AI compliance plan
Your AI compliance plan.
33 duties from 5 enacted laws in 1 state. Each one says who it falls on, when it starts and where in the law it comes from. The next start date is January 1, 2027.
The plan at a glance
33duties from 5 laws
6start in the next 90 days; the next on January 1, 2027
1law lets people sue over a violation
1law gives a set number of days to fix a violation before enforcement
Download CSV and calendar with Pro
Open as a checklist
Pro turns this plan into a spreadsheet for audit files and a calendar of every start date. The plan on this page stays open to everyone.
Already in effect 17 duties
These duties are in force today.
| Starts | Law | Who | What it requires | How often | Source |
|---|---|---|---|---|---|
| October 1, 2025 | Connecticut intimate synthetically created image crime (Public Act 25-168, section 261) | Person | Do not knowingly disseminate a synthetic image showing another identifiable person's intimate parts or sexual intercourse, without consent, intending viewers to believe it is real, where harm results.Applies when: The person knows the image is synthetically created and disseminates it to one or more people. | Ongoing | P.A. 25-168 § 261(a) |
| July 1, 2026 | Connecticut data privacy act changes on profiling, automated decisions and LLM training disclosure (Public Act 25-113, SB 1295) | Controller | State in the privacy notice whether the controller collects, uses or sells personal data to train large language models.Applies when: From July 1, 2026. | Ongoing | C.G.S. 42-520(b)(1)(H), as amended by Public Act 25-113, § 9 |
| August 1, 2026 | Connecticut data privacy act changes on profiling, automated decisions and LLM training disclosure (Public Act 25-113, SB 1295) | Controller | Conduct an impact assessment of profiling used for significant decisions, covering purpose, risks and mitigation, data inputs and outputs, metrics and limits, transparency and post-deployment monitoring.Applies when: Profiling for decisions with a legal or similarly significant effect, for processing created on or after August 1, 2026. | Ongoing | C.G.S. 42-522(c), (g)(2), as amended by Public Act 25-113, § 11 |
| October 1, 2026 | Connecticut AI companions, automated employment decisions, frontier AI and provenance law (Public Act 26-15, SB 5) | Subscription-based provider | Before entering into or renewing an AI subscription or charging a fee, give the consumer written notice of key terms and receive the consumer's written acceptance.Applies when: Offering AI technology to Connecticut residents under a paid subscription. | Each time it happens | Public Act 26-15, § 1(b)(1) |
| October 1, 2026 | Connecticut AI companions, automated employment decisions, frontier AI and provenance law (Public Act 26-15, SB 5) | Subscription-based provider | In the notice, disclose material terms, including usage limits and whether access or functionality can be limited or reduced; at renewal, disclose any new or changed limits.Applies when: Each initial subscription and renewal. | Each time it happens | Public Act 26-15, § 1(b)(2) |
| October 1, 2026 | Connecticut AI companions, automated employment decisions, frontier AI and provenance law (Public Act 26-15, SB 5) | Frontier developer | Do not adopt rules or contracts that penalize protected disclosures, or retaliate against covered employees who reasonably believe a catastrophic risk poses specific and substantial danger.Applies when: On or after October 1, 2026. | Ongoing | Public Act 26-15, § 2(b) |
| October 1, 2026 | Connecticut AI companions, automated employment decisions, frontier AI and provenance law (Public Act 26-15, SB 5) | Frontier developer | Give all covered employees clear notice of their rights, by workplace posting plus notice to new hires and remote workers, or at least annual written notice with acknowledgment.Applies when: On or after October 1, 2026. | Ongoing | Public Act 26-15, § 2(d) |
| October 1, 2026 | Connecticut AI companions, automated employment decisions, frontier AI and provenance law (Public Act 26-15, SB 5) | Covered provider (generative AI) | Where commercially and technically reasonable, embed tamper-resistant provenance data in audio, image or video content the system creates or materially alters, using methods such as C2PA.Applies when: On or after October 1, 2026. | Ongoing | Public Act 26-15, § 15(b)(1) |
