Connecticut CART Act Explained: A Practical Business Compliance Guide (2026)

Last Updated: November 4, 2026

Connecticut has passed one of the most comprehensive state-level AI laws in the United States. The Connecticut Artificial Intelligence Responsibility and Transparency Act — the CART Act, enacted as Public Act 26-15 — was signed by Governor Ned Lamont on May 27, 2026, and its first wave of obligations took effect on October 1, 2026. If your business operates in Connecticut, employs people in the state, deploys AI-powered hiring tools, develops frontier AI models, or offers generative AI subscriptions to consumers, the CART Act applies to you today. Understanding the Connecticut CART Act compliance requirements is no longer optional — it is an active legal obligation enforced by the Connecticut Attorney General.

The CART Act is sweeping in scope. It regulates five distinct categories of AI activity: automated employment-related decision technology (AEDT) used in hiring and personnel decisions, AI companion systems, frontier AI model developers, generative AI content provenance, and online platforms used by minors. Each category carries its own set of obligations, its own effective dates, and its own enforcement exposure. The law phases in across three main windows — October 1, 2026, October 1, 2027, and January 1, 2028 — which means compliance is not a one-time project but an ongoing programme that must be scoped and sequenced correctly.

This guide is written for the people who have to actually implement compliance: Chief Legal Officers, HR Directors, Chief Technology Officers, and AI governance leads at organizations doing business in Connecticut. By the end of this article, you will know exactly which CART Act obligations are live today, which are coming in 2027, what the enforcement mechanism looks like, and the specific steps your organization needs to take now to build a defensible compliance posture. Connecticut joins a growing roster of states — alongside Colorado, Illinois, and the EU AI Act framework — in moving from AI policy debate to enforceable law, and the CART Act is one of the most detailed examples of what that looks like in practice.

⚖️ 1. What Is the Connecticut CART Act? (PA 26-15 Explained)

The Connecticut Artificial Intelligence Responsibility and Transparency Act — universally shortened to the CART Act — is Public Act 26-15, enacted from Senate Bill 5. The Connecticut legislature passed SB 5 with strong bipartisan support: the Senate voted 32 to 4 in favor, and the House passed it 131 to 17. Governor Ned Lamont signed the bill on May 27, 2026. Connecticut is now among the most aggressive states in the country for AI regulation, joining a movement that includes Colorado’s AI Act (SB 26-189, effective January 1, 2027) and Illinois HB 3773 — but the CART Act is broader in scope than either of those laws.

The CART Act’s full name signals its core philosophy: Artificial Intelligence Responsibility and Transparency. The law does not prohibit AI. It does not cap its use. What it does is impose accountability structures — disclosure duties, anti-discrimination safeguards, human oversight requirements, and governance obligations — on the businesses and developers that deploy AI in high-stakes contexts. Connecticut’s approach reflects a “transparency-first” regulatory philosophy, similar in spirit to the EU AI Act’s requirements for high-risk AI systems, but applied through the lens of employment law, consumer protection, and online safety.

The Act covers five distinct regulated domains, each with its own obligations and timelines. These are not unified under one blanket rule — a business may fall under one, several, or all five categories depending on what it does and who it serves. Understanding which category applies to your organization is the first step in any CART Act compliance programme. According to NIST’s AI Risk Management Framework, categorizing AI systems by risk domain is the foundational step in any structured governance approach — and the CART Act effectively codifies that logic into Connecticut law.

The Five Regulated Domains Under the CART Act

📅 2. CART Act Compliance Timeline: Every Deadline Your Business Needs to Know

The single most important thing to understand about the CART Act is that it is a phased law. Many businesses began preparing for the wrong obligations first — specifically, they drafted AEDT disclosure notices and pre-decision notice templates for the October 1, 2026 deadline, when in fact those notice requirements do not apply until October 1, 2027. This is not a minor misunderstanding — it means compliance resources were allocated to future obligations while October 2026 obligations (which are live today) may have been underserved.

