Connecticut SB 5 Passes May 1: AI Provenance, AEDT Disclosures, and Chatbot Guardrails by 2027

Connecticut’s legislature sent Governor Ned Lamont an AI omnibus bill on May 1, 2026¹, after the House approved it 131, 17 and the Senate had passed it 32, 4¹ on April 21. SB 5 imposes staggered obligations on three distinct product categories: synthetic-media provenance for large generative platforms, pre-use compliance disclosures for automated employment decision tools, and guardrails on AI companion chatbots that interact with minors. Lamont’s spokesperson said he “looks forward to signing”² the measure, setting up an October 2026 start date for the first provisions.

What SB 5 Covers and When It Takes Effect

The bill bundles provisions that usually travel separately in other states. The provenance, AEDT, and companion-bot rules each carry their own effective dates, so the compliance surface expands in phases rather than all at once.

Large generative providers face the earliest deadline. Platforms with more than one million monthly users must embed provenance metadata in synthetic audio, images, text, and video by October 1, 2026³; all remaining developers capable of generating synthetic content must comply a year later, by October 1, 2027³. AEDT developers must hand over compliance information to deployers by the same October 2026 cutoff, while deployers themselves have until October 1, 2027⁴ to supply pre-decision notices and data-correction rights to workers facing adverse employment decisions. The companion-bot provisions take effect January 1, 2027⁴.

Provenance Requirements for Generative Platforms

Platforms above the one-million-monthly-user threshold will need to embed provenance metadata directly into synthetic audio, images, text, and video. The requirement is not a disclosure buried in terms of service; it is a technical specification applied at the point of generation or distribution. Smaller developers get a twelve-month extension, but the engineering work is identical: ingest, sign, and persist provenance records for synthetic outputs.

The one-million-user threshold captures the major foundation-model APIs and consumer frontends, but it also sweeps in mid-sized image generators and voice-cloning services that may not have C2PA pipelines in production.

AEDT Rules: Developer vs. Deployer Obligations

The bill draws a sharp line between AEDT developers and the deployers who use their tools. Developers must furnish compliance information, likely covering bias audits, accuracy metrics, and known limitations, before any tool is used as a substantial factor in hiring, promotion, discipline, or discharge. That developer-facing deadline is October 1, 2026⁴. Deployers then have until October 1, 2027⁴ to provide pre-decision notices and grant data-correction rights to workers who receive adverse employment decisions.

The split creates a supply-chain dependency: an HR SaaS vendor that misses the October 2026 documentation deadline blocks every Connecticut customer from lawful deployment for a full year, even if the customer is ready on the deployer side.

Companion-Bot Guardrails and Minor Protections

AI companion chatbots operating in Connecticut must include suicide and self-harm detection protocols, display clear non-human disclosure, and abstain from romantic, sexually explicit, or manipulative interactions with minors. The effective date is January 1, 2027⁴. Minors and their parents have a private right of action for violations, which exposes vendors to direct litigation rather than administrative fines alone.

The prohibition on “manipulative techniques to extend minor sessions” is notably vague. It likely targets engagement-maximizing loops common in consumer chatbot products, but the line between personalization and manipulation will be settled in court, not in commit logs.

How Connecticut Compares to Colorado, California, and Texas

Connecticut’s package lands while Colorado is retreating from its earlier comprehensive regime. Colorado repealed SB 24-205 in May 2026⁵ and replaced it with SB 26-189⁵, a narrower ADMT disclosure framework that takes effect January 1, 2027. That leaves Connecticut with what legal analyses describe as one of the stricter state-level AI compliance architectures currently on the table, at least for provenance and employment automation.

California’s SB 1119 and AB 2023 cover overlapping territory but do not align cleanly with Connecticut’s scope or timeline. Texas’s TRAIGA addresses a different slice of the problem. The result is a compliance matrix in which a product feature lawful under Colorado’s new disclosure regime may still require provenance embedding and AEDT documentation in Connecticut.

Federal Preemption Risk and the Compliance Matrix

The staggered obligations sit atop an unresolved preemption fight. On December 11, 2025, President Trump signed Executive Order 14365⁶, directing the Department of Justice to establish an AI Litigation Task Force charged with challenging state AI laws on federal preemption and interstate-commerce grounds. NetChoice, CBIA, and CCIA testified against SB 5⁷ during the legislative process, arguing the bill creates an unnavigable patchwork, violates the First Amendment, and imposes disproportionate burdens on small businesses.

Preemption litigation could freeze or overturn parts of the law, but engineering teams cannot ship on the assumption that a court will grant an injunction. The more practical risk is that Connecticut’s specific requirements, particularly the one-million-user provenance threshold and the developer-deployer AEDT split, become a template that other states copy, expanding the patchwork before federal preemption is ever resolved.

What Engineering Teams Should Do Before October 2026

Five months is a narrow runway for C2PA pipeline construction or AEDT documentation systems. Teams shipping generative media should audit their synthetic output pipelines now for C2PA or equivalent provenance embedding. The work is not a configuration toggle; it touches encoding, storage, and downstream delivery paths. HR-tech vendors need to package bias-audit and compliance documentation for Connecticut deployers by October, which means finishing the underlying assessments this summer. Chatbot products with any minor-facing surface should review session-management logic for engagement-maximizing patterns that could read as manipulative under the January 2027 standard.

Frequently Asked Questions

Is Connecticut really the seventh state to pass a comprehensive AI law?

The “seventh state” label traces to companion-bot legislation counts, not comprehensive AI regulation broadly. Primary sources describe SB 5 as an omnibus bundling separate provisions—provenance, AEDT, and companion-bot rules—and no verified tally confirms seven states with comparably scoped AI omnibus laws on the books.

What specific requirements does Connecticut impose that Colorado’s SB 26-189 drops?

Colorado’s replacement law is limited to ADMT disclosure obligations. Connecticut retains provenance metadata embedding for synthetic media, a developer-deployer AEDT liability split with supply-chain blocking risk, and minor-specific chatbot guardrails backed by a private right of action—none of which appear in Colorado’s narrower framework.

Could a federal preemption challenge block SB 5 before October 2026?

Unlikely. The DOJ AI Litigation Task Force created under Executive Order 14365 has not yet filed suit against any state AI law. Federal preemption challenges typically require 12–18 months to reach a preliminary injunction ruling, meaning the October 2026 first-deadline wave would arrive before any binding court decision.

Why does the companion-bot provision’s private right of action matter for vendors?

Most state AI laws—including Colorado’s SB 26-189 and California’s existing AI statutes—route enforcement through the attorney general’s office, which exercises prosecutorial discretion. Connecticut’s companion-bot provisions grant minors and parents standing to sue directly, bypassing that gatekeeper and exposing vendors to unpredictable, potentially uncapped damages from individual plaintiffs.

Footnotes

1. CT Mirror: Artificial intelligence regulation passes Connecticut House ↩ ↩²

2. Freshfields: Connecticut poised to enact one of the nation’s most comprehensive AI laws ↩

3. AI Policy Desk: Connecticut AI law 2026 compliance checklist ↩ ↩²

4. DLA Piper: Unpacking Connecticut’s new AI law ↩ ↩² ↩³ ↩⁴ ↩⁵

5. Davis Graham & Stubbs: Colorado AI Act repeal and replacement ↩ ↩²

6. Manatt: Trump Executive Order targets state AI laws ↩

7. NetChoice: Testimony against unconstitutional and redundant AI regulation in Connecticut ↩