Connecticut has moved from “state to watch” to a state companies may actually need to operationalize against.
If you want the official bill text, Connecticut’s latest substitute text is here: SB 5.
On May 1, 2026, the legislature passed SB 5, a broad AI bill that would place Connecticut among the more aggressive state players in AI governance. The point is not just that another state acted. It is that Connecticut appears to be building a framework that spans multiple AI risk areas at once.
What makes this state move worth watching
A lot of state AI proposals focus on one slice of the problem, usually hiring tools, consumer protection, or deepfakes. Connecticut's approach is broader. It treats AI governance as a cross-functional legal problem rather than a niche product issue.
That matters because it better reflects how organizations actually use AI. AI now touches hiring, customer communications, vendor tools, automated decisions, synthetic media, and internal workflows.
The patchwork problem is getting harder
SB 5 is also another reminder that federal law is not about to simplify the map. States are continuing to legislate, and they are doing it with different definitions, priorities, and enforcement models.
That creates two practical tasks for legal teams. First, they need a real inventory of where AI shows up in the business. Second, they need a governance structure that can absorb state variation without rewriting the whole policy stack every time a legislature moves.
The takeaway
Connecticut’s bill may not become the national template by itself. But it does point toward the future: AI governance that looks more like privacy or employment compliance, meaning state-specific, operationally demanding, and hard to solve with one policy memo.
Connecticut is not the whole story. But it is increasingly part of the real one.
Colorado's AI law is moving again before many companies have even finished mapping the original version.
If you want the official text, the Colorado bill is here: SB26-189.
In May 2026, lawmakers passed SB 26-189, a major rewrite of the state's earlier AI framework. The main shift is from regulating broadly defined “high-risk AI systems” to regulating automated decision-making technology, or ADMT, when it materially influences consequential decisions.
What stands out is how directly the law targets decision environments legal teams already care about: employment, housing, lending, insurance, health care, education, and essential government services. The practical question is less about what a tool is called and more about how it is used when it affects a person in a meaningful way.
The new focus is operational accountability
The revised bill is set to take effect on January 1, 2027. That buys time, but it also makes the compliance direction clearer.
Developers would need to give deployers technical documentation on intended uses, training data categories, limitations, and human-review instructions. Deployers would need to provide consumer notices and, after an adverse outcome, a plain-language explanation of the role the system played. Consumers would also have rights to seek correction of inaccurate data and meaningful human review.
What legal teams should focus on
This is especially important for employment and other high-impact workflows. Recruiting tools, ranking systems, interview-analysis products, and recommendation engines can all end up inside the regulatory frame if they materially influence decisions.
That means the compliance question becomes more concrete: what is the system doing, who is relying on it, what notice is required, and what happens when someone challenges the outcome?
The bigger lesson
Colorado’s rewrite is a useful reminder that state AI compliance is still moving in real time. Static AI policies are going to age badly. Legal and compliance teams need a more flexible operating model that can absorb changing definitions, disclosure duties, and review rights across states.
The takeaway is not that Colorado is backing away from AI regulation. It is that Colorado is trying to make its law more targeted and more workable. For companies using AI in consequential decisions, the safer question is not “do we use AI?” but “can we explain and defend how this system influenced the decision?”
Lawyers and business teams are increasingly using AI to think through legal and risk questions.
That does not automatically make the prompt, output, or workflow privileged.
The practical risk is simple: if people put sensitive legal analysis into the wrong AI environment, they may create a discoverable record instead of a protected one.
This is a privilege, confidentiality, and workflow problem showing up in a new tool.
The key practical point
There is a major difference between:
a public or lightly controlled AI tool
and an enterprise environment with negotiated controls, restricted retention, and clear terms that do not permit your prompts or data to be used to train models for other users
That distinction should be doing a lot of work in legal AI policy.
If the tool is not enterprise-approved, if the data controls are unclear, or if the provider can use prompts to improve models for others, legal teams should assume the risk is much higher.
What not to do
Do not paste live dispute facts, investigation details, board communications, draft legal theories, or regulator-response strategy into a casual AI tool.
Do not assume a prompt is protected just because it relates to legal advice.
Do not let employees use consumer AI tools for sensitive legal work without tool-specific approval.
Do not treat “internal” and “privileged” as if they mean the same thing.
Do not rely on vague vendor marketing about privacy or security. Check the actual enterprise terms, retention settings, training terms, and admin controls.
What to do instead
Use an enterprise AI environment with contractual controls and settings that prevent your prompts and data from being used to train models for other customers or the public service.
Limit legal-use cases to approved tools and approved users.
Create a short list of off-limits prompt categories, including litigation strategy, privileged investigation facts, deal-sensitive issues, and regulator-response planning.
