Connecticut AI law casts wider net, but Colorado's may hit harder – experts

Colorado and Connecticut have adopted markedly different approaches to regulating AI, creating competing models for states weighing how to govern the technology.

The Colorado Artificial Intelligence Disclosure and Management Act (CADMA) regulates the use of automated decision-making technology across a range of consequential decisions, including employment, lending, healthcare and education. Signed into law May 14 and effective Jan. 1, 2027, the law provides companies a 60-day opportunity to cure alleged violations before the attorney general may bring an enforcement action, except in cases involving knowing or repeated violations.

Connecticut's Senate Bill 5 takes a different approach. Rather than focusing primarily on consequential decisions, the omnibus measure combines provisions governing employment-related AI systems, AI companion chatbots, synthetic-content watermarking, frontier-model whistleblower protections and other AI-related issues into a single framework.

While Connecticut's law covers a broader range of AI policy topics, experts told S&P Global Market Intelligence that Colorado's law may have broader operational implications because it applies to AI-assisted decision-making across multiple sectors.

"Colorado took a prescriptive, penalty-first approach that predictably triggered industry pushback and litigation," said Dhruv Jain, founder of Hong Kong-based AI governance consultancy Robossist. "Connecticut went broader and more flexible."

Colorado takes another swing at AI

Colorado's CADMA law comes after the state had previously passed the Colorado Artificial Intelligence Act in 2024, representing the nation's first comprehensive AI law at the state level. As originally crafted, the law regulated "high-risk" AI systems used to make "consequential decisions" in areas such as education, employment, lending, government services, healthcare, housing, insurance and legal services. The act required developers and deployers of these systems to exercise reasonable care to prevent algorithmic discrimination and provide transparency through consumer notices and disclosures. The act imposed fines of $20,000 per violation of the law.

CADMA, by contrast, narrows AI regulation to focus on "covered Automated Decision-Making Technology" that processes personal data and materially influences consequential decisions. It also eliminates "algorithmic discrimination" obligations, and it restructures Developer and Deployer definitions with new exceptions.

Ryan Thompson, an attorney at Hogan Lovells, said CADMA's "covered automated decision-making technology" definition is still likely to capture a number of enterprise AI use cases involving consequential decisions in "covered domains" despite the revisions from Colorado's earlier AI framework.

Thompson said the framework remains similar to Colorado's earlier approach and seems unlikely to substantially reduce the law's scope for many real-world enterprise applications, although the burdens themselves have been reduced for those in scope.

Rachel Marmor, a partner at Holland & Knight focused on AI, data privacy and employment law, said CADMA regulates a broader set of consequential decisions than Connecticut's employment-focused provisions, even as Connecticut's law addresses a wider range of AI governance issues.

Connecticut's employment reach

Connecticut's law also places greater emphasis on employment-related uses of AI than Colorado's framework does. The measure requires disclosures to employees and job applicants when automated decision-making tools are used and establishes rights related to personal data used in employment decisions.

Marmor said the employment provisions are likely to have the broadest business impact.

Connecticut joins California and Colorado as one of the few states with frameworks directly regulating AI use in employment decisions, Marmor said. While all three states require notice before such tools are used, Connecticut differs by emphasizing access to and correction of personal data used in employment decisions rather than opt-out or appeals rights.

Marmor highlighted two provisions she said are particularly novel: a requirement that employers disclose whether layoffs reported under the WARN Act are AI-related and a voluntary safe harbor program that could provide participating companies with a presumption of compliance with certain consumer protection and privacy requirements.

Guy Brenner, a partner at Proskauer, said employers face the challenge of navigating a growing patchwork of state AI laws that differ in scope and compliance requirements.

"The real challenge for employers [is] navigating the patchwork of rapidly proliferating AI laws and determining where and how they apply and deciding how to comply," Brenner said.

Competing theories of governance

The states also differ in the scope of issues they seek to regulate. While Colorado lawmakers considered separate whistleblower legislation focused on advanced AI developers, Connecticut incorporated whistleblower protections and AI companion chatbot provisions into its broader AI package.

