Building AI Governance, Monitoring Shadow AI in Tennessee - GovTech

Doubling down is a phrase from the casino floor, which is fitting, because Tennessee CIO Kristin Darby went to the NASCIO Annual Conference to announce a wager: the state is implementing electronic monitoring of AI activities and calling it governance. Doubling down is what you do when the first hand hasn't gone your way, and the house here is a workforce that has spent two years quietly pasting contracts into chatbots. Note what isn't being regulated — the vendors who built the models — only the people typing into them, which is cheaper and polls considerably better. 'Shadow AI,' the headline's sinister noun, turns out to mean staff using tools nobody signed off on, and the state's answer to that is a dashboard.

Darby says maintaining safety is 'an absolute priority' and that without monitoring the state is not able to guarantee it. Absolute priorities in state government have the shelf life of a budget cycle, but take it at face value: the guarantee of safety now rests on somebody in Nashville reading an activity log. No statute, no procurement figure, no list of banned tools appears in the excerpt — just a commitment to watching, delivered at a conference, which is where governance goes when legislation won't. And legislation won't: as the Brennan Center explained when we covered the FRONTIER Act, Congress is currently trying to stop states from regulating AI developers at all. Tennessee gets to monitor its own typists.

So the shape of AI accountability in Tennessee is a chief information officer, a monitoring system, and a conference lanyard, promising to guarantee safety in a domain where the vendors who built the models decline to. It isn't nothing: Darby at least names the problem instead of pretending her workforce invented these habits out of malice. They didn't — the tools were sold as productivity, and the invoice now arrives as a log file. Whether 'monitoring' means blocking prompts, flagging them or keeping receipts for the next audit is, per the excerpt, anyone's guess.