Kentucky AI Laws and Regulation (2026)

Kentucky regulates AI through Senate Bill 4, signed March 24, 2025, which created an AI Governance Committee, requires disclosure when government agencies use AI in decisions affecting citizens, and gives a candidate altered by synthetic media in a campaign ad a court action to force a disclosure. The Kentucky Consumer Data Protection Act, effective January 1, 2026, adds consumer opt-out rights for AI profiling.

Kentucky has emerged as a national leader in state-level AI governance. With the passage of Senate Bill 4 in 2025, Kentucky created one of the most structured frameworks for regulating AI use in government, complete with a dedicated governance committee, risk-based classification system, transparency requirements, and election integrity provisions. Combined with the Kentucky Consumer Data Protection Act's AI profiling rules and aggressive early enforcement against an AI chatbot company, Kentucky offers a model that other states are watching closely.

This guide covers Kentucky's enacted AI laws, the SB 4 governance framework in detail, deepfake protections, the KCDPA's AI-related provisions, pending legislation, and how federal AI policy intersects with Kentucky law.

This article is for informational purposes only and does not constitute legal advice. Consult a licensed Kentucky attorney for guidance on specific situations.

Kentucky SB 4: The AI Governance Framework

Senate Bill 4, signed by Governor Andy Beshear on March 24, 2025, is Kentucky's landmark AI legislation. The bill passed with overwhelming bipartisan support, with votes of 30-3 in the Senate and 86-10 in the House. The law took effect immediately upon the governor's signature.

SB 4 was the direct result of recommendations from Kentucky's Artificial Intelligence Task Force, established under HCR 38 in 2024 and co-chaired by Representative Josh Bray and Senator Amanda Mays Bledsoe.

The AI Governance Committee

Under KRS 42.731, the Commonwealth Office of Technology (COT) must create an Artificial Intelligence Governance Committee. The committee has the following duties.

Develop policy standards. The committee must create policy standards and guiding principles to mitigate risks and protect the data and privacy of Kentucky citizens and businesses. These standards must adhere to the latest version of ISO/IEC 42001, the International Organization for Standardization's standard for AI management systems.

Establish technology standards. The committee must set protocols and requirements for the use of generative AI and high-risk AI systems across state government.

Ensure transparency. All AI systems used by government must be documented and their use disclosed to the public.

Maintain a centralized registry. The committee must maintain a current inventory of all generative AI systems and high-risk AI systems used by state government agencies.

Defining High-Risk AI Systems

SB 4 introduces a risk-based classification approach. A "high-risk artificial intelligence system" is defined as any AI system that is a "substantial factor" in the decision-making process or is specifically intended to autonomously make, or be a substantial factor in making, a "consequential decision."

A "consequential decision" is defined as any decision that has a material legal or similarly significant effect on the provision or denial of services, cost, or terms to any citizen or business.

The definition explicitly excludes several categories of AI.

• Systems performing narrow procedural tasks
• Systems that improve the result of a completed human activity
• Systems that detect decision-making patterns or deviations from previous patterns but are not meant to replace or influence human assessment without human review
• Systems that perform preparatory tasks in assessments relevant to consequential decisions

This exclusion framework is designed to avoid over-regulating routine AI applications while maintaining oversight of systems that materially affect people's rights and access to services.

Transparency and Disclosure Requirements

SB 4 requires government bodies to disclose the use of generative AI in two key situations.

Decisions affecting citizens. When a governmental body uses generative AI in rendering decisions related to citizens, it must disclose that AI was involved in the process.

Public output. When AI is used to produce public-facing output, the use of AI must be disclosed.

Citizens who receive a consequential decision involving AI have the right to appeal that decision, ensuring human review of AI-driven government actions.

Annual Reporting

The Commonwealth Office of Technology must transmit an annual report to the Legislative Research Commission and the Interim Joint Committee on State Government by December 1, compiling the use-case reports it receives from each state department, agency, and administrative body identifying potential beneficial uses of AI within their operations. This creates a forward-looking planning process that encourages innovation while maintaining accountability.

