EveryAILaw.com

Section 2 takes effect on 2026-10-01, including the anti-retaliation rules and notice duties for frontier developers. Large frontier developers must establish the internal anonymous reporting process no later than 2027-01-01. Reports and investigation updates go to officers and directors at least quarterly, except that an accused officer or director must not receive the report or its updates. Section 2(c) requires an internal channel and board sharing; it does not require submitting these reports to the state. Catastrophic risk requires a foreseeable and material risk that a frontier model's development, storage, use, or deployment materially contributes to the death of, or serious injury to, more than fifty individuals, or more than $1 billion in damage to or loss of covered property, arising from a single incident. The incident must involve expert-level assistance creating or releasing a chemical, biological, radiological, or nuclear weapon, or conduct without meaningful human oversight, intervention, or supervision that constitutes a cyberattack or would constitute murder, assault, extortion, or theft if performed by an individual. Covered property includes tangible and intangible property but excludes equity (§ 2(a)(1), (3)). The definition excludes risks from otherwise publicly accessible, substantially similar information; lawful federal-government activity; and combinations of a foundation model with other software where the model does not materially increase the risk (§ 2(a)(1)(B)). A covered employee is an employee responsible for assessing, managing, or addressing the specified model-weight security, catastrophic-risk, loss-of-control, or deceptive-technique risks (§ 2(a)(2)); the section does not treat every employee as a covered employee.

The first US statute in this reference to name the Coalition for Content Provenance and Authenticity standard in its own text rather than gesturing at "widely accepted industry standards" as California's SB 942 does. The one-million-users-per-month threshold parallels California's covered-provider test, so a provider building C2PA provenance for California largely satisfies Connecticut — the same convergence the EU Article 50 and California alignment produced.

Two dates matter and they are a year apart: the sections take effect 2026-10-01, but the duties attach only to technology deployed on or after 2027-10-01, which is the date recorded here. The developer-to-deployer information duty in § 8 is the structural piece — it makes the vendor responsible for supplying whatever the employer needs to meet its own disclosure duties, closing the "our vendor won't tell us" gap that undercuts comparable laws.

Not a disclosure rule but a liability rule, and it is the sharpest incentive in the Act: using an automated employment-related decision technology is expressly not a defense to a discrimination complaint, while evidence of anti-bias testing may be considered in the employer's favour. That asymmetry converts bias testing from a good practice into the only available mitigation, which is why it belongs under bias-prevention rather than with the disclosure provisions.

Connecticut's version goes further than California's or New York's in two ways: it requires escalation to clinically appropriate services when a user expresses risk *again after* an initial referral, and it separately requires measures preventing the companion from claiming to be human or generating output that contradicts its own AI disclosure. The second duty closes the gap a disclosure-only rule leaves open — a system that discloses at the top of a session and then insists it is human when asked.

Two distinct disclosure regimes ride in one act. The § 1 subscription rules attach at contract formation and renewal, which puts AI-specific terms into consumer contract law rather than product design. The § 5(b) companion notice takes effect later, on 2027-01-01, and offers operators a choice between a persistent static notice visible throughout the interaction and a notice repeated at intervals — the persistent option has no counterpart in the California or New York statutes. A second, separately enacted subscription regime starts the same day: Public Act 26-100 § 46 (Substitute HB 5222, signed 2026-06-02) requires subscription-based providers of generative AI systems with more than one million monthly users to disclose usage limits (tokens, images, transcription) and any discretion to reduce functionality, with renewal re-disclosure, enforced by the Attorney General under CUTPA. PA 26-100 does not repeal or amend § 1; the two sections differ in covered actors and required content and both apply from 2026-10-01. A model-generated claim that PA 26-100 replaced § 1 was checked against the retained PA 26-100 text and is not supported.