As federal AI regulation stalls, states are building a patchwork of rules that healthcare developers must navigate piecemeal.

The enactment of the CART Act in Connecticut signals a shift in how artificial intelligence will be governed in America. With Washington gridlocked, state legislatures are stepping into the vacuum. They are not waiting for consensus.

This new law targets high-risk applications, including healthcare, employment, and online safety. It introduces staggered compliance deadlines running from October 2026 through January 2028. For health tech developers, the clock is officially ticking.

The Patchwork Problem

The law includes specific carveouts and innovation initiatives for healthcare. However, these carveouts do not equal deregulation. Instead, they create a highly specific local environment that developers must study closely.

When states write their own rules, national scaling becomes a minefield. A tool compliant in Hartford might face legal hurdles in Boston or Albany. The cost of compliance is about to skyrocket for mid-sized digital health firms.

Enforcement is Local

Power under this act sits squarely with the state Attorney General. This means enforcement will likely be political and highly visible. Whistleblower protections are also baked into the law, inviting internal scrutiny of algorithmic bias and safety failures.

Health systems can no longer view AI governance as a future problem. The era of building fast and patching later is dead. If you deploy clinical or administrative AI in New England, your legal risk profile just changed forever.