Connecticut Joins The AI Hiring Law Wave—with A More Measured Approach

Key Takeaways:

• Connecticut has joined a growing number of states regulating employers' use of AI in hiring and employment decisions.

• The “Act Concerning Online Safety” emphasizes notice, transparency, correction rights, and human review.

• Unlike New York City's AI hiring law, Connecticut will not require mandatory bias audits before use.

• Employers should begin evaluating AI hiring tools now, with key provisions taking effect in October 2026 and 2027.

Connecticut has joined the growing number of jurisdictions imposing targeted rules on employers’ use of artificial intelligence tools in hiring and other employment decisions. “An Act Concerning Online Safety,” Public Act No. 26-15, signed by Governor Lamont on May 27, 2026 (the “Act”), is a comprehensive privacy law that imposes obligations on artificial intelligence tool developers, employers, and state agencies related to the use and deployment of artificial intelligence tools to consumers.

Connecticut’s Act borrows several concepts that multistate employers will recognize, including advance notice, adverse-decision explanations, correction rights, and an appeal process with human review where technically feasible. However, it does not go as far as New York City’s Automated Employment Decision Tools law, which requires an independent bias audit before use and public posting of certain audit information, and it is more closely aligned with Colorado’s newly amended Automated Decision-Making Tools (“ADMT”) framework—and with concepts reflected in California’s ADMT rules—in emphasizing notice, adverse-decision explanations, correction rights, and human review rather than mandatory bias testing.

As discussed below, the Act’s employment-discrimination provisions take effect on October 1, 2026, while its notice-related developer and deployer obligations are formally effective the same day but apply only to covered tools deployed on or after October 1, 2027.

Covered Businesses and Use Cases

The Act applies to a “deployer” doing business in Connecticut that uses an “automated employment-related decision process” in the state, a definition that is intentionally broad so as to include employers. Notably, certain provisions apply to employers that deploy tools that are intended to interact with an employee or applicant within Connecticut, which means that employers in other states may be drawn into coverage if Connecticut residents are able to apply to, or work remotely, in a position located in Connecticut. 

Covered AI tools, known as “automated employment-decision technology” or “AEDT” include those that make, assist in making, or are used in the course of making an employment-related decision, such as computer-based assessments, predictive testing, resume screening, targeted job advertising, interview-analysis tools, and systems that evaluate third-party data concerning applicants or employees. The legislature bounded the definition of AEDT to exclude traditional business tools, such as word processing, spreadsheets, data storage, and other software programs that are incidental to making an employment decision.

Notice and Disclosure Obligations

The Act makes a distinction between AEDTs intended to “interact” with an applicant or employee, and those that generate an output for the purpose of making, or as a substantial factor in making, an employment-related decision. Where a covered process is intended to interact with an applicant or employee, the deployer must disclose that the individual is interacting with an automated employment-related decision process, unless that fact would be obvious to a reasonable person. For an AEDT that is used to generate an output for the purpose of making, or as a substantial factor in making, an employment-related decision, the deployer must provide written notice before the decision is made stating that it has deployed the AEDT, identifying the AEDT by trade name, describing the purpose of the AEDT and the nature of the employment-related decision at issue, describing the type and source of the personal information the AEDT will use or process, and providing contact information for the deployer. The Act contains a special carveout exempting trade secrets or other legally protected information from the disclosure requirements, so long as the party providing notice discloses that the information is being withheld and the basis for doing so.

The Act specifically requires software developers to share the information necessary to make the above disclosures with a deployer. It also permits deployers and developers to apportion the disclosure obligations to the developer by contract, providing an out for developers who do not wish to share data about their tool, but in exchange for the developer taking on the disclosure obligations. Such contractual provision must clearly specify which duties are being assumed by the developer.

The notice and disclosure provisions go into effect on October 1, 2027. 

Anti-Discrimination Provisions

The Act amends Connecticut’s anti-discrimination laws, including the separate statute addressing protections for sexual orientation, to preclude an employer’s use of AEDTs as defense to unlawful discrimination. These amendments are effective October 1, 2026.

However, one of the most notable features of Connecticut’s approach is that the Act does not mandate that employers complete a stand-alone bias audit before using an automated employment-decision technology, as with New York City’s law and, until recently, Colorado’s. Instead, anti-bias testing remains voluntary in the sense that the Act permits the commission or a court to consider evidence of such testing or similar proactive efforts, but does not require testing as a condition of use. Separately, the Act creates, effective July 1, 2027, a Connecticut Department of Consumer Protection pilot program under which up to five approved “independent verification organizations” may apply to assess whether artificial intelligence models adhere to standards reflecting best practices for preventing personal injury, property damage, data privacy harms, and other harms. That pilot program is not written as an employment-specific safe harbor, and evidence of verification bias testing is admissible only in a private civil action for personal injury or property damage, not in an enforcement action brought by the Attorney General or another state agency. Against that backdrop, employers that voluntarily test AI hiring tools should consider how the testing is structured and documented. In Mobley v. Workday, Inc., No. 23-cv-00770, (N.D. Cal. May 29, 2026), Magistrate Judge Laurel Beeler held that Workday’s bias-testing data was protected by the attorney-client privilege where counsel curated the data and used the results to provide legal advice. The ruling is not a blanket privilege rule for all bias audits, but it underscores the practical value of involving counsel early, defining the legal purpose of the review, limiting distribution, and avoiding use of privileged testing materials for ordinary business or regulatory-reporting purposes.

Enforcement

The notice and disclosure provisions may be enforced only by the state’s Attorney General as an unfair and deceptive trade practice. For violations occurring before December 31, 2027, the Attorney General may issue a notice of violation with a 60-day cure period. Significantly, no private right of action is available for such violations.

Practical Steps for Employers

The Act’s amendments to Connecticut’s employment-discrimination statutes take effect on October 1, 2026, and its separate AEDT notice-and-disclosure requirements apply to covered tools deployed on or after October 1, 2027. Employers using AI-enabled recruiting, screening, interview, or other employment-decision tools in Connecticut should begin preparing now:

• Inventory tools used in hiring, promotion, evaluation, discipline, and similar employment decisions, and identify which tools materially influence employment outcomes.
• Review applicant and employee communications to determine whether Connecticut-facing workflows will require an interaction disclosure or employment-decision pre-decision notices.
• Revisit vendor agreements now to clarify which party will supply the information needed for the notice and disclosure requirements and whether the developer will contractually assume any of those duties.
• Assess whether bias testing makes business and legal sense for your organization. Employers that decide to move forward should also consider involving outside counsel at the outset to evaluate whether the work can be structured to maximize potential privilege or work-product protections.