Last checked 2026-10-17. These summaries describe public rules for general information. They are not legal advice and do not say whether any rule applies to you. Rules change and can be rewritten or challenged; always read the source and ask your attorney.
Connecticut, United States
Connecticut SB 5 (2026): AI subscriptions and employment AI
Key dates
- May 27, 2026: SB 5 signed; HB 5222, signed June 2, 2026, changed some of its provisions.
- October 1, 2026: written disclosures for AI subscriptions take effect.
- October 1, 2027: disclosures for automated employment decision tools take effect.
Who the source says it covers
Two parts are most likely to come up for small businesses. The subscription rules cover providers of generative AI systems with more than one million monthly users that sell subscriptions to consumers. The employment rules cover deployers that use automated employment-related decision tools with employees or applicants in Connecticut.
What it requires, in brief
- Subscription providers give written notice of key terms, such as usage limits and whether they can reduce access, and get the consumer’s written acceptance before charging or renewing.
- Deployers of employment decision tools tell employees or applicants, before a decision, that the tool is used, what it is for, what personal data it uses and how to contact them; adverse decisions come with the main reasons.
What to have written down if it applies
- If you buy AI subscriptions: keep the provider’s disclosure of usage limits with your AI tool register.
- If you use software that helps screen applicants or decide on employees: list it in your register with its owner and what data it uses.
Does it apply to you? Ask your attorney.
Sources
Colorado, United States
Colorado SB 26-189: the rewritten Colorado AI law
Key dates
- May 14, 2026: SB 26-189 signed, repealing and replacing the 2024 Colorado AI Act before it took effect.
- January 1, 2027: the new law takes effect.
Who the source says it covers
Companies that deploy AI in connection with decisions about Colorado consumers, and employers using AI with Colorado employees and job applicants, according to the source below.
What it requires, in brief
- The new law moves toward disclosure and transparency, with three-year recordkeeping requirements and a 60-day period to cure a violation before enforcement.
What to have written down if it applies
- A dated list of the AI tools that influence decisions about customers, employees or applicants, and who reviews those decisions.
Does it apply to you? Ask your attorney.
Sources
California, United States
California CCPA rules on automated decisionmaking technology
Key dates
- July 24, 2025: the California Privacy Protection Agency adopted the regulations.
- January 1, 2027: compliance date for the automated decisionmaking requirements.
Who the source says it covers
Businesses subject to the CCPA that use automated decisionmaking technology to make a significant decision about a consumer, such as decisions about lending, housing, education, employment or healthcare, according to the source below.
What it requires, in brief
- A notice before use describing the technology, its purpose and the personal information involved, with a way to opt out.
- Disclosure of the rights to opt out of and access the technology in the privacy policy, plus access and appeal rights for consumers.
What to have written down if it applies
- Which of your tools, if any, make decisions about people without a person reviewing them.
Does it apply to you? Ask your attorney.
Sources
European Union
EU AI Act, Article 50: transparency for chatbots and AI-generated content
Key dates
- July 27, 2026: the AI Omnibus (Regulation (EU) 2026/1744) entered into force. It moved some high-risk deadlines but did not change the transparency obligations.
- August 2, 2026: Article 50 transparency obligations became enforceable.
Who the source says it covers
Providers of AI systems that interact with people or generate content, and deployers of those systems, including deployers that publish deepfakes, according to the source below.
What it requires, in brief
- Chatbots and virtual assistants tell people they are dealing with an AI system unless that is obvious.
- AI-generated audio, images, video and text are marked in a machine-readable way by providers; deployers disclose deepfakes of real people, places or events.
What to have written down if it applies
- If you serve EU customers with a chatbot or publish AI-generated media: where and how you tell people it is AI.
Does it apply to you? Ask your attorney.
Sources