Kentucky — Federal AI Profile + State AI Laws (HB 207 AI-CSAM 2024; SB 4 election synthetic-media disclosure 2025) + DOI Bulletin 2024-02 Insurer AI Systems (NAIC model) + Bulletin 2026-01 imagery AI + KRS 304.17A-607 physician-only utilization review: AI Compliance Requirements

Kentucky HB 207 (2024 Regular Session, signed by Gov. Andy Beshear March 28, 2024; effective July 15, 2024) amended KRS Chapter 531 (Pornography) to add "digitization" — a computer- or AI-generated visual depiction of a child engaged in sexually explicit conduct, including a depiction that uses a real, identifiable child as the source — to Kentucky's felony child-exploitation offenses, and separately criminalized child sex dolls. Producing, possessing, importing, promoting, or trafficking such AI-generated material is a felony. Binds individuals and any business or platform that creates or distributes such material in Kentucky. (The child-sex-doll provision is under constitutional challenge in an April 2026 Union County case; the Attorney General is defending and the law remains in force.) Counsel should confirm the exact KRS 531 "digitization" definition/section, the felony class and sentencing, and the effective date against the enacted text.

FTC Act § 5 applies to all Kentucky businesses using AI. Ensure AI chatbots disclose their nature, AI-generated marketing claims are truthful, and AI pricing systems do not engage in unfair practices. Kentucky Attorney General is active in consumer protection enforcement under Kentucky Consumer Protection Act (KRS § 367.170).

Kentucky's auto manufacturing sector (Toyota, Ford, GM) and logistics companies (UPS, Amazon) use AI for hiring, scheduling, worker monitoring, and safety. EEOC May 2023 guidance requires employers to test AI employment tools for disparate impact. Toyota Georgetown and Ford Louisville must ensure AI worker monitoring does not have discriminatory scheduling or performance effects. Mobley v. Workday, Inc. (N.D. Cal. Case No. 3:23-cv-00770-RFL — a private collective/class action; core claims allowed to proceed to trial per a 2026-06-22 ruling) illustrates vendor AI-screening liability.

NLRB GC Memo 23-02 (Oct. 2022) establishes that employers must bargain with unions before implementing AI monitoring, algorithmic performance management, or AI-driven scheduling systems for unionized workers. Kentucky's UAW-represented auto plants (Ford Louisville, General Motors) must negotiate with unions before deploying AI management systems. Failure to bargain is an unfair labor practice under NLRA § 8(a)(5).

On April 16, 2024 Kentucky Insurance Commissioner Sharon P. Clark issued Bulletin 2024-02, "The Use of Artificial Intelligence Systems in the Business of Insurance", to "ALL INSURERS LICENSED TO DO BUSINESS IN KENTUCKY", effective immediately ("This bulletin shall take immediate effect"). Its stated purpose is to remind all Insurers holding certificates of authority that decisions or actions impacting consumers made or supported by advanced analytical and computational technologies, including AI Systems, must comply with all applicable insurance laws and regulations — including but not limited to those addressing unfair trade practices and unfair discrimination — and to advise Insurers of the information and documentation the Department may request during an investigation or examination of an Insurer regarding its use of such technologies. Section 3 asks Insurers to adopt and implement controls specifically related to their use of AI designed to mitigate the risk of Adverse Consumer Outcomes, and states that "the Department strongly urges that all Insurers authorized to do business in the Commonwealth develop, implement, and maintain a written program (an 'AIS Program') for the responsible use of AI Systems that makes, or supports decisions related to regulated insurance practices. The AIS Program would ideally be designed to mitigate the risk of Adverse Consumer Outcomes, including, at a minimum, the statutory provisions set forth in Section 1 of this bulletin." READ THE NORMATIVITY CAREFULLY BEFORE ADVISING A CLIENT: Kentucky's § 1.0 lead-in is "The Department recommends the following, NON-BINDING guidelines be considered by Insurers" — language the NAIC model bulletin does not contain anywhere, and which replaces the model's flat statement that Insurers "are expected to" maintain the program. The AIS Program guidelines themselves track the model: the Program should be designed to mitigate the risk that the Insurer's use of an AI System will result in Adverse Consumer Outcomes (§ 1.1); should address governance, risk management controls, and internal audit functions (§ 1.2); should vest responsibility for development, implementation, monitoring and oversight, and for setting the Insurer's AI strategy, with senior management accountable to the board or an appropriate board committee (§ 1.3); should be tailored to and proportionate with the Insurer's use of and reliance on AI, with the scope of controls for a given use case reflecting the Degree of Potential Harm to Consumers (§ 1.4); may be independent of or part of the existing Enterprise Risk Management programme and may adopt, incorporate or rely upon a third-party standard framework such as the NIST Artificial Intelligence Risk Management Framework, Version 1.0 (§ 1.5); should address AI use across the insurance life cycle including product development and design, marketing, use, underwriting, rating and pricing, case management, claim administration and payment, and fraud detection (§ 1.6); should address all phases of an AI System life cycle — design, development, validation, implementation (both systems and business), use, ongoing monitoring, updating and retirement (§ 1.7); should address AI Systems used for regulated insurance practices whether developed by the Insurer or a third-party vendor (§ 1.8); and should include processes and procedures to provide NOTICE to impacted consumers that AI Systems are in use and to provide access to appropriate levels of information based on the phase of the insurance life cycle in which the AI Systems are being used (§ 1.9). Section 2 defines the operative terms: "Adverse Consumer Outcome", "Algorithm", "AI System", "Artificial Intelligence (AI)", "Degree of Potential Harm to Consumers", "Generative Artificial Intelligence", "Machine Learning (ML)", "Model Drift", "Predictive Model", and "Third Party". The Department also recognises the NAIC Principles of Artificial Intelligence adopted in 2020 as an appropriate source of guidance.

