Governor Ned Lamont signed into law the Connecticut Artificial Intelligence Responsibility and Transparency Act (the CART Act). This legislation marks a substantial step in regulating artificial intelligence with far-reaching implications. The Act addresses a wide range of issues, from AI in employment decisions, safety measures for the most powerful AI models, and content provenance to youth online safety and consumer protections.
This Client Alert is only a summary of some of the provisions of the CART Act. For a complete copy of the CART Act, click here. As highlighted below, there are important carve outs for certain health care applications and opportunities for health care innovation in the AI space.
While the law is broad, its practical impact will vary depending on your organization’s use of AI. The provisions phase in on staggered effective dates, with some obligations beginning July 1, 2026 or later in 2026, and other obligations not taking effect until 2027 or 2028. In light of this Act, if you are subject to Connecticut law, we recommend reviewing your current AI practices now to avoid surprises.
Key Provisions That May Affect Your Business
- AI in Employment
A significant focus of the new law is how AI influences Connecticut’s workforce which is likely to have the broadest day-to-day implications for employers. The law applies to AI tools called automated employment-related decision technology used as a “substantial factor” in employment-related decisions, e.g., hiring, promotion, discipline, discharge, and selection for training, among others. Employers using such tools must disclose to applicants and employees when they are interacting with an AI tool or automated decision process, including the purpose and trade name of the technology and the categories and sources of personal data used. This written notice must be provided before the employment-related decision is made and must also explain how the personal data will be assessed in reaching the decision. Developers of such automated employment-related decision technology must supply their customers with the compliance-related information needed to meet these obligations.
The law also amends Connecticut’s anti-discrimination statutes to codify that the use of automated decision-making is not a defense to a discrimination claim, although courts may consider proactive anti-bias testing as a mitigating factor. As always, employers remain fully responsible for ensuring workforce decisions do not result in disparate treatment or impact on protected classes of applicants or employees, including when those decisions are made or aided by AI.
Prior to the effective date, employers likely will want to take the following practical steps:
- Inventory AI tools used throughout the organization with an initial focus on HR.
- Engage with AI vendors on the data, logic, and anti-bias testing disclosures to understand the documentation and compliance support that will be provided.
- Review and update employment notices, application processes, adverse-action communications, and other HR processes, to incorporate the required disclosures and explanations.
- Determine what, if any, reporting obligations there may be related to layoffs or plant closings.
- AI Companion Chatbots; Exceptions for Certain Health Care Applications
Effective January 1, 2027, operators of AI chatbots that simulate human conversation must clearly disclose that the user is interacting with AI rather than a human and must implement evidence-based protocols to detect expressions of suicidal ideation or self-harm and refer users to appropriate resources. For minor users, operators must take measures meeting or exceeding industry standards to prevent the chatbot from encouraging self-harm, suicidal ideation, violence, disordered eating, or substance use. Chatbots may not engage in romantic or explicit interactions with minors and may not deploy manipulative techniques designed to foster emotional dependence.
Importantly, the CART Act includes carve-outs for certain health care AI systems from the definition of an artificial intelligence companion. Excluded from the CART Act requirements are AI systems used solely to provide health care-related education, clinical support, medication-adherence reminders, disease-management guidance or other treatment-support functions provided that the AI system (i) does not present itself as a human being, (ii) does not use anthropomorphic features, and (iii) is not designed to meet a user’s social or emotional needs.
Chatbots may offer mental health services to minors, but only under limited circumstances. AI companions may not offer mental health services to minor users unless the companion is specifically designed to deliver such services, its developers utilize clinical best practices, and clear lines of accountability have been established to address any harms the companion may cause. The companion’s functions, limitations, and data privacy policies must be readily accessible to the user and the user’s treating licensed mental health professional, and the companion must conspicuously disclose at the beginning of each interaction that it is not a licensed mental health professional and is not marketed as a substitute for one. The companion must also refrain from discouraging users from seeking professional mental health services or assistance from an appropriate adult, and may not encourage users to harm others or engage in romantic or sexually explicit interactions with minor users.
- Health Care AI Innovation Competition
During the fiscal year ending June 30, 2027, the Office of the Comptroller, in collaboration with Connecticut Innovations, Incorporated, and other relevant stakeholders, may serve as a member of the steering committee for a competition to foster artificial intelligence utilization to improve health equity and health outcomes in Connecticut. As part of the competition, the Comptroller may make relevant data available after consulting with stakeholders.
This initiative creates structured opportunities for health care organizations, health systems, AI developers, and other stakeholders to participate in state-supported efforts to advance responsible, equity-focused AI applications in health care. It complements the Act’s carve-outs for certain clinical support, education, medication-adherence, and disease-management AI tools and reinforces Connecticut’s dual emphasis on protecting consumers while actively promoting health care AI innovation.
What Should You Do Next?
The law takes a measured, transparency-focused approach rather than imposing pre-approval requirements or outright bans, but compliance will require updates to policies, notices, vendor contracts, and internal processes, particularly for organizations using AI in hiring or human resources functions. We suggest the following practical steps:
- For consumer-facing chatbots, evaluate readiness for the January 2027 disclosure, self-harm detection, and minor-protection requirements.
- Follow best practices to avoid Prompt Injection – A command that supersedes or overrides the safeguards put in place by a deployer of AI. Any and all technical controls put in place by AI deployers to ensure compliance with the law can be overridden by Prompt Injection if safeguards are not put in place to avoid Prompt Injection.
- Monitor implementing regulations and guidance from the Attorney General and state agencies, as well as federal preemption developments that could affect enforcement.
This is a rapidly evolving area, in Connecticut, other states across the country, and at the federal level. Should you have any questions regarding the above, please contact the authors, the Garfunkel Wild attorney with whom you regularly work, or email us at [email protected].