From the State Government edition of October 5, 2026
Tennessee CIO says the state is adding run-time monitoring to detect and shut off unapproved AI, while a safety chatbot handles a few thousand calls a day
Tennessee Strategic Technology Solutions (CIO Kristin Darby), as reported by Government Technology · State enterprise IT / AI governance and resident-facing chatbot · Tennessee statewide
- Publisher
- Government Technology
- Original publication
- 2026-10-05
- Source retrieved
- 2026-10-06
What happened
In an Oct 5 GovTech video interview recorded at last week's NASCIO Annual Conference, Tennessee CIO Kristin Darby says the state has 'doubled down on AI governance.' Enterprise policy requires every AI tool or implementation to go through the governance council and be endorsed by Strategic Technology Solutions (STS), and the state is in the process of implementing electronic policy enforcement and run-time monitoring so it can detect and turn off AI that has not been approved, including shadow AI. Darby also says a Department of Safety and Homeland Security chatbot handles the most common resident queries, currently a few thousand calls a day with a high customer satisfaction rating, and that the state is scaling it to other agencies.
Why it matters
Directly relevant to state CIOs: it moves AI governance from a written approval rule to technical enforcement across agencies, which is the step most states with AI policies (98% per NASCIO's survey) have not described publicly. Published Oct 5, after the last run.
Evidence and measured results
Opened the GovTech article and its video transcript (curl, UA SLED-research-bot/1.0, BeautifulSoup text extraction). Confirmed the Oct 5 publication date, the STS approval requirement, the run-time monitoring described as in progress, and the chatbot volume and satisfaction claims. The chatbot figures are the CIO's statement; no survey method, baseline or containment rate is given.
Limitations and uncertainty
Interview-based and operator-reported; monitoring is described as being implemented, not completed. Chatbot metrics ('a few thousand calls a day', 'high customer satisfaction') lack method, baseline and error data. No independent evaluation.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-05; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- States have AI approval rules but little way to see or stop AI use that skipped approval.
- Stakeholders
- State CIO
- State CISO
- AI governance council
- Agency AI leads
- Privacy officer
- Discovery questions
- How complete is your register of approved AI tools and embedded AI features?
- How do you detect AI use that was never approved?
- How long does AI approval take today?
- Who decides what happens when shadow AI is found?
- Value hypothesis
- A complete AI register with detection testing can show how much unapproved AI use exists and shorten the path to approved alternatives.
- Potential engagement
- Four-to-six week AI-use discovery: build the approved-tool register, run a detection test against known AI services, and propose an enforcement workflow.
- Unsupported claims
- That monitoring eliminates shadow AI
- That the safety chatbot saved a measured amount of staff time
- That Tennessee's approach has been independently evaluated
- That high satisfaction means accurate answers
Pre-sales engineering
Role takeaway
- Fit
- Governance-to-enforcement work on existing network, identity and SaaS controls rather than a new platform.
- Architecture and integration
- Feed an approved-AI register into proxy, CASB or endpoint controls, tag AI service and agent traffic, and send matches to the council's intake queue.
- Prerequisites
- Authoritative approved-AI register
- Network and SaaS telemetry coverage
- Enterprise AI policy with enforcement authority
- Defined exception process
- Constraints
- No tooling or coverage detail in the source
- AI embedded in approved apps is hard to distinguish
- Monitoring employee activity raises labor and privacy questions
- Agency autonomy differs by state
- Security
- Treat unapproved AI as data-exfiltration risk: block or alert on unknown AI endpoints, log decisions, and restrict monitoring data to security staff with set retention.
- Proof of value
- Detection rate on a seeded test of known AI services
- Share of AI use found that maps to the register
- Time from detection to decision
Delivery
Role takeaway
- Work
- Publish the approved-tool register, connect monitoring to council intake, and define detect-review-block steps.
- Dependencies
- CISO telemetry tooling
- Governance council charter
- Privacy and HR review of employee monitoring
- Ownership
- State CIO office (STS in Tennessee) with the CISO; agencies own their AI requests.
- Skills and adoption
- Agency staff need to know which tools are approved and how to request new ones; security analysts need playbooks for AI findings.
- Governance checkpoints
- Register published and kept current
- Monitoring privacy review
- Exception and appeal process
- Periodic report to the governance council
- Acceptance criteria
- Proposed: approval decisions within an agreed number of business days
- Proposed: seeded detection test catches most known AI services
- Proposed: every blocked tool gets a documented decision
- Risks
- Slow approvals drive workarounds
- Incomplete telemetry gives false confidence
- Monitoring data misused or over-retained
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Detecting shadow AI implies network, endpoint or SaaS telemetry that can identify AI services and agent traffic, plus a way to block them. That needs an authoritative register of approved tools for the monitoring to compare against.
Governance
Who approves, reviews and stays accountable for outcomes?
Ties approval by the governance council to enforcement: anything not endorsed by STS can be detected and turned off. Darby also cites legislative engagement as part of the governance structure.
Security and privacy
What data, permissions and controls need testing?
Run-time monitoring addresses data leakage through unapproved AI tools, but it also creates monitoring data about employee activity that needs its own retention and access rules. The article gives no detail on tooling or coverage.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Darby frames enforcement as a response to employee enthusiasm; states will need clear approved alternatives and training so monitoring does not just push work back to manual processes.
Procurement
What should contracts, pricing and exit terms secure?
An approval-plus-monitoring regime means AI features embedded in existing software also need to be registered and endorsed, which affects how renewals and add-on AI features are bought.
Operating model
Which teams own the service once it runs?
Central IT becomes the gatekeeper for all AI tools with a council for cross-agency input; agencies need a fast route to approval or shadow use continues.
Publication history
- 2026-10-05State Government · Issue 305 resources
Stable resource ID: tennessee-shadow-ai-runtime-monitoring-govtech-20261005