Law / United States / 
Kentucky
State-agency artificial intelligence governance and public disclosure (Senate Bill 4 of 2025)
2025 Ky. Acts ch. 66 (SB 4); KRS 42.722, 42.726(2)(q), 42.731
In force since .
An AI governance rule binding government bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Governance, Disclosure, Reporting
- Audit expectation
- none
What it requires
- If you are a Kentucky department, agency, or administrative body, disclose to the public, through a clear and conspicuous disclaimer, when generative artificial intelligence, an artificial intelligence system, or another artificial intelligence-related capability is used to render a decision about individual citizens or businesses, in a process or to produce materials that inform a decision or create an output, or to produce information or outputs that citizens and businesses can access (KRS 42.731(6)(a)).
- When an artificial intelligence system makes external decisions about citizens of the Commonwealth, disclose how artificial intelligence is used in the decision-making process, provide the extent of human involvement in validating and overseeing any decision made, and make readily available options for individuals to appeal a consequential decision that involves artificial intelligence (KRS 42.731(6)(b)).
- Include in the disclaimer information about third-party artificial intelligence products or programs, including how the high-risk or generative system works, such as system cards or other documented information provided by developers (KRS 42.731(6)(c)).
- The operating standards for a high-risk artificial intelligence system prohibit using it to render a consequential decision without a risk management policy and program that specifies principles, process, and personnel and identifies, mitigates, and documents any bias or potential bias, and each policy adheres at a minimum to the latest version of ISO/IEC 42001 or another national or internationally recognized artificial intelligence risk management framework (KRS 42.731(8)).
- Allow only the use of necessary data in artificial intelligence systems, do not allow unrestricted access to personal data controlled by the Commonwealth, and secure all data and implement a timeframe for data retention (KRS 42.731(3)).
- Be subject to review of the generative artificial intelligence systems or high-risk artificial intelligence systems you use (KRS 42.731(4)).
- Send the Commonwealth Office of Technology a report examining and identifying potential use cases for deploying generative and high-risk artificial intelligence systems, including a description of the benefits and risks to individuals, communities, government, and government employees (KRS 42.731(11)(b)).
- The Commonwealth Office of Technology establishes, publishes, maintains, and implements policy standards and procedures for the responsible, ethical, and transparent use of generative and high-risk artificial intelligence systems, covering their procurement, implementation, and ongoing assessment (KRS 42.726(2)(q)).
- The Artificial Intelligence Governance Committee maintains a centralized registry of the generative and high-risk artificial intelligence systems in use and develops an approval process that includes a registry of application, use case, and decision rationale (KRS 42.731(1)(d) and (e)).
- Nothing in these provisions requires disclosing trade secrets, confidential or proprietary information about the design or use of an artificial intelligence system, or information that would create a security risk (KRS 42.731(9)).
These lines are LexLint's reading of the law's text.
What record it asks for
What the log must hold
System identity, Decision basis
Logging duty
The Committee keeps a centralized registry of the generative and high-risk artificial intelligence systems in use and an approval process that includes a registry of application, use case, and decision rationale. The section does not use the word log and names no retention period.
- Kind
- Implicit
- As of
- Provision
- KRS 42.731(1)(d) and (e)
- Trigger
- high_risk_systems
- content_generation
What this law does
Section 3 of Kentucky Acts chapter 66 of 2025, now KRS 42.731, took effect on . The Commonwealth Office of Technology must create an Artificial Intelligence Governance Committee to govern the use of artificial intelligence systems by state departments, state agencies, and state administrative bodies.
The Committee develops policy standards and guiding principles, to mitigate risks and protect the data and privacy of Kentucky citizens and businesses, that adhere to the latest version of Standard ISO/IEC 42001 of the International Organization for Standardization. The Committee maintains a centralized registry that includes a current inventory of generative artificial intelligence systems and high-risk artificial intelligence systems.
The Commonwealth Office of Technology must establish, publish, maintain, and implement comprehensive policy standards and procedures for the responsible, ethical, and transparent use of generative artificial intelligence systems and high-risk artificial intelligence systems by departments, agencies, and administrative bodies.
A department, agency, or administrative body must disclose to the public, through a clear and conspicuous disclaimer, when generative artificial intelligence, artificial intelligence systems, or other artificial intelligence-related capabilities are used to render any decision regarding individual citizens or businesses within the state, in any process or to produce materials that inform a decision or create an output, or to produce information or outputs accessible by citizens and businesses.
When an artificial intelligence system makes external decisions related to citizens of the Commonwealth, the department, agency, or administrative body must disclose how artificial intelligence is used in the decision-making process, provide the extent of human involvement in validating and oversight of any decision made, and make readily available options for individuals to appeal a consequential decision that involves artificial intelligence.
The disclaimer must also give information about third-party artificial intelligence products or programs, including how a high-risk or generative system works, such as system cards or other documented information provided by developers.
The operating standards for high-risk artificial intelligence systems must prohibit using such a system to render a consequential decision without a risk management policy and program that specifies principles, process, and personnel and identifies, mitigates, and documents any bias or potential bias.
Each risk management policy must at a minimum adhere to the latest version of Standard ISO/IEC 42001 or another national or internationally recognized risk management framework for artificial intelligence systems. A high-risk artificial intelligence system is one that is a substantial factor in the decision-making process or specifically intended to autonomously make, or be a substantial factor in making, a consequential decision.
The Commonwealth Office of Technology must transmit reports to the Legislative Research Commission and the Interim Joint Committee on State Government by , and annually every year thereafter. The section does not require the disclosure of trade secrets, confidential or proprietary information about the design or use of an artificial intelligence system, or any information which would create a security risk.
KRS 42.720 to 42.742 do not grant the Commonwealth Office of Technology any authority over the judicial or legislative branches of state government, or their agencies.
When LexLint raises it
When your app profile says your app generates content with AI or makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .