Connecticut’s New AI Law Mandates Disclosure of Automated Employment-Related Decision Technology and Otherwise Regulates AI in Employment

On May 27, Connecticut Gov. Ned Lamont signed into law Public Act No. 26-15, “An Act Concerning Online Safety” (the Act), which governs the use of AI technology in a wide variety of contexts. The 74-page Act addresses many potential risks arising from the use of AI, ranging from mental-health risks posed by AI companions to “catastrophic” risks of mass death, injury or property damage posed by the use of foundation models “in the creation or release of a chemical, biological, radiological or nuclear weapon” and cyberattacks. Id. §§ 2, 4. In particular, employers should pay close attention to the sections governing disclosure of “automated employment-related decision technology” (herein, AEDT) and adapt their employment practices accordingly.

Disclosure of Automated Employment-Related Decision Technology

The Act defines AEDT to mean “any technology that processes personal data and uses computation to generate any output, including, but not limited to, any prediction, recommendation, classification, ranking, score or other information, that is a substantial factor used to make or materially influence an employment-related decision.” Id. § 7(a)(1). “Employment-related decisions” are material employment decisions regarding an individual’s tenure or terms, privileges or conditions of employment that are “made based on any individual’s personal data,” excluding decisions relating to “workplace health and safety, scheduling and planning or productivity monitoring.” Id. § 7(a)(5). A factor is “substantial” within the meaning of the Act if it “meaningfully alters the outcome of an employment-related decision concerning an individual.” Id. § 7(a)(8). Like many AI laws in the employment context, the Act distinguishes between “deployers” who use AEDT (generally employers or their agents) and “developers” who create AEDT. Id. §§ 7(a)(2)–(4).

If employers use AEDT to “interact” with employees and applicants (e.g., through natural language and adaptive, human-like responses to user inputs), then the Act requires the employer to disclose to employees and applicants, in plain language, that they are interacting with such technology, unless it would be obvious to a reasonable person. Id. § 9.

If employers use AEDT “to generate any output for the purpose of making, or as a substantial factor in making, an employment-related decision,” then the Act requires the employer to provide written notice — before the employment-related decision is made — disclosing the use of the AEDT, the purpose of the AEDT in the employment-related decision, the trade name of the AEDT, the categories and sources of personal data involved, how the personal data will be assessed in reaching a decision, and contact information for the employer. Id. § 10.

Both of these provisions will apply to the use of AEDT on or after Oct. 1, 2027, so employers have time to make the necessary adjustments. The Act also allows employers to contractually delegate these responsibilities to the developer of the AEDT. It remains to be seen if developers will volunteer to assume these duties in an effort to market their offerings to employers. In the absence of delegation, the developer must provide the employer with the information to comply with the Act.

Any violation of the Act’s disclosure obligations, id. §§ 8–11, constitutes an “unfair or deceptive trade practice” within the meaning of Conn. Gen. Stat. § 42-110b, which is enforceable by the state’s attorney general. Id. § 12. The attorney general may provide an opportunity to cure a violation within 60 days, if possible, before initiating an enforcement action, but is not required to do so. Id. The Act’s disclosure obligations do not create a private right of action. Id.

AEDT Use Is Not a Defense Against Discrimination Claims

Employers cannot avoid discrimination claims by blaming AEDT. The Act amends Connecticut law prohibiting discriminatory employment practices, Conn. Gen. Stat. § 46a-60(b), to make clear that the use of AEDT is not a defense against discrimination claims. Id. § 13. However, “evidence of anti-bias testing or similar proactive efforts to avoid the discriminatory practice” may be considered in defense of such claims. Id.

This largely concerns disparate impact claims, where an employer may defend the use of AEDT with evidence that it conducted anti-bias testing or other steps taken to limit the disparate impact and/or ensure that the selection decisions were job-related.

Expanded WARN Act Requirements

The Act supplements employers’ responsibilities under the federal WARN Act, 29 U.S.C. § 2102(a), which requires written notice to the Connecticut Labor Department of a plant closing or mass layoff. Beginning Oct. 1, 2026, those notices must include additional information regarding AI; specifically, “whether the layoffs that are the subject of such written notice are related to the employer’s use of artificial intelligence or another technological change.” Id. § 26.

Whistleblower Protections for Employees of AI Developers

Additionally, employees of AI developers that train foundation models enjoy expanded whistleblower protections. A “foundation model” is “any engineered or machine-based system that (A) varies in its level of autonomy, (B) can, for any explicit or implicit objective, infer from the inputs such system receives how to generate outputs that can influence physical or virtual environments, (C) is trained on a broad data set, (D) is designed for generality of output, and (E) is adaptable to a wide range of distinctive tasks.” Id. § 2(a)(7). The Act refers to AI developers that train foundation models as “frontier developers” or “large frontier developers.” Id. §§ 2(a)(8)–(9). The Act prohibits frontier developers from retaliating against employees for reporting suspected violations of law, unethical practices, mismanagement or abuse of authority. Id. § 2(b)(1) (incorporating protected activities under Conn. Gen. Stat. § 31-51m(b)). By Jan. 1, 2027, large frontier developers with annual gross revenues exceeding $500 million in the preceding calendar year must establish “a reasonable internal process” to investigate and respond to reports by risk-management employees of “any activity that poses a specific and substantial danger to the public health or safety due to a catastrophic risk.” Id. § 2(c). Frontier developers that violate these provisions are liable to the state for a civil penalty up to $1,000 per violation. Id. § 2(e).

Conclusion

With the passage of the Act, Connecticut joins the ranks of other states addressing use of AI in employment and other contexts through legislation. Given the breakneck pace of new developments, Connecticut employers deploying or developing AI tools should be mindful of the changing legal landscape and adapt their practices accordingly.

Paul Hastings actively monitors updates on this topic, and we are available to assist with emerging compliance challenges.