Connecticut AI Law Fines & Penalties
Updated for 2026. Status: No Law. Deadline: N/A.
AI Compliance Context for Connecticut
As of 2026-07-04, Connecticut has not enacted an AI-specific statute; the Connecticut Attorney General office defers to Connecticut Data Privacy Act (Conn. Gen. Stat. sec. 42-515 et seq.) with an automated-decision / profiling opt-out. Operators across sectors in Connecticut watch federal signals first.
The federal and neighboring-state framework that governs your AI operations. Cross-Sector operators in Connecticut operate under a federal-dominant framework anchored by FTC Section 5 (15 USC 45) and NIST AI RMF 1.0, with adjacent authorities Gramm-Leach-Bliley Act (GLBA) / NIST Cybersecurity Framework (15 U.S.C. § 6801-6809; NIST CSF 2.0); General Data Protection Regulation (GDPR) (for EU users) (EU Regulation 2016/679); Section 508 / ADA Title III (Digital Accessibility) (29 U.S.C. § 794(d); 42 U.S.C. § 12181). FTC Operation AI Comply (Sep 2024) targeted five companies across sectors. The practical risk they have to price in is cross-sector FTC Section 5 exposure and state UDAP liability, and the bellwether signal to monitor is NIST AI RMF 1.0 (Jan 2023) is cited as the federal baseline across 30+ agency guidance documents. No regional statute applies yet. Connecticut's comprehensive high-risk AI bill (SB 2) passed the Senate but died in the House in 2024 and failed again in 2025; narrow measures apply, including a state-agency AI inventory and, effective July 2026, LLM training-data disclosure (SB 1295). Use this as a starting point; sector pages on this site go deeper into industry-specific obligations.
Because Connecticut has no dedicated AI statute, regulatory obligations fall back to Connecticut Data Privacy Act (Conn. Gen. Stat. sec. 42-515 et seq.) with an automated-decision / profiling opt-out layered with federal sector-specific rules.
Federal law still governs Cross-Sector AI in Connecticut primarily through FTC Section 5 (15 USC 45) and NIST AI RMF 1.0. Adjacent federal authorities include Gramm-Leach-Bliley Act (GLBA) / NIST Cybersecurity Framework (15 U.S.C. § 6801-6809; NIST CSF 2.0); General Data Protection Regulation (GDPR) (for EU users) (EU Regulation 2016/679); Section 508 / ADA Title III (Digital Accessibility) (29 U.S.C. § 794(d); 42 U.S.C. § 12181). Gramm-Leach-Bliley Act (GLBA) / NIST Cybersecurity Framework (enforced by Federal Trade Commission; NIST) applies to saas platforms handling personal/financial data via ai must implement nist csf security standards: identify, protect, detect, respond, recover. Penalty exposure: ftc civil penalties up to $100,000/violation; private litigation for data breaches. FTC Operation AI Comply (Sep 2024) targeted five companies across sectors.
The enforcement surface for Cross-Sector centres on FTC, CFPB, State Attorneys General, and the statute operators most often under-document is General Data Protection Regulation (GDPR) (for EU users) (EU Regulation 2016/679) — a gap that surfaces in cross-sector FTC Section 5 exposure disputes. Build an evidence binder covering AI inventory, risk-tier register, incident-response runbook, and board-level AI risk report. Treat NIST AI RMF 1.0 (Jan 2023) is cited as the federal baseline across 30+ agency guidance documents as your leading indicator and escalate when the signal shifts.
Connecticut's immediate neighbors also lack AI-specific statutes, so operators defer primarily to federal frameworks until regional precedent emerges.
With 11-50 employees you can justify a half-time compliance lead and part-time external counsel on retainer. Small-stage Cross-Sector operators should deploy a named compliance lead, formal AI inventory, quarterly bias spot-checks, and a documented escalation path, with semi-annual internal audit with annual external review and ownership resting with a designated AI compliance lead reporting to the CEO. small-business budgets ($50K-$250K) justify a compliance lead plus a GRC tool such as Credo AI, Fairly, or Holistic AI. For Cross-Sector specifically, the sharpest exposure to manage is cross-sector FTC Section 5 exposure and state UDAP liability. Given Connecticut's concentration in insurance, financial services, and advanced manufacturing, insurance-underwriting models and automated employment-screening tools deserve priority in your AI inventory.
Verified 2026-07-04. See https://www.cga.ct.gov/asp/cgabillstatus/cgabillstatus.asp?selBillType=Bill&bill_num=SB00002&which_year=2024 for the Connecticut Attorney General public record on Connecticut AI policy.
Applicable laws
Key requirements
Connecticut has not enacted a comprehensive AI law — its high-risk AI bill (SB 2) passed the Senate but died in the House in 2024 and failed again in 2025. Narrow measures apply: a state-agency AI inventory, an automated-decision opt-out under the Connecticut Data Privacy Act, and (effective July 1, 2026) a duty to disclose when personal data is used to train large language models. Existing consumer-protection and anti-discrimination laws may also apply to AI.