| October 1, 2026 | Connecticut price setting device disclosure, surveillance pricing ban and facial recognition rules (Public Act 26-64, SB 4) | Person doing business in the state that uses a price setting device | Show with the online price "THIS PRICE WAS INCREASED BY A PRICE SETTING DEVICE USING YOUR PERSONAL DATA", or a substantially similar one, readily visible to the average consumer.Applies when: The person advertises, promotes, labels or displays online a price set by a price setting device, other than a discounted price for an online transaction. | Ongoing | Public Act 26-64, § 11(b)(1), (2) |
| October 1, 2026 | Connecticut price setting device disclosure, surveillance pricing ban and facial recognition rules (Public Act 26-64, SB 4) | Retail seller or third-party delivery service | Do not engage in surveillance pricing.Applies when: Any pricing of goods or services to consumers by a retail seller or third-party delivery service doing business in Connecticut. | Ongoing | Public Act 26-64, § 11(c)(1) |
| October 1, 2026 | Connecticut price setting device disclosure, surveillance pricing ban and facial recognition rules (Public Act 26-64, SB 4) | Retail seller or third-party delivery service | Prominently post the discounted price and its terms on the website in plain language, and offer that price to all consumers on those terms.Applies when: The seller relies on the discount carve-out for uniform terms, broad groups or loyalty programs. | Ongoing | Public Act 26-64, § 11(c)(2)(C) |
| October 1, 2026 | Connecticut price setting device disclosure, surveillance pricing ban and facial recognition rules (Public Act 26-64, SB 4) | Controller or consumer health data controller | Use facial recognition technology only to match still images or video against a database the controller exclusively maintains.Applies when: The controller uses facial recognition technology on its premises for security, fraud, identity theft, harassment or illegal-activity purposes. | Ongoing | C.G.S. 42-524(a)(2)(A)(i), as amended by Public Act 26-64, § 16 |
| October 1, 2026 | Connecticut price setting device disclosure, surveillance pricing ban and facial recognition rules (Public Act 26-64, SB 4) | Controller or consumer health data controller | Post clearly legible signs at each entrance where facial recognition is used, saying it is in use, with a conspicuous hyperlink or QR code to the facial recognition policy.Applies when: The controller uses facial recognition technology on its premises for those purposes; entrances limited to authorized employees are excepted. | Ongoing | C.G.S. 42-524(a)(2)(A)(ii), as amended by Public Act 26-64, § 16 |
| October 1, 2026 | Connecticut price setting device disclosure, surveillance pricing ban and facial recognition rules (Public Act 26-64, SB 4) | Controller or consumer health data controller | Include contact information for the Attorney General's office in the facial recognition policy.Applies when: The controller maintains a facial recognition policy linked from its entrance signs. | Ongoing | C.G.S. 42-524(a)(2)(B)(i), as amended by Public Act 26-64, § 16 |
| October 1, 2026 | Connecticut synthetic intimate image civil action and platform takedown (Public Act 26-55, HB 5312) | Covered platform | Establish and maintain a process for a harmed individual or the Attorney General to request removal of a synthetically created intimate image.Applies when: On or after October 1, 2026. | Ongoing | Public Act 26-55, § 2(a) |
| October 1, 2026 | Connecticut synthetic intimate image civil action and platform takedown (Public Act 26-55, HB 5312) | Covered platform | Post a clear and conspicuous, plain-language notice on the platform describing its responsibilities and how to submit a removal request; a link to another page is allowed.Applies when: On or after October 1, 2026. | Ongoing | Public Act 26-55, § 2(b) |
| October 1, 2026 | Connecticut synthetic intimate image civil action and platform takedown (Public Act 26-55, HB 5312) | Individual | Do not knowingly disseminate a synthetically created intimate image of another person with intent to harm; the person harmed may sue for damages and an injunction.Applies when: On or after October 1, 2026. | Ongoing | Public Act 26-55, § 1(a) |
Starting in the next 90 days 6 duties
Time to prepare is short for these.
