LexLint.ioBeta

Know the law your code answers to.

Law / United States / Connecticut

Generative AI Content Provenance Duty for Large Providers

2026 Conn. Pub. Acts 26-15, Sec. 15

In force since .

An AI transparency rule binding private bodies.

How the hook was established
express
What makes it apply
Data subject residence
Obligation class
Content labelling
Audit expectation
none
Setting the rule reaches
General

What it requires

  • If your generative AI system has more than one million users a month and is publicly accessible to consumers, embed provenance data, to the extent commercially and technically reasonable, in audio, image, or video content the system creates or materially alters.
  • Use commercially and technically reasonable methods, such as the Coalition for Content Provenance and Authenticity standard, to make that provenance data difficult to remove or tamper with.
  • You do not have to identify a person depicted in the content, or disclose a trade secret, to satisfy this duty.

These lines are LexLint's reading of the law's text.

In the frameworks

NIST AI RMF
  • MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
NIST AI 600-1
OWASP Agentic Top 10
  • ASI09Human-Agent Trust Exploitation
MIT mitigations Draft
  • 2.4Content Safety Controls
  • 4.6User Rights & Recourse

Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Logging duty

Section 15(b)(1) requires a covered provider to embed provenance data in content its generative AI system creates or materially alters, and to make that data hard to remove or tamper with. The provenance data travels with the distributed content itself rather than being kept by the provider as a separate log; the section states no duty to additionally create, keep, or later produce on demand a record of the provenance data or of having embedded it.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

A covered provider, defined as anyone who creates a generative artificial intelligence system that has more than one million users a month and is publicly accessible to consumers, must, to the extent commercially and technically reasonable, embed provenance data in audio, image, or video content its system creates or materially alters, letting a consumer assess whether the content came from that system, and must use commercially and technically reasonable methods, including the Coalition for Content Provenance and Authenticity standard, to make that data hard to remove or tamper with.

The duty does not require identifying an individual depicted in the content or disclosing a trade secret.

When LexLint raises it

When your app profile says your app generates audio with AI, generates images with AI or generates video with AI.

Back to the example  ·  Lint your app

Page updated .