Section 2.0 of Bulletin 2024-02 asks that an Insurer's AIS Program include a governance framework for the oversight of AI Systems, which "would ideally prioritize transparency, fairness, and accountability in the design and implementation of the AI Systems, recognizing that proprietary and trade secret information must be protected". An Insurer may adopt new internal governance structures or rely on existing ones, but the Department recommends the framework address: the policies, processes and procedures — including risk management and internal controls — to be followed at each stage of an AI System life cycle from proposed development to retirement (§ 2.1); the requirements the Insurer adopts to DOCUMENT compliance with the AIS Program's policies, processes, procedures and standards, developed with Section 4 of the bulletin in mind (§ 2.2); and the internal AI System governance accountability structure (§ 2.3), namely (a) the formation of centralized, federated or otherwise constituted committees comprising representatives from business units, product specialists, actuarial, data science and analytics, underwriting, claims, compliance and legal, (b) scope of responsibility and authority, chains of command and decisional hierarchies, (c) the INDEPENDENCE of decision-makers and lines of defense at successive stages of the AI System life cycle, (d) monitoring, auditing, escalation and reporting protocols and requirements, and (e) development and implementation of ongoing training and supervision of personnel. Section 2.4 adds a Predictive-Model-specific duty: processes and procedures for designing, developing, verifying, deploying, using, updating and monitoring Predictive Models, including a description of the methods used to detect and address errors, performance issues, outliers, or unfair discrimination in the insurance practices resulting from use of the Predictive Model. Section 3.0 asks the Program to document the Insurer's risk identification, mitigation and management framework and internal controls for AI Systems generally and at each life-cycle stage, addressing: the oversight and approval process for development, adoption or acquisition of AI Systems, and identification of constraints and controls on automation and design to align and balance function with risk (§ 3.1); data practices and accountability procedures including data currency, lineage, quality, integrity, bias analysis and minimization, and suitability (§ 3.2); management and oversight of Predictive Models including algorithms used therein — inventories and descriptions, detailed development-and-use documentation, and assessments such as interpretability, repeatability, robustness, regular tuning, reproducibility, traceability, model drift and the auditability of these measurements where appropriate (§ 3.3); validating, testing and RETESTING as necessary to assess the generalization of AI System outputs upon implementation, including the suitability of the data used to develop, train, validate and audit the model, where validation may take the form of comparing model performance on unseen data available at the time of model development to performance observed post-implementation, or measuring performance against expert review (§ 3.4); protection of non-public information, particularly consumer information, including unauthorized access to the Predictive Models themselves (§ 3.5); data and record retention (§ 3.6); and a narrative description of the model's intended goals and objectives and how the model is developed and validated to ensure the AI Systems relying on it correctly and efficiently predict or implement those goals (§ 3.7). Section 4.0 covers third-party AI Systems and data: the Program should address the Insurer's process for acquiring, using or relying on (i) third-party data to develop AI Systems and (ii) AI Systems developed by a third party, which may include standards, policies, procedures and protocols for due diligence and the methods employed to assess the third party and its data or AI Systems, so that decisions made or supported from those AI Systems which could lead to Adverse Consumer Outcomes will meet the legal standards imposed on the Insurer itself (§ 4.1); where appropriate and available, contract terms that provide audit rights and/or entitle the Insurer to receive audit reports by qualified auditing entities, and that require the third party to cooperate with the Insurer regarding regulatory inquiries and investigations related to the Insurer's use of the third party's product or services (§ 4.2); and the performance of those contractual rights regarding audits and other activities to confirm the third party's compliance with contractual and, where applicable, regulatory requirements (§ 4.3).