The October 1, 2026 obligations are real and enforceable now. They include the AEDT statutory framework going live (definitions, enforcement structure, and the critical anti-discrimination amendment), AI-related WARN notice obligations for employers conducting layoffs influenced by AI, and generative AI subscription disclosures for large-scale providers. The Connecticut Attorney General can begin enforcement on these provisions today. The mandatory cure period — which runs from October 1, 2026 through September 30, 2027 — means that businesses have a 60-day cure window after receiving an AG notice during this period, but that window is not an invitation to delay preparation.

Planning your compliance roadmap means working backward from each effective date, assigning ownership, and building the documentation infrastructure before the deadlines hit — not after. Organizations that have adopted mature AI governance frameworks, as outlined in research by McKinsey’s 2026 State of AI, demonstrate 40–60% faster compliance implementation when they have pre-existing governance structures in place. The CART Act’s phased structure rewards organizations that build governance infrastructure now rather than scrambling to implement it obligation by obligation.

Complete CART Act Phased Timeline

🤖 3. What Is AEDT? Understanding Automated Employment-Related Decision Technology

The AEDT definition is the most consequential definition in the CART Act for the majority of Connecticut employers. AEDT — Automated Employment-Related Decision Technology — is defined as any technology that processes personal data and uses computation to generate any output — including a prediction, recommendation, classification, ranking, or score — that is a substantial factor used to make, or that materially influences, an employment-related decision. Employment-related decisions covered include hiring, promotion, discipline, compensation adjustments, and discharge.

The key phrase is “substantial factor.” This is a broader threshold than many compliance teams initially assume. An AI tool does not need to make the final decision autonomously to qualify as AEDT — it only needs to materially influence a decision made by a human. Resume screening tools that rank candidates, applicant tracking systems that score engagement, performance management platforms that flag employees for review, compensation benchmarking tools that recommend pay bands — all of these are plausible AEDT candidates under the Act’s definition. The CART Act also makes explicitly clear, effective October 1, 2026, that an employer cannot use AEDT as a defense against a discrimination complaint under the Connecticut Fair Employment Practices Act.

This anti-discrimination amendment is the most immediately consequential provision that is live today. Before October 1, 2026, an employer facing a discrimination claim might argue that an algorithmic system — not a human decision-maker — was responsible for an adverse employment outcome. The CART Act has permanently closed that defense. If your AEDT discriminates, the employer is liable, full stop. This is consistent with guidance from the IBM Institute for Business Value on AI ethics, which identifies algorithmic accountability — the principle that organizations remain liable for AI-driven outcomes — as a foundational governance requirement.

Does Your Tool Qualify as AEDT? A Decision Framework

AEDT Threshold Test: Ask three questions. (1) Does the tool process personal data about an individual? (2) Does it generate a computational output — a score, rank, prediction, classification, or recommendation? (3) Is that output a substantial factor in an employment decision affecting a Connecticut resident? If yes to all three: the tool is AEDT. Document it now.

📋 4. CART Act Compliance Requirements: What Businesses Must Do and When

Compliance with the CART Act is not a single deliverable — it is a governance programme that spans at least two years and requires cross-functional ownership across Legal, HR, IT, and leadership. The obligations are distinct by category, and the sequencing matters. The following section breaks down what each type of covered organization must do, organized by when the obligation takes effect.

What Employers Must Do by October 1, 2026 (Already Effective)

Three obligations are live for employers as of October 1, 2026. First, the AEDT statutory framework is in effect, which means the definitions, enforcement structure, and anti-discrimination amendment are all operative. Employers can no longer argue that an AEDT system — rather than the employer — is responsible for a discriminatory employment outcome. This is not a paperwork obligation; it is a liability shift that must be reflected in how your legal team handles employment discrimination claims and settlement strategy starting today.