Enforcement: What SB 4 Leaves Out

SB 4 created no penalty for a state agency or employee that ignores its AI governance rules. KRS 42.731 is the only operative section the act added to KRS Chapter 42, and it contains no fine, no administrative sanction, and no personnel consequence. Nothing else in the KRS 42.720 to 42.742 series supplies one either.

The act also creates no private right of action for AI governance violations. Compliance rests on the ordinary machinery of state government: the approval process the AI Governance Committee must develop under KRS 42.731(1)(e), the annual reports COT owes the Legislative Research Commission and the Interim Joint Committee on State Government under subsection (11), and the administrative regulations COT was directed to promulgate under subsection (12).

Election Integrity Provisions

SB 4 added KRS 117.322, which addresses AI-altered synthetic media in election communications. This section is widely described as a ban or a labeling mandate. It is neither, and the difference matters to anyone deciding what they can lawfully run.

There Is No Ban and No Standalone Disclosure Mandate

KRS 117.322 does not prohibit distributing AI-generated political content, and it imposes no freestanding duty on advertisers to label AI use. What it creates is a lawsuit. A qualifying plaintiff may ask a court for injunctive or other equitable relief requiring that the communication carry a disclosure that is clear and conspicuous and placed so a user is likely to notice it. A prevailing party may be awarded reasonable attorney's fees and costs.

Including that disclosure is an affirmative defense under KRS 117.322(4), not an obligation a regulator enforces up front. Penalties attach only at the back end: under subsection (3), failing to obey the court's order to add the disclosure carries the penalties set in KRS 121.990(3) for a violation of KRS 121.190(1), Kentucky's campaign-advertising disclaimer statute, which KRS 121.990(3) treats as a Class D felony.

Only Candidates Can Sue

Standing is narrow. KRS 117.322(1)(a) gives the action to "any candidate for any elected office whose appearance, action, or speech is altered" through synthetic media in an electioneering communication. A private individual depicted in a deceptive political deepfake has no claim under this section and must look elsewhere in Kentucky law.

The suit runs against the sponsor of the communication, meaning whoever paid for it. The candidate files in the Circuit Court of the county where he or she resides and must establish the use of synthetic media by clear and convincing evidence. The medium that carried the communication and its advertising sales representative are not liable except in the narrow circumstances subsections (3) and (5) describe.

The Definition Is Narrower Than "AI Content"

The section reaches only "synthetic media" as KRS 117.001(20) defines it: an audio recording or video recording of an identifiable natural individual's appearance, action, or speech that was intentionally manipulated using generative adversarial network techniques to create a realistic but false depiction. AI-generated text and AI-generated still images in political messaging fall outside that definition.

The communication must also qualify as an "electioneering communication" under KRS 117.001(8), which is limited to electronically distributed communications that unambiguously refer to a candidate or ballot measure and that run within 45 days before a primary or regular election. News coverage, editorial opinion, and communications that are already reportable contributions or independent expenditures are excluded.

Kentucky is one of 28 states as of September 2025 that have enacted laws specifically addressing deepfakes in political communications.

Kentucky Consumer Data Protection Act and AI

The Kentucky Consumer Data Protection Act (KCDPA) took effect on January 1, 2026, adding important protections that directly affect AI systems operating in Kentucky.

AI Profiling Rights

The KCDPA gives consumers the right to opt out of profiling that produces legal or similarly significant effects. Under the law, "profiling" means any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable person, including their economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

This definition captures many AI applications that analyze consumer data to make predictions or automated decisions.

Data Protection Impact Assessments

The KCDPA requires businesses to conduct and document data protection impact assessments for processing activities that present reasonably foreseeable risks, including profiling that may result in the following.

• Unfair or deceptive treatment of consumers
• Disparate impact on protected groups
• Significant financial, physical, or reputational injury

This requirement means businesses deploying AI systems that profile consumers in Kentucky must proactively assess and document the risks those systems create.

