AI Regulation Tracker  /  Government and public sector

Kentucky Puts State AI Under a Governance Committee, a Registry, and an Approval Gate

Signed in 2025 and codified at KRS 42.731, Kentucky Senate Bill 4 builds a governance stack for how the Commonwealth buys and runs artificial intelligence. It creates an Artificial Intelligence Governance Committee, a centralized registry of generative and high-risk AI, an approval step before agencies deploy AI, and disclosure of AI use in decisions affecting citizens, with a path to appeal consequential AI decisions.

By Anthony Guerriero  ·  The Leveraged Years Regulatory Research  ·  Published July 20, 2026  ·  Last updated July 20, 2026

Most of the AI laws that get attention aim at private industry. Kentucky pointed Senate Bill 4 at its own government first. The bill, sponsored by Senator Amanda Mays Bledsoe and signed by Governor Andy Beshear on March 24, 2025, sets the terms for how the Commonwealth of Kentucky itself buys, builds, approves, and runs artificial intelligence. The operative duties now live in a new statute, KRS 42.731, whose official heading is "Duties of Artificial Intelligence Governance Committee." That is a narrow-sounding title for a fairly complete governance framework.

The framing in the statute is deliberate. Rather than banning or greenlighting anything, the law directs the state to build responsible, ethical, and transparent procedures for the allowable use, development, and approval of artificial intelligence across state government, and it requires public disclosure of that use. In other words, Kentucky decided that before it lets AI touch citizen-facing decisions, it wants a paper trail, an owner, and an approval step. That is the whole design.

What the law actually sets up

Read past the headline and there are five moving parts, and each one is an operational requirement, not a slogan.

• A governance committee. SB 4 creates the Artificial Intelligence Governance Committee inside the Commonwealth Office of Technology and makes it the body responsible for the state's AI policy standards and guiding principles, with particular attention to generative and high-risk systems.
• A centralized registry. The committee is directed to maintain a central registry of generative and high-risk AI systems used across state government. You cannot govern what you have not inventoried, and the registry is how the Commonwealth learns what AI it is actually running.
• An approval gate. State agencies are expected to route AI through the Office of Technology and the committee's procedures before deploying it. Approval sits in front of deployment, not behind it, which turns AI adoption into a reviewed decision rather than a quiet one.
• Disclosure. The law requires disclosure of AI use, including where AI is involved in decisions that affect citizens. The public gets to know when a government decision had a machine in the loop.
• Human oversight and appeal. Consequential decisions are supposed to keep a human accountable, and the framework provides a route to appeal decisions made with AI. Automation does not become an excuse that closes off recourse.

There is also an election-integrity strand. The bill addresses AI-generated content in political messaging and disclaimers for synthetic video and audio, a piece that drew most of the floor debate. That part is real, but the governance stack for state-agency AI is the durable core, and it is the part that changes how the Commonwealth operates day to day.

Read the status precisely: binding, but on the government

Be exact about what this does and does not do. SB 4 is enacted law, not a consultation or a set of best-practice guidelines, so its duties are binding. But the duties bind the Kentucky state government. This is not a statute that regulates how a private Kentucky business uses AI internally, and it should not be described that way. Its reach is executive-branch agencies, cabinets, programs, and administrative bodies that use the Commonwealth's technology infrastructure, plus the reporting and registry machinery around them.

That distinction matters because it is easy to overstate a law like this in either direction. Anyone who tells you Kentucky now regulates private-sector AI has read the press release, not the statute. Anyone who waves it off as symbolic has missed that a state just imposed a registry, an approval step, disclosure, and an appeal right on its own use of AI, and that these are enforceable duties with reporting deadlines attached. The committee's first report was due December 1, 2025, with annual reports after that, which is how you can tell the framework is meant to keep running rather than sit on a shelf.

Why this reaches beyond Frankfort

A government procurement rule is also a market rule for everyone who sells into that government. If your company licenses an AI product to a Kentucky agency, your system is what has to appear in the registry, clear the approval process, and support the agency's disclosure and appeal obligations. In practice that pushes requirements down your contract: the state cannot document non-discrimination, human oversight, and citizen benefit for a black box it cannot see into. Vendors that can produce model documentation, explain how a decision was reached, and support an appeal workflow will clear Kentucky's gate. Vendors that cannot will stall in it.

Kentucky is also not doing this in isolation. A growing cluster of states is building governance frameworks for public-sector AI, and they rhyme: an inventory or registry, an oversight body, disclosure, and human review of consequential decisions. If you sell AI to state governments, Kentucky's structure is a preview of the compliance surface you will meet in more than one capitol. Building to it once, cleanly, is cheaper than retrofitting it agency by agency.

What this means for US agencies, vendors, and counsel

For a Kentucky agency, the practical work is inventory and process. Know which AI systems you are running, get them into the registry, and do not deploy new AI ahead of the approval procedure the committee sets. Stand up a real human-oversight step for consequential, citizen-facing decisions, and be able to show the disclosure and the appeal path. For a company selling AI to the Commonwealth, treat registry-readiness and explainability as part of the deal, because the agency on the other side of the table now has statutory duties it will flow through to you. For counsel advising either side, KRS 42.731 is the section to read, and the questions to work through are who owns approval, what triggers disclosure, and how an appeal of an AI-assisted decision actually runs. None of this is exotic. It is governance hygiene that a statute has now made mandatory for the party that adopts the AI.

Browse the full AI Regulation News tracker

Informational analysis for working professionals, not legal advice. Confirm how KRS 42.731 or any Kentucky requirement applies to your situation with qualified counsel.