| Starts | Law | Who | What it requires | How often | Source |
|---|---|---|---|---|---|
| January 1, 2027 | Connecticut AI companions, automated employment decisions, frontier AI and provenance law (Public Act 26-15, SB 5) | Large frontier developer | Maintain a process for anonymous good-faith employee reports, give the reporting employee reasonable updates, and share reports with officers and directors at least quarterly.Applies when: Large frontier developers, by January 1, 2027. | Ongoing | Public Act 26-15, § 2(c) |
| January 1, 2027 | Connecticut AI companions, automated employment decisions, frontier AI and provenance law (Public Act 26-15, SB 5) | Operator (AI companion) | Use evidence-based methods to detect expressions of suicide, self-harm or imminent violence, block outputs encouraging them, and refer users to resources including the 9-8-8 Lifeline.Applies when: Operating an AI companion for Connecticut users. | Ongoing | Public Act 26-15, § 5(a)(1)(A) |
| January 1, 2027 | Connecticut AI companions, automated employment decisions, frontier AI and provenance law (Public Act 26-15, SB 5) | Operator (AI companion) | Take reasonable measures so the companion does not claim to be human, including when asked, and publish the safety protocol prominently on the operator's website.Applies when: Operating an AI companion for Connecticut users. | Ongoing | Public Act 26-15, § 5(a)(1)(B), (a)(2) |
| January 1, 2027 | Connecticut AI companions, automated employment decisions, frontier AI and provenance law (Public Act 26-15, SB 5) | Operator (AI companion) | Clearly disclose the user is talking to an AI companion: persistently, or at the first interaction each 24 hours, then hourly for minors and every three hours for adults.Applies when: A reasonable user could believe they are interacting with a human. | Ongoing | Public Act 26-15, § 5(b) |
| January 1, 2027 | Connecticut AI companions, automated employment decisions, frontier AI and provenance law (Public Act 26-15, SB 5) | Operator (AI companion) | For minors, use industry-standard measures preventing encouragement of self-harm or violence, unqualified mental health services, romantic or sexual interaction, and manipulative engagement tactics.Applies when: The operator knows or has reason to believe the user is under 18. | Ongoing | Public Act 26-15, § 6(a)(1) |
| January 1, 2027 | Connecticut AI companions, automated employment decisions, frontier AI and provenance law (Public Act 26-15, SB 5) | Operator (AI companion) | Make tools available to minor users and their parents or guardians to manage screen time and account settings.Applies when: Operating an AI companion for Connecticut users. | Ongoing | Public Act 26-15, § 6(b) |
Starting later 3 duties
Dates further out, in order.
| Starts | Law | Who | What it requires | How often | Source |
|---|---|---|---|---|---|
| October 1, 2027 | Connecticut AI companions, automated employment decisions, frontier AI and provenance law (Public Act 26-15, SB 5) | Developer | Give deployers the information they need to meet the interaction disclosure and pre-decision notice duties.Applies when: Technology marketed or licensed for employment decisions and deployed in Connecticut on or after October 1, 2027. | Ongoing | Public Act 26-15, § 8(a), (b) |
| October 1, 2027 | Connecticut AI companions, automated employment decisions, frontier AI and provenance law (Public Act 26-15, SB 5) | Deployer | Disclose in plain language to employees or applicants who interact with the technology that they are doing so, unless obvious to a reasonable person.Applies when: Technology deployed on or after October 1, 2027; a developer may assume this duty by contract. | Each time it happens | Public Act 26-15, § 9; § 8(c) |
| October 1, 2027 | Connecticut AI companions, automated employment decisions, frontier AI and provenance law (Public Act 26-15, SB 5) | Deployer | Before the decision, give written notice of the deployment, its purpose and decision type, trade name, personal data categories and sources, and contact information.Applies when: Before an employment-related decision using technology deployed on or after October 1, 2027. | Each time it happens | Public Act 26-15, § 10 |
Triggered by an event 7 duties
These apply when something happens, such as a request, an incident or a decision about a person. Each row says what triggers it.
