Law / United States / 
Connecticut
Frontier Developer Catastrophic-Risk Whistleblower Protections
2026 Conn. Pub. Acts 26-15, Sec. 2
In force since .
An AI governance rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Audit expectation
- periodic
- Who audits it
- Self
What it requires
- If you are a frontier developer, do not retaliate against a covered employee for reporting a reasonable, good-faith belief that your activity poses a specific and substantial danger to public health or safety through a catastrophic risk.NIST AI RMFGOVERN 4.1
- If you are a large frontier developer with annual gross revenue over five hundred million dollars, establish by an internal process letting a covered employee anonymously report such a concern.NIST AI RMFGOVERN 4.3
- Share each report and update with your officers and directors at least quarterly, withholding it from any officer or director the report accuses of wrongdoing.NIST AI RMFGOVERN 2.1
- Give covered employees notice of their rights under this section, at hiring and periodically afterward.NIST AI RMFGOVERN 4.1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 2.1Roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks are documented and are clear to individuals and teams throughout the organization.
- GOVERN 4.1Organizational policies and practices are in place to foster a critical thinking and safety-first mindset in the design, development, deployment, and uses of AI systems to minimize potential negative impacts.
- GOVERN 4.3Organizational practices are in place to enable AI testing, identification of incidents, and information sharing.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 2 never uses the words logs, records or audit trail. It requires a large frontier developer to maintain a process for a covered employee to submit a report and to receive reasonable updates on the status of the investigation and the actions taken, and requires each report and update to be shared with officers and directors at least quarterly. That is documentation created and periodically produced to a named internal audience, which cannot happen without the report and update being written down, so the duty is implicit. The report is triggered by a specific and substantial danger to public health or safety through a catastrophic risk, which the section defines to include a cyberattack, expert assistance in a chemical, biological, radiological or nuclear weapon, and loss of control over the model.
- Kind
- Implicit
- As of
- Provision
- Sec. 2(c) and (d)
- Trigger
- security_incident
What this law does
A frontier developer, defined as anyone who trains or intends to train a foundation model using more than ten to the twenty-sixth power of computing operations, may not retaliate against a covered employee for reporting a reasonable belief that the developer's activity poses a specific and substantial danger to public health or safety through a catastrophic risk, defined to include contributing to more than fifty deaths or serious injuries or more than one billion dollars of property damage or loss from a single incident.
A large frontier developer, one with annual gross revenues over five hundred million dollars, must by establish an internal process for a covered employee to anonymously report such concerns, share reports with officers and directors at least quarterly, and give employees notice of their rights under the section.
A frontier developer that violates the notice or anti-retaliation provisions is liable to the state for a civil penalty of up to one thousand dollars per violation, recoverable by the Attorney General in Superior Court for the judicial district of Hartford.
When LexLint raises it
When your app profile says your app is a frontier developer.
Back to the example · Lint your app
Page updated .