Connecticut’s Omnibus AI Law (SB 5): Compliance Guide for Employers, Platforms, and Developers

Connecticut just became one of the most consequential states for AI regulation in the country. On May 27, 2026, Governor Ned Lamont signed Senate Bill 5, “An Act Concerning Online Safety,” into law after years of legislative debate and months of intensive negotiations during the 2026 session. The 39-section statute is not a single focused rule — it is an omnibus AI and online safety package that creates three distinct regulatory regimes operating on different timelines and affecting entirely different categories of businesses.

If you operate in Connecticut — or if your products, platforms, or employees interact with Connecticut residents — you need to understand what SB 5 requires and by when. This guide walks through each of the three major regimes: the Automated Employment Decision Tool (AEDT) requirements for employers; the AI companion and safety obligations for platforms serving minors; and the whistleblower and catastrophic-risk-reporting requirements for frontier AI developers.

How SB 5 Came to Be

Connecticut has been trying to pass comprehensive AI legislation since 2022. An earlier bill — Senate Bill 2 in 2023 — failed after intense business lobbying. A more ambitious algorithmic accountability bill was shelved in 2024 as Colorado’s law became a cautionary tale for states trying to pass broad high-risk AI mandates. In the 2026 session, the legislature shifted strategy: rather than a single broad law covering all AI systems, SB 5 targeted three specific problem areas where consumer harm was easiest to document — employment discrimination via AI tools, predatory AI companion apps targeting minors, and safety risks from extremely powerful AI models.

The result is a law that affects three different industries with three different compliance programs, all under one statute. Effective dates range from October 1, 2026 to January 1, 2028, giving businesses between four months and eighteen months to get ready depending on which provisions apply to them.

Regime One: Automated Employment Decision Tools (AEDTs)

What Is an AEDT Under SB 5?

SB 5 defines an Automated Employment-Related Decision Technology (AEDT) as any technology that processes personal data and generates outputs — including a rank, score, classification, or recommendation — constituting a substantial factor used to make or materially influence an employment-related decision. Covered decisions include whether to hire, fire, promote, discipline, renew employment, or select an individual for training.

The definition is deliberately broad. It covers AI-driven applicant tracking systems that screen resumes, video interview platforms that score facial expressions or speech patterns, skill-matching algorithms that rank internal candidates for promotion, and performance management tools that assign numerical ratings affecting termination or retention decisions. If the output of an AI system is a substantial factor in a covered decision, the system is an AEDT.

Note what the definition does not cover: AI tools used only for scheduling, timekeeping, payroll processing, or other administrative functions that do not produce outputs that materially influence covered employment decisions. Whether a particular tool falls within the definition will depend on how it is actually used, not just how the vendor has labeled it.

Effective Dates for AEDT Requirements

The AEDT provisions operate on a two-step timeline:

• October 1, 2026: The anti-discrimination amendment takes effect. Beginning on this date, an employer’s use of AEDT is no longer a defense to a complaint alleging a discriminatory employment practice under Connecticut’s Fair Employment Practices Act. However, the Connecticut Commission on Human Rights and Opportunities (CHRO) and courts may consider evidence of anti-bias testing or similar proactive efforts as a mitigating factor when evaluating employer conduct.

• October 1, 2027: The full disclosure and notice requirements become operative. Employers must begin providing written pre-decision notices to affected employees and applicants, maintain compliance documentation, and comply with the record-retention requirements described below.

Core Employer Obligations Under the AEDT Framework

Pre-Decision Notice. Before making an employment decision in which an AEDT played a substantial role, deployers must provide written notice to the affected employee or applicant. The notice must disclose:

• That AEDT has been deployed and the nature of the decision being made.
• The trade name and purpose of the AEDT.
• The categories of personal data analyzed and how those data points are assessed.
• The sources of the personal data used in the analysis.

This requirement applies whether the individual is an external applicant or a current employee. Employers who use third-party platforms to source, screen, or assess candidates will need to obtain this information from their vendors.

Interaction Disclosure. If a deployed AEDT interacts directly with employees or job applicants — such as a chatbot that conducts initial screening interviews — the deployer must disclose in plain language that the individual is interacting with automated technology, unless it would be obvious to a reasonable person.

Anti-Discrimination Compliance. The October 2026 provision takes the long-standing rule that “our vendor’s algorithm told us to do it” off the table as a defense to discrimination claims. This is significant. Under prior law, employers sometimes argued that disparate impact from an algorithmic system was attributable to the technology, not the employer. SB 5 closes that path. The employer using the AEDT owns the outcome.