Section 4 of Bulletin 2024-02 sets out what the Department may request in an AI-focused investigation or market conduct action. It states that regardless of the existence or scope of a written AI Systems Program, an Insurer "can expect to be asked about its development, deployment, and use of AI Systems, or any specific Predictive Model, AI System or application and its outcomes (including Adverse Consumer Outcomes) from the use of those AI Systems, as well as any other information or documentation deemed relevant by the Department", and that inquiries should be expected to include the Insurer's governance framework, risk management, and internal controls. The enumerated production list is: (1.1) information and documentation related to or evidencing the AIS Program — "assuming the Insurer has implemented such a program in accordance with Department recommendations" — including (a) the written AIS Program, (b) documentation evidencing its adoption, (c) its scope including any AI Systems and technologies NOT included in or addressed by it, (d) how it is tailored to and proportionate with the Insurer's use and reliance on AI Systems, the risk of Adverse Consumer Outcomes and the Degree of Potential Harm to Consumers, and (e) the policies, procedures, guidance, training materials and other information relating to adoption, implementation, maintenance, monitoring and oversight — specifically (i) processes and procedures for development, adoption or acquisition of AI Systems, covering (1) identification of constraints and controls on automation and design and (2) data governance and controls including data lineage, quality, integrity, bias analysis and minimization, suitability, and Data Currency; (ii) processes and procedures for management and oversight of Predictive Models including measurements, standards or thresholds used in development, validation and oversight; and (iii) protection of non-public information including unauthorized access to Predictive Models themselves. (1.2) Information and documentation relating to the Insurer's pre-acquisition/pre-use diligence, monitoring, oversight and auditing of data or AI Systems developed by a third party. (1.3) Information evidencing implementation of and compliance with the AIS Program, including monitoring and audit activities: (a) documentation of the formation and ongoing operation of coordinating bodies for development, use and oversight of AI Systems; (b) documentation of data practices and accountability procedures; (c) management and oversight of Predictive Models and AI Systems, including (i) the Insurer's INVENTORIES and descriptions of Predictive Models and AI Systems used to make or support decisions that can result in Adverse Consumer Outcomes, and (ii) as to any specific model under investigation, (1) documentation of compliance with all applicable AI Program policies, protocols and procedures, (2) information about the data used in development and oversight including source, provenance, lineage, quality, integrity, bias analysis and minimization, suitability and Data Currency, and (3) information on the techniques, measurements, thresholds and similar controls used; and (d) documentation of validation, testing and auditing including evaluation of Model Drift to assess the reliability of outputs, reflective of whether the AI System is based on Predictive Models or Generative AI. Section 4's part 2 adds, where the investigation concerns third-party data or models: (2.1) due diligence conducted on third parties and their data, models or AI Systems; (2.2) the contracts themselves, including terms on representations, warranties, data security and privacy, data sourcing, intellectual property rights, confidentiality and disclosures, and cooperation with regulators; (2.3) audits and confirmation processes performed regarding third-party compliance; and (2.4) documentation of validation, testing and auditing including evaluation of Model Drift. The bulletin closes by noting that investigations and market conduct actions may use procedures varying in nature, extent and timing per regulatory judgment, may include any of the continuum of market actions described in the NAIC Market Regulation Handbook, and may involve contracted specialists with relevant subject-matter expertise.

