. The Act introduces new legal definitions establishing which technologies fall within the regulatory framework — the groundwork on which later obligations will build.
Companion privacy legislation: the broader expansion
The second law expands the Connecticut Data Privacy Act with a set of targeted prohibitions and frameworks that will sound familiar to anyone tracking state privacy law, while going further in some areas:
- Data broker regulation. A new regulatory framework governs data brokers operating with Connecticut residents' data.
- Genetic information. The law prohibits the sale of Connecticut residents' genetic information — a sharp, specific ban.
- Facial recognition. New restrictions apply to the use of facial recognition technology.
- Precise geolocation. New restrictions apply to the collection and use of precise geolocation data.
- Personalized algorithmic pricing. The law places restrictions on using personal data to set prices on goods, rent and other transactions. Connecticut thereby joins California, New York and Maryland, which have enacted similar restrictions on the use of personal data to set prices.
The pricing provision deserves special attention from retailers, landlords and travel or ticketing businesses. If your prices change based on who is browsing, you need to understand exactly where the line now sits.
AI in hiring: notice is not a shield
Among the biggest changes affecting employers are the new rules on automated employment decision processes. Applicants and employees must receive plain-language notice about when and how AI has been used in employment decisions — covering screening tools, resume parsers, video-interview analysis and similar systems.
Critically, the law is explicit that using such systems does not insulate an employer from discrimination liability. Relying on a third-party hiring algorithm does not outsource the associated legal risk. If the vendor's tool produces biased outcomes, the employer that deployed it remains exposed. This means HR teams must:
- Inventory every automated tool touching hiring, promotion and termination decisions.
- Write clear notices explaining what the tool does and when it is used — and deliver them at the right stage of the process.
- Document human oversight: who reviews the tool's outputs, how often, and what criteria override it.
- Re-examine vendor contracts to clarify who is responsible for testing, auditing and disclosing bias, because the law will look past the vendor relationship to the employer.
What's coming in 2027 and 2028
The October 2026 provisions are only the first wave. Businesses should plan for:
- 1 January 2027: Companies must alert chatbot users that they are not interacting with a human, and implement new safeguards concerning suicide, self-harm and interactions with minors.
- 1 January 2028: Additional youth-related social media provisions take effect, including parental controls and new default setting requirements that will limit when minors receive notifications, as well as limits on what information platforms can display to younger users.
Connecticut's legislature is already considering further AI regulation. Senator James Maroney, co-chairman of the legislature's General Law Committee and the lead architect of the new laws, said at a recent press conference, per CT Mirror:
"This is a start. This is not a finish; this is not a ceiling. This is the floor. It's just a start and we know we have a lot more to do."
Treat today's compliance work as the foundation for a longer build-out.
Enforcement
While several state agencies share responsibility for different portions of the laws, the bulk of the enforcement power rests with the Attorney General's Office. Businesses should assume active enforcement and keep documentation that would survive scrutiny.
A practical compliance checklist
- Build an AI use-case inventory. Companies operating in Connecticut will need to conduct an inventory of AI use cases, not merely a list of AI systems. Identify everywhere AI or personal data you collect touches hiring, pricing, facial recognition, consumer subscriptions, geolocation, genetic information and interactions with minors.
- Map each use case to its effective date. Some obligations bite on 1 October 2026; others arrive in 2027 and 2028. A single calendar that ties every use case to its deadline keeps the programme honest.
- Review consumer and employee notices. Rewrite subscription terms disclosures, chatbot disclosures and hiring-process notices in plain language, and confirm the written-acceptance mechanics for AI subscriptions.
- Audit vendors and contracts. Review AI and data vendors, and clarify contractual allocations of responsibility — for bias testing, for disclosures, for data handling — so gaps do not sit between two companies' legal teams.
- Document human oversight. For automated employment decisions, record who oversees the system, how decisions are reviewed, and how the process guards against discrimination.
- Watch the other states. The personalized-pricing provisions already align Connecticut with California, New York and Maryland; the practical approach for multi-state businesses is usually to design for the strictest applicable standard rather than maintaining fifty variants.
Frequently asked questions
Does the law apply to my company if we're not based in Connecticut?
If your business operates in Connecticut — selling subscriptions, hiring employees, or processing Connecticut residents' data there — the regime is aimed at you. Most multi-state companies find it simpler to apply the strictest standard nationally.
What counts as a "generative AI subscription"?
The law's new statutory definitions establish the framework, but broadly: paid subscriptions to generative AI products sold to consumers, with written notice of key terms and written acceptance required. Check the current statutory text or counsel for edge cases.
Yes — but you must notify applicants and employees in plain language, document human oversight, and understand that the vendor's involvement does not transfer discrimination liability away from you.
When do the chatbot and youth-safety rules apply?
Chatbot identity disclosure and self-harm/minor safeguards begin 1 January 2027; the youth social-media provisions follow on 1 January 2028.
Sources