| Starts | Law | Who | What it requires | How often | Source |
|---|---|---|---|---|---|
| When triggered | Connecticut AI companions, automated employment decisions, frontier AI and provenance law (Public Act 26-15, SB 5) | Developer or deployer | When withholding information as a trade secret or legally protected, send a notice saying so and giving the reason.Applies when: Information is withheld under section 11(a). | Each time it happens | Public Act 26-15, § 11(b) |
| When triggered | Connecticut AI companions, automated employment decisions, frontier AI and provenance law (Public Act 26-15, SB 5) | Employer | Disclose, in the form the Labor Commissioner sets, whether layoffs in a filed WARN notice relate to the employer's use of AI or other technological change.Applies when: When filing a written layoff notice under 29 U.S.C. 2102(a). | Each time it happens | Public Act 26-15, § 26 |
| When triggered | Connecticut data privacy act changes on profiling, automated decisions and LLM training disclosure (Public Act 25-113, SB 1295) | Controller | Honor a consumer's request to opt out of profiling in furtherance of any automated decision that produces a legal or similarly significant effect.Applies when: On a consumer opt-out request, from July 1, 2026. | Each time it happens | C.G.S. 42-518(a)(5)(C), as amended by Public Act 25-113, § 8 |
| When triggered | Connecticut data privacy act changes on profiling, automated decisions and LLM training disclosure (Public Act 25-113, SB 1295) | Controller | If feasible, let the consumer question the profiling result, learn the reason for the decision and review the data used; for housing decisions, correct data and reevaluate.Applies when: Profiling was used in a decision with a legal or similarly significant effect and the consumer exercises the right. | Each time it happens | C.G.S. 42-518(a)(6), as amended by Public Act 25-113, § 8 |
| When triggered | Connecticut data privacy act changes on profiling, automated decisions and LLM training disclosure (Public Act 25-113, SB 1295) | Controller | Respond to consumer requests within 45 days, extendable once by 45 days with notice; decide appeals and inform the consumer in writing within 60 days.Applies when: On receipt of a consumer request or appeal. | Each time it happens | C.G.S. 42-518(c), (d), as amended by Public Act 25-113, § 8 |
| When triggered | Connecticut data privacy act changes on profiling, automated decisions and LLM training disclosure (Public Act 25-113, SB 1295) | Controller | Disclose relevant impact assessments to the Attorney General when required; they remain confidential and exempt from public disclosure.Applies when: When the Attorney General requires disclosure. | Each time it happens | C.G.S. 42-522(d), as amended by Public Act 25-113, § 11 |
| When triggered | Connecticut synthetic intimate image civil action and platform takedown (Public Act 26-55, HB 5312) | Covered platform | Remove the image as soon as possible and within 48 hours of a valid request, and make reasonable efforts to identify and remove copies.Applies when: On receipt of a valid removal request. | Each time it happens | Public Act 26-55, § 2(c) |
Law by law
Who each law covers, who enforces it, the penalties, whether people can sue and what the text leaves open. Open a law to see it; every line cites its section.
Connecticut AI companions, automated employment decisions, frontier AI and provenance law (Public Act 26-15, SB 5)
16 duties · checked November 15, 2026
Public Act 26-15 (Substitute SB 5, 2026 Regular Session), approved May 27, 2026; Sections 1, 2, 4 to 15 and 26 (new sections and amendments to C.G.S. 46a-60 and 46a-81c). Official text · Full law page
Who it covers
- Subscription-based provider. A person doing business in Connecticut that offers an AI technology to a Connecticut resident under a paid subscription. Public Act 26-15, § 1(a)
- Frontier developer / large frontier developer. A person doing business in Connecticut that trained or began training a foundation model with more than 10^26 operations; large frontier developers also have, with affiliates, more than $500 million annual gross revenue. Threshold: More than 10^26 integer or floating-point operations; large frontier developer: more than $500,000,000 annual gross revenue in the prior calendar year Public Act 26-15, § 2(a)
- Operator (AI companion). An individual or business entity that provides or operates an AI companion for users in Connecticut. Public Act 26-15, § 4(1), (5)
- Developer / deployer of automated employment-related decision technology. A person doing business in Connecticut that develops or substantially modifies, or deploys in Connecticut, technology whose output is a substantial factor in an employment-related decision. Public Act 26-15, § 7
- Covered provider (generative AI). A non-governmental person that creates, codes or produces a publicly accessible generative AI system for images, audio or video. Threshold: More than 1,000,000 users per month Public Act 26-15, § 15(a)
- Employer. An employer that files a written layoff notice with the Labor Department under 29 U.S.C. 2102(a) (federal WARN Act). Public Act 26-15, § 26
Enforcement
- Enforcer: Attorney General, exclusively, under CUTPA for sections 1, 5, 6, 8 to 11 and 15; Attorney General in Hartford Superior Court for section 2. A web search on November 15, 2026 found no court challenge to these sections.