Understanding the penalty framework under No comprehensive AI law — high-risk AI bill (SB 2) died in 2024 and failed again in 2025; narrow provisions only (state-agency AI inventory; LLM training-data disclosure, eff. 2026) is the essential first step in calibrating a compliance investment for Connecticut. Connecticut does not yet have a dedicated AI law in effect, but federal enforcement frameworks — including FTC Section 5, EEOC hiring guidance, and CFPB fair lending rules — already apply to AI-driven decisions affecting consumers and employees here. Penalty structures are still being established, but comparable state AI laws carry per-violation fines of $500 to $25,000. This page maps where exposure concentrates so compliance leaders can prioritize their spend accordingly.
The most frequent penalty trigger under AI laws structured like No comprehensive AI law is the disclosure violation — specifically, failing to notify an individual that an AI system materially influenced a decision affecting them. Connecticut has not enacted a comprehensive AI law — its high-risk AI bill (SB 2) passed the Senate but died in the House in 2024 and failed again in 2025. Narrow measures apply: a state-agency AI inventory, an automated-decision opt-out under the Connecticut Data Privacy Act, and (effective July 1, 2026) a duty to disclose when personal data is used to train large language models. Existing consumer-protection and anti-discrimination laws may also apply to AI. Each automated decision issued without the required disclosure is, in per-violation penalty frameworks, a separately actionable event. A business running a high-volume AI workflow — screening job applications, approving loan modifications, triaging customer service cases — can accumulate hundreds of discrete violations before a single complaint is filed. Regulators in states with active AI enforcement have used exactly this accumulation logic in settlement negotiations, leveraging per-violation counts to reach settlement amounts that significantly exceed what a flat-rate fine structure would allow.
The enforcement trigger for AI penalties in Connecticut typically originates from one of three sources: an individual complaint filed with the CT attorney general or relevant agency; a media or academic investigation that surfaces algorithmic disparities such as differential approval rates by race, gender, or ZIP code; or a regulatory sweep targeting a specific industry or use case. Under federal law, all three channels are currently available to regulators examining AI use in Connecticut. Whistleblower provisions in several comparable state laws allow private individuals to initiate state investigations by filing documented complaints — meaning a single informed employee or consumer can set an enforcement action in motion without state agency resources being the limiting factor.
Beyond state enforcement, Connecticut businesses deploying AI face layered federal penalty exposure that stacks on top of any state fines. The FTC has authority under Section 5 of the FTC Act to pursue unfair or deceptive AI practices, and has already brought enforcement actions against companies for undisclosed AI use in consumer-facing products. The EEOC has issued detailed guidance indicating it will apply disparate-impact theory to AI hiring tools, with civil rights remedies that can include back pay, reinstatement, and injunctive relief in addition to per-violation civil penalties. The CFPB has published guidance treating AI-driven credit decisions as subject to Regulation B's adverse action notice requirements. In each case, the federal penalty is independent of any state enforcement action, meaning a single AI compliance failure can generate simultaneous exposure across multiple regulators.
Penalty exposure under Connecticut's AI framework is not uniform across all business categories. High-volume consumer-facing AI deployments — particularly in hiring, lending, insurance pricing, and access to housing — carry the greatest exposure because they generate the highest number of individual decisions and are therefore subject to the highest potential per-violation accumulation. AI systems that process sensitive personal data such as health records, financial information, or biometric identifiers face additional enforcement attention because they simultaneously trigger AI law obligations and legacy data-protection requirements. Smaller, lower-volume AI deployments — AI used internally for scheduling or administrative workflows that do not directly affect consumer rights — generally carry lower enforcement priority, though the legal obligations are no less real.
The most effective penalty mitigation strategy is documented compliance infrastructure built before a violation is alleged. Regulators across the country have consistently taken into account whether an accused business had a good-faith compliance program when determining enforcement responses — including whether to pursue a formal action, negotiate a settlement, or issue a warning. A documented AI inventory, written disclosure notices, a designated compliance owner, and records of bias-testing or impact assessments collectively demonstrate the kind of organized good-faith effort that regulators weigh favorably. Absent that documentation, an otherwise defensible company looks indistinguishable from one that simply ignored its obligations. Given the enforcement trajectory of comparable state AI laws, the cost of a compliance program is typically a fraction of the cost of a single enforcement settlement.
A final but underappreciated penalty risk involves third-party AI tools — off-the-shelf AI products purchased from vendors. Under Connecticut's AI framework, the deploying business bears compliance responsibility for AI systems it uses, regardless of who built or trained the model. If a vendor's AI tool fails to meet the disclosure, bias-testing, or documentation requirements of No comprehensive AI law, the liability falls primarily on the deployer, not the vendor. Businesses should audit vendor contracts for compliance representations, require vendors to provide documentation of their AI systems' risk assessments and testing protocols, and negotiate indemnification provisions that address AI-law-specific liability. Vendor due diligence is itself a compliance obligation in several states, and evidence of performed due diligence can reduce penalty exposure even when a third-party system is found to be non-compliant.
Explore More for Connecticut
Anchored to the primary government source (statute, bill text, or agency rule) and verified directly against it · Last verified Jul 4, 2026. See our methodology.
- ↗cga.ct.govhttps://www.cga.ct.gov/asp/cgabillstatus/cgabillstatus.asp?selBillType=Bill&b…
- ↗cbia.comhttps://www.cbia.com/news/issues-policies/sweeping-artificial-intelligence-bi…
- ↗ai-law-center.orrick.comhttps://ai-law-center.orrick.com/connecticut/