Laws governing synthetic media, AI voice cloning, face-swapping, and digital impersonation. Here is what Connecticut businesses need to know in 2026.
Connecticut has enacted No comprehensive AI law — high-risk AI bill (SB 2) died in 2024 and failed again in 2025; narrow provisions only (state-agency AI inventory; LLM training-data disclosure, eff. 2026). Connecticut has not enacted a comprehensive AI law — its high-risk AI bill (SB 2) passed the Senate but died in the House in 2024 and failed again in 2025. Narrow measures apply: a state-agency AI inventory, an automated-decision opt-out under the Connecticut Data Privacy Act, and (effective July 1, 2026) a duty to disclose when personal data is used to train large language models. Existing consumer-protection and anti-discrimination laws may also apply to AI.
State law does not replace federal law — you must comply with both. These federal rules apply to deepfake laws nationwide:
It depends on the thresholds written into the specific statute, and those are not comparable across laws — some key on employee count or revenue, others on user volume or on the kind of system you deploy. We do not publish a generic small-business exemption for Connecticut, because stating one the statute does not contain would be worse than stating none. Read the primary source linked from our Connecticut law page to confirm whether you are in scope.
The key deadline in Connecticut is N/A. The law is still developing — monitor for final rules.
Connecticut penalties for AI non-compliance: N/A. Who enforces, and how, varies by statute — check the primary source linked from our Connecticut law page for the enforcement authority and process that actually applies to you.
Federal law does not currently preempt state AI law. Connecticut's AI statutes apply independently of federal rules, and federal laws like ECOA, FCRA, and HIPAA apply alongside them — so you must comply with both.
Best practice: document all AI systems used, conduct an internal audit, implement required disclosures, and keep records for at least 3 years. For high-risk uses like deepfake laws, consider hiring an independent third-party auditor to validate compliance.
Take the free 4-question risk snapshot. See which laws apply, your risk level, and the first actions to take — no signup required.
Take the Free Assessment →