- Penalty: Unfair or deceptive trade practice under C.G.S. 42-110b; CUTPA penalty amounts are not stated in the act, violations of the AI subscription, AI companion, automated employment decision and provenance sections. Public Act 26-15, §§ 1(c), 5(c), 6(c), 12, 15(c)
- Penalty: Civil penalty of up to $1,000 per violation, plus injunctive relief and the state's investigation costs, expert fees and attorneys' fees, frontier developer whistleblower and notice violations. Public Act 26-15, § 2(e)
- Can people sue? No Public Act 26-15, §§ 1(c), 5(c), 12, 15(c) (C.G.S. 42-110g does not apply); § 6(c) and § 2(e) are silent
- Time to fix before enforcement: 60 days (Applies only to violations of sections 8 to 11 occurring on or before December 31, 2027, when the Attorney General finds the violation curable)
Exemptions
- Not AI companions: business operational chatbots not marketed as companions, limited in-game characters, standalone voice assistants, narrow educational tools, qualifying health care tools, narrow task tools, and developers that do not decide the use case or deployment. Public Act 26-15, § 4(1)
- Not covered technology: spreadsheets, spam filters and tools giving purely descriptive or statistical information; not employment-related decisions: nonmaterial task changes, health and safety, scheduling and productivity monitoring. Public Act 26-15, § 7
- Sections 8 to 10 do not require disclosure of trade secrets or information protected by state or federal law. Public Act 26-15, § 11(a)
- Provenance duty excludes personal identifying information, trade secrets, business-to-business uses, products offering solely video games or interactive experiences, and tools used only for upscaling, noise reduction or compression. Public Act 26-15, § 15(b)(2)
What the text leaves open
- Section 6(c) makes violations a CUTPA practice enforced solely by the Attorney General but, unlike sections 1, 5 and 15, does not say C.G.S. 42-110g is inapplicable; whether a private CUTPA action is available is unclear.
- CUTPA civil penalty amounts (C.G.S. 42-110o) were not opened; the General Assembly's statutes pages refused the reader.
- Section 39 (algorithmic feeds, warnings and default limits for minors on covered social media platforms, effective January 1, 2028) and the state-agency, academy, pilot and study sections are not covered in this file.
- Section 26 sets no penalty and names no enforcer.
- Section 14's bar on the automated-technology defense applies only to its subdivision (1) (sexual orientation and civil union status).
Connecticut data privacy act changes on profiling, automated decisions and LLM training disclosure (Public Act 25-113, SB 1295)
6 duties · checked November 15, 2026
Public Act 25-113 (SB 1295, 2025 Regular Session), approved June 24, 2025; Sections 5, 6, 8, 9 and 11 amending C.G.S. 42-515, 42-516, 42-518, 42-520 and 42-522. Official text · Full law page
Who it covers
- Controller. A person doing business in Connecticut or targeting residents that, in the prior calendar year, controlled or processed personal data of at least 35,000 consumers, controls or processes sensitive data, or offers personal data for sale. Threshold: Not fewer than 35,000 consumers (excluding data processed only to complete a payment transaction); no numeric threshold for sensitive data or sale of personal data C.G.S. 42-516, as amended by Public Act 25-113, § 6
Enforcement
- Enforcer: Attorney General under the Connecticut Data Privacy Act enforcement section (C.G.S. 42-525), which this act does not amend and which was not opened. A web search on November 15, 2026 found no court challenge to these provisions.
- Penalty: the law does not set an amount.
- Can people sue? The law does not say Public Act 25-113, §§ 5 to 12
- Time to fix before enforcement: The law does not say
Exemptions
- Personal data controlled or processed solely to complete a payment transaction does not count toward the thresholds. C.G.S. 42-516, as amended by Public Act 25-113, § 6
- Processing personal data for profiling in furtherance of an automated decision is permitted only to the extent necessary to detect or correct bias, with safeguards and deletion afterward. C.G.S. 42-524(b)(4), as amended by Public Act 25-113, § 12
What the text leaves open
- Enforcement, any cure period and private action are governed by C.G.S. 42-525, which was not opened; the General Assembly's statutes pages refused the reader.
- Profiling and impact assessment changes for online services used by minors (C.G.S. 42-529a, 42-529b, amended by sections 15 and 16) are not covered in this file.
- The entity and data exemptions in C.G.S. 42-517 (amended by section 7) were not read in detail.
Connecticut intimate synthetically created image crime (Public Act 25-168, section 261)
1 duty · checked November 15, 2026
Public Act 25-168 (HB 7287, 2025 Regular Session, state budget act), approved June 30, 2025; section 261 (new). Official text · Full law page
Who it covers
- Person. Any person who intentionally disseminates a synthetically created intimate image of another identifiable person. P.A. 25-168 § 261(a)
Enforcement
- Enforcer: Section 261 creates a crime and names no specific enforcer. A web search on November 15, 2026 found no lawsuit or court order against this section; court dockets were not searched.
- Penalty: Class D misdemeanor; class A misdemeanor if the person acquired or created the image intending to harm (subdivision (a)(5)), dissemination to one person by any means. P.A. 25-168 § 261(d)(1)
- Penalty: Class C misdemeanor; class D felony if the person acquired or created the image intending to harm (subdivision (a)(5)), dissemination to more than one person through an interactive computer service, information service or telecommunications service. P.A. 25-168 § 261(d)(2)
- Can people sue? The law does not say P.A. 25-168 § 261 (no civil action in this section; a separate 2026 act, P.A. 26-55, has its own file)
- Time to fix before enforcement: The law does not say
Exemptions
- Images resulting from voluntary exposure or sexual intercourse in a public place or a commercial setting. P.A. 25-168 § 261(c)
- Images of a person who is not clearly identifiable, unless other identifying information accompanies the image. P.A. 25-168 § 261(c)
- Providers of an interactive computer service, information service or telecommunications service are not made liable for content provided by another person. P.A. 25-168 § 261(e)
What the text leaves open
- The codified General Statutes section number for section 261 was not confirmed on an official page; the statute pages refused the reader.
- Jail terms and fines for class D, C and A misdemeanors and class D felonies are in other statutes that were not opened.
- Whether Public Act 26-55 (HB 5312, mapped in CT-HB5312) or another 2026 act changed section 261 was not checked against its text in this run.
