Kentucky AI Laws: What's Enacted and What's Next (2027)

As of November 2026, Kentucky's main AI law is Senate Bill 4 (SB 4, 2025 Ky. Acts ch. 66), which governs how state government uses AI and lets a candidate sue over altered election media; it is not a law on private companies' AI. We found no comprehensive AI act and no Kentucky statute aimed at chatbots, AI in hiring, or AI in health care.

How we searched: Where this page says we found no law, we mean a text search of every act of the 2025 and 2026 Regular Sessions on the Legislative Research Commission's site (2025 chapters 1 to 162, 2026 chapters 1 to 202) for "artificial intelligence", "machine learning", "chatbot", "algorithm", "automated decision", "synthetic media", "deepfake" and "generative", plus the 2026 bill index headings for personnel and employment, insurance, health insurance, health services and mental health. We did not run that search over the code as a whole, over earlier sessions, or over administrative regulations.

This page covers Kentucky state law as of November 4, 2026. It is general legal information, not legal advice. For the national picture, see our guide to US AI laws.

Kentucky AI Laws at a Glance

SB 4 and KRS 42.731: AI in Kentucky State Government

SB 4 is Chapter 66 of the 2025 Acts, signed March 24, 2025. An emergency clause made it effective on approval. The legislature's record shows votes of 30-3 in the Senate, 86-10 in the House, and 33-4 on Senate concurrence.

The act's AI governance duties fall on state government. KRS 42.731 requires the Commonwealth Office of Technology (COT) to create an Artificial Intelligence Governance Committee "to govern the use of artificial intelligence systems by state departments, state agencies, and state administrative bodies." A summary that calls SB 4 a general AI act overstates it.

The committee. It develops policy standards that adhere to the latest version of ISO/IEC 42001, sets technology standards for generative and high-risk AI, keeps a centralized registry of those systems, and runs an approval process.

What counts as high-risk. KRS 42.722 defines a high-risk system as one that is "a substantial factor in the decision-making process or specifically intended to autonomously make, or be a substantial factor in making, a consequential decision." A consequential decision has "a material legal or similarly significant effect on the provision or denial of services, cost, or terms to any citizen or business."

The definition excludes a system intended to perform a narrow procedural task, improve the result of a completed human activity, detect decision-making patterns without replacing or influencing human assessment absent human review, or perform a preparatory task.

Disclosure. Under KRS 42.731(6)(a), a state body must disclose "through a clear and conspicuous disclaimer" when AI is used to render a decision about citizens or businesses, to inform a decision or create an output, or to produce information or outputs they can access.

Appeals. When an AI system "makes external decisions related to citizens," the body must disclose how AI is used, state the extent of human involvement, and "make readily available options for individuals to appeal a consequential decision that involves artificial intelligence."

Risk management. Operating standards must bar using a high-risk system to render a consequential decision without a risk management policy and program. That policy must adhere to ISO/IEC 42001 or another recognized framework, and it must identify, mitigate and document bias.

Limits. KRS 42.731(9) does not require disclosure of trade secrets, confidential or proprietary information about a system, or information that would create a security risk. The section states no penalty and no private right of action.

Reports and rules. COT must report to the Legislative Research Commission and the Interim Joint Committee on State Government by December 1, 2025, and annually after that. It also had to promulgate administrative regulations by December 1, 2025. We did not find an AI chapter in the chapter list for KAR Title 200, which shows chapter titles only, and we did not confirm whether a regulation or the first report was filed.

KRS 117.322: Synthetic Media in Kentucky Campaign Ads

KRS 117.322 is a lawsuit remedy for candidates. It does not ban AI in campaign ads, and it does not impose a standing label requirement.

A candidate "whose appearance, action, or speech is altered through the use of synthetic media in an electioneering communication" may seek an injunction or other equitable relief against the sponsor, requiring a clear and conspicuous disclosure. The candidate files in the Circuit Court of the county where he or she resides and must prove the use of synthetic media by clear and convincing evidence.

The definition is narrow. Under KRS 117.001, synthetic media is an audio or video recording of an identifiable person "intentionally manipulated with the use of generative adversarial network techniques" to create a realistic but false result. It must depict something that did not occur, created without the person's consent, and give a fundamentally different impression than the original.

A disclosure is an affirmative defense. Failing to obey a court order to add one is subject to the penalties in KRS 121.990(3) for a violation of KRS 121.190(1). A court may award a prevailing party reasonable attorney's fees and costs.

