From the journal

Connecticut Senate Bill 5 Establishes AI Consumer Protections and Employment Obligations, May 2026

Connecticut Senate Bill 5, the C.A.R.T. Act, passed both chambers of the Connecticut General Assembly in May 2026 and awaits Governor Ned Lamont's signature. The bill requires operators of AI automated decision tools to disclose their use in employment, lending, and housing decisions, and mandates mental health crisis protocols for AI chatbot operators serving consumers.

2 min read

Connecticut Senate Bill 5, titled the C.A.R.T. Act, passed both chambers of the Connecticut General Assembly in May 2026 and now sits on Governor Ned Lamont's desk for signature. The bill is at the enacted stage pending gubernatorial action. It targets AI automated decision tools used in consequential commercial contexts, consumer-facing AI chatbots, synthetic media labeling, and online safety for minors. The Act takes effect upon the Governor's signature.

The bill's automated decision tool provisions require businesses that deploy AI systems in decisions related to hiring, promotion, termination, credit, and housing to disclose the use of such tools to affected individuals and to provide an opt-out mechanism. The chatbot provisions require AI chatbot operators to detect expressions of suicidal ideation or self-harm and respond with appropriate crisis resources under protocols the operator must establish and publish. The bill also creates an Artificial Intelligence Policy Office within the state executive branch, an AI Learning Laboratory, and a Connecticut AI Academy.

Employers using AI-driven hiring or performance evaluation tools, consumer lenders using algorithmic underwriting, and technology companies operating AI chatbots serving Connecticut residents face disclosure and process obligations under the bill. Companies using AI to generate synthetic media distributed publicly must label that content. Workforce development programs under the bill support workers and employers as they adopt AI tools across industries.

Connecticut's enactment places it alongside Colorado and Illinois, which passed state AI consumer protection laws before the enactment of any federal AI statute. The C.A.R.T. Act does not create a private right of action for consumers but authorizes the Connecticut Attorney General to enforce its provisions. Questions remain on the exact capability thresholds that will define a high-risk automated decision tool and on whether Connecticut's obligations will be preempted by future federal AI legislation.

Licentium advises businesses on compliance obligations under US state AI legislation, including automated decision tool disclosure requirements, opt-out mechanisms, and risk assessment methodologies. We assist technology companies, employers, and consumer-facing platforms in mapping exposure under state AI bills and building compliance programs in advance of effective dates. Work we undertake includes AI regulatory risk mapping, state AI compliance program design, automated decision tool auditing, and legislative monitoring.

Source: Connecticut Senate Bill 5 (C.A.R.T. Act), Connecticut General Assembly, May 2026

AI Regulatory

More from the journal

See all
Illia Prokopiev

Crypto Vaults and Lending Strategies Under U.S. Federal Securities Law

Commissioner Hester M. Peirce’s July 22, 2026 statement does not establish binding law, but it identifies the principal federal securities-law questions raised by crypto vaults and onchain lending strategies. This analysis examines when vault interests, lending claims, receipt tokens, and related service-provider activities may trigger the Securities Act, Exchange Act, Investment Company Act, and Investment Advisers Act.

MiCAR Transitional Regime for CASPs Expires Across the EU, July 2026

On 1 July 2026, the MiCAR transitional period under Article 143(3) of Regulation (EU) 2023/1114 expired across the EU. Former virtual asset service providers operating under national registrations must now hold a MiCAR crypto-asset service provider authorisation or cease providing crypto-asset services. In Luxembourg, the CSSF confirmed that VASP registration under the 2004 AML Law no longer provides a sufficient legal basis for market activity.

EDPB Adopts Final GDPR Guidelines on Blockchain Data Processing, EU, 8 July 2026

On 8 July 2026, the European Data Protection Board adopted the final version of Guidelines 02/2025 on the processing of personal data through blockchain technologies. The guidelines confirm that encrypted and hashed on-chain data remains personal data under the GDPR and that blockchain immutability does not override data subjects' right to erasure under Article 17. Controllers must address architecture choices and data minimisation before any on-chain recording of personal data.