Connecticut price setting device disclosure, surveillance pricing ban and facial recognition rules (Public Act 26-64, SB 4)
6 duties · checked November 14, 2026
Public Act 26-64 (SB 4, 2026 Regular Session), approved May 27, 2026; Section 11 (new); Sections 12 and 16 amending C.G.S. 42-515 and 42-524. Official text · Full law page
Who it covers
- Person doing business in the state that uses a price setting device. Any individual or legal entity doing business in Connecticut that uses a price setting device, other than to set a discounted price for an online transaction, and advertises, labels or displays the resulting price online. Public Act 26-64, § 11(b)(1), (a)(5)
- Retail seller. A retailer as defined in C.G.S. 12-407, to the extent it makes retail sales of tangible personal property, including retail food establishments, doing business in Connecticut. Public Act 26-64, § 11(a)(8), (c)(1)
- Third-party delivery service. A company outside a retail food establishment's own operations that facilitates delivery or online ordering for that establishment's customers, doing business in Connecticut. Public Act 26-64, § 11(a)(10), (c)(1)
- Controller or consumer health data controller. A controller or consumer health data controller under the Connecticut data privacy law that uses facial recognition technology on its premises for security, fraud, identity theft, harassment or illegal-activity purposes. Public Act 26-64, § 16 (C.G.S. 42-524(a)(2))
Enforcement
- Enforcer: Connecticut Attorney General, solely, for Section 11; a violation is an unfair or deceptive trade practice under C.G.S. 42-110b(a). Public Act 26-64 does not itself say how the facial recognition requirements are enforced; the privacy law's enforcement section was not read.
- Penalty: the law does not set an amount.
- Can people sue? No Public Act 26-64, § 11(e) (no private right of action and no grounds for an action under C.G.S. 42-110g; covers Section 11 only)
- Time to fix before enforcement: The law does not say
Exemptions
- A price setting device used only to establish a discounted price for an online transaction does not trigger the disclosure. Public Act 26-64, § 11(b)(1)
- Persons licensed, authorized or registered under Connecticut insurance laws; financial institutions and affiliates to the extent subject to Title V of the Gramm-Leach-Bliley Act; and banks and holding companies with a Connecticut office supervised by the Banking Commissioner. Public Act 26-64, § 11(d)(1)-(3)
- Not surveillance pricing: a discounted consumer service offered to retain a customer, and price differences justified by cost to serve (such as selections, delivery distance or time) or by timing (such as supply and demand). Public Act 26-64, § 11(c)(2)(A), (B)
- Not surveillance pricing: discounts on publicly disclosed uniform terms, for broad groups such as veterans, seniors, students or teachers, or through a loyalty program the consumer actively joins, if the seller posts the terms online and offers them to all consumers. Public Act 26-64, § 11(c)(2)(C)
- Facial recognition signs are not required at entrances to areas limited to authorized employees. Public Act 26-64, § 16 (C.G.S. 42-524(a)(2)(A)(ii))
What the text leaves open
- Enforcement, penalties, any cure period and any private right of action for the facial recognition requirements depend on the data privacy law's enforcement section (C.G.S. 42-525), which the act does not reproduce and which was not read.
- The facial recognition requirements sit in C.G.S. 42-524, the privacy law section on activities the law does not restrict; how they interact with the rest of that section was read only in paraphrase.
- Section 13 amends consumer rights on profiling used for automated decisions (C.G.S. 42-518). It was not extracted because the act alone does not show which of that text is new.
- Who is a controller, including any consumer-count thresholds, is set by parts of the privacy law not read here.
- Dollar penalties under the Connecticut Unfair Trade Practices Act for Section 11 violations were not read.
Connecticut synthetic intimate image civil action and platform takedown (Public Act 26-55, HB 5312)
4 duties · checked November 15, 2026
Public Act 26-55 (Substitute HB 5312, 2026 Regular Session), approved May 26, 2026; Sections 1 and 2 (new). Official text · Full law page
Who it covers
- Covered platform. A covered platform as described in 47 U.S.C. § 223a (the federal TAKE IT DOWN Act definition). Public Act 26-55, § 2(a)
- Individual. An individual who knowingly disseminates a synthetically created intimate image of another person with intent to harm. Public Act 26-55, § 1(a)
Enforcement
- Enforcer: Attorney General, by petition to the Superior Court, for platform duties; harmed individuals may sue disseminators. A web search on November 15, 2026 found no court challenge to this law.
