Connecticut SB 5 imposes new AI rules for employers and developers

Connecticut expands oversight of AI-driven hiring decisions

Connecticut has joined a growing roster of states tightening the leash on how artificial intelligence influences the workplace. On May 27, 2026, Governor Ned Lamont signed SB 5 (Public Act No. 26-15), a comprehensive law that imposes new legal requirements on both the companies using automated tools to hire or fire staff and the developers building those technologies. According to a report from Cooley, the law introduces a rigorous framework for “automated employment-related decision technology,” or AEDT, which covers any system that uses computation to generate outputs—such as rankings, scores, or recommendations—that act as a “substantial factor” in making employment decisions.

The stakes for businesses are immediate, even if the full weight of the new disclosure rules won’t land until late 2027. While many of the administrative requirements are on a longer runway, other provisions are already live. For instance, the law amends the Connecticut Fair Employment Practices Act to ensure that a company cannot use AI as a legal shield against discrimination claims. Furthermore, employers must now disclose whether layoffs reported via federal WARN Act notices are the result of AI usage or other technological changes.

This shift signals a move toward high-stakes algorithmic accountability. While New York City’s existing AEDT laws focus on tools that replace or substantially assist human decision-making, Connecticut’s “materially influence” standard is arguably broader. It could potentially capture software that merely provides information to a human manager, even if that manager makes the final call.

The burden of transparency for employers and developers

The law creates two distinct classes of regulated entities: deployers and developers. Deployers are any businesses operating in Connecticut that use AEDT to affect employment terms, such as hiring, promotions, or discipline. Starting October 1, 2027, these employers must provide employees and applicants with written notice that includes the tool’s trade name, the categories of personal data being analyzed, and the sources of that data. They must also disclose the purpose of the technology in plain language.

Developers face their own set of hurdles. Any person doing business in the state who develops or “intentionally and substantially modifies” an AEDT must provide employers with the necessary information to meet these disclosure obligations. This creates a complex web of contractual necessity; if an employer heavily customizes a third-party tool, they may find themselves reclassified as a developer under the law.

There is, however, a significant legal gray area regarding geography. Because SB 5 does not explicitly define “deployer” or “doing business in Connecticut,” it remains unclear if the law applies to out-of-state employers with remote workers in the state, or to Connecticut residents applying for roles in other states. Until the courts or regulators provide clarity, many multistate employers are opting for a conservative approach, assuming the law applies to any interaction involving a Connecticut resident.

Algorithmic bias and the end of the “black box” defense

One of the most critical shifts involves how companies handle discrimination lawsuits. A February 2026 memo from Attorney General William Tong confirmed that existing anti-discrimination laws apply to AI-driven decisions. Under SB 5, the use of an automated system is no longer a valid defense if that system results in biased outcomes. While the law does not strictly mandate anti-bias testing, the Connecticut Commission on Human Rights and Opportunities (CHRO) or a court may look at whether an employer conducted such tests—and how they responded to any flaws found—when evaluating a claim.

The connecticut commission on human rights l

The Connecticut AI law: what employers must do now #Shorts

The enforcement mechanism is centralized under the Connecticut Attorney General via the Connecticut Unfair Trade Practices Act (CUTPA). Notably, there is no private right of action, meaning individual employees cannot sue directly under this specific statute; instead, they must rely on the state’s legal apparatus. To ease the transition, the Attorney General will offer a 60-day “cure period” for certain violations through the end of 2027, allowing businesses to fix mistakes before facing formal legal action.

Requirement Type	Effective Date	Primary Target
Anti-discrimination protections	October 1, 2026	All Employers
Layoff (WARN) AI disclosures	October 1, 2026	Employers conducting layoffs
Deployer disclosure & notice	October 1, 2027	Employers using AEDT
Developer information sharing	October 1, 2027	AI Software Developers

Frontier developers and the regulatory sandbox

Beyond the hiring office, SB 5 reaches into the very heart of high-level AI research. The law introduces specific protections for “frontier developers”—those training massive foundation models. These developers are prohibited from retaliating against employees who blow the whistle on activities that pose a “catastrophic risk” to public health or safety. By January 1, 2027, the largest of these entities, defined as those with more than $500 million in annual gross revenue, must implement anonymous internal reporting processes for their staff.

Governor ned lamont of connecticut, official portrait (cropped)

To balance this strict oversight with the need for economic growth, Connecticut is also planning a “regulatory sandbox.” Set to begin in July 2027, this initiative will allow companies to test innovative AI products under reduced regulatory requirements for a limited time. This move mirrors similar approaches taken in states like Texas, aiming to foster innovation while maintaining a safety net for the public.

For companies currently integrating machine learning into their workflows, the window for preparation is closing. The transition from “experimental tool” to “regulated employment decision-maker” is now a matter of statutory record. As the legal landscape continues to fracture into state-specific requirements, the ability to audit a tool’s logic and data sources is becoming as essential as the tool itself.