Kentucky

Summary

Kentucky has enacted two AI-specific laws as of mid-2026. The Kentucky AI Governance Act (SB 4, signed March 24, 2025) is the primary statute: it governs how state agencies acquire, inventory, and use AI, requires public disclosure whenever AI substantially influences a government decision affecting residents, and mandates human review for consequential outcomes. The Kentucky Consumer Data Protection Act (KCDPA, HB 15, eff. January 1, 2026) applies to the private sector and requires data-protection impact assessments for automated profiling that creates legal or similarly significant effects, and gives consumers an opt-out right. Kentucky has no enacted bot-disclosure or AI-training-data law applicable to private-sector websites. General consumer-protection law (KRS 367.170) and the KCDPA are the operative private-sector tools, as demonstrated by the AG's January 2026 enforcement action against Character Technologies (Character.AI) for deceptive and exploitative chatbot practices. Two 2026-session bills remain in play: HB 455 (AI restrictions in mental health therapy, passed House 88-7, Senate status unclear) and previously HB 498 (AI use by courts, 2025 session — did not advance).