🎙️ Episode 39 is live — Connecticut's AI Law Binds Thursday · ~10 min
Connecticut's CART Act has its first effective date in seven days, and almost every summary in circulation — including the Attorney General's own consumer guidance — puts the wrong duties on that date. We read the enacted text section by section.
📰 This episode accompanies CyberEyeQ Weekly #39 — the two are one issue. The written briefing carries the full Deep Dive, the Deadline Watch table and the source documents.
This week's stories
Connecticut — CART Act first tranche commences 1 October. Content provenance for genAI providers above one million monthly users (Sec. 15), written acceptance for AI subscriptions (Sec. 1), a WARN-notice AI disclosure (Sec. 26), and an evidentiary rule stripping employers of the automated-tool defence (Secs 13–14). The chatbot duties are January 2027; the AEDT disclosure package is October 2027. Public Act 26-15 — enacted text
EU — IVDR class C legacy transition closes 26 September. Under IVDR Art. 110(3c) as inserted by Regulation (EU) 2024/1860, a signed notified-body agreement is required by 26 September 2026; the application had to be lodged by 26 May 2026 and the QMS in place by 26 May 2025. Regulation (EU) 2024/1860
Italy — D.Lgs. 160/2026 in force 30 September. Adapts Italian law to the EU AI Act on AI in policing and on civil and criminal liability. Clause-level commentary is unverified against the decree's own articles. Normattiva
Ireland — DPC fines Google €403 million. Location-data processing 2018–2020; compliance ordered within six months. Data Protection Commission
US — DOJ settles cyber-fraud claims for $2,042,518. False Claims Act allegations over NIST SP 800-171 non-compliance on a Department of Defense contract network; relator share $375,823. Allegations only. Department of Justice
Also covered
Massachusetts fines TradeZero America $750,000 over an unvetted third-party chat vendor. Securities Division
HHS OCR settles a HIPAA Security Rule case with Ambry Genetics for $700,000 (225,370 individuals). OCR
Ofcom opens an Online Safety Act investigation into Aylo (Pornhub) over Apple-signal age checks. Ofcom
China's CAC publishes ten typical enforcement cases; an AI mini-program ordered offline. CAC
Compliance action items
26 Sep — Confirm a countersigned notified-body agreement for every self-declared class C IVD, and reconcile against the 26 May 2026 application record.
30 Sep — Connecticut: provenance marking, subscription written acceptance, the WARN-AI field, and a dated anti-bias testing record. Italy: counsel reads D.Lgs. 160/2026's articles.
1 Oct — Connecticut CART Act tranche one binds; Austria NISG 2026 in full force; China MPS Order No. 176 inspection measures take effect.
17 Nov — DOJ/Pinnacle proposed final judgment — Tunney Act comments close on the algorithmic-pricing decree.
Resources
Upgrade to CyberEyeQ Pro for the deep-dive recommendations and source documents.
CyberEyeQ — Actionable Regulatory Intelligence. For informational purposes only; not legal advice. Contact: [email protected]