{"resourceId":"tennessee-shadow-ai-runtime-monitoring-govtech-20261005","versions":[{"version":"external-651a5f68508ec8d2aec4922d3c727e06daf93934b14e0a1e982a3eab73979413","resource":{"id":"tennessee-shadow-ai-runtime-monitoring-govtech-20261005","title":"Tennessee CIO says the state is adding run-time monitoring to detect and shut off unapproved AI, while a safety chatbot handles a few thousand calls a day","organization":"Tennessee Strategic Technology Solutions (CIO Kristin Darby), as reported by Government Technology","sector":"State enterprise IT / AI governance and resident-facing chatbot","geography":"Tennessee statewide","publishedAt":"2026-10-05","publicationDate":"2026-10-05","eventDate":null,"sourceName":"Government Technology","sourceLabel":"Building AI Governance, Monitoring Shadow AI in Tennessee (GovTech, Oct 5, 2026, video interview at NASCIO Annual Conference)","sourceUrl":"https://www.govtech.com/artificial-intelligence/building-ai-governance-monitoring-shadow-ai-in-tennessee","evidenceClass":"independent-reporting","outcomeClass":"emerging","topics":["governance-procurement","data-security","operating-model","knowledge-work"],"finding":"In an Oct 5 GovTech video interview recorded at last week's NASCIO Annual Conference, Tennessee CIO Kristin Darby says the state has 'doubled down on AI governance.' Enterprise policy requires every AI tool or implementation to go through the governance council and be endorsed by Strategic Technology Solutions (STS), and the state is in the process of implementing electronic policy enforcement and run-time monitoring so it can detect and turn off AI that has not been approved, including shadow AI. Darby also says a Department of Safety and Homeland Security chatbot handles the most common resident queries, currently a few thousand calls a day with a high customer satisfaction rating, and that the state is scaling it to other agencies.","sledRelevance":"Directly relevant to state CIOs: it moves AI governance from a written approval rule to technical enforcement across agencies, which is the step most states with AI policies (98% per NASCIO's survey) have not described publicly. Published Oct 5, after the last run.","evidence":"Opened the GovTech article and its video transcript (curl, UA SLED-research-bot/1.0, BeautifulSoup text extraction). Confirmed the Oct 5 publication date, the STS approval requirement, the run-time monitoring described as in progress, and the chatbot volume and satisfaction claims. The chatbot figures are the CIO's statement; no survey method, baseline or containment rate is given.","architectureImplications":"Detecting shadow AI implies network, endpoint or SaaS telemetry that can identify AI services and agent traffic, plus a way to block them. That needs an authoritative register of approved tools for the monitoring to compare against.","governanceImplications":"Ties approval by the governance council to enforcement: anything not endorsed by STS can be detected and turned off. Darby also cites legislative engagement as part of the governance structure.","securityPrivacyImplications":"Run-time monitoring addresses data leakage through unapproved AI tools, but it also creates monitoring data about employee activity that needs its own retention and access rules. The article gives no detail on tooling or coverage.","caveats":"Interview-based and operator-reported; monitoring is described as being implemented, not completed. Chatbot metrics ('a few thousand calls a day', 'high customer satisfaction') lack method, baseline and error data. No independent evaluation.","streamIds":["state-government"],"roles":{"sales":"The opening point is enforcement, not policy: Tennessee is moving from 'every AI tool must be approved' to monitoring that can find and switch off unapproved AI. Discovery should ask whether a prospect's AI register is complete enough to enforce against, and how long approval takes. A bounded offer is an AI-tool discovery and register baseline. This interview cannot support claims about chatbot savings or that monitoring eliminates shadow AI, since figures are anecdotal and the rollout is unfinished.","engineering":"Technically, this is about detection coverage and an authoritative allowlist. Pair a register of approved AI services with network, identity and SaaS telemetry that can flag AI traffic, including AI features inside approved apps and agent traffic, and route findings to a block or review workflow. Constraint: GovTech gives no tool or coverage detail, so any proof of value should measure what share of known AI use the monitoring actually detects in a test, not assume full visibility.","delivery":"Delivery work is standing up the approve-then-monitor loop: publish the approved-tool list, connect monitoring alerts to the governance council's intake, and define what happens when unapproved use is found. Ownership sits with the state CIO office and CISO, with agency AI leads. Acceptance criteria should be proposed targets such as approval turnaround and detection test rates. Risks are slow approvals driving workarounds and monitoring data being held without clear retention rules."