EveryAILaw.comDoes Connecticut AI Responsibility Act (PA 26-15) require Incident Reporting?
Connecticut • phased enforcement
Yes — 1 provision
Requirements at a glance
This regulation imposes 6 specific requirements for Incident Reporting across 1 provision:
- Anti-retaliation rules — A frontier developer may not make, adopt, enforce, or enter into any rule, regulation, policy, or contract allowing it to discharge, discipline, or otherwise penalize any employee for activity protected by Conn. Gen. Stat. § 31-51m(b). It also may not authorize any person with authority over a covered employee, or another covered employee with investigative or corrective authority, to discipline or retaliate against that employee for reporting, on reasonable cause, activity posing the specified catastrophic-risk danger (§ 2(b)(1)-(2))
- Anonymous internal channel — By 2027-01-01, each large frontier developer must establish and maintain a reasonable internal process for a covered employee to anonymously report information believed in good faith to indicate activity posing a specific and substantial danger to public health or safety due to catastrophic risk (§ 2(c)(1)(A))
- Investigation updates — The developer must give reasonable updates to each reporting employee on the status of the resulting investigation and the actions taken (§ 2(c)(1)(B))
- Quarterly board sharing — Reports and updates must be shared with the officers and directors at least quarterly (§ 2(c)(2)(A))
- Accused-officer carve-out — Where a report alleges wrongdoing by an officer or director, neither the report nor its updates may be shared with that person (§ 2(c)(2)(B))
- Notice of rights — Each frontier developer must give covered employees clear notice of their rights and responsibilities, either through continuous workplace posting plus equivalent notices to new hires and periodic notices to remote workers, or through at least annual written notice received and acknowledged by each covered employee (§ 2(d)(1)-(2))
Frontier Developer Catastrophic Risk Reporting
Section 2 takes effect on 2026-10-01, including the anti-retaliation rules and notice duties for frontier developers. Large frontier developers must establish the internal anonymous reporting process no later than 2027-01-01. Reports and investigation updates go to officers and directors at least quarterly, except that an accused officer or director must not receive the report or its updates. Section 2(c) requires an internal channel and board sharing; it does not require submitting these reports to the state. Catastrophic risk requires a foreseeable and material risk that a frontier model's development, storage, use, or deployment materially contributes to the death of, or serious injury to, more than fifty individuals, or more than $1 billion in damage to or loss of covered property, arising from a single incident. The incident must involve expert-level assistance creating or releasing a chemical, biological, radiological, or nuclear weapon, or conduct without meaningful human oversight, intervention, or supervision that constitutes a cyberattack or would constitute murder, assault, extortion, or theft if performed by an individual. Covered property includes tangible and intangible property but excludes equity (§ 2(a)(1), (3)). The definition excludes risks from otherwise publicly accessible, substantially similar information; lawful federal-government activity; and combinations of a foundation model with other software where the model does not materially increase the risk (§ 2(a)(1)(B)). A covered employee is an employee responsible for assessing, managing, or addressing the specified model-weight security, catastrophic-risk, loss-of-control, or deceptive-technique risks (§ 2(a)(2)); the section does not treat every employee as a covered employee.
Requirements
| Requirement | Details |
|---|---|
| Anti-retaliation rules | A frontier developer may not make, adopt, enforce, or enter into any rule, regulation, policy, or contract allowing it to discharge, discipline, or otherwise penalize any employee for activity protected by Conn. Gen. Stat. § 31-51m(b). It also may not authorize any person with authority over a covered employee, or another covered employee with investigative or corrective authority, to discipline or retaliate against that employee for reporting, on reasonable cause, activity posing the specified catastrophic-risk danger (§ 2(b)(1)-(2)) |
| Anonymous internal channel | By 2027-01-01, each large frontier developer must establish and maintain a reasonable internal process for a covered employee to anonymously report information believed in good faith to indicate activity posing a specific and substantial danger to public health or safety due to catastrophic risk (§ 2(c)(1)(A)) |
| Investigation updates | The developer must give reasonable updates to each reporting employee on the status of the resulting investigation and the actions taken (§ 2(c)(1)(B)) |
| Quarterly board sharing | Reports and updates must be shared with the officers and directors at least quarterly (§ 2(c)(2)(A)) |
| Accused-officer carve-out | Where a report alleges wrongdoing by an officer or director, neither the report nor its updates may be shared with that person (§ 2(c)(2)(B)) |
| Notice of rights | Each frontier developer must give covered employees clear notice of their rights and responsibilities, either through continuous workplace posting plus equivalent notices to new hires and periodic notices to remote workers, or through at least annual written notice received and acknowledged by each covered employee (§ 2(d)(1)-(2)) |
Penalties
| Violation | Fine |
|---|---|
| Per violation | Civil penalty not exceeding $1,000 per violation, recoverable by the Attorney General in Hartford superior court, plus injunctive or equitable relief that is not stayed pending appeal. A prevailing state may recover investigation costs, expert witness fees, action costs, and reasonable attorneys' fees; remedies and penalties are cumulative (§ 2(e)) |
Sources: Public Act 26-15 (enacted text)