From the journal

Connecticut Governor Signs CART Act on 27 May 2026, Creating AI Obligations for Employers and Developers

Connecticut Governor Ned Lamont signed Senate Bill 5, the Connecticut Artificial Intelligence Responsibility and Transparency Act (CART Act), on 27 May 2026. The law creates obligations for automated employment decision technology, frontier AI developers, AI companion operators, generative-AI provenance, and AI in healthcare, with most provisions effective 1 October 2026.

2 min read

On 27 May 2026, Connecticut enacted Senate Bill 5, the Connecticut Artificial Intelligence Responsibility and Transparency Act (CART Act). Most provisions take effect on 1 October 2026. Core employment-related automated-decision obligations phase in through 1 October 2027. Connecticut joins 22 other US states that have enacted AI or automated-decision legislation.

The CART Act creates obligations across five categories. Deployers of automated employment decision technology (AEDT) must conduct annual impact assessments, disclose use to candidates and employees, and offer a human review pathway. Frontier AI model developers must publish safety policies, document catastrophic-risk evaluations annually, and adopt written whistleblower protections. Operators of AI companions serving minors must detect and address crisis indicators, disclose AI identity to users, and not enable romantic or sexual interactions. Generative-AI deployers must comply with content provenance-marking rules. AI deployed in healthcare settings is subject to patient-notification requirements.

The CART Act applies to any business deploying or developing covered AI tools that conducts business in Connecticut. There is no revenue threshold or headcount minimum. AEDT deployers must provide written notice to affected individuals before or at the time of an automated decision, identify the type of AEDT used, and offer a mechanism for human review. Frontier developers in Connecticut must designate a responsible officer and maintain a current safety policy available to the Connecticut Attorney General on request.

The CART Act does not create a private right of action. Enforcement rests with the Connecticut Attorney General. The Connecticut Office of Policy and Management must adopt implementing regulations by 1 April 2027. Penalties are not specified in the enacted text and will be addressed in those regulations. The law's scope for AI companions and frontier models marks a departure from prior US state AI statutes, which focused primarily on AEDT in employment.

Licentium advises on AI regulatory obligations and maintains a partner network in US and cross-border jurisdictions. Businesses assessing CART Act obligations, reviewing AEDT requirements, or mapping AI deployment obligations under US state law may contact us. Work we undertake includes AI regulatory compliance reviews, automated employment decision technology audits, US state AI law mapping, and engagement with state regulators.

Source: Connecticut General Assembly, Substitute for Senate Bill No. 5 (CART Act), signed 27 May 2026

AI Regulatory

More from the journal

See all
Illia Prokopiev

From Cloud Concentration to AI Dependence: The UK’s Critical Third Parties Regime

The United Kingdom now directly oversees designated technology suppliers whose service failures could threaten financial stability. The question is whether the first cloud designations show a legal expansion toward AI-model providers, and what the present regime requires. This analysis assumes the quoted statement concerns the UK financial-services Critical Third Parties regime and assesses the law through 14 July 2026.

Alberta Regulated iGaming Market Launched on 13 July 2026 with 22 Operators

Alberta's regulated private iGaming market launched on 13 July 2026, making Alberta the second Canadian province to permit private online gambling operators after Ontario. The Alberta Gaming, Liquor and Cannabis Commission serves as market regulator and the Alberta iGaming Corporation oversees commercial operations and operator contracts. Twenty-two operator sites went live on day one, including FanDuel, DraftKings, BetMGM, and BetRivers. Operators must fully launch or exit the Alberta market by 13 October 2026.

European Commission Presents Cybersecurity and AI Action Plan on 7 July 2026

On 7 July 2026, the European Commission presented an Action Plan on Cybersecurity and Artificial Intelligence. The plan directs the Commission and ENISA to evaluate advanced AI models before they reach the EU market, establish a secure testing platform for critical-sector organisations, and launch an EU Grand Challenge on AI-powered cybersecurity solutions. It operates alongside the AI Act, NIS2 Directive, DORA, Cyber Resilience Act, and Cyber Solidarity Act, and introduces no new directly binding obligations.