First Enforcement Action: Character.AI Lawsuit

On January 8, 2026, just seven days after the KCDPA took effect, Attorney General Russell Coleman filed Kentucky's first enforcement action under the new law. The lawsuit targeted Character Technologies and its product, Character.AI.

The complaint filed in Franklin Circuit Court alleges that Character.AI preyed on children by allowing them to engage in harmful conversations with AI chatbots, including sexually explicit content, promotion of self-harm, and encouragement of substance use.

Key allegations include the following.

KCDPA violations. The company failed to obtain verifiable parental consent before collecting and processing children's personal data, as required by the KCDPA in accordance with the Children's Online Privacy Protection Act (COPPA).

Consumer protection violations. The complaint also alleges unfair, false, misleading, and deceptive acts under the Kentucky Consumer Protection Act, seeking $2,000 per violation.

Relief sought. The AG seeks injunctive relief under the KCDPA and monetary penalties under consumer protection law.

This early enforcement action signaled Kentucky's willingness to use its new privacy law aggressively against AI companies that fail to protect vulnerable users.

Kentucky's Deepfake and CSAM Laws

Kentucky has enacted laws addressing AI-generated exploitative content, particularly involving minors.

KRS Chapter 531: Pornography and Exploitation of Minors

Kentucky Revised Statutes Chapter 531 addresses pornography and the sexual exploitation of minors. Significant updates to these statutes took effect July 15, 2024, including provisions that cover AI-generated and computer-synthesized material.

Kentucky is one of 46 states that have enacted laws criminalizing AI-generated or computer-edited child sexual abuse material. Under KRS Chapter 531, the following activities involving AI-generated CSAM are criminal offenses.

• Use of a minor in a sexual performance (KRS 531.310)
• Promoting a sexual performance by a minor (KRS 531.320)
• Possession or viewing of material portraying a sexual performance by a minor (KRS 531.335)
• Distribution of such material (KRS 531.340)

The 2024 amendments extending coverage to computer-generated and AI-generated images apply to KRS 531.320, 531.335, and 531.340. KRS 531.310 (use of a minor in a sexual performance) was not amended and its own text still requires an actual minor who was employed, consented to, authorized, or induced to engage in a real sexual performance. However, a same-day 2024 companion statute, KRS 531.306, provides that in any prosecution under KRS 531.300 to 531.370, including KRS 531.310, the Commonwealth is not required to prove the actual identity, age, or existence of the minor when the offense involves a computer-generated image. That makes the practical reach of KRS 531.310 to wholly AI-generated material, where no real minor exists, an open legal question rather than a settled negative.

Federal Protections: The TAKE IT DOWN Act

The federal TAKE IT DOWN Act, signed by President Trump, provides additional protection for Kentucky residents by making it a federal crime to publish or threaten to share non-consensual intimate images, including AI-generated deepfakes. Social media platforms must remove such content within 48 hours of notification by a victim.

The 2024 AI Task Force and Its Legacy

Kentucky's current AI regulatory framework grew directly out of the Artificial Intelligence Task Force established by House Concurrent Resolution 38 in 2024. Co-chaired by Representative Josh Bray and Senator Amanda Mays Bledsoe, the task force issued 11 recommendations in November 2024 that shaped SB 4 and the state's broader AI policy direction.

Key recommendations included the following.

1. Establish policy standards for AI use by state government, including a framework for ethical decision-making, approval processes, required disclosures, and data privacy protections
2. Urge the federal government to take immediate action on AI regulation
3. Promote and protect the integrity of Kentucky elections through responsible AI use
4. Establish a state AI governance framework focused on data privacy, ethical standards, transparency, and accountability
5. Promote AI education and workforce development through integration of AI into educational curricula

Senator Bledsoe has continued to lead the task force into its second phase, focusing on implementation of SB 4 and identifying areas where additional legislation may be needed.

Pending Legislation in the 2026 Session

The 2026 Kentucky General Assembly session has addressed several AI-adjacent issues.