},"roleDetails":{"sales":{"customerProblem":"States have AI approval rules but little way to see or stop AI use that skipped approval.","stakeholders":["State CIO","State CISO","AI governance council","Agency AI leads","Privacy officer"],"discoveryQuestions":["How complete is your register of approved AI tools and embedded AI features?","How do you detect AI use that was never approved?","How long does AI approval take today?","Who decides what happens when shadow AI is found?"],"valueHypothesis":"A complete AI register with detection testing can show how much unapproved AI use exists and shorten the path to approved alternatives.","potentialEngagement":"Four-to-six week AI-use discovery: build the approved-tool register, run a detection test against known AI services, and propose an enforcement workflow.","unsupportedClaims":["That monitoring eliminates shadow AI","That the safety chatbot saved a measured amount of staff time","That Tennessee's approach has been independently evaluated","That high satisfaction means accurate answers"]},"engineering":{"fit":"Governance-to-enforcement work on existing network, identity and SaaS controls rather than a new platform.","architectureIntegration":"Feed an approved-AI register into proxy, CASB or endpoint controls, tag AI service and agent traffic, and send matches to the council's intake queue.","prerequisites":["Authoritative approved-AI register","Network and SaaS telemetry coverage","Enterprise AI policy with enforcement authority","Defined exception process"],"constraints":["No tooling or coverage detail in the source","AI embedded in approved apps is hard to distinguish","Monitoring employee activity raises labor and privacy questions","Agency autonomy differs by state"],"security":"Treat unapproved AI as data-exfiltration risk: block or alert on unknown AI endpoints, log decisions, and restrict monitoring data to security staff with set retention.","proofOfValue":["Detection rate on a seeded test of known AI services","Share of AI use found that maps to the register","Time from detection to decision"]},"delivery":{"work":"Publish the approved-tool register, connect monitoring to council intake, and define detect-review-block steps.","dependencies":["CISO telemetry tooling","Governance council charter","Privacy and HR review of employee monitoring"],"ownership":"State CIO office (STS in Tennessee) with the CISO; agencies own their AI requests.","skillsAdoption":"Agency staff need to know which tools are approved and how to request new ones; security analysts need playbooks for AI findings.","governanceCheckpoints":["Register published and kept current","Monitoring privacy review","Exception and appeal process","Periodic report to the governance council"],"acceptanceCriteria":["Proposed: approval decisions within an agreed number of business days","Proposed: seeded detection test catches most known AI services","Proposed: every blocked tool gets a documented decision"],"risks":["Slow approvals drive workarounds","Incomplete telemetry gives false confidence","Monitoring data misused or over-retained"]}},"retrievedAt":"2026-10-05T22:19:01-05:00","enrichedAt":"2026-10-05T22:19:01-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Darby frames enforcement as a response to employee enthusiasm; states will need clear approved alternatives and training so monitoring does not just push work back to manual processes.","procurementImplications":"An approval-plus-monitoring regime means AI features embedded in existing software also need to be registered and endorsed, which affects how renewals and add-on AI features are bought.","operatingModelImplications":"Central IT becomes the gatekeeper for all AI tools with a council for cross-agency input; agencies need a fast route to approval or shadow use continues.","sourceVerification":{"responseId":"curl-tn-govtech-20261005","openedUrl":"https://www.govtech.com/artificial-intelligence/building-ai-governance-monitoring-shadow-ai-in-tennessee","referenceExcerpt":"getting the electronic monitoring put in place to enable us to detect and turn off anything that hasn't been appropriately approved","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}