Creative Commons License

The Connecticut State Capitol on January 7, 2025. Credit: Shahrzad Rasekh / CT Mirror

After previous failed attempts, lawmakers in Connecticut made progress on artificial intelligence legislation this year, passing a massive 39-section bill that seeks to do everything from outline AI workforce development programs to regulate the social media use of minors. 

The legislation, also known as the Connecticut Artificial Intelligence Responsibility and Transparency, or CART, Act, was result of a long-sought compromise between lawmakers in the state Senate, House and governor’s office. While some of CART Act’s provisions went into effect already, some will become law starting Oct. 1.

The legislature also passed companion legislation that expands the Connecticut Data Privacy Act, adding in additional consumer protections as well as new restrictions around surveillance pricing, geolocation data and facial recognition technology.  

Discussions of how — or even if — to place guardrails around artificial intelligence has become a national issue, one that has grown even more pressing in the months since the state’s AI and data privacy bills were signed. Warnings of AI’s potential harms have become louder, even as the Trump administration argues that national AI regulation will hamper the economy.

Here’s what to know about the wave of AI and data privacy regulations set to go into effect.

What does the AI law do? 

Lawmakers settled on a targeted framework for the state’s AI law, also known as Public Act No. 26-15, that focuses on AI chatbots, youth social media regulation and laws around employment decision-making and AI workforce development.

Some provisions took effect earlier this year, including the creation of the Connecticut AI Academy, which will help train people in AI skills. A formal state AI working group was also established to help propose additional policies and there is now a requirement that emerging technologies like quantum computing and AI be included in an economic development strategic plan created by the state.

On Oct. 1, additional parts of the law take effect. That includes disclosure requirements around AI subscriptions, new whistleblower protections for people involved with the development and deployment of large AI frontier models, and a slew of new definitions that seek to standardize what exactly is and is not artificial intelligence technology in the state.

What does the data privacy law do? 

The data privacy law focuses on consumer protections, outlining what rights residents have against some of the more controversial uses of AI like facial recognition. The new law, Public Act No. 26-64,  also includes several portions that will take effect in October. That includes new requirements that the Department of Consumer Protection create a system to help track and regulate data brokers, a ban on the sale of residents’ genetic data and restrictions on the use of facial recognition technology and surveillance pricing.

What do these laws change for employers? 

The biggest changes for employers come in the CART Act. The legislation’s possible effects on businesses was a major point of discussion during the session, and business needs were often cited as one reason why the legislation should not pass.

Some of the law’s employment-related changes start in October, including a requirement that companies prepare a framework to disclose when and how AI has been used in employment decisions. Under the new law, the use of automated employment decision-making will not protect companies from discrimination claims. Companies using automated employment decision making must have this framework in place by Oct. 1, 2027, and will need to use plain language to notify applicants and employees when and where they are interacting with AI.

What does the CART Act say about youth social media use and chatbots?

Some of the biggest changes in the CART Act revolve around the online safety and social media use of minors. The new law includes additional parental controls, new default settings that will limit when minors receive notifications and limits on what information platforms can display to younger users. 

The law also provides new regulation around AI companion chatbots, requiring that chatbots disclose that they are not human beings. The law also requires additional mental health protections, suicide and self-harm detection protocols, and disclosures around chatbots that interact with minors.

The chatbot regulations will go into effect on January 1, 2027. The youth social media regulations will go into effect one year later on January 1, 2028. 

What happens next? 

The new AI and data privacy laws come with a variety of staggered enforcement dates, and more provisions are set to go into effect between January 2027 and January 2028. A number of state agencies are responsible for different portions of the laws, though the bulk of enforcement power will rest with the Attorney General’s Office. 

While many parts of the laws have yet to become enforceable, the state legislature is already preparing to consider new regulations in the upcoming months, arguing that laws will need to regularly adapt to address new uses of artificial intelligence in the future. 

“This is a start. This is not a finish; this is not a ceiling. This is the floor,” said Sen. James Maroney, D-Milford, co-chairman of the legislature’s General Law Committee and lead architect of the new AI and data privacy regulations, during a recent press conference. “It’s just a start and we know we have a lot more to do.”

P.R. Lockhart is CT Mirror’s economic development reporter. She focuses on the relationship between state economic policy, businesses activity, and equitable community development. P.R. previously worked as an economic development reporter in West Virginia for Mountain State Spotlight, where she covered inequality, workforce development, and state legislative policy. Her career began in Washington D.C. with fellowship and staff writer roles with Mother Jones and Vox. P.R. graduated with a degree in psychology and a certificate in policy journalism and media studies from Duke University.