Second, employers conducting mass layoffs or plant closings in Connecticut must now disclose to the Connecticut Department of Labor whether the layoff was substantially caused or contributed to by an AI system. This applies to any WARN notice filed in Connecticut as of October 1, 2026. If your organization is using AI-driven workforce planning tools, restructuring analytics, or productivity optimization systems that influence headcount decisions, those systems must be identified and their role in any layoff decision must be documented and disclosed. This is a new field on what was previously a standard regulatory filing — it must be integrated into your WARN notice process immediately.

Third, employers should use this period to build the foundation for the October 1, 2027 AEDT notice obligations. The October 2026 to September 2027 period is a mandatory cure period — meaning if the Connecticut Attorney General notifies your organization of a violation during this window, you have 60 days to cure before enforcement action proceeds. After September 30, 2027, cure opportunities become discretionary. Organizations that treat the cure period as an extension of their preparation window are playing a risky game: a notification from the AG still carries legal, reputational, and operational costs, even if the violation is ultimately cured.

What Employers Must Do by October 1, 2027

The October 1, 2027 deadline carries the heaviest compliance burden for most employers. By this date, any employer using AEDT to make or materially influence an employment decision affecting Connecticut applicants or employees must provide written pre-decision notice. This notice must be delivered before the employment decision is made and must include, in plain language: that the employer is using an AEDT; the purpose of the technology and the nature of the employment decision; the trade name of the AEDT; the categories of personal data the AEDT analyzes; the sources of that data; and a point of contact for the applicant or employee to direct questions.

Additionally, employers must offer a human review pathway. Where an AEDT is deployed in a way that the individual directly interacts with it, the employer must disclose that interaction unless it would be obvious to a reasonable person that they are dealing with automated technology. This “human review” requirement means your AEDT workflows must be designed with an override or escalation mechanism built in — not bolted on after the fact. Organizations that use AI governance frameworks modeled on the NIST AI Risk Management Framework 1.0 will find the CART Act’s notice and oversight requirements map closely to the “GOVERN” and “MANAGE” functions in that framework.

What Generative AI Providers Must Do (October 1, 2026)

Subscription-based generative AI providers with more than one million monthly users offering public access to consumers for personal use must provide prescribed subscription disclosures as of October 1, 2026. This threshold is designed to capture large-scale consumer AI platforms — think services like ChatGPT, Claude, or Gemini operating at scale — but any provider meeting the user threshold and serving Connecticut consumers must comply regardless of where it is headquartered. The disclosure requirements relate to synthetic content provenance: users must be informed when they are consuming AI-generated content in ways that could mislead a reasonable person.

What Frontier AI Developers Must Do (October 1, 2026)

Developers training foundation models above 10²⁶ floating point operations (FLOPs) — the threshold that captures the most capable and potentially highest-risk frontier models — are subject to whistleblower protection requirements effective October 1, 2026. Covered developers must implement internal reporting pathways that allow employees to raise safety concerns about AI systems under development without fear of retaliation. This is consistent with the EU AI Act’s requirements for general-purpose AI model providers, and reflects a broader global regulatory trend of importing internal governance obligations from financial services regulation into the AI sector. For a comparison of how AI governance requirements are evolving across jurisdictions, our AI governance frameworks guide provides a full cross-jurisdictional breakdown.

⚠️ 5. Enforcement, Penalties, and What “Cure Period” Actually Means

The CART Act’s enforcement structure is intentionally designed to give businesses a structured runway to achieve compliance — but it is not a free pass. Enforcement authority rests exclusively with the Connecticut Attorney General, working through the state’s Unfair Trade Practices Act (CUTPA). There is no private right of action — employees and applicants cannot sue employers directly under the CART Act’s AEDT disclosure provisions. However, the anti-discrimination amendment to the Connecticut Fair Employment Practices Act, which is now live, operates through the existing discrimination framework — which does carry private enforcement rights. This is a critical distinction that many compliance guides overlook.

