AI compliance answer

Which states require AI impact assessments?

Freshness
Last verified: August 13, 2026
Coverage
Multi-state comparison
Jurisdictions
CT · MN
Referenced records
3

Direct answer

Connecticut has two distinct assessment regimes. SB-1103 / Public Act 23-16 requires Connecticut state agencies to assess AI before implementation. Separately, Connecticut General Statutes §42-522, as amended by Public Act 25-113, requires covered private controllers to assess profiling used for decisions with legal or similarly significant effects for processing activities created or generated on or after August 1, 2026; employment-role data is excluded. Minnesota §325M.18 requires covered private controllers to conduct data privacy and protection assessments for targeted advertising, data sales, sensitive data, heightened-risk processing, and certain profiling, but ordinary job-applicant and employee-role data is excluded. Colorado's SB 26-189 repealed its prior AI impact-assessment model, so Colorado is not on this list.

Applicable Regulations

SB-1103

An Act Concerning Artificial Intelligence, Automated Decision-Making and Personal Data Privacy (Public Act 23-16)

enacted

Public Act 23-16 — the enacted form of Connecticut SB-1103 (2023 session). Signed by Governor Ned Lamont on June 7, 2023, making Connecticut among the first states to impose oversight on state agency use of AI. Government-only scope: does NOT directly regulate private-sector AI. Requires state agencies to complete impact assessments before deploying AI systems, publish a public AI inventory, and submit annual reports to the joint standing consumer-protection committee. Sections 1–3 effective July 1, 2023; Section 4 effective October 1, 2023; Section 5 effective upon passage.

Key Requirements

State Agency AI Impact Assessments State agencies may not employ AI systems that have not undergone impact assessments or that result in unlawful discrimination or disparate impact against specified individuals or groups
Public AI Inventory All inventory reports detailing AI systems used by state agencies and the Judicial Department must be publicly accessible online, with the Department of Administrative Services making its inventories available on the state's open data site
Annual Consumer-Protection Report Annual report to the joint standing committee on consumer protection, due February 15 beginning 2025 and annually thereafter
Effective: 2023-07-01
PA-25-113

Connecticut Data Privacy Act Impact-Assessment Amendment (Public Act 25-113)

enacted

Public Act 25-113 amended Connecticut General Statutes Section 42-522 to require covered controllers that profile consumers for decisions producing legal or similarly significant effects to conduct and document an impact assessment. The amendment took effect July 1, 2026, and the new impact-assessment requirements apply prospectively to processing activities created or generated on or after August 1, 2026. This is a private-controller consumer- data regime, distinct from SB-1103's state-agency AI assessments.

Key Requirements

Profiling Impact Assessment Controllers engaged in profiling for decisions that produce legal or similarly significant effects must document the purpose, inputs, outputs, risks, mitigations, performance limits, transparency measures, monitoring, and safeguards
Prospective Application The new impact-assessment requirement applies to processing activities created or generated on or after August 1, 2026, and is not retroactive
Attorney General Access The Connecticut Attorney General may require disclosure of an assessment relevant to an investigation; disclosed assessments remain confidential
Effective: 2026-07-01
HF-4757

Minnesota Consumer Data Privacy Act (MCDPA)

enacted

Enacted May 24, 2024 as Chapter 121 of the 2024 Minnesota Session Laws, codified at Minnesota Statutes Chapter 325M. Effective July 31, 2025 with full enforcement (no cure period) from February 1, 2026. Applies to controllers and processors of personal data of Minnesota residents meeting the thresholds below. Grants consumers rights to access, correct, delete, and port personal data; to opt out of targeted advertising, data sales, and profiling; and — uniquely among state laws — to question the result of a profiling decision, receive the reason for that outcome, and request reevaluation if inaccurate data was used. Requires data protection assessments before processing personal data for targeted advertising, data sales, sensitive data, and profiling with heightened risk. Enforced exclusively by the Minnesota Attorney General; no private right of action. Consumers acting in an employment context, and data collected and used solely within a job-applicant or employment role, are excluded.

Key Requirements

Core Consumer Rights Right to access, correct, delete, and obtain a portable copy of personal data. Right to know which third parties received data sales.
Opt-Out of Profiling and Targeted Advertising Consumers may opt out of processing for targeted advertising, sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects.
Profiling Challenge and Explanation Right When covered profiling produces legal or similarly significant effects, consumers may question the result, receive the reason for the outcome, and request reevaluation if inaccurate data was used. The statute lists employment among significant-decision contexts, but ordinary job-applicant and employment-role data is excluded from the Act.
Data Protection Assessment Controllers must conduct and document data protection assessments before processing for targeted advertising, data sales, sensitive data, profiling with heightened risk, and other high-risk processing activities.
Privacy Notice Requirements Controllers must provide a privacy notice with a hyperlink labeled 'Your Privacy Rights' disclosing data categories, purposes, third-party disclosures, and opt-out mechanisms.
Attorney General Enforcement Only the Minnesota AG may enforce. A 30-day cure period applied through January 31, 2026; from February 1, 2026, no cure period — violations subject to immediate civil penalty action.
Effective: 2025-07-31

Full State Analysis

Connecticut AI Regulations Minnesota AI Regulations
Disclaimer: This content is provided for informational purposes only and does not constitute legal advice. AI regulations and insurance policy terms change frequently. Consult with a qualified attorney or insurance professional for advice specific to your situation. Gridex makes no warranties regarding the accuracy or completeness of this information.