Kentucky has enacted NO artificial-intelligence-specific utilization-review or prior-authorization statute — but the general utilization-review statute constrains automated denial more tightly than many AI-specific acts do, and it is the provision to advise on. KRS 304.17A-607, as amended by 2026 Ky. Acts ch. 45 sec. 26 (HB 527) and 2025 Ky. Acts ch. 146 sec. 5 (HB 662) and effective July 15, 2026, provides that an insurer or private review agent "shall not provide or perform utilization reviews without being registered with the department" (subsection (1)), and that a registered insurer or private review agent shall "(b) Ensure that for the provision of utilization review services, ONLY LICENSED PHYSICIANS, who are of the same or similar specialty and subspecialty, when possible, as the ordering provider, shall: 1. Make a utilization review decision to: a. Deny, reduce, limit, or terminate a health care benefit; or b. Deny, or reduce payment for, a health care service because that service is not medically necessary, experimental, or investigational; except in the case of a health care service rendered by a chiropractor or optometrist where the denial shall be made respectively by a chiropractor or optometrist duly licensed in Kentucky; and 2. Supervise qualified personnel conducting case reviews" (subsection (2)(b)). An AI System may therefore assist, triage, or surface information, but the adverse determination itself must be made by a same-or-similar-specialty licensed physician, and any qualified personnel conducting case reviews must be under that physician's supervision. TIMEFRAMES, from subsection (2)(i): a utilization review decision concerning URGENT health care services must be rendered and notified "no later than twenty-four (24) hours after obtaining all necessary information"; a decision on NONURGENT health care services within "five (5) days of obtaining all necessary information". "Necessary information" is statutorily limited to the results of any face-to-face clinical evaluation, any second opinion that may be required, and any other information the department determines necessary. DEEMED APPROVAL, subsection (3)(a): "The insurer's or private review agent's failure to make a determination and provide written notice within the time frames set forth in this section shall be DEEMED TO BE A PRIOR AUTHORIZATION for the health care services or benefits subject to the review", unless the failure results from circumstances documented to be beyond the insurer's control (subsection (3)(b)). NOTICE CONTENT, subsection (2)(j)3: a denial of a step therapy exception or of coverage, or a reduction in payment, for a treatment, procedure, drug requiring prior approval or device must state the specific medical and scientific reasons for the denial or the schedule-of-benefits/exclusions provision relied on, "the title of the reviewer making the decision, except that a written notice provided to a provider shall also include, if applicable, the medical license number of the reviewer making the decision", a description of alternative covered benefits (except on retrospective review), and instructions for the internal appeal under KRS 304.17A-617. CHANGE CONTROL, subsection (4): an insurer or private review agent shall submit a copy of any changes to its utilization review policies or procedures to the department, and "No change to utilization review policies and procedures shall be effective or used until after it has been filed with and APPROVED BY THE COMMISSIONER" — the practical consequence being that introducing an AI tool into the UR workflow is a policy/procedure change requiring prior departmental approval, not merely internal governance. DIRECTION OF TRAVEL, recorded because it cuts against the national trend: 2025 HB 662 (Acts ch. 146, effective June 27, 2025) REMOVED human-identification safeguards rather than adding them — per the Department's own Bulletin 2025-02, it amended KRS 304.17A-545 to delete the requirement that the medical director of a managed care plan sign a denial of a service, and amended KRS 304.17A-617 and KRS 304.17A-607 to delete the requirement that determination letters carry the medical license number of the person making the determination, retaining it only for letters sent to a provider. Separately, 2026 HB 527 (Acts ch. 45, effective July 15, 2026) replaced the standalone definition of "adverse determination" in KRS 304.17A-600(1) with the meaning given in 29 C.F.R. sec. 2560.503-1, so the trigger for the whole appeals apparatus is now set by the federal ERISA claims-procedure regulation.

Kentucky SB 4 (2025 Regular Session, signed by Gov. Andy Beshear March 24, 2025) creates a civil cause of action against any individual or organization that uses "synthetic media" — audio or video substantially generated or altered by AI to depict a real person — in electioneering communications without transparent disclosure that artificial intelligence was used. The law does not ban synthetic media; it requires disclosure. Remedies include injunctions and damages, with exceptions for media that clearly signals its synthetic nature (satire, parody, journalism). Platforms/social-media companies are generally not liable unless they sponsored the electioneering communication. Any campaign, committee, or person distributing AI-generated/altered political audio or video in Kentucky must include the disclosure. (SB 4 also establishes a government-only AI governance framework for state agencies via the Commonwealth Office of Technology — that part does not bind private businesses.) Counsel should confirm the exact election-code section, the covered-communication definition and any pre-election timing window, and the effective date against the enacted text.

Kentucky financial institutions and auto finance companies (Toyota Financial Services, Ford Motor Credit) using AI for credit decisions must comply with FCRA adverse action notice requirements. CFPB Circular 2022-03 confirms that "model output" is not sufficient — lenders must provide specific reasons from the consumer's own credit file when AI denies or limits credit.

Monitor legislature.ky.gov for AI bills. Kentucky meets annually starting in January. Kentucky's manufacturing base and healthcare sector make AI employment and health AI legislation likely in 2025-2027 sessions.

