By Roman Aglaganov
While Washington debates, US states keep writing their own AI rules. Connecticut’s SB 5, “An Act Concerning Online Safety”, was signed by Governor Ned Lamont in May and is one of the widest-ranging state AI laws so far. Its first parts took effect on 1 October 2026, with more phasing in until 2028.
In force now
Subscriptions: companies that sell AI on a subscription must give Connecticut customers a written notice of the key terms, including any limits they may impose and whether they can restrict access to AI features, and get written acceptance before taking payment or renewing. Breaking the rules counts as an unfair trade practice, enforced by the state attorney general.
Whistleblowers: employees of “frontier developers”, companies training models with more than 10²⁶ operations of compute, the same threshold California and New York use, are protected from retaliation when they report catastrophic risks. The law defines those as risks of a model helping to kill or seriously injure more than 50 people or cause over $1 billion in damage. Developers with more than $500 million in annual revenue must also set up an anonymous internal reporting channel by 1 January 2027.
Coming in January: AI companions
From 1 January 2027, operators of AI companions, chatbots built to sustain human-like relationships, must detect signs of suicide risk, self-harm or imminent violence and point users to help such as the 988 crisis line. They must not let the bot claim to be human, and must remind users they are talking to an AI: at least hourly for minors and every three hours for adults. There are extra protections for under-18s, including bans on sexual content and manipulative engagement tricks.
Why it matters
Each state law covers only that state’s residents. Together, California, New York, Connecticut and others are building a de facto national rulebook, one state at a time. For AI companies, that patchwork is a strong argument for clear federal rules; for users, it is often the only protection on offer.
