Is this checklist enough for Connecticut compliance?

It covers the AI-traffic obligations a Connecticut inquiry reaches for: identity, classification, opt-out enforcement, profiling assessments, employment routes, content provenance, minor-facing policy, destination logging, evidence independence, and retention. It does not replace a full CTDPA programme covering privacy notices, consumer access and deletion rights across all channels, data minimization, and vendor contracting. Treat it as the AI-specific layer.

Does Connecticut SB 2 apply to us?

Substitute SB 2 never became law. It passed the Senate on 14 May 2025 and died in the House, as the 2024 version did before it. Compliance plans written against SB 2's developer and deployer duties should be re-pointed at Public Act 26-15 and the amended CTDPA, which carry overlapping but differently structured obligations and different effective dates.

When do the Public Act 26-15 obligations start?

Most provisions take effect 1 October 2026, with further obligations arriving 1 January 2027, 1 October 2027, and 1 January 2028, and some items already effective in July 2026. The staggering matters for retention planning, because evidence covering the earliest period has to survive until the last tranche is being enforced.

What counts as a legally significant decision?

Decisions producing a legal or similarly significant effect on a consumer, which in practice covers employment, credit, housing, insurance, education, healthcare services, and access to essential goods. The 2026 amendments extended the opt-out to profiling in furtherance of any such decision, so a workflow with human sign-off remains in scope.

How does this overlap with other state regimes?

The overlap is substantial. An identity-bound, classified, independently written per-request record answers Connecticut, Colorado, and California obligations from the same store, with the state-specific work sitting in policy configuration rather than in a separate logging pipeline. The audit trail requirements by regulation view compares what each regime expects.

Connecticut SB 2 AI Compliance Checklist: Ten Items Before the October 2026 Deadline

Connecticut's profiling impact assessment obligation attached to processing created or generated on or after 1 August 2026, which was yesterday. The rest of the state's AI regime starts landing on 1 October 2026 under Public Act 26-15, the act Governor Ned Lamont signed on 2 June 2026 after Substitute Senate Bill 2 died in the House for the second session running.

This checklist follows the order an Attorney General inquiry tends to take: identity and classification records first, then consumer rights and opt-outs, then the covered-use obligations under Public Act 26-15, then evidence independence and retention. Each item pairs the action with the evidence it produces, because an impact assessment describes a design and an inquiry asks what the deployed system actually did.

1. Bind a named identity to every AI request

Route AI traffic so a named user or agent, rather than a shared service key, is attached to each prompt. Evidence is a per-request record showing which identity sent which prompt to which model, which every downstream Connecticut obligation depends on once the state asks who caused a specific decision.

2. Classify the personal data in the context window

Evaluate what is in the prompt before it leaves, separating ordinary personal data from the sensitive categories the CTDPA treats differently, including consumer health data and precise geolocation. Evidence is a per-request classification decision recorded at the boundary rather than a document label inherited from a source system.

3. Resolve consumer opt-out state in the request path

Check suppression state at the moment a prompt is assembled, because the 2026 amendments removed "solely" from the automated decision provision and a human in the loop no longer takes the processing out of scope. Evidence is a per-request record showing the flag was evaluated and what routing decision followed.

4. Complete the profiling impact assessment and attach records to it

Run the dedicated profiling impact assessment for legally significant decisions, separate from the CTDPA data protection assessment, for processing created or generated on or after 1 August 2026. Evidence is the assessment plus a queryable operational record covering the assessed period, which is what distinguishes a filed assessment from a demonstrated one.

5. Tag employment routes as consequential

Mark requests originating from hiring, promotion, discipline, or termination workflows at the point they are made, since Public Act 26-15 reaches employment decision-making and turns on whether AI was a substantial factor. Evidence is a route-tagged, identity-bound request record, reconstructable months later rather than inferred from an applicant tracking system that never saw the prompt.

6. Instrument the response boundary for content provenance

Apply and record generative content marking before output leaves the system, because the act's provenance duties attach to what was produced rather than to the personal data that went in. Evidence is a record of what was generated, by which model, for which caller, and whether marking was applied.

7. Apply age and context-aware policy on minor-facing routes

Give routes serving minors or AI companion experiences a different permitted set than adult routes, ahead of the obligations phasing in through 2027 and January 2028. Evidence is a per-route policy record joined to the traffic that ran under it.

8. Record the destination endpoint for every request

Log the model endpoint and its region for each request carrying Connecticut personal data. Evidence is a destination log, which AI data residency controls produce at the moment of transmission rather than at procurement, and it answers the frontier-model routing question at the same time.

9. Keep the evidence write path outside the application

Ensure the compliance record is written by a system the application making the AI call has no custody over, so it survives selective logging, later modification, and crash-loss between the model response and the log commit. This is the argument in You Own the AI Liability, Not the Vendor, and it decides how the Attorney General reads every other artifact on this list.

10. Set retention to cover the staggered effective dates

Fix a retention period reaching past 1 January 2028, when the last tranche of Public Act 26-15 obligations lands, then run a real query against the oldest data you hold. My honest take: the CTDPA has no private right of action, which sounds like relief until you notice it means the questions arrive from the Attorney General in writing, and a written question expects a document rather than a description. AI audit log retention requirements covers what the various regimes expect.

How the checklist maps to the controls

Items 1 through 10 resolve to a handful of enforcement points at the request boundary, laid out in the Connecticut AI controls mapping. The audit-evidence view covers what each artifact looks like when the state asks. Together they turn this list into a running system with evidence attached.

DeepInspect

Nine of these ten items produce evidence at one place: the boundary between your users or agents and the LLM APIs they call. DeepInspect sits inline at that boundary. It binds identity to each request, classifies the prompt, resolves consumer suppression state, enforces per-role and per-route policy, records the destination, and writes a signed per-decision record before the response returns. The checklist becomes a query rather than a scramble.

For a controller facing the October 2026 start date, items 3 and 5 are the two an inquiry will reach first, because opt-out handling and employment decisions are where Connecticut's changes bite hardest. Book a technical deep dive at deepinspect.ai.