How Connecticut Public Act 26-15 / SB 5 (Online Safety and AI Provisions) applies to financial services organizations and the obligations to plan for.
Banks, lenders, insurers, broker-dealers, and fintech firms using AI for credit decisions, underwriting, fraud detection, and consumer interaction.
This law applies to financial services organizations to the extent their AI use falls within the law's scope (see the obligations below). Organizations operating in Connecticut should treat this law as part of the baseline regulatory obligations alongside any sector-specific federal rules.
On and after October 1, 2026, a subscription-based provider that creates, codes, or otherwise produces a generative AI system with more than 1,000,000 monthly users and public accessibility to consumers for personal use must provide the generative-AI subscription disclosure required by Public Act 26-100 Section 46 (which replaced the original Public Act 26-15 subscription provisions). The duty is enforced solely by the Attorney General as a Connecticut Unfair Trade Practices Act (CUTPA) violation, with no private right of action.
Deadline: from_2026-10-01
On and after October 1, 2026, an employer that conducts a layoff substantially caused or contributed to by an artificial intelligence system must provide the AI-related layoff notice required by Public Act 26-15. This is one of the earliest-effective private-sector duties in the Connecticut package and applies alongside the state's existing separation and mass-layoff notice obligations.
Deadline: from_2026-10-01
On and after January 1, 2027, a large frontier-model developer must establish an anonymous whistleblower reporting channel through which employees and contractors can report critical AI risks. Violations of the frontier-developer whistleblower provisions carry a civil penalty of up to $1,000 per violation plus injunctive and equitable remedies, distinct from the CUTPA/Attorney-General model that governs most other provisions of the Act.
Deadline: from_2027-01-01
On and after January 1, 2027, an operator of an AI companion (a system designed to simulate sustained human-like relationships with a user) must implement the Act's chatbot safety provisions, including protections for minors. These operator duties sit within the Act's broader youth online-safety framework and are enforced by the Attorney General as CUTPA violations.
Deadline: from_2027-01-01
For deployments of automated employment-related decision technology (AEDT) on or after October 1, 2027, a deployer must provide the Act's interactive disclosures and pre-decision written notice to affected individuals. The Attorney General may issue a 60-day cure notice for AEDT violations occurring through December 31, 2027, so the earliest AEDT-specific compliance work is a 2027 program task rather than a 2026 one.
Deadline: from_2027-10-01
This law applies to financial services organizations to the extent their AI use falls within the law's scope (see the obligations below). The law should be read with the source-derived obligations listed on this page and any sector-specific federal rules that apply to financial services workflows.
Connecticut Public Act 26-15 / SB 5 (Online Safety and AI Provisions) is scheduled to take effect on October 1, 2026.
Connecticut Public Act 26-15 / SB 5 (Online Safety and AI Provisions) lists developer, deployer as the role coverage for Connecticut. The actual duty depends on whether the organization develops, deploys, procures, or uses the covered AI system in the law's scope.
Connecticut Public Act 26-15 / SB 5 (Online Safety and AI Provisions) does not list a fixed maximum penalty in the Atlas record; remedies follow the law's enforcement framework and source sections.
We may receive referral commissions from recommended compliance tools. Recommendations are based on product fit and not on commission size. Links marked “partner link” include a tracked redirect.