Connecticut’s AI Subscription Law Is Now Live. What Providers Must Disclose

Connecticut’s new AI law regulates a part of the generative-AI relationship that companies often treat as ordinary commerce: the subscription transaction.

Section 46 of Public Act 26-100, enacted from House Bill 5222, took effect October 1, 2026. It applies to a defined class of subscription-based providers of publicly accessible generative-AI systems. Before those providers enter into or renew a covered subscription—or collect payment for it—they must give the consumer written notice of the subscription’s key terms and conditions, and the consumer must provide written notice accepting those terms and conditions.

The law is not a general disclosure mandate for every AI product. Its practical effect is narrower and more operational: covered providers need a reliable, versioned way to explain material limits and discretionary controls at the point of initial purchase and renewal.

The short answer

• Public Act 26-100’s subscription-disclosure provision is effective October 1, 2026.
• It targets nongovernmental persons doing business in Connecticut that create, code, or otherwise produce a generative-AI system that has more than one million users per month and is publicly accessible to consumers for personal use, and that provide or offer that system to consumers through a subscription.
• Before entering into or renewing a subscription, or collecting payment for one, the provider must give written notice of key terms and conditions and obtain written consumer acceptance.
• Initial notices must include material information sufficient for a reasonable consumer to decide whether to purchase or maintain the subscription, including any quantitative or qualitative limitations—including limitations imposed in response to consumer conduct—and whether the provider has discretion to limit or eliminate access to, or reduce the quantity or quality of, any functionality.
• Every renewal requires written notice of the subscription’s key terms and conditions and the consumer’s written notice of acceptance; at minimum, the renewal notice must identify covered limitations and provider discretion that will apply for the first time or have changed since the immediately preceding term.
• Violations are unfair or deceptive trade practices enforceable solely by the Attorney General. The act does not create a private right of action under the cited provision.
• Section 47 takes effect October 1, 2027 and, within available appropriations, directs the Department of Consumer Protection to develop and administer an independent-verification pilot. It is not a substitute for the current subscription-notice duty.

This is a targeted scope, not an all-AI rule

The act’s definitions do much of the legal work.

For this section, a generative artificial intelligence system is technology that uses machine learning to generate images, audio, or video, including systems using deep learning, natural-language processing, or similar or more complex computational processing.

A “consumer” is an individual who resides in Connecticut. The incorporated definition excludes an individual acting in a commercial or employment context. It also excludes an individual acting as an employee, owner, director, officer, or contractor of a company, partnership, sole proprietorship, nonprofit, or government agency when the individual’s communications or transactions with the controller occur solely within that role. A subscription is an agreement under which a subscription-based provider offers a generative-AI system to such a consumer in exchange for a fee, remuneration, or other compensation. A covered provider must be doing business in Connecticut, must create, code, or otherwise produce a system that has more than one million users per month and is publicly accessible to consumers for personal use, and must provide or offer that system through a subscription. Federal, state, and local government agencies are excluded.

That combination matters. The statute is not written as a rule for every enterprise deployment, internal model, one-off API transaction, or AI-enabled feature. Companies should analyze the statutory definitions before assuming either that they are covered or that they are outside the law.

The requirement that the system have more than one million users per month also creates a measurement question. A provider should be able to explain what population it is counting, what period it is using, and how it treats accounts or users across products and subscription tiers. The statute sets the threshold; it does not supply a ready-made product analytics policy.

The disclosure is a condition of the transaction

Section 46 does not merely ask providers to place generic terms somewhere on a website.

Before a provider enters into or renews a covered subscription—or collects a fee, remuneration, or compensation for an initial or renewal subscription—the provider must provide written notice disclosing key terms and conditions. The consumer must also provide written notice that the consumer accepted those key terms and conditions.

That structure connects the notice and acknowledgment to the commercial event itself. Product and legal teams should therefore map the actual purchase, renewal, and payment flows rather than treating this as a copy update in a static terms-of-service page.

The implementation questions are practical:

• Where is the written notice displayed or delivered?
• How is the consumer’s written acceptance captured?
• Can the provider prove which version was shown for a particular transaction?
• What happens when a subscription renews automatically?
• Does the payment system prevent collection if the required notice or acknowledgment is missing?

The act does not answer those technical questions. It makes them part of the provider’s compliance design.

What the initial notice must explain

The initial notice must include material information sufficient for a reasonable consumer to decide whether to purchase or maintain the subscription.

The act specifically requires disclosure of any quantitative or qualitative limitations the provider may impose under the subscription, including limitations involving tokens, generated or modified images, transcription services, and limitations imposed in response to consumer conduct. The notice must also disclose whether the provider has discretion to limit or eliminate the consumer’s access to, or reduce the quantity or quality of, any functionality offered under the subscription.

That is broader than a single monthly usage number. A useful notice should help a reasonable consumer understand both the stated allowance and the provider’s operational discretion. For example, a provider may need to explain not only a token or image limit but also whether it can change the quality of outputs, throttle use, remove a feature, or otherwise reduce the quantity or quality of functionality under the subscription’s terms.

The safest operational approach is to connect the notice to the product’s actual entitlement and control system. If the product team changes a usage cap, model tier, image allowance, transcription feature, or access-control rule, the legal notice should not remain on an unrelated version of the subscription page.

Renewal notices are not a one-time formality

The act separately addresses renewal terms.

For every renewal, the provider must give written notice of the subscription’s key terms and conditions, and the consumer must provide written notice accepting them. At a minimum, the renewal notice must disclose covered limitations and provider discretion that will apply for the first time during the renewal term or that have been modified since the immediately preceding term.