The 2026 change. HB 757, 2026 Ky. Acts ch. 161, sec. 106, a revenue bill, amended the section effective July 15, 2026. A medium or its sales representative can now be liable for changing a communication so that it qualifies as synthetic media only if it acted "with intent to deceive or mislead." The other route remains: intentionally removing a disclosure and then not removing the communication or replacing the disclosure when notified. Neither route applies when a licensee, programmer or operator of a federally licensed broadcasting station transmits a communication subject to 47 U.S.C. sec. 315. Separately, subsection (6) says a provider or user of an interactive computer service is not treated as the publisher or speaker of information from another content provider, and that such a service is exempt as provided by 47 U.S.C. sec. 230, though it may be held liable under subsection (3).

For the rest of Kentucky's deepfake law, see our guide to Kentucky deepfake laws.

Computer-Generated Images of Minors

HB 207 (2024), Acts ch. 15, added computer-generated images of a minor as an element of several offenses in KRS ch. 531. Its enacted summary says that where an offense involves such an image, the Commonwealth need not prove the identity or age of the computer-generated minor, or that the minor exists.

HB 366 (2026), Acts ch. 109, signed April 13, 2026, amended KRS 531.335 on possessing or viewing matter portraying a sexual performance by a minor. As amended, the section covers matter that "visually depicts a sexual performance by a minor person or computer-generated image of a minor person," and it requires knowledge of the matter's content and character.

Kentucky Consumer Data Protection Act: AI Profiling

The Kentucky Consumer Data Protection Act (KCDPA, HB 15, 2024 Ky. Acts ch. 72, KRS 367.3611 and following) took effect January 1, 2026. It is a privacy law. Its word is "profiling," defined as "any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects" of a person, not AI.

Opt-out. Consumers may opt out of profiling "in furtherance of decisions that produce legal or similarly significant effects." The act defines those as decisions on financial and lending services, housing, insurance, education enrollment, criminal justice, employment opportunities, health care services, or access to basic necessities.

Assessments. Controllers must carry out a data protection impact assessment for profiling that presents the risks the act lists.

Who is covered. The act applies to persons doing business in Kentucky, or targeting its residents, that in a calendar year control or process the personal data of at least 100,000 consumers, or 25,000 consumers while deriving over 50 percent of gross revenue from selling personal data.

Who is not. Exempt entities include cities, state agencies and political subdivisions, financial institutions and data covered by the Gramm-Leach-Bliley Act, HIPAA covered entities and business associates, nonprofits and institutions of higher education, among others. A "consumer" does not include a person acting in a commercial or employment context.

Enforcement. The Attorney General has exclusive authority. He must give 30 days' written notice before an action, and a controller or processor that cures and says so in writing avoids an action for damages. After that, he may seek up to $7,500 for each continued violation. The act creates no private right of action.

Attorney General v. Character Technologies

Attorney General Russell Coleman sued Character Technologies, Inc. and its two founders in Franklin Circuit Court in January 2026 over the Character.AI chatbot. This is an enforcement action under state consumer protection and privacy law, with a common-law claim, not a case under an AI statute and not a challenge to a state AI law.

WSMV reported on October 11, 2026 that an unredacted complaint had been filed the week before, and it reported no ruling. A WKYT report carried by WSMV, dated October 14, said Kentucky was joining a national coalition in Character Technologies' bankruptcy case, which raised concerns about protecting children and consumers before any sale of the company's data or assets.

These are news accounts as of those dates. The claims are allegations, not findings.

What We Did Not Find in Kentucky Law

In the search described at the top of this page, through November 4, 2026, we found no Kentucky act on AI in employment decisions, health care or insurance, no chatbot law, no general AI disclosure law beyond the election remedy, and no frontier model law.

The term search did turn up other 2026 acts. HB 314 (Acts ch. 2) lists COT's duty to set AI policy standards for state bodies, and budget acts mention AI funding for state agencies. None of these regulates private AI use.

Bulletin No. 2024-02, adopted April 16, 2024, is Kentucky's entry on the National Association of Insurance Commissioners' list of states adopting its model bulletin on insurers' use of AI, in the list's status as of November 3, 2026. A bulletin is a regulator's statement of expectations under existing law, not a new law. We did not read the Kentucky bulletin itself.

