United States - Kentucky - AI Governance Act (SB 4)

Overview

Kentucky Senate Bill 4 establishes one of the most comprehensive state-level AI governance frameworks in the United States, creating structured oversight for AI use across Kentucky state government while addressing emerging concerns about AI-generated content in elections. Signed by Governor Andy Beshear on March 24, 2025, the law reflects Kentucky's position in the growing movement of states developing AI governance absent federal legislation. Championed by Senate Republicans Amanda Mays Bledsoe and Brandon Storm, the legislation achieved remarkable bipartisan support with 30-3 passage in the Senate and 86-10 in the House. Unlike private sector-focused AI laws in states like Colorado, Kentucky's approach concentrates on government AI use, establishing approval processes, disclosure requirements, and human oversight mandates. The law also uniquely addresses election integrity concerns, prohibiting deceptive AI-generated political content—a provision reflecting growing awareness of AI's potential to disrupt democratic processes. The framework takes effect immediately upon signing, requiring prompt compliance by state agencies.

Definitions

SB 4 establishes definitions aligned with emerging national standards. Artificial intelligence system encompasses machine-based systems that infer from inputs how to generate outputs including content, decisions, predictions, or recommendations. Generative AI specifically refers to AI systems capable of producing new content such as text, images, or code. High-risk AI systems are those substantially affecting consequential decisions. Consequential decisions are those affecting legal rights, access to government services, or costs to citizens and businesses—the threshold triggering heightened oversight requirements. Substantial factor means the AI system materially influences decision outcomes rather than merely providing background information. Synthetic media refers to AI-generated or manipulated audio, video, or images that falsely depict individuals, addressed specifically in election integrity provisions. The law distinguishes between different risk levels, applying graduated requirements based on potential impact. Deployer refers to state agencies that implement AI systems, while developer encompasses those creating AI tools.

Governance and Institutional Framework

SB 4 creates a multi-layered governance structure centered on the Commonwealth Office of Technology (COT). An AI Governance Committee within COT develops policy standards and guiding principles for AI systems, with particular attention to generative and high-risk applications. COT establishes standards aligned with national benchmarks including NIST and ISO frameworks, ensuring Kentucky's approach reflects best practices. State agencies must obtain COT approval before implementing AI systems, creating centralized oversight and technical review. A centralized registry of AI systems maintains transparency and enables monitoring. Each state cabinet must submit annual reports to COT by December 1 identifying potential beneficial AI uses, creating a forward-looking planning process. The Governor's office retains ultimate authority over state AI policy. Individual agencies bear responsibility for implementation within COT guidelines, including conducting risk assessments, ensuring human oversight, and maintaining documentation. The framework creates accountability at multiple levels while preserving agency flexibility within established parameters.

Key Focus Areas

• Risk-Based Oversight: Structured approach targeting AI systems substantially affecting consequential decisions on legal rights, services, or costs.
• COT Approval Requirement: State agencies must obtain Commonwealth Office of Technology approval before implementing AI systems.
• Public Disclosure: Mandatory disclosure when AI is used in decision-making processes affecting citizens.
• Centralized Registry: Maintenance of comprehensive registry of AI systems deployed across state government.
• Human Oversight Mandate: Human review required for all consequential AI-driven decisions.
• Anti-Discrimination Requirements: Agencies must document how AI systems will not discriminate.
• Data Security: AI systems must maintain data privacy and protection standards.
• Election Integrity: Disclosure requirements and prohibitions on deceptive AI-generated political content.
• Synthetic Media Restrictions: Ban on unreported AI-generated content fraudulently depicting individuals in political contexts.
• Legal Remedies: Available for individuals targeted by deceptive AI-generated media in elections.
• Agency Reporting: Annual cabinet reports on potential beneficial AI uses due December 1.
• National Standard Alignment: Oversight aligned with NIST and ISO benchmarks.

Implementation Framework

SB 4 took effect immediately upon Governor Beshear's signature on March 24, 2025, requiring prompt compliance. State agencies must inventory existing AI systems and assess which require COT approval based on consequential decision involvement. New AI deployments require pre-implementation approval, creating a gating process for AI adoption. COT must develop approval criteria, risk assessment templates, and registry infrastructure. Agencies must establish human oversight procedures for consequential decisions and create documentation demonstrating non-discrimination, citizen benefit, and data security compliance. The election integrity provisions apply immediately to upcoming elections, requiring political actors to disclose AI-generated content. The December 1 annual reporting deadline creates ongoing planning cycles. Agencies should establish designated personnel responsible for AI governance compliance and liaison with COT. Training programs should be developed to ensure staff understanding of requirements, particularly regarding disclosure obligations and human oversight procedures.

Monitoring and Evaluation

SB 4 establishes ongoing monitoring through multiple mechanisms. The centralized AI registry provides visibility into deployed systems across state government. Regular agency reporting to COT creates accountability and enables identification of compliance gaps. Annual cabinet reports on beneficial AI uses create forward-looking assessment of AI opportunities. COT's oversight role enables ongoing evaluation of agency compliance with approval requirements, disclosure obligations, and human oversight mandates. The AI Governance Committee can update standards based on implementation experience and evolving best practices. Risk assessments conducted by agencies create documentation for compliance verification. The election integrity provisions will be monitored through standard election oversight mechanisms, with legal remedies creating private enforcement incentives. The legislature may conduct oversight hearings and consider amendments based on implementation experience. Comparison with other state approaches—particularly Colorado, Texas, and Utah—will inform evaluation of Kentucky's framework effectiveness.

Penalties, Liability, and Appeals

SB 4 establishes differentiated consequences for violations. State agencies deploying AI without required COT approval may face administrative consequences through standard government accountability mechanisms. Individual employees violating AI policies may face personnel actions. The election integrity provisions create specific legal remedies for individuals depicted in deceptive AI-generated political content, enabling civil litigation against those releasing synthetic media without disclosure. Criminal penalties may apply for election-related AI fraud under existing election law frameworks. The anti-discrimination documentation requirement creates potential liability exposure if AI systems are later shown to discriminate despite agency assurances. No private right of action exists for general AI governance violations—enforcement occurs through government oversight and accountability structures. Appeals from agency AI decisions follow standard administrative procedure, with judicial review available. COT denial of AI system approval may be appealed through administrative processes.

Relationship to Other Instruments

SB 4 joins the growing patchwork of US state AI legislation while taking a distinctive government-focused approach. Colorado SB24-205 regulates private sector high-risk AI with consumer protection focus, while Kentucky concentrates on state government operations. Arkansas HB 1958 similarly addresses public sector AI but with less detailed governance infrastructure. The law's alignment with NIST and ISO standards creates federal compatibility and international alignment. Executive Order 14110 directs similar federal agency AI governance, and Kentucky's framework could facilitate state-federal coordination. The election integrity provisions address concerns highlighted in multiple state deepfake laws. The risk-based approach reflects principles from the EU AI Act applied to government context. Kentucky's centralized approval process differs from states allowing agency-level AI governance discretion. The immediate effective date contrasts with extended implementation periods in other state laws.

International Alignment

Kentucky's SB 4 reflects international trends in AI governance while adapting approaches to US state government context. The EU AI Act's risk-based categorization influences Kentucky's focus on consequential decisions and high-risk AI systems, though Kentucky applies these concepts specifically to government operations rather than economy-wide. The disclosure requirements align with international transparency principles articulated in OECD AI Principles and UNESCO's Recommendation on the Ethics of AI. The human oversight mandate reflects global consensus on maintaining human agency over AI decision-making in sensitive contexts. NIST and ISO alignment creates indirect international standard compatibility. The election integrity provisions address concerns highlighted internationally regarding AI manipulation of democratic processes—the Council of Europe has emphasized similar protections. Canada's federal AI governance framework includes comparable government AI oversight mechanisms. The centralized registry approach follows patterns used in EU member states tracking public sector AI deployment. Kentucky's immediate effectiveness differs from extended implementation timelines common internationally.

Implementation Timeline

Sources and References