On October 1, 2026, the first group of sections of Connecticut Public Act 26-15 (Substitute Senate Bill 5, “An Act Concerning Online Safety”), approved by Governor Ned Lamont on May 27, 2026, took effect. Section 2 protects employees of frontier developers who report catastrophic risks. It bars policies or contracts that let a developer penalise an employee for such reports, requires large frontier developers to give reporting employees updates on their investigation, and requires posted notice of employee rights. The Attorney General can seek civil penalties of up to 1,000 dollars per violation. The act defines catastrophic risk as a foreseeable, material risk that a frontier model contributes to the death or serious injury of more than fifty people, or more than one billion dollars in damage, through weapons assistance or unsupervised conduct such as a cyberattack.
Section 15, also effective October 1, 2026, requires a “covered provider” (a generative AI system for images, audio or video with more than one million monthly users that is publicly available to consumers) to include provenance data in content it creates or materially alters, where commercially and technically reasonable, and to make that data hard to remove, citing the Coalition for Content Provenance and Authenticity standard as an example. Section 26 requires employers filing federal WARN layoff notices to tell the state Labor Department whether the layoffs relate to AI or other technological change, and section 38 bars state agencies from using AI in benefits or rights-affecting decisions unless it complies with state standards.
Other parts are staggered. The employment-decision sections take effect on October 1, 2026, but their disclosure and pre-decision notice duties apply to systems deployed on or after October 1, 2027. The AI companion provisions take effect on January 1, 2027, and one section on January 1, 2028.
Why it matters: Connecticut now has a broad AI statute in force, and it joins California in giving employees of frontier labs legal protection for raising catastrophic-risk concerns, alongside a provenance duty aimed at large consumer image, audio and video generators. What it does not show: the most demanding employer obligations do not bite until late 2027, the provenance duty is qualified by “commercially and technically reasonable”, and the whistleblower penalty is capped at 1,000 dollars per violation, so actual enforcement remains to be seen.