Civil penalties for CART Act violations are up to $1,000 per violation. While that figure may seem modest relative to GDPR-scale fines, the “per violation” structure means penalties can compound quickly across a workforce using AEDT at scale. An organization that deploys AI hiring tools across thousands of Connecticut applicants without required disclosures is not facing one $1,000 violation — it is potentially facing one violation per affected individual. The reputational and operational cost of an AG investigation is also significant independent of the financial penalty. Connecticut’s AG enforcement approach has historically been aggressive in consumer protection — the CART Act gives that office a new mandate covering AI-related harms.

The CART Act Cure Period — What It Actually Means: From October 1, 2026 through September 30, 2027, if the AG notifies your organization of a CART Act violation, you have 60 days to cure the violation before enforcement proceeds. After September 30, 2027, cure opportunities are discretionary — the AG can proceed directly to enforcement without offering a cure window. The cure period is not a reason to delay compliance; it is a grace mechanism for organizations making good-faith efforts that fall short. Organizations with no compliance programme in place are unlikely to receive favorable treatment even during the cure period.

The rebuttable presumption provision is worth noting as a positive compliance incentive. Under the CART Act, a developer, integrator, or deployer that has actually complied with the Act’s requirements is presumed to have used reasonable care. This creates a direct legal benefit to documented compliance — a paper trail of your AEDT inventory, vendor assessments, notice templates, and audit logs is not just good governance practice; it is your first line of legal defense if enforcement proceedings are initiated.

🔧 6. Practical CART Act Compliance: A Step-by-Step Action Plan for 2026 and 2027

Building a defensible CART Act compliance posture requires cross-functional coordination. HR, Legal, IT, Procurement, and senior leadership all have roles to play. The following action plan is organized by phase, starting with what must be completed now for the October 2026 obligations, moving through the January 2027 AI companion deadline, and culminating in the full AEDT notice infrastructure required by October 2027.

Phase 1: Immediate Actions (Complete Now — October 2026 Obligations Live)

Step 1 — AI System Inventory. Conduct a comprehensive audit of every AI and automated decision-making tool used anywhere in your HR and employment workflow. This includes applicant tracking systems, resume screening tools, interview scoring platforms, performance management software, compensation benchmarking tools, and workforce analytics platforms. For each tool, document: its vendor name, the type of output it generates (scores, rankings, classifications, recommendations), the employment decision it influences, and whether Connecticut employees or applicants are in scope.

Step 2 — AEDT Classification. Apply the AEDT threshold test to each tool on your inventory. For tools that meet the definition, escalate to legal review immediately. For borderline cases, document your reasoning — the CART Act’s rebuttable presumption provision means documented good-faith analysis is legally valuable. For tools that clearly do not qualify, document why and retain that documentation.

Step 3 — WARN Notice Process Update. If your organization has any possibility of conducting workforce reductions in Connecticut, update your WARN notice process immediately to include the AI contribution disclosure field. This means identifying which workforce planning or restructuring decisions involve AI-generated analysis, recommendations, or outputs. Brief your HR Operations and Legal teams on when and how this disclosure is triggered.

Step 4 — Vendor Contract Review. Review vendor agreements for every identified AEDT to confirm whether your vendor has disclosure obligations under the CART Act and whether those obligations have been satisfied. The CART Act places information-sharing duties on AEDT developers — meaning your vendor is required to give you the information you need to comply with the notice requirements. If your vendor cannot or will not provide this information, that is a material contract issue that must be escalated.

Phase 2: Prepare for January 2027 (AI Companion Operators)

If your organization operates consumer-facing AI companion products — conversational AI systems designed to form ongoing relationships with users — January 1, 2027 is your next hard deadline. AI companions are defined broadly enough to capture a range of consumer-facing conversational AI products, but the Act expressly excludes business-support chatbots and healthcare AI from this category. If you are building or deploying consumer AI companions, your disclosure infrastructure — specifically, the obligation to disclose the AI’s non-human nature where a reasonable person could be misled — must be operational by January 1, 2027.