- Penalty: Civil penalty of up to $25,000 per day for each individual harmed, a covered platform's violation of section 2. Public Act 26-55, § 2(e)
- Penalty: Economic and noneconomic damages, including emotional distress, punitive damages, injunction, and costs and reasonable attorneys' fees to the prevailing party, knowing dissemination of a synthetically created intimate image with intent to harm. Public Act 26-55, § 1(a)
- Can people sue? Yes Public Act 26-55, § 1(a), (d)
- Time to fix before enforcement: None
Exemptions
- A covered platform acting in good faith under section 2 is not liable for any claim based on disabling access to or removing the image. Public Act 26-55, § 2(d)
What the text leaves open
- Section 2(e) ties the per-day penalty to an individual harmed as described in section 1; how the per-day count works is not stated.
- The private action must be brought within two years of discovering the dissemination (§ 1(d)); it is against the disseminating individual, and the act does not say whether platforms can be sued under section 1.
- The definitions of disseminate, harm and synthetically created image in C.G.S. 53a-189d were not opened.
Other enacted laws to check
These 2 enacted AI laws are in the states you chose, but they are not yet mapped duty by duty, so they are not in the plan above. Each page has a summary and the official source.
- Connecticut SB01103: An Act Concerning Artificial Intelligence, Automated Decision-making And Personal Data Privacy. (effective July 1, 2023)
- Connecticut SB924: An Act Concerning Motor Vehicle Registration Notice, the International Registration Plan, Carriers, School… (effective July 12, 2019)
Information, not legal advice. This plan summarizes what the official texts of the laws listed say. It does not decide whether a law applies to your organization; that turns on facts such as your size, your role as a developer or deployer, and how you use AI. Laws change, and courts and regulators can read them differently. Check the official text linked with each duty and talk to a qualified lawyer before acting. Using this page does not create an attorney-client relationship. See our terms of service.
How the plan is built
Each law in the plan was read from its official text, on the legislature’s or state’s own website. 265 of the 326 have also been read a second time to confirm every date, threshold, penalty and enforcer; the rest have had one full read, and each shows the date it was last checked. Each duty is written in plain English in 30 words or fewer and carries the section it comes from, with a link.
Where a law is silent, the plan says so. It does not borrow a penalty from another statute or guess at a deadline. A law that is repealed or replaced on a known date shows that end date, and its duties leave the plan once the date passes. The date each law was last checked appears with it.
The plan is built fresh from these records every time the page loads, so it changes as soon as a law is added or re-checked. To report an error, use the corrections page. For how we find laws and decide what counts as an AI law, see our methodology. If you are not sure which laws touch your business at all, start with Am I Affected?
Common questions
What does an AI compliance plan cover?
Each duty an enacted state AI law places on a business or other regulated party: who it applies to, what it requires, when it starts, how often it recurs, who enforces it, the penalties and whether people can sue. The builder covers 1,235 duties in 326 enacted laws across 50 states, and every duty links to the section of law it comes from.
Where does the information come from?
From the official text of each law: the enrolled bill, session law or codified statute, opened on the legislature's or state's own website. 265 of the 326 laws have also been read a second time to confirm every date, threshold, penalty and enforcer, and the date each law was last checked is shown with it. Where a law is silent on a point, such as a penalty amount, the plan says the law does not say rather than filling the gap. Law firm summaries and news reports are never used as sources.
Does the plan include every AI law in a state?
Not yet. It includes the enacted laws we have mapped duty by duty. When you choose a state, its other enacted AI laws are listed separately with links, so nothing is left out of view. New laws are added as they are read. When a law is repealed or replaced on a set date, its duties show that end date and leave the plan once it passes.
How do I know which duties apply to my company?
Start with the 'who it covers' entry for each law: many apply only above a size or revenue threshold, only to developers or only to deployers, or only in one industry. The plan quotes those conditions from the text. Whether your company meets them depends on facts only you and your counsel know.
Is this legal advice?
No. It is information drawn from official legal texts, organized so you can see what each law requires. Use it to brief your team and your lawyers, not in place of them.
What does Pro add?
The same plan as a CSV file for spreadsheets and audit files, and as a calendar file (.ics) with every dated duty as an event that links back to the law. Both are built from the states and uses you pick. The plan on this page, and printing it, are open to everyone.