Web searches found no AI executive order from Governor Beshear, and they would not show every order. General laws such as the Kentucky Consumer Protection Act and the Kentucky Civil Rights Act are not AI laws, and this page does not cover how a court would apply them to AI.

AI Note-Takers and Recording in Kentucky

AI meeting assistants raise recording consent questions. Our guide to Kentucky AI meeting recording laws covers them.

Kentucky AI Bills That Did Not Pass

These bills are not law. Each status is what the legislature's record page showed when read for this update. The 2026 pages were last updated August 19, 2026.

How Federal AI Policy Affects Kentucky

As of November 4, 2026, we found no federal statute in the public laws of the 119th Congress that sets general rules for private AI systems or generally preempts state AI laws. In December 2025, Executive Order 14365 directed federal agencies to challenge or discourage state AI laws the administration views as conflicting with national policy, and called for a federal framework from Congress. The order itself does not declare any state law invalid.

The Justice Department formed an AI Litigation Task Force in January 2026, the White House issued legislative recommendations in March 2026, and the FTC proposed a policy statement in July 2026. Separately, in April 2026 the Justice Department intervened in a lawsuit against Colorado's AI law under the Civil Rights Act of 1964. We did not find a published Commerce evaluation of state laws in the Federal Register or on ntia.gov, or a BEAD notice carrying the order's AI condition on NTIA's sites.

For more, see our pages on Trump's AI executive orders and state AI law preemption.

What Changes in Kentucky AI Law in 2027

As of November 4, 2026, we found no AI law scheduled to take effect in Kentucky in 2027; we searched the Legislative Research Commission's Acts of the 2025 and 2026 Regular Sessions and its 2026 bill indexes.

One related date is on the calendar. HB 692 (2026), Acts ch. 118, takes effect July 1, 2027. It bars KCDPA controllers from collecting automatic content recognition data without a consumer's consent. It is a privacy amendment, not an AI law.

COT's next annual report under KRS 42.731(11) is due by December 1, 2026. We did not review any bill filed for a 2027 session.

More Kentucky Laws

• Kentucky Data Privacy Laws
• Kentucky Deepfake Laws
• Kentucky Employee Monitoring Laws
• Kentucky Biometric Privacy Laws
• Kentucky AI Meeting Recording Laws

Frequently Asked Questions

Does Kentucky have an AI law?

Yes, but a narrow one. SB 4 (2025) governs how state departments, agencies and administrative bodies use AI and gives candidates a court remedy for synthetic media in campaign ads. We found no comprehensive Kentucky AI act.

Does Kentucky SB 4 apply to private businesses?

KRS 42.731 applies to state departments, agencies and administrative bodies, and its AI governance duties do not fall on private companies. The election section, KRS 117.322, can reach a sponsor of an electioneering communication and, in limited cases, a medium.

What is a high-risk AI system under Kentucky law?

Under KRS 42.722, it is an AI system that is a substantial factor in the decision-making process, or is specifically intended to autonomously make or be a substantial factor in making, a consequential decision. Systems for narrow procedural tasks, improving a completed human activity, detecting patterns without replacing human assessment absent review, or preparatory tasks are excluded.

Does Kentucky ban AI deepfakes in political ads?

No. KRS 117.322 lets a candidate altered by synthetic media in an electioneering communication ask a court to order a clear and conspicuous disclosure. A disclosure is an affirmative defense, and penalties apply for failing to obey the court's order. The definition covers audio or video manipulated with generative adversarial network techniques.

Can Kentucky consumers opt out of AI profiling?

The Kentucky Consumer Data Protection Act lets consumers opt out of automated profiling in furtherance of decisions with legal or similarly significant effects. It covers businesses meeting its data thresholds, exempts groups such as financial institutions, HIPAA covered entities and nonprofits, and does not cover people acting in a commercial or employment context.

Is Kentucky suing Character.AI?

Yes. Attorney General Russell Coleman sued Character Technologies and its two founders in Franklin Circuit Court in January 2026. It is an enforcement action under state consumer protection and privacy law, with a common-law claim. The allegations are unproven, and an October 2026 news report described no ruling.

What AI laws take effect in Kentucky in 2027?

As of November 4, 2026, we found none in the Acts of the 2025 and 2026 Regular Sessions. A KCDPA amendment on automatic content recognition data takes effect July 1, 2027, but it is a privacy amendment, not an AI law.