Source: JD Supra / BCLP

On May 27, 2026, Governor Lamont enacted Connecticut Public Act No. 26-15, the Online Safety Act, which creates a multi-part regulatory framework for AI and online platforms with chief provisions effective October 1, 2026, AI companion rules effective January 1, 2027, and covered platform requirements effective January 1, 2028. The law addresses a broad set of contexts — consumer-facing subscription AI services (explicitly requiring written notice of key terms and written consumer acceptance before use), frontier model development (including prohibitions on retaliation against whistleblowers reporting “catastrophic risks” and a mandate for large developers with over $500 million in annual revenue to set up anonymous internal reporting by January 1, 2027), automated employment-related decision technology (AEDT) and AI companion applications.

Subscription-based providers must disclose qualitative or quantitative limitations such as usage caps or accuracy limits; AEDT deployers must give a written pre-use notice to applicants and employees disclosing five specified items (deployment, purpose and nature of decision, trade name, categories of personal data analyzed and how assessed, and data sources plus deployer contact information); AI companions must detect suicide/self-harm risks, refer users to mental health resources, and not claim to be human with stricter prohibitions for minors including bans on romantic or manipulative interactions. Covered platforms must use age verification or obtain verifiable parental consent before providing algorithmic feeds to minors, show Surgeon General warnings on mental-health risks, and set minors’ default usage limits to one hour per day. Most violations are classified as unfair or deceptive trade practices enforceable solely by the Attorney General with generally no private right of action; frontier developers face civil penalties up to $1,000 per violation and potential recovery of investigation costs and attorneys’ fees if the state prevails. For certain employment-related AI violations before 2028, the Attorney General may issue a notice of violation and allow a 60-day cure period before suing.