Kentucky Revised Statutes Title VI. Financial Administration § 42.731.Duties of Artificial Intelligence Governance Committee; duties of Commonwealth Office of Technology regarding artificial intelligence systems; establishment of policies and operating standards on use of artificial intelligence by state agencies; report; administrative regulations

(a) Developing policy standards and guiding principles to mitigate risks and protect data and privacy of Kentucky citizens and businesses that adhere to the latest version of Standard ISO/IEC 42001 of the International Organization for Standardization;

(b) Establishing technology standards to provide protocols and requirements for the use of generative artificial intelligence and high-risk artificial intelligence systems;

(c) Ensuring transparency in the use of artificial intelligence systems;

(d) Maintaining a centralized registry to include current inventory of generative artificial intelligence systems and high-risk artificial intelligence systems; and

(e) Developing an approval process to include a registry of application, use case, and decision rationale aimed at mitigation of risks.

(a) Verify the use and development of generative artificial intelligence systems and high-risk artificial intelligence systems; and

(b) Act in compliance with responsible, ethical, and transparent procedures to implement the use of artificial intelligence technologies by:

(a) Allow only the use of necessary data in artificial intelligence systems;

(b) Do not allow unrestricted access to personal data controlled by the Commonwealth; and

(c) Secure all data and implement a timeframe for data retention.

(a) How the artificial intelligence system will not result in unlawful discrimination against any individual or group of individuals;

(b) How the use of generative artificial intelligence or other artificial intelligence capabilities will benefit the citizens of the Commonwealth and serve the objectives of the department or agency;

(c) To what extent oversight and human interaction of the artificial intelligence system should be required;

(d) The potential risks, including cybersecurity, data protection and privacy, and health and safety of individuals and businesses, and a mitigation strategy to any identified or potential risk; and

(e) The proper control and management for all data possessed by the Commonwealth to maintain security and data quality.

(6)(a) A department, agency, or administrative body shall disclose to the public, through a clear and conspicuous disclaimer, when generative artificial intelligence, artificial intelligence systems, or other artificial intelligence-related capabilities are used:

(b) When an artificial intelligence system makes external decisions related to citizens of the Commonwealth, a department, agency, or administrative body shall:

(c) Any disclaimer under paragraph (a) of this subsection shall also provide information regarding third-party artificial intelligence products or programs, including but not limited to information as to how the high-risk artificial intelligence system or generative artificial intelligence system works, such as system cards or other documented information provided by developers.

(8)(a) Operating standards for utilization of high-risk artificial intelligence systems shall prohibit the use of a high-risk artificial intelligence system to render a consequential decision without the design and implementation of a risk management policy and program for high-risk artificial intelligence systems. The risk management policy shall:

(b) Each risk management policy designed and implemented shall at a minimum adhere to the latest version of Standard ISO/IEC 42001 of the International Organization for Standardization or another national or internationally recognized risk management framework for artificial intelligence systems, and consider the:

(11)(a) The Commonwealth Office of Technology shall transmit reports to the Legislative Research Commission and the Interim Joint Committee on State Government by December 1, 2025, and annually every year thereafter. The reports shall include:

(b) To facilitate the report in paragraph (a) of this subsection, the Commonwealth Office of Technology shall receive from each department, agency, and administrative body a report examining and identifying potential use cases for the deployment of generative artificial intelligence systems and high-risk artificial intelligence systems, including a description of the benefits and risks to individuals, communities, government, and government employees.