To govern AI in Connecticut, follow four steps: inventory every AI system you use, classify each by risk, document it in one standing record, and assign an owner with a review date. The method works whatever Connecticut requires next, because it answers the first question any regulator, client or auditor asks: what AI do you use, and who does it affect?
What’s changing in Connecticut
Connecticut’s AI law, SB 5, was enacted in May 2026 and began phasing in on October 1, 2026. It covers AI in employment decisions, AI subscriptions and AI companions, and sets a mandatory cure period through September 30, 2027. Companion rules start January 1, 2027, and employment-decision rules apply to systems deployed on or after October 1, 2027. The Connecticut Data Privacy Act was also widened on July 1, 2026, with lower thresholds and a profiling impact assessment for processing from August 1, 2026.
Both depend on knowing which AI systems you have. This guide is educational, not legal advice, so have Connecticut counsel confirm how the rules apply to you.
Step 1: Inventory every AI system
Answer: An AI inventory is a living register of every AI system you use, build or buy: who owns it, what it does, what data it touches and who it affects.
Check procurement and expense records, single sign-on and browser extensions, AI features inside software you already own, developer tools and API keys, and a short survey of each team. For every system, capture the owner, vendor and model, purpose, data used, people affected, deployment date and the access it holds.
Step 2: Classify by risk tier
Answer: Risk tiering puts the strictest controls where harm is greatest. Give each system its highest applicable tier.
Flag any system that can act, not just answer. Developer Simon Willison’s “lethal trifecta” (private data, untrusted content and external communication in one agent) is the test. If a system has all three, redesign it or require human approval for high-impact actions.
Tier 1: Decisions about people. This covers hiring, promotion, credit, benefits and care. Minimum controls are bias testing, plain-language notices and a human appeal path.
Tier 2: Consumer-facing AI. This covers chatbots, AI subscriptions and companion chat. Minimum controls are AI disclosure, clear terms and harm escalation.
Tier 3: Personal-data profiling. This covers scoring, segmentation and prediction. Minimum controls are a privacy notice update and an impact assessment.
Tier 4: Internal productivity. This covers drafting, summarizing and search. Minimum controls are an acceptable-use policy and periodic review.
Step 3: Document each system
Answer: Keep one standing record per system so you can answer a regulator, client or auditor quickly.
Each record should hold the purpose and risk tier, data sources, vendor documents and contract terms, bias-testing methods and results, who oversees outputs, the notice shown to users, and the deployment date and change history. Law firms advising on SB 5 recommend documenting bias testing, because Connecticut’s presumption of reasonable care rewards organizations that can show their work.
Step 4: Assign owners and set a review rhythm
Name an executive sponsor, an owner for each system, and privacy, legal and security contacts. As a starting cadence (our recommendation, not a legal requirement), review Tier 1 and 2 systems quarterly and the rest yearly. Re-review whenever the model, vendor, data or use case changes.
Where an IT consultant fits
An IT consultant can’t give legal advice but can do the technical work: discovery, access reviews, data mapping and monitoring. When comparing IT consultants in Connecticut, look for vendor-neutral advice and a clear method.
The SamurAI is an enterprise AI governance and IT consulting firm based in Bridgewater, New Jersey. Our SamurAI AI governance work supports Connecticut organizations with AI Governance, Compliance & Risk Assessment and Zero Trust & Identity for AI agents.
Frequently asked questions
- What is an AI inventory? An AI inventory is a living register of every AI system your organization uses, builds or buys, recording the owner, purpose, data, people affected, vendor, deployment date and risk tier.
- Does Connecticut law require an AI inventory? Law-firm summaries of SB 5 don’t describe a standalone inventory mandate, but you can’t meet its disclosure and documentation duties without knowing where AI is used. Confirm specifics with counsel.
- When do Connecticut’s AI rules take effect? Most of SB 5 began on October 1, 2026. Companion rules start January 1, 2027, and employment-decision rules apply to systems deployed on or after October 1, 2027.
- Do these rules apply if we only use off-the-shelf AI tools? They can. Buying instead of building doesn’t remove your own obligations, such as disclosing automated employment tools. Classify each tool by what it does and who it affects
Ready to get your AI in order?
Not sure where your organization stands under Connecticut's new AI rules? Book a consultation with The SamurAI team. We'll walk through your AI inventory, risk tiers and documentation with you, so you know what to fix first. Book a consultation
Sources
- WilmerHale: What Companies Should Know About Connecticut’s New Omnibus AI Law
- Holland & Knight: Connecticut Enacts Comprehensive AI Legislation
- Faegre Drinker: Connecticut Enacts Comprehensive AI Regulation
- Ogletree Deakins: New Connecticut Law Restricts Employer AI Use
- Foley & Lardner: Connecticut Dramatically Expands Its Data Privacy Act