HB 227: Social Media Age Verification and Algorithmic Protections for Minors

House Bill 227 would require social media companies to verify user age and prohibit the use of addictive algorithms targeting minors. The bill passed the full House 96-0 on March 9, 2026 but stalled in the Senate Judiciary Committee, which returned it twice without further action, and it did not pass during the 2026 session.

While not exclusively an AI bill, HB 227 addresses AI-driven recommendation algorithms that social media platforms use to target content at younger users.

HB 567: Public Records and AI-Generated Requests

House Bill 567 would allow public agencies to require photo identification from individuals requesting public records. The bill responds to concerns that state agencies have been overwhelmed by AI-generated records requests, which consume staff time and resources.

AI Data Center Legislation

Kentucky has emerged as a target for AI data center development, prompting significant legislative activity. In 2025, the legislature passed a law exempting data centers from sales and use taxes on computer equipment for 50 years. The 2026 session has focused on establishing location requirements, protecting utility ratepayers from cost increases, and creating frameworks for nuclear power expansion to serve data centers.

How Federal AI Policy Affects Kentucky

Federal AI policy creates additional requirements for Kentucky residents and businesses beyond state law.

FTC Enforcement

The Federal Trade Commission actively enforces against deceptive AI practices nationwide, including in Kentucky. The FTC has warned companies against making unfounded claims about AI capabilities, using AI to generate fake reviews, and deploying AI in ways that cause substantial consumer harm.

Sector-Specific Federal Rules

Kentucky businesses in regulated industries face additional AI requirements from federal agencies. Financial institutions must ensure AI credit-scoring tools comply with fair lending laws. Healthcare providers must meet FDA requirements for AI diagnostic tools. Employers must follow EEOC guidance on algorithmic fairness.

NIST AI Risk Management Framework

The NIST AI Risk Management Framework provides voluntary guidelines for responsible AI deployment. Notably, Kentucky's SB 4 references the ISO/IEC 42001 standard, aligning state government AI governance with international best practices.

How Existing Kentucky Law Applies to AI

Beyond SB 4 and the KCDPA, several existing Kentucky laws apply to AI systems.

Consumer Protection

The Kentucky Consumer Protection Act (KRS 367.110-367.360) prohibits unfair, false, misleading, or deceptive acts and practices. AI-driven business practices that mislead consumers fall under this act, as demonstrated by Attorney General Coleman's Character.AI lawsuit, which included consumer protection claims alongside KCDPA claims.

Employment Discrimination

The Kentucky Civil Rights Act (KRS 344) prohibits employment discrimination based on race, color, religion, national origin, sex, age, disability, and other protected characteristics. Employers using AI tools for hiring, promotion, or termination must ensure those tools do not produce discriminatory outcomes.

The Kentucky Commission on Human Rights enforces these protections. Kentucky does not have a dedicated AI hiring law requiring bias audits or algorithmic impact assessments.

Penalties Summary

Looking Ahead: Kentucky's AI Regulatory Future

Kentucky has established itself as a leading state in AI governance, and the trajectory suggests continued activity. Key trends to watch include the following.

SB 4 implementation. The AI Governance Committee's development of detailed policy standards and the centralized AI registry will shape how all Kentucky state agencies deploy AI systems going forward.

KCDPA enforcement expansion. The Character.AI lawsuit signals aggressive enforcement against AI companies that violate Kentucky's data privacy law, particularly those that impact children.

Data center regulation. Kentucky's push to attract AI data centers while protecting ratepayers and communities creates a unique intersection of economic development and technology policy.

Private sector AI regulation. SB 4 currently focuses on government AI use. The AI Task Force's second phase may recommend extending transparency or disclosure requirements to private sector AI deployments.

Healthcare AI. Federal developments in AI medical device regulation may prompt Kentucky to establish state-level guidelines, particularly given the state's rural healthcare challenges.

More Kentucky Laws

• Kentucky Data Privacy Laws
• Kentucky Deepfake Laws
• Kentucky Employee Monitoring Laws
• Kentucky Biometric Privacy Laws