Last reviewed
Jun 3, 2026
Sources
16 citations
Review status
Source-backed
Revision
v1 ยท 2,145 words
Add missing citations, update stale details, or suggest a clearer explanation.
Connecticut Senate Bill 5, formally titled "An Act Concerning Online Safety" and widely referred to as the Connecticut Artificial Intelligence Responsibility and Transparency Act, is a wide-ranging state law regulating several uses of artificial intelligence at once. Governor Ned Lamont signed it on May 29, 2026, after the legislature passed it on May 1, 2026. [1][2][3] The roughly 39-section law covers companion chatbots, automated tools used in hiring and firing, provenance marking for AI-generated media, whistleblower protections at frontier AI labs, disclosure rules for subscription AI services, and notice requirements when layoffs are tied to AI. Its provisions phase in on staggered dates between October 1, 2026 and January 1, 2028. [4][5]
SB 5 is one of the broadest state AI regulation packages enacted in the United States to date. Where the Colorado Artificial Intelligence Act built a single framework around "consequential decisions" and California passed separate, targeted statutes, Connecticut bundled many distinct regimes into one omnibus bill. Several firms describe the result as narrower than Colorado's in the employment context but, on companion chatbot rules, among the most restrictive in the country. [4][6]
AI regulation had stalled in Connecticut for years before SB 5. The bill's lead author, Senator James Maroney, a Democrat from Milford, had pushed comprehensive AI legislation in earlier sessions focused on algorithmic discrimination. The state Senate designated those measures priority bills and passed them, but the House did not take them up under a veto threat from Governor Lamont. [2][7] The closest prior effort was 2025's Senate Bill 2, a comprehensive bill that cleared the Senate after a late agreement but collapsed once Lamont signaled he would veto it. Lamont had long argued that heavy regulation could hurt Connecticut businesses and slow innovation. [2][3]
What changed in 2026 was the negotiation. According to CT Mirror, the 2026 bill ended up with a similar scale and breadth to the failed 2025 SB 2, but it added provisions the governor wanted, including a regulatory sandbox and youth social media protections, which appear to have secured his support. [2] Lamont's office said he made it "a priority this session to fight for protections for Connecticut residents, especially children, from serious threats posed by emerging technology." [2] The House passed SB 5 by a vote of 131 to 17 on May 1, 2026, and the Senate passed it 32 to 4. [2][8]
SB 5 is best understood as several separate laws stitched together. The components below are the ones lawyers analyzing the statute have flagged as most significant.
| Component | Core requirement | Effective date |
|---|---|---|
| Companion chatbots (AI companions) | Self-harm detection protocols, disclosure that the user is talking to AI, restrictions on companions for minors | January 1, 2027 [4][5] |
| Synthetic media provenance | Large generative AI providers (over 1 million monthly users) must embed tamper-resistant provenance data in AI-generated audio, image, and video | October 1, 2026 [5][9] |
| Automated employment decision technology | General requirements and discrimination clarifications take effect first; deployer disclosure/notice obligations follow | October 1, 2026, then October 1, 2027 [4][10] |
| Frontier model whistleblower protections | Anti-retaliation rules for employees; large frontier developers must build anonymous reporting channels | October 1, 2026, channel by January 1, 2027 [4][9] |
| AI-related layoff notice | Employers must tell the Labor Department whether mass layoffs or plant closings relate to AI or other technology | October 1, 2026 [9][11] |
| Social media protections for minors | Age assurance, parental consent, default daily time limits on recommender systems | January 1, 2028 [4] |
The companion chatbot rules are the part of SB 5 that has drawn the most attention. The law defines an AI companion broadly, covering AI models that communicate in natural language and simulate human conversation through text, audio, or video, while carving out customer service bots. [10] Operators must use evidence-based methods to detect and respond to expressions of suicide, self-harm, or imminent violence, and must disclose to users that they are interacting with AI rather than a person. [1][4]
The minor-facing prohibitions go further. An operator may not provide a companion to a user under 18 if it is reasonably foreseeable that the companion could encourage self-harm or disordered eating, provide mental health services without authorization, discourage a user from seeking professional help, encourage illegal activity, engage in romantic or sexual interaction, or use manipulative engagement tactics. [4][10] A safe harbor protects operators who reasonably determined a user was an adult. Unlike most of the statute, the companion provisions include a private right of action: an aggrieved user, or a parent or guardian, can sue for actual and punitive damages plus attorney fees. [10] DLA Piper called this potentially the most restrictive companion bot regulation in the country, comparing it to California's AB 1064, which Governor Gavin Newsom vetoed in 2025 over concerns that similar bans could effectively prohibit children from using conversational bots at all. [10]
The employment provisions are the ones most likely to affect ordinary Connecticut businesses. SB 5 covers what it calls automated employment-related decision technology, defined as a computational process that generates output affecting an employment decision and is more than a de minimis factor. [10] Employers and deployers must disclose to applicants and employees when such a tool is used, identify its purpose and trade name, describe the categories and sources of data it relies on, and give pre-decision notice before an adverse action. [5][11] The law also amends Connecticut's anti-discrimination statute to clarify that using one of these tools is not a defense to a discrimination claim, and instructs courts to consider whether an employer conducted anti-bias testing. [10]
