Cybersecurity news is watching US states write their own AI rules. Connecticut's statute imposes an AI provenance duty — this 6-question check maps your AI use against the statute's triggers.
Connecticut's statute imposes duties around AI-generated content provenance — knowing when content is AI-made and keeping records that prove it. The 6-question check maps your AI use against the statute's triggers: what you generate, where you deploy it, and whether your records would survive scrutiny. Answer honestly — 'I don't know' is itself a finding.
The Connecticut AI provenance duty is a statutory requirement for organizations deploying AI to maintain records proving the provenance of AI-generated content — what the AI made, when, and under whose control.
Since October 1, 2026, Connecticut has required large consumer-facing AI providers to embed provenance data — watermarks, C2PA-style metadata — in the AI-generated or AI-altered audio, images, and video they put out. It's the first US state AI-content provenance duty, and only the state Attorney General enforces it. Six questions sort you into COMPLIANT, EXPOSED, or EXEMPT.
Short answer: §15 of Public Act 26-15 applies to covered providers — anyone who creates, codes, or produces a generative AI system with more than 1 million monthly users, publicly accessible to consumers for personal use, that generates images, audio, or video. Text-only systems, internal-only tools, and government agencies are out of scope. If you're in scope, provenance data must be embedded to the extent commercially and technically reasonable, and it must be hard to strip.
Answer for the generative AI system your organization builds or operates.
| Element | What it says |
|---|---|
| Who is covered | A "covered provider": any person who creates, codes, or otherwise produces a generative AI system with more than 1 million users per month that is publicly accessible to consumers for personal use. Government agencies are excluded. |
| What content | Audio, image, and video (or combinations) that the system creates or materially alters. Text is not covered. |
| The duty | To the extent commercially and technically reasonable, include provenance data so a consumer can assess whether the content was created or materially altered by the provider's system. |
| The standard | Use commercially and technically reasonable methods — including the relevant C2PA standards — to make the provenance data difficult to tamper with, remove, or disassociate from the content. |
| Not required | No identified-individual PII in the provenance data; no disclosure of trade secrets or confidential/proprietary design information. |
| Excluded content | Video games and interactive experiences; technical functions like noise reduction. Minor edits are not "materially altered": brightness, contrast, color, sharpening, saturation, filters, resizing, scaling, cropping, format conversion, resampling, denoising, background-noise removal. |
| Enforcement | Connecticut Attorney General only, under the Connecticut Unfair Trade Practices Act. No private right of action. |
Important scope note: this duty applies to the provider of the AI system — the company that built it — not to an end user who merely posts AI-generated content. If you don't build or operate the generative system, you're not a covered provider.
Sources: the statute text — Connecticut General Assembly: Public Act No. 26-15 (PDF, Substitute Senate Bill No. 5); RecordingLaw — "Connecticut AI Content Provenance Duty Took Effect October 1, 2026"; EveryAILaw — Connecticut AI Responsibility Act (PA 26-15).
Section 15 of Connecticut Public Act 26-15 ("An Act Concerning Online Safety", also called the CART Act — Substitute Senate Bill No. 5, signed May 27, 2026). It requires covered providers to embed provenance data in AI-created or materially altered audio, image, and video content, to the extent commercially and technically reasonable. It took effect October 1, 2026, and is the first US state-level AI-content provenance duty.
"Covered providers": any person who creates, codes, or otherwise produces a generative AI system that has more than one million users per month and is publicly accessible to consumers for personal use. The system must generate images, audio, or video. Federal, state, and local government agencies are excluded.
To the extent commercially and technically reasonable: (1) include provenance data in any audio, image, or video content their system creates or materially alters, in a manner that lets a consumer assess whether the content was AI-created or AI-altered; and (2) use methods — including the relevant Coalition for Content Provenance and Authenticity (C2PA) standards — that make the provenance data difficult to tamper with, remove, or disassociate from the content.
No. Section 15 covers audio, image, and video content only. Text-only generative systems are outside the duty.
Only the Connecticut Attorney General, under the Connecticut Unfair Trade Practices Act. There is no private right of action.
A substantial alteration of the data in the content. The statute excludes minor modifications that do not significantly change the perceived content or meaning: changes in brightness, contrast or color, sharpening, saturation, application of a filter, resizing, scaling, cropping, format conversion, resampling, denoising, or removal of background noise in audio.