Connecticut SB 2 AI Audit Evidence: What the Attorney General Asks For Now That SB 5 Passed Instead
Senate Bill 2 passed the Connecticut Senate on 14 May 2025 and died in the House, the second session running. The law that actually arrived is Substitute Senate Bill 5, signed as Public Act 26-15 on 2 June 2026, alongside amendments to the Connecticut Data Privacy Act that took effect 1 July 2026 with profiling impact assessments from 1 August 2026. This walks the evidence artifacts a Connecticut review requests and names which system produces each one.
Substitute Senate Bill 2 passed the Connecticut Senate on 14 May 2025 and never cleared the House, repeating what happened to the 2024 version. Teams that spent two sessions building a compliance plan around SB 2's developer and deployer duties were tracking a bill that never became law.
The obligations arrived anyway, under different numbers. Governor Ned Lamont signed Substitute Senate Bill 5 as Public Act 26-15 on 2 June 2026, the act the General Assembly's AI Caucus calls the Connecticut Artificial Intelligence Responsibility and Transparency Act. Most of it takes effect 1 October 2026, with further obligations landing 1 January 2027, 1 October 2027, and 1 January 2028. Separately, sweeping amendments to the Connecticut Data Privacy Act took effect on 1 July 2026, and the new profiling impact assessment duty attaches to processing created or generated on or after 1 August 2026. That deadline passed yesterday. I want to walk what the Attorney General's office actually asks for, because the artifacts are operational and most Connecticut programmes have policy documents instead.
The profiling impact assessment record (amended CTDPA)
The amended CTDPA requires controllers that profile consumers to make legally significant decisions to conduct a dedicated impact assessment, separate from the existing data protection assessment, for processing activities created or generated on or after 1 August 2026. An assessment describes a system before it runs.
What a review asks for next is proof the deployed system behaved the way the assessment described. That is a per-request record naming the caller, the classification of the personal data in the context window, the model endpoint, and the policy decision that permitted the call. An assessment with no operational record behind it establishes intent and nothing about the period under review.
The opt-out enforcement record
The 2026 amendments removed the word "solely" from the automated decision-making provision. A consumer can now opt out of profiling in furtherance of any decision producing a legal or similarly significant effect, including decisions where a human sits somewhere in the loop. That change turns a narrow carve-out into an operating requirement.
Honoring the opt-out means the request path knows, at the moment a prompt is assembled, that this consumer's data carries a suppression flag. The evidence a reviewer wants is a per-request record showing the flag was evaluated and the routing decision that followed, which is the same decision lineage burden as GDPR Article 22 automated decisions.
The employment decision record (Public Act 26-15)
Public Act 26-15 reaches employment decision-making, AI companions, frontier models, generative content provenance, and platforms used by minors. The employment provisions are the ones that touch the largest number of Connecticut employers, and they turn on whether an AI system was a substantial factor in a consequential decision.
Answering that question after the fact requires a record of which requests informed which decision, written when the request was made. Reconstructing it from an applicant tracking system months later produces a narrative rather than evidence, because the tracking system stores the outcome and never saw the prompt.
The content provenance record
The act's generative AI content provenance obligations attach to output rather than to personal data, which makes them a different artifact class. The evidence is a record at the response boundary showing what was generated, by which model, for which caller, and whether the required marking was applied before the content left the system. Teams that instrument the request path and skip the response path end up with half the record.
Why self-written application logs fail
An application that makes the AI call and also writes the compliance log is attesting to itself. That record breaks in three ways: the application logs its successes and misses its edge-case failures, the log can be modified by the same system that failed, and a crash between the model response and the log commit leaves the action taken with the evidence gone. I set this out in You Own the AI Liability, Not the Vendor, and Connecticut sharpens it because the CTDPA is enforced by the Attorney General with no private right of action, so the state's questions arrive in writing and expect documents.
My candid view: two sessions of SB 2 coverage taught Connecticut teams to watch the legislature instead of building the evidence layer, and the bill that finally passed carries a shorter runway than the one they were reading. October is nine weeks out.
DeepInspect
This is the evidence layer Connecticut AI programmes usually lack. DeepInspect sits inline between your users or agents and the LLM APIs they call. For every request it evaluates identity, data classification, consumer flags, and destination, then writes a signed, tamper-evident record before the response returns. The record holds the caller, the classification in the prompt, the model endpoint, the policy decision, and the response.
When the Attorney General asks which consumers' data reached which model, or whether an opt-out was honored on a specific date, the answer is a query against records the application never controlled. The Connecticut AI controls mapping shows how each obligation lines up with an enforcement point. Book a technical deep dive at deepinspect.ai.
Frequently asked questions
- Did Connecticut SB 2 become law?
Substitute SB 2 never became law. It passed the Connecticut Senate on 14 May 2025 and died in the House without a vote, following the same path as the 2024 version. The AI legislation that passed in the 2026 session was Substitute SB 5, signed as Public Act 26-15 on 2 June 2026.
- What governs AI in Connecticut right now?
Public Act 26-15 covers employment decision-making, AI companions, frontier models, generative content provenance, and online platforms used by minors, with staggered effective dates beginning 1 October 2026. The amended Connecticut Data Privacy Act, effective 1 July 2026, governs profiling and automated decisions over consumer personal data, with the new profiling impact assessment obligation attaching from 1 August 2026.
- What does the removal of "solely" change in practice?
Under the earlier text, a consumer could opt out only of decisions made solely by automated means, so inserting a human reviewer removed the obligation. The amended provision covers profiling in furtherance of any decision producing a legal or similarly significant effect, which means a human in the loop no longer takes the processing outside scope. The control has to run in the request path rather than at the decision desk.
- Do vendor logs satisfy a Connecticut review?
Model provider logs reflect the provider's view of the API call. They carry no identity context from your directory, no record of consumer opt-out state, and no policy decisions, and they sit outside your custody. The CTDPA places the obligation on the controller, so the record has to exist on your side showing who sent what, where it went, and which control fired.
- Should we still build for SB 2?
The artifacts SB 2 would have required are the ones Public Act 26-15 and the amended CTDPA already ask for: identity binding, prompt classification, per-decision records, and opt-out enforcement in the request path. That work holds its value regardless of which bill number carries it, and the same records answer the audit trail requirements in other states.