The statute preserves a meaningful incentive: documented anti-bias testing and proactive compliance efforts can be considered by the CHRO or a court when evaluating whether a discriminatory practice occurred and what remedy is appropriate. This is not a full affirmative defense, but it is a factor, and it incentivizes employers to audit their tools before deploying them.

What Employers Must Do Now

Step 1: Identify your AEDTs. Conduct an inventory of every tool used in hiring, firing, promotion, discipline, renewal, or training decisions. Include third-party platforms and any AI features embedded in your HRIS, ATS, or performance management systems. Ask vendors directly whether their products use AI to generate scores, rankings, or recommendations that your team uses to make employment decisions.

Step 2: Request vendor documentation. For each AEDT, obtain from the vendor: (a) a description of how the tool works; (b) the categories of personal data processed; (c) information about bias testing the vendor has conducted; and (d) confirmation of what data sources the tool draws from. This documentation will be needed to satisfy the notice requirements and to demonstrate compliance.

Step 3: Conduct or commission anti-bias testing now. The October 2026 anti-discrimination provision takes effect before the full disclosure requirements. Start bias testing your most-used AEDTs immediately, document the results, and document any corrective steps taken. This creates the record the CHRO and courts can consider as a mitigating factor.

Step 4: Draft your notice templates. Work with counsel to draft plain-language notice templates for each covered employment decision type. Have the notices ready before October 2027, and build them into your workflows — whether that means updating your ATS, your offer letter system, or your HR portal.

Step 5: Review your vendor contracts. Your contracts with AEDT vendors should require them to provide you with the information you need to satisfy the notice requirements, to notify you promptly of material changes to the tool, and to cooperate with any regulatory inquiry. Add indemnification provisions for vendor conduct that contributes to AEDT violations.

Enforcement of the AEDT Provisions

Violations of SB 5’s AEDT requirements are enforceable solely by the Connecticut Attorney General. For violations occurring on or before December 31, 2027, the AG may issue a notice of violation with a 60-day cure period before initiating enforcement — provided the AG determines the violation is curable. Violations that are not susceptible to cure, or that recur after a cure has been completed, may result in immediate enforcement action.

There is no private right of action under SB 5’s AEDT framework. However, the removal of the AEDT-as-defense provision means that discrimination claims under existing Connecticut law will now sweep in AEDT-related conduct, and those claims do carry private litigation rights.

Regime Two: AI Companion Safety Obligations for Platforms

What Are AI Companions?

SB 5 defines AI companion systems as systems that can engage in ongoing personalized interactions with users — systems capable of sustaining what feels, from the user’s perspective, like a relationship. This covers a range of products: apps designed to provide companionship or emotional support, mental health and wellness chatbots, social AI friends, romantic AI products, and any conversational AI system that learns user preferences and simulates ongoing interaction.

Connecticut is one of the first states to comprehensively regulate this product category, and its law creates a two-tier system: baseline protections for all users and enhanced protections specifically for minors.

Baseline Protections for All Users

Beginning on a specified effective date (provisions roll in through 2027), all AI companion platforms operating in Connecticut must:

• Disclose non-human status: Users must be informed clearly that they are interacting with an AI system, not a human. This disclosure must be prominent enough that a reasonable person would see it.
• Implement safety protocols for crisis situations: If a user expresses suicidal ideation, self-harm, or a mental health crisis, the system must have protocols to respond appropriately — such as providing crisis hotline information and refraining from responses that could exacerbate the crisis.
• Refrain from deceptive practices: Platforms may not design systems to deceive users into believing they are communicating with a human being or to exploit emotional vulnerability for commercial purposes.

Enhanced Protections for Minors

For users under 18, SB 5 layers on additional requirements:

• Parental tools: Platforms must provide parents with tools to manage their minor children’s privacy settings and, in some configurations, screen time with AI companion systems.
• Engagement-maximizing features restricted: Features designed to maximize engagement — such as streaks, reward loops, and emotional dependency mechanics — are restricted or prohibited for minor users. The law targets the same design patterns that have been scrutinized in the social media context.
• Privacy safeguards: Personal data collected from minor users in AI companion interactions is subject to enhanced handling requirements, including limitations on retention and restrictions on secondary use.