Phase 3: Build AEDT Notice Infrastructure (For October 2027)

The October 1, 2027 deadline requires the most complex infrastructure build. Written pre-decision AEDT notices must be delivered to affected individuals before employment decisions are made — this is not a checkbox disclosure; it must be a process integrated into your hiring, promotion, and personnel decision workflows. The notice must include six specific elements: (1) a plain-language statement that AEDT is in use; (2) the purpose of the technology and the nature of the decision; (3) the AEDT’s trade name; (4) the categories of personal data analyzed; (5) the data sources; and (6) a point of contact for questions. Notice templates should be drafted now, reviewed by counsel, and tested in your systems well before October 2027. For governance frameworks that support this kind of structured AI oversight at scale, our guide to non-human identity for AI agents covers the credential and identity management layer that underpins responsible AEDT deployment.

🏭 6. CART Act vs. Colorado AI Act vs. Illinois HB 3773: How Connecticut Compares

Connecticut’s CART Act does not exist in a vacuum. Businesses with multi-state operations need to understand how the CART Act intersects with and differs from the other major state AI compliance frameworks already in force or coming into effect. Colorado’s AI Act (SB 26-189, effective January 1, 2027) focuses specifically on “high-risk” AI systems and requires impact assessments and bias testing. Illinois HB 3773, in force since January 1, 2026, focuses on AI use in video interviews. The CART Act is broader than both — covering employment AI, generative content, frontier developers, AI companions, and online safety in a single statute.

The 2026 State AI Compliance Reality: There is no longer a single AI governance framework that covers all state-level obligations for US businesses. Connecticut, Colorado, and Illinois each have distinct requirements with overlapping but non-identical scope. Multi-state employers must map their AI systems against each jurisdiction’s definitions — and the CART Act’s AEDT definition is different enough from Colorado’s “high-risk AI system” definition that the same tool may be regulated differently in each state.

For businesses already building EU AI Act compliance programmes, the CART Act will feel familiar in structure — but the specific definitions, thresholds, and notice mechanics differ materially. Organizations implementing an integrated multi-jurisdictional AI compliance framework should reference our EU AI Act Explained guide alongside this CART Act analysis to identify where obligations converge and where they diverge. The OWASP framework for AI security risks also provides a useful technical complement to the CART Act’s governance requirements, particularly for organizations assessing bias and safety risks in AEDT deployments.

🏁 7. Conclusion: Where to Start and What Matters Most

The Connecticut CART Act is live, enforceable, and consequential. The common mistake businesses are making right now is treating October 2026 as a soft launch and October 2027 as the real deadline. That framing is wrong. The anti-discrimination amendment is in force today — and it has already changed the legal landscape for every Connecticut employer using AI in personnel decisions. The WARN notice AI disclosure obligation is in force today. The mandatory cure period is running now. The organizations that will be best positioned at the October 2027 AEDT notice deadline are the ones building their compliance infrastructure today, not scrambling to implement it in the nine months before notices go live.

The practical starting point for most organizations is a documented AI system inventory. You cannot comply with a law you do not understand, and you cannot understand your exposure without knowing which tools are in scope. From the inventory, the path forward is methodical: classify each tool against the AEDT definition, review vendor contracts for developer disclosure obligations, update your WARN notice process, brief your legal team on the anti-discrimination amendment, and begin drafting the pre-decision notice templates that will be required in 2027. For organizations navigating this alongside broader AI governance obligations, our review of enterprise AI governance frameworks outlines the structural approaches that support multi-jurisdiction compliance at scale. The CART Act is not the last AI compliance obligation Connecticut businesses will face — but how well you build your programme now will determine how costly the next one is to implement.

🔗 Related Articles

• 📖 AI Governance Frameworks: How to Build a Policy That Actually Works (2026)
• 📖 EU AI Act Explained: What Every Business Needs to Know (2026)
• 📖 The AI Audit Checklist: 25 Questions Every Organization Must Answer
• 📖 Non-Human Identity for AI Agents Explained: Security & Governance Guide (2026)
• 📖 AI Incident Response: A Practical Playbook for 2026