Require lawyer involvement when the purpose of the workflow is legal advice.
Know what records the tool keeps, where they are stored, who can export them, and how long they remain available.
What recent cases make clear
Recent attention to cases like United States v. Heppner has put a spotlight on a basic point many organizations still blur: a communication can feel private and still fail privilege requirements.
In Heppner, Judge Rakoff held that AI-generated materials created through Claude were not protected by attorney-client privilege or the work-product doctrine because the defendant disclosed information to a third-party platform and the materials were not prepared by counsel or at counsel’s direction.
Different cases can come out differently, and courts are not applying a one-line rule that all AI prompts are discoverable or all AI-assisted work loses protection.
But that is not a reason for comfort. It is a reason to stop assuming the facts will break your way.
A useful default rule
If a prompt would be uncomfortable to hand to an opposing lawyer, regulator, or prosecutor later, it should not be casually entered into an unstructured AI workflow.
That rule is not perfect, but it is much better than assuming “we were just using AI to think.”
The takeaway for legal teams
The real issue is not the model by itself. It is whether the workflow, tool, and contract structure are good enough to support sensitive legal use.
Clearon AI’s recommendation is not to ban AI for legal work. It is to make sure legal AI use happens inside the right workflow.
approve an enterprise AI environment with terms and settings that protect sensitive prompts and do not allow them to train models for other users
block consumer or unapproved tools for privileged, litigation, investigation, and regulator-response work
limit sensitive legal prompting to approved users and defined use cases
give employees concrete do-and-don’t rules instead of vague policy language
treat prompt security, retention, and export controls as part of legal workflow design, not an afterthought
In law, workflow mistakes have a nasty habit of becoming exhibits.
The EU AI Act story in 2026 is no longer about one looming deadline.
It is about figuring out what moved, what did not, and where legal teams should spend compliance time first.
“The AI Act was delayed” is too sloppy to be useful.
Recent reporting indicates that the European Parliament and Council reached agreement on amendments that would postpone some major obligations, especially around high-risk AI uses and watermarking timing, while the European Commission also published draft guidance on transparency obligations that still begin this year.
So the practical question is not whether the AI Act matters less. It is where the immediate compliance pressure now sits.
It is what still appears to hit in 2026 and what can likely be sequenced later.
The short version
Here is the cleanest practical read based on current reporting:
What did not move
core transparency obligations still appear set for August 2, 2026
disclosure expectations for AI systems that interact with people
related user-facing design and notice questions
the need to review where AI-generated or AI-manipulated content appears in products and workflows
What moved later
AI-generated content transparency and some watermarking-related timing reportedly moves to December 2, 2026
Annex III high-risk AI systems reportedly move to December 2, 2027
Annex I product and product-safety high-risk AI systems reportedly move to August 2, 2028
That does not mean companies can relax.
It means they should stop treating every AI Act obligation as if it lands on the same day.
What stayed on the 2026 calendar
The biggest mistake legal teams can make here is hearing “delay” and translating it into “not urgent.”
That would be a bad read.
Even with the reported changes, core transparency obligations still appear positioned to matter starting August 2, 2026.
For many organizations, that means focusing now on systems that interact directly with users and making sure disclosures are not buried in terms or documentation nobody reads.
In plain English, companies should be asking:
Where are users directly interacting with AI systems?
Is the disclosure clear in the interface itself?
Are we treating different user groups appropriately?
Do any product flows involve AI-generated or AI-manipulated content that raises separate transparency issues?
Are product, legal, compliance, and design teams aligned on what the user actually sees?
That is practical work. Not compliance cosplay.
What legal teams should do now
This is the moment for reprioritization, not celebration.
A practical checklist:
map AI systems that directly interact with users
identify where AI-generated or AI-manipulated content appears
review interface-level disclosures instead of relying on buried policies
separate immediate 2026 transparency work from later high-risk build-out
revisit vendor diligence questions and contract language in light of the updated timing
give business teams a clearer timeline so “delay” does not become an excuse for doing nothing
For in-house teams, this is also a communications problem.
If the business hears only that the EU delayed the AI Act, the organization may under-resource work that still appears likely to happen this year.
That misunderstanding can create more risk than the original deadline pressure.
The bigger lesson
The EU AI Act is becoming a sequencing challenge.
That means the winning move for legal teams is not just knowing the rules. It is knowing the order in which the rules matter.
That is what good AI governance looks like in practice.
Not panic.
Not delay theater.
Just disciplined prioritization.
The AI Act still matters in 2026.
The real question now is which part of it is knocking first.
One caution, though: because this area is moving through amendments, guidance, and implementation detail at the same time, legal teams should confirm the latest official timetable before treating any one summary as the final word.