Kentucky's only post-instrument AI guidance, and the one document that applies Bulletin 2024-02 to a concrete use case. On March 11, 2026 Commissioner Sharon P. Clark issued Bulletin 2026-01 to "ALL PROPERTY & CASUALTY INSURANCE COMPANIES AUTHORIZED TO TRANSACT BUSINESS IN THE COMMONWEALTH OF KENTUCKY", advising them of the legal requirements and limitations that apply to cancellation, nonrenewal and claim settlement actions based on issues discovered through (1) satellite imagery and (2) aerial imagery — defined in its own footnote as images captured from a spaceborne platform and from an airborne platform such as an aircraft or drone respectively. The operative rules are: SATELLITE imagery alone cannot reasonably justify denial of a property damage claim because such images "by themselves fail to capture 'all available information' relevant to a claim", nor can it alone justify cancellation or nonrenewal under KRS 304.20-320 without further investigation — "an insurer may not rely on satellite imagery as the SOLE basis for cancellation, nonrenewal, or claim denial", and satellite imagery may not be used as a basis for cancellation or nonrenewal solely in conjunction with any reason identified in KRS 304.20-340 that also may not be used as a sole basis; insurers may use satellite imagery as a tool to identify property degradation or damage but "must conduct further investigation to validate any suspected issues discovered from the use of satellite data". AERIAL images may generally be used as a basis for cancellation, nonrenewal or claim denial only if all three conditions hold: (1) the images are sufficiently clear to allow an individual to visualize the specific property conditions that are noncompliant with the insurer's underwriting guidelines; (2) the images are accompanied by a written summary which clearly identifies the specific noncompliant property conditions; and (3) the images contain a date stamp showing they were taken within the last 12 months. Low-resolution, out-of-focus, blurry or dated aerial images cannot be used to justify an adverse action. Both satellite and aerial images of a roof displaying streaking or discoloration are not sufficient to independently support cancellation, nonrenewal or claim denial based on roof degradation. An insured is entitled to review all satellite and aerial images relied upon by an insurer to support a cancellation, nonrenewal or claim denial, and on a complaint contesting an adverse action the insurer may be required to show independent confirmation of any issue discovered through satellite imagery. THE AI HOOK, in the bulletin's own words: "In addition to the above, insurers using artificial intelligence programs to enhance, interpret, or otherwise review satellite or aerial images should familiarize themselves with the requirements set forth in Bulletin 2024-02 regarding the use of artificial intelligence systems in insurance." Note the header line, which is more explicit than Bulletin 2024-02's: "The Bulletin is not legally binding on either the Department or the reader."

Kentucky enacted a gold-carding statute in the 2026 Regular Session: HB 176, "An Act Relating to Prior Authorization" (2026 Ky. Acts ch. 102). Per the Kentucky Department of Insurance's own Bulletin 2026-05, the Act requires an insurer that issues a health benefit plan to OFFER a programme under which a participating provider may qualify for an exemption from any prior authorization requirements for a particular service, and provides that the insurer shall not require a covered person or participating provider to obtain prior authorization for a service if, when the health care service is provided, the provider meets the programme requirements for an exemption. The programme SHALL: (1) provide the prior authorization exemption for a period established by the insurer based on a previous evaluation period in which the provider met the programme terms and conditions; (2) NOT condition participation upon a provider exceeding a 93% approval rate for prior authorization requests submitted during the evaluation period; (3) require the insurer to evaluate annually whether a provider qualifies for an exemption for a particular service; (4) require the insurer to notify each participating provider within thirty (30) days after conducting an annual evaluation whether or not the provider meets the exemption requirements; and (5) require the insurer to make the programme requirements available to a provider during the contracting process. The programme MAY, among other things, offer an exemption for any prescription drug; offer an exemption to a provider group covering all providers practising within the group; condition participation on the provider entering into a value-based care agreement; require a minimum period as a participating provider; require compliance with interoperability standards and an electronic health record access agreement; condition participation on a utilization requirement for the service; and provide that the insurer may revoke participation for fraud or where the provider's utilization of the service exceeds an established maximum utilization rate. Where a provider meets the programme standards the insurer shall send a notice confirming eligibility together with a list of each health care service for which the provider meets the exemption. The Act also requires the Department to report to the Interim Joint Committee on Banking and Insurance no later than September 30 of each year on implementation, the number of insurers offering an exemption programme, and the number of participating providers by provider group, specialty and county. This is a gold-carding statute, NOT an AI-in-utilization-review statute — it contains no artificial-intelligence, algorithm or automated-decision language — but it is directly relevant to any AI-assisted prior-authorization workflow, because the 93% approval-rate ceiling on eligibility criteria and the mandatory annual evaluation both constrain how an insurer may use model-derived provider scoring to gate exemptions.