The employment rules phase in over two steps. The general requirements and the discrimination clarifications take effect October 1, 2026, while the deployer disclosure and notice obligations apply to tools deployed on or after October 1, 2027. [4][10] Holland & Knight notes that Connecticut's approach is narrower than Colorado's because it is scoped to employment rather than all consequential decisions, and that it omits Colorado's risk-assessment and appeal requirements. [4]
For synthetic media, SB 5 requires covered providers of generative AI systems with more than one million monthly users to embed machine-readable, tamper-resistant provenance data in content their systems create or materially alter. [5][9] The standard tracks industry frameworks such as C2PA and asks providers to make the markings effective, interoperable, robust, and reliable as far as is technically feasible. Minor edits such as resizing or color changes are excluded, with carve-outs for text-only content, assistive editing, artistic or satirical works, and law enforcement uses. [5][10] The Future of Privacy Forum and Davis Wright Tremaine place this requirement on the default October 1, 2026 effective date. [5][9]
SB 5 borrows the frontier model concept that has appeared in California and other states. It defines a frontier developer as any person doing business in Connecticut who trains, initiates training of, or trains a foundation model using more than 10 to the 26th power floating-point operations, a threshold that includes compute used for original training, fine-tuning, reinforcement learning, and material modifications. [12][13] That figure matches the marker used in Illinois's frontier bill and in several proposed federal bills. [12] A large frontier developer is one whose annual gross revenue, aggregated across affiliates under common control, exceeded $500 million in the prior calendar year. [13]
The whistleblower regime protects employees who report that a developer or its model may contribute to a catastrophic risk, defined as a foreseeable, material risk of an incident causing death or serious injury to more than 50 people, or more than $1 billion in property damage, through weapons assistance such as chemical, biological, radiological, or nuclear harms, or through autonomous cyberattacks or criminal conduct. [9][13] Anti-retaliation protections take effect with the rest of the law, and large frontier developers must stand up an anonymous internal reporting channel by January 1, 2027, investigate reports, act to eliminate dangers, and report regularly to whistleblowers and to their own officers and directors. [4][9] Penalties for frontier-developer violations run up to $1,000 per violation, plus injunctive and equitable relief. [13]
A provision the brief for this article flagged, and that Bloomberg Law highlighted, amends Connecticut's existing layoff-notice law. Employers who must serve written notice to the state Labor Department about a mass layoff or plant closing now also have to disclose whether the action relates to the employer's use of AI or other technological change. [11][14] This sits alongside, and does not replace, federal WARN Act obligations. [14] SB 5 also requires subscription-based AI services to disclose key terms before a consumer enters or renews a subscription, and it directs the state to develop a feasibility plan for a multistate AI regulatory sandbox, with recommendations due by January 1, 2028. [5][12]
Most of SB 5 is enforced exclusively by the Connecticut Attorney General, with violations treated as unfair or deceptive trade practices under the Connecticut Unfair Trade Practices Act. [4][5] There is generally no private right of action, with two notable exceptions: the automated decision-making companion provisions for minors, which allow aggrieved users or their guardians to sue, and the social media provisions for minors. [10] A discretionary 60-day right to cure applies to automated employment technology violations that occur on or before December 31, 2027, giving employers an early grace period. [4][5] The frontier-developer penalty cap of $1,000 per violation is modest compared with the much larger exposure under California's frontier law. [9][13]
SB 5 lands in a crowded and increasingly inconsistent landscape of state AI laws. On employment, Connecticut joins Illinois, Colorado, California, New York City, and Texas, but its rules are narrower than Colorado's broad consequential-decision framework and omit Colorado's developer disclosure, risk-assessment, and appeal requirements. [4][6] The Colorado Artificial Intelligence Act, the first comprehensive state AI law, was set to take effect June 20, 2026 and was itself expected to be amended. [10]
On frontier models, Connecticut's whistleblower regime is narrower than California's Transparency in Frontier Artificial Intelligence Act (SB 53), and unlike that law it stands alone without paired safety-framework or transparency-reporting mandates. [4][9] Its companion chatbot rules, by contrast, are stricter than most, and its provenance requirement echoes the marking obligations in California's AB 853. For companion bots, analyses count Connecticut among a small group of states, alongside New York and California, that have moved to regulate the technology. [10]
SB 5 takes effect against active federal efforts to limit state AI regulation. On December 11, 2025, President Trump signed an executive order titled "Ensuring a National Policy Framework for Artificial Intelligence," which directed the Attorney General to set up an AI Litigation Task Force to challenge state AI laws in court and threatened to condition some federal funding on whether states maintain what the order called onerous AI rules. A later federal framework recommended preempting state employment-related AI requirements. [15][16] Connecticut passed and signed SB 5 anyway, joining California, Colorado, and other states that have kept legislating despite the pressure. As of mid-2026 no federal preemption statute had been enacted, so laws like SB 5 remain operative and businesses must plan to comply. [16]