EveryAILaw.comDoes Connecticut AI Responsibility Act (PA 26-15) require Risk Assessment?
Connecticut • phased enforcement
Yes — 1 provision
Requirements at a glance
This regulation imposes 7 specific requirements for Risk Assessment across 1 provision:
- Protocol as a precondition — No operator may provide or operate an AI companion unless it includes a protocol meeting the statutory minimum (§ 5(a)(1)(A))
- Evidence-based detection — The protocol must use evidence-based methods to detect user expressions clearly indicating a risk of suicide, self-harm, or imminent physical violence, and to institute measures preventing output that encourages them (§ 5(a)(1)(A)(i))
- Crisis referral — On detection, refer the user to appropriate mental health evaluation and treatment resources, including the 9-8-8 National Suicide Prevention Lifeline (§ 5(a)(1)(A)(ii))
- Escalation on repeat detection — If a further such expression is detected after a referral, refer the user to mental health services consistent with clinical best practices and expertise (§ 5(a)(1)(A)(iii))
- No claiming humanity — Implement reasonable measures preventing the companion from claiming to be a human being, including when asked directly, and from generating output that refutes or conflicts with the disclosure that it is not human (§ 5(a)(1)(B))
- Publish the protocol — Post the protocol in a prominent, publicly accessible location on the operator's website (§ 5(a)(2))
- Minor safeguards — Where the operator knows or has reason to believe the user is under eighteen, institute measures meeting or exceeding industry standards to prevent the specified categories of output (§ 6(a)(1))
AI Companion Crisis Protocol #
Connecticut's version goes further than California's or New York's in two ways: it requires escalation to clinically appropriate services when a user expresses risk *again after* an initial referral, and it separately requires measures preventing the companion from claiming to be human or generating output that contradicts its own AI disclosure. The second duty closes the gap a disclosure-only rule leaves open — a system that discloses at the top of a session and then insists it is human when asked.
Requirements
| Requirement | Details |
|---|---|
| Protocol as a precondition | No operator may provide or operate an AI companion unless it includes a protocol meeting the statutory minimum (§ 5(a)(1)(A)) |
| Evidence-based detection | The protocol must use evidence-based methods to detect user expressions clearly indicating a risk of suicide, self-harm, or imminent physical violence, and to institute measures preventing output that encourages them (§ 5(a)(1)(A)(i)) |
| Crisis referral | On detection, refer the user to appropriate mental health evaluation and treatment resources, including the 9-8-8 National Suicide Prevention Lifeline (§ 5(a)(1)(A)(ii)) |
| Escalation on repeat detection | If a further such expression is detected after a referral, refer the user to mental health services consistent with clinical best practices and expertise (§ 5(a)(1)(A)(iii)) |
| No claiming humanity | Implement reasonable measures preventing the companion from claiming to be a human being, including when asked directly, and from generating output that refutes or conflicts with the disclosure that it is not human (§ 5(a)(1)(B)) |
| Publish the protocol | Post the protocol in a prominent, publicly accessible location on the operator's website (§ 5(a)(2)) |
| Minor safeguards | Where the operator knows or has reason to believe the user is under eighteen, institute measures meeting or exceeding industry standards to prevent the specified categories of output (§ 6(a)(1)) |
Penalties
| Violation | Fine |
|---|---|
| Unfair trade practice | Enforced through the Connecticut Unfair Trade Practices Act, Conn. Gen. Stat. § 42-110b(a) |
Sources: Public Act 26-15 (enacted text)