Connecticut law sets safety and disclosure rules for artificial intelligence

AI subscription providers must disclose key terms and get the customer’s written acceptance before charging for or renewing a subscription. The rule covers providers doing business in Connecticut who offer AI technology to Connecticut residents for a fee. For a first subscription, the notice must include material information a reasonable customer needs to decide whether to buy or keep it, including limits on use and any provider power to change access or features. For renewals, the notice must explain new or changed limits and provider powers. Violations are enforced only by the Attorney General; customers have no private right to sue under this section. This requirement takes effect October 1, 2026.

AI companion operators must use crisis safety steps, identify the companion as AI when needed, and protect minor users from specified harms. These rules cover operators providing AI companions for personal use in Connecticut, with statutory exclusions for certain business, gaming, educational, health, and task-specific tools. Minor protections apply when the operator knows or has reason to believe the user is under 18. Operators must detect expressions of suicide, self-harm, or imminent violence, avoid outputs that encourage harm, and refer users to support. If crisis language appears again after a referral, the operator must refer the user to mental health services consistent with clinical best practices. If a reasonable user could think the companion is human, the operator must clearly disclose that it is AI during the interaction. For users the operator knows or has reason to believe are under 18, safeguards must address harmful advice, sexual or romantic interactions, manipulative engagement, and other listed risks; the operator must also offer screen-time and account controls. These requirements take effect January 1, 2027.

Employers must disclose when automated tools affect job decisions and explain the data those tools use. These duties apply to developers and employers doing business in Connecticut when covered tools are marketed or used to materially influence employment decisions about workers or applicants in the state. The rules cover tools that meaningfully affect decisions such as hiring, promotion, discipline, or discharge; they exclude certain routine software and decisions about scheduling, safety, or productivity monitoring. Workers and applicants must be told when they interact with a tool unless that is obvious. Before a covered decision, they must receive written details about the tool’s purpose, the decision, the types and sources of personal data used, and how the tool assesses that data. Protected information may be withheld with notice stating the reason; a developer may contract to take on some employer duties. The disclosure duties apply to tools deployed on or after October 1, 2027; the written notice about a decision must arrive before that decision.

Large public AI providers must attach hard-to-remove information showing when certain media was created or materially changed by AI. The rule covers providers whose generative AI systems are publicly available for personal use and have more than one million users per month. The rule applies only to the extent commercially and technically reasonable, and the information must let consumers assess whether the provider’s system created or materially changed the content. It excludes minor edits such as resizing or color changes, business-to-business uses, certain game experiences, and tools used only for upscaling, noise reduction, or compression. It does not require identifying people or revealing protected business information. This requirement takes effect October 1, 2026.

Covered social media operators must limit personalized recommendations to minors, display mental health warnings, and use protective default settings. These rules cover platforms where recommending, selecting, or prioritizing user media is a significant part of the service, with exceptions for platforms mainly selling goods and platforms used only for contracted educational purposes. The recommendation limit applies when media is selected using information linked to a user or device. Exceptions include recommendations based on a specific search, privacy settings, or a direct private message; verified parent or guardian consent also allows personalized recommendations for a minor. Operators must use commercially reasonable and technically feasible age checks. If they cannot determine age after using those methods, they presume the user is an adult unless they know the user is a minor. Defaults limit minors’ access to recommended content to one hour daily, restrict certain notifications and interactions, and block sensitive content; verified parents or guardians can adjust certain limits. The rules take effect January 1, 2028. Annual public reports covering the prior calendar year begin by March 1, 2028.