Ashley Casovan, managing director of the International Association of Privacy Professionals' AI Governance Center, said Colorado's proposed whistleblower bill drew criticism because it applied only to a narrow subset of model developers. As AI regulation evolves, policymakers may either incorporate such protections into broader frameworks or pursue stand-alone legislation that can be updated more easily as technology develops, she said.

Lawmakers are effectively testing different theories of AI governance, said Robossist's Jain.

Colorado focuses on regulating consequential uses of AI across sectors, he added, while Connecticut assembles a collection of governance, consumer protection and workplace-related provisions into a single bill.

Alberto Hernandez, a technology attorney focused on privacy and transparency issues, said Colorado follows a more traditional compliance model centered on identifying high-risk AI systems, assessing discrimination risks and assigning responsibilities to developers and deployers.

Connecticut, by contrast, extends beyond bias and discrimination concerns into issues involving AI companions, safety risks and whistleblower protections, Hernandez said.

"I think Connecticut's approach will age better, because AI regulation will not stay limited to bias audits and will become a broader governance question, about power, safety and accountability," Hernandez said.

Building for the patchwork

For companies operating across multiple jurisdictions, however, the differences between individual state laws may matter less than the broader trend toward increased governance obligations.

"Most organizations I talk to are building their compliance frameworks closer to the EU AI Act's risk-based model than anything coming out of US state legislatures," Jain said. Multinational companies are increasingly adopting a highest-common-denominator approach, he added.

Thompson said companies subject to both state laws will likely find significant overlap in their compliance efforts. Connecticut's employment-focused provisions are narrower in scope than CADMA's coverage of consequential decisions across a broader set of domains, and organizations that comply with Colorado's requirements may already be much of the way toward satisfying Connecticut's employment-related obligations.

Laura Riposo VanDruff, a partner at Kelley Drye & Warren and former attorney in the Federal Trade Commission's Bureau of Consumer Protection, said companies should evaluate AI compliance obligations alongside existing consumer-protection requirements.

While a violation of a state AI law would not automatically trigger consumer-protection enforcement, the same underlying conduct could potentially support unfairness or deception claims under state or federal law, VanDruff said.

Federal pressure, state momentum

An uptick in state AI legislation has come as lawmakers in Washington, DC, continue to discuss whether federal legislation should preempt state AI laws. In December 2025, US President Donald Trump issued an executive order calling for a federal preemption of state AI laws. In March 2026, the White House published its national policy framework on AI, calling on Congress to preempt state AI laws that "impose undue burdens to ensure a minimally burdensome national standard."

On June 4, Reps. Jay Obernolte (R-Calif.) and Lori Trahan (D-Mass.) unveiled a discussion draft version of a bill titled the "Great American AI Act" that would establish a federal framework on AI. Notably, the law, if enacted, would preempt state laws.

Discussions about preemption, though, have been ongoing for years, and it could be some time before lawmakers coalesce over a federal policy.

"The practical reality is that states aren't waiting," Jain said.

Even if Congress ultimately adopts a federal framework, Jain said the compliance infrastructure organizations build now will not be wasted because they will need to be "adapted, not rebuilt."

As debate continues at the federal level, Thompson said companies are generally planning to comply with state requirements as they take effect while monitoring litigation and federal policy developments.

Marmor said Connecticut's omnibus structure may make it a useful source of model language for future legislation. Rather than copying the law wholesale, states could borrow provisions governing AI companions, synthetic-content watermarking or employment-related AI decisions.

At the same time, CADMA remains significant because it applies across a broader set of consequential decisions, including employment, lending, healthcare and education, she said.

Whether states gravitate toward narrower employment-focused rules or broader consequential-decision frameworks may depend on whether CADMA avoids the legal and political challenges that confronted Colorado's earlier AI law, she said.

"We saw a lot of states shy away from broad 'algorithmic discrimination' bills this year in light of federal deregulatory pressure," Marmor said.