What Platforms Must Do

If you operate an AI companion platform that reaches Connecticut users, your compliance checklist includes:

1. Audit your disclosure language: Ensure your non-human disclosure is conspicuous, not buried in terms of service.
2. Build or update your crisis-response protocols: Work with mental health professionals to design response flows that appropriately handle disclosures of suicidal ideation and self-harm. Document the protocol.
3. Identify minor users: Implement age verification or age estimation sufficient to trigger the enhanced minor protections. The method you use should be appropriate to the risk level of your product.
4. Review your engagement mechanics: Conduct a product review specifically targeting engagement-maximizing features. Document decisions about which features to restrict for minors.
5. Update your privacy program: If you do not already have a separate data handling protocol for minor user data, build one.

Regime Three: Frontier AI Developer Whistleblower and Safety Obligations

Who Is a “Frontier” Developer Under SB 5?

This is the narrowest of the three regimes, but it is also the most novel. SB 5 defines covered “frontier” AI developers as those training foundation models using more than 10²⁶ (one hundred septillion) floating point operations of computing power. This compute threshold is calibrated to capture the most capable and most expensive AI models currently being developed — those from organizations operating at the frontier of AI capability. As of the law’s passage, only a small number of companies in the world operate at this scale.

The threshold is numeric and objective. If your compute budget for a training run clears 10²⁶ FLOP, you are subject to this provision regardless of what you call the model or how you market it.

The Whistleblower Protection Requirement

Effective October 1, 2026, frontier developers must protect employees who report concerns to the developer or to government authorities about conduct they reasonably believe may contribute to a “catastrophic risk.”

A catastrophic risk is defined as an event that would result in:
– Injury or death to 50 or more people, or
– More than $1 billion in property damage,

…arising from the AI model’s assistance with chemical, biological, radiological, or nuclear (CBRN) threats; autonomous cyberattacks causing critical infrastructure failure; or autonomous criminal conduct causing widespread harm.

The whistleblower protection means that frontier developers cannot retaliate against employees for reporting these concerns — either internally or to regulators. It also means developers must have internal reporting mechanisms that allow employees to raise safety concerns without fear of job loss, demotion, or other adverse action.

What Frontier Developers Must Do

1. Assess whether you meet the compute threshold: Audit your most recent and planned training runs. If any run exceeds 10²⁶ FLOP, the frontier provisions apply.
2. Establish an internal safety reporting channel: Create a documented process for employees to report catastrophic-risk concerns, with anti-retaliation protections. This should be a formal policy, not an informal open-door understanding.
3. Train HR and management: Retaliation against a whistleblowing employee is the clearest enforcement trigger. HR and direct managers of AI development teams need to understand what constitutes a protected report and what actions are prohibited.
4. Review contractor and vendor agreements: Whistleblower protections typically extend to employees. Consider whether your safety reporting obligations should also flow to contractors and third-party AI development teams working on covered models.

The Regulatory Sandbox

SB 5 also includes provisions directing the state to develop an AI regulatory sandbox — a program that would allow companies to test new AI technologies and products in Connecticut with modified regulatory requirements under supervised conditions. The sandbox is intended to allow innovation to proceed without full regulatory compliance during the testing phase, while still providing the state with visibility into how new AI products work.

Sandbox details are still being developed, but businesses planning to launch novel AI products in Connecticut should monitor developments. Sandbox participation, if available, could allow companies to operate with reduced compliance burdens during a defined testing period.

Connecticut as Part of the Growing Patchwork

SB 5 does not exist in isolation. Businesses operating nationally now face a complex matrix of state AI laws that overlap in some areas and conflict in others. Connecticut’s AEDT framework shares conceptual DNA with New York City’s Local Law 144 (the first major AEDT law in the country) but differs in scope and procedure. Connecticut’s minor-protection provisions echo California’s Age Appropriate Design Code requirements. The frontier-developer whistleblower provisions are entirely novel.

If you operate across multiple states, a state-by-state AI compliance audit is no longer optional — it is a business necessity. The federal government has not yet passed a comprehensive AI law, and the patchwork of state requirements is accumulating fast.

Quick-Reference Compliance Timeline

Key Takeaways

SB 5 is a serious law that creates real liability exposure for three categories of businesses: employers using AI in employment decisions, operators of AI companion platforms, and the handful of companies building the world’s most powerful AI systems. Each category has a distinct set of obligations, distinct enforcement mechanisms, and distinct compliance timelines.

For most Connecticut employers, the immediate priority is the October 2026 anti-discrimination provision. Bias testing your AEDTs and documenting that testing is the single most important action you can take before the first effective date arrives. The full disclosure requirements do not kick in until October 2027, but building the infrastructure for those disclosures takes time — and the clock is already running.

This post is for general informational purposes only and does not constitute legal advice. Reading this post does not create an attorney-client relationship. If you have questions about your specific situation, consult a qualified attorney.