Subscription businesses should therefore treat every renewal as a compliance checkpoint. The renewal flow should provide the applicable written notice, obtain and preserve the consumer’s written acceptance, retain the relevant version history, and specifically identify newly introduced or modified limitations and discretion.

This is particularly important for products that move users between model families, change rate limits, retire features, or introduce tier-specific controls during a continuing subscription relationship.

Enforcement belongs to the Attorney General

Section 46 provides that a violation is an unfair or deceptive trade practice under Connecticut’s consumer-protection statute. It also says enforcement is solely by the Attorney General, that a cited private-remedy provision does not apply, and that the section does not create a private right of action.

That enforcement design should shape how companies describe the risk. The provision is not written as a new private damages claim for every consumer who did not receive a compliant notice. It is a public-enforcement rule with a specific consumer-protection classification.

That does not make the operational duty optional. A provider still needs evidence showing what notice was supplied, when it was supplied, what version applied, and how the consumer accepted it. The absence of a private right of action is not a reason to omit controls; it is a reason to understand the actual enforcement pathway accurately.

A separate verification pilot starts in 2027

Public Act 26-100 also creates a different AI program. Section 47 takes effect October 1, 2027 and, within available appropriations, directs the Department of Consumer Protection to develop and administer a pilot to evaluate independent verification programs operated by third parties. That effective date does not guarantee that the pilot will be operational on that day.

The pilot concerns whether AI models adhere to best-practice standards for mitigating or preventing personal injury, property damage, data-privacy harms, and other harms. The department shall approve no more than five independent verification organizations to participate in the pilot program. Applicants must describe their scope, risk definitions, measurable metrics, data and methods, evaluation and reporting protocols, technical and governance controls, audit methods, reassessment and remediation processes, independence, conflicts, governance, and personnel qualifications.

Approved organizations must establish and maintain minimum verification and auditing standards and suspension or revocation procedures; share data with and report annually to the department; require participating persons to participate transparently; and establish procedures for reassessment and, if necessary, suspension after material model changes. The pilot terminates March 31, 2031. By December 31, 2028, the Department of Consumer Protection, in consultation with the Institute for Municipal and Regional Policy at the University of Connecticut, must evaluate the pilot and recommend legislation. By January 31, 2029, the institute must submit a report to the General Assembly committee having cognizance of consumer-protection matters.

The evidentiary effect is limited. Evidence of verification or good standing is admissible only in a private civil action asserting personal injury or property damage caused by an AI model, and only to the extent the action concerns a specific harm or risk within the verification’s state-approved scope. The evidence is inadmissible in enforcement actions brought by the Attorney General or another state agency and creates no presumption, inference, or defense in those proceedings. The evidentiary provisions described above do not apply if the person acted wilfully, wantonly, or recklessly; materially misrepresented information to the verification organization; or failed to implement required corrective action.

Providers should keep that 2027 pilot separate from the 2026 subscription obligation. A future verification program is not a current safe harbor for deficient consumer disclosures and does not eliminate the need to build accurate notice and acknowledgment controls now.

What covered providers should do now

1. Confirm scope. Document whether the person does business in Connecticut; creates, codes, or otherwise produces the system; whether the system has more than one million users per month and is publicly accessible to consumers for personal use; and whether the person provides or offers the system to consumers through a subscription.
2. Map the transaction. Identify every initial subscription, renewal, and payment path, including app-store, web, reseller, and automatic-renewal flows.
3. Inventory limitations. Record quantitative and qualitative limits, including tokens, image generation or modification, transcription, model access, quality controls, and feature availability.
4. Document discretion. Identify every control that lets the provider limit or eliminate access to, or reduce the quantity or quality of, any functionality, and decide how that discretion will be described to consumers.
5. Version the evidence. Preserve the notice presented, the applicable subscription term, the consumer’s written acceptance, and the timestamp or transaction record connecting them.
6. Build renewal handling. Provide the required written notice and obtain written consumer acceptance for every renewal, while specifically identifying covered limitations or provider discretion first introduced or modified for the renewal term.
7. Plan separately for 2027. Monitor Department of Consumer Protection implementation of the independent-verification pilot without treating it as a substitute for current Section 46 compliance.

The bottom line

Section 46 of Connecticut Public Act 26-100 is a consumer-contract provision for a defined class of large, publicly accessible generative-AI subscription providers. Its immediate requirement is straightforward to state but demanding to operationalize: disclose material terms, limitations, and discretionary controls in writing, obtain written consumer acceptance, and make the process work for renewals as well as initial purchases.

The later verification pilot adds a separate state experiment around model-risk assessment. It may become important for civil-liability evidence and industry practice, but it does not change the current subscription-disclosure duty or create a general enforcement defense.

For providers in scope, the first compliance deliverable is not a policy memo. It is a traceable transaction flow that can show what the consumer was told, what the consumer accepted, and what the provider was allowed to change.

This article is general information, not legal advice.

Sources

• Connecticut General Assembly, HB 5222 bill status: https://www.cga.ct.gov/asp/CGABillStatus/cgabillstatus.asp?bill_num=HB5222&selBillType=Bill
• Connecticut Public Act 26-100, official text: https://www.cga.ct.gov/2026/act/Pa/pdf/2026PA-00100-R00HB-05222-PA.PDF
• Connecticut General Statutes § 42-515, incorporated definition of “consumer”: https://www.cga.ct.gov/current/pub/chap_743jj.htm#sec_42-515