On October 1, 2026, one of the most ambitious state-level AI laws in the United States switched on. Connecticut’s Artificial Intelligence Responsibility and Transparency Act — the CART Act, enacted as Public Act 26-15, the Act Concerning Online Safety — is now enforceable, and its reach extends well beyond the state’s borders. Any company selling AI subscriptions to Connecticut residents, building frontier models, or generating synthetic media that reaches Connecticut users now has new obligations.
With Congress still without a comprehensive federal AI statute, Connecticut has effectively written a preview of what American AI regulation looks like when a state decides to stop waiting.
What the law actually requires
The CART Act grew out of Senate Bill 5, which the General Assembly adopted in May 2026 and the governor signed on May 27. Its provisions phase in on different dates, but the core of the law is live now. The headline requirements fall into four buckets.
1. Subscription transparency for AI products
Section 1 targets subscription-based providers of AI technology. Before entering into or renewing a subscription, providers must give consumers written notice of the key terms and obtain written acceptance. This sounds mundane, but it is aimed squarely at the now-standard practice of burying auto-renewal terms, price escalations, and data-use provisions in clickwrap for AI chatbots, coding assistants, and creative tools.
2. Frontier-developer safeguards
Sections 2 and 15 apply to ‘frontier developers’ — defined as organizations training foundation models above a compute threshold of 1026 floating-point operations. These developers face design and risk-management requirements: documented testing, risk assessment, and controls scaled to the model’s capabilities. The threshold is deliberately set to capture only the largest training runs, but it creates a formal regulatory category for frontier labs that did not previously exist in state law.
3. Synthetic-content disclosure
Providers whose systems generate synthetic digital content — AI-produced images, video, audio, and text — face transparency obligations. If your product creates media that could be mistaken for real, Connecticut users need to be able to tell. This is the provision with the widest blast radius: it touches every generative media tool with Connecticut users, not just frontier labs.
4. Whistleblower and worker protections
The law protects employees working on large frontier models who raise safety concerns, and it requires plain-language notice to job applicants and employees when AI is used in employment decisions. Critically, the statute states that using a third-party hiring algorithm does not insulate an employer from discrimination liability. Buying the tool does not buy you out of the risk.
The companion privacy overhaul
The AI provisions arrived alongside an expansion of the Connecticut Data Privacy Act, and the two are designed to work as a pair. The companion legislation creates a data broker regulatory framework, prohibits the sale of Connecticut residents’ genetic information, and restricts facial recognition, precise geolocation tracking, and personalized algorithmic pricing — the practice of using personal data to set different prices for different people. On pricing, Connecticut now aligns with California, New York, and Maryland, which have enacted similar restrictions.
Taken together, the package gives Connecticut one of the densest AI-and-data regulatory regimes of any US state: rules for how models are built, how AI products are sold, how synthetic media is labeled, and how personal data feeds the whole pipeline.
Why this law matters beyond Connecticut
Three features make the CART Act nationally significant.
First, it pushes obligations up the supply chain. Developers must give deployers the information they need to comply — it is not enough to follow the rules yourself; the companies building AI tools have to help the businesses using them stay compliant. That is a notable shift in how liability flows through the AI stack, and it will show up in vendor contracts well outside Connecticut.
Second, Connecticut built an on-ramp, not just a wall. SB 5 created a regulatory sandbox for AI experimentation, chatbot controls, and a study of independent verification organizations — essentially certified third-party auditors for AI systems. The message to industry is: come build here, but build accountably.
Third, it is already colliding with federal policy. The Trump administration’s December 2025 executive order on AI policy directed the Justice Department to establish an AI Litigation Task Force to challenge state AI laws deemed inconsistent with federal policy. The department set up the task force in January 2026 and in April intervened in xAI’s lawsuit against Colorado’s AI law. In March 2026 the White House sent Congress recommendations urging federal preemption of state AI laws. Connecticut’s law is exactly the kind of statute that task force was built to test.
What companies should do now
- Map your Connecticut exposure. If you sell AI subscriptions to Connecticut residents or your generative tools serve Connecticut users, the subscription-disclosure and synthetic-content provisions likely already apply to you.
- Audit employment AI. Review every automated hiring or workforce-management tool, prepare plain-language notices, and confirm your contracts do not pretend vendor indemnification erases discrimination liability — under this law, it does not.
- Classify your models. If you train foundation models, determine whether any run exceeds the 1026 FLOPs threshold and stand up the design and risk-management documentation Sections 2 and 15 require.
- Fix the vendor paperwork. Renegotiate AI vendor agreements so developers supply the compliance information deployers need. Connecticut made that a legal duty, not a favor.
- Watch the preemption fight. With 26 state attorneys general urging Congress to preserve state authority even as the federal task force pushes the other way, the rules could shift mid-compliance.
The CART Act will not be the last state AI law, and it may not survive in its current form if federal preemption advances. But as of this week, it is the law in Connecticut — and the compliance template other states are already studying. For a parallel look at how Europe is handling one slice of the same problem, see our coverage of Denmark’s deepfake consent bill.
Featured image: Ragesoss via Wikimedia Commons (CC BY-SA 3.0)
