State & Local GovernmentIssue 305 records
State Government
Tonight's edition is about how states check and enforce AI rules. Tennessee's CIO told GovTech on Oct 5 that every AI tool needs central approval and that the state is adding run-time monitoring to detect and shut off unapproved AI; a safety department chatbot reportedly handles a few thousand calls a day. Utah's AI policy office, expanding its sandbox into clinical care on Oct 5, signed six independent evaluators so pilot results don't rest on company self-reports, while saying an attestation receipt proves only that a check ran and that it hasn't decided which decisions AI should never make. In Vermont, the legislators' Sep 24 memo and the attached Anthropic form show an agreement silent on source-code retention and training, with liability capped at the greater of $1,000 or fees paid. At the Sep 30 hearing the digital services secretary said only test code was shared and that future free trials will get full contract review. Her written answers are due Oct 7. Two patterns follow: states want records they can check rather than assurances, and approval rules need something that enforces them.
- Evidence records
- 5
- Cross-source patterns
- 2
- Evidence classes
- 3 independent reporting1 standards or public-body guidance1 government evaluation
- Outcomes
- 3 emerging1 cautionary1 mixed
- Source freshness
- 5 new this fortnight
- Research completed
- 2026-10-06
Choose a role to see its takeaway beside every record in the ledger.
Patterns across the evidence
Synthesis · Lighthouse Advisory interpretation
States are asking for records they can check instead of assurances
Utah's AI policy office says it won't rely on company self-reports and has signed six independent evaluators who can audit samples of a pilot's real activity, while noting that an attestation receipt shows only that a check ran. In Vermont, the oversight memo responds to ADS's statement that it follows NIST practices by asking for the dated pre-deployment risk assessment, the executed agreement and the approvals, and the hearing account shows the secretary describing test-code-only use while lawmakers ask for paperwork to confirm it. Both cases treat a document an outsider can examine as the evidence, rather than the operator's description.
Operating questionFor each AI tool or pilot you run or permit, which document would an outside reviewer use to confirm your description of what it does and what data it touches?
Supporting evidenceUtah Department of Commerce, Office of Artificial Intelligence PolicyVermont General Assembly (Sen. Rob Plunkett, Rep. Laura Sibilia, Rep. Monique Priestley) to the Agency of Digital ServicesVermont Agency of Digital Services and Joint Information Technology Oversight Committee (reported by Compass Vermont)
An AI approval rule only works when something enforces it
Tennessee requires every AI tool to be endorsed by its central IT agency and is adding run-time monitoring so it can detect and turn off AI that skipped approval. Vermont's free Anthropic trial bypassed full contract review because ADS didn't treat it as a procurement, and the administration has now committed to route future trials through that review and list them on the AI inventory. Utah keeps start, continue and stop authority over sandbox pilots and makes a false evaluator certification grounds to pause or end one. In each case, a written approval rule needed a mechanism, whether monitoring, contract review or stop authority, to actually apply.
Operating questionIf an agency started using an AI tool tomorrow without approval, including a free trial, how would you find out and what would happen next?
Supporting evidenceTennessee Strategic Technology Solutions (CIO Kristin Darby), as reported by Government TechnologyVermont Agency of Digital Services and Joint Information Technology Oversight Committee (reported by Compass Vermont)Utah Department of Commerce, Office of Artificial Intelligence Policy
Evidence ledger
Full record · every source keeps its link and limitations
Tennessee CIO says the state is adding run-time monitoring to detect and shut off unapproved AI, while a safety chatbot handles a few thousand calls a day
In an Oct 5 GovTech video interview recorded at last week's NASCIO Annual Conference, Tennessee CIO Kristin Darby says the state has 'doubled down on AI governance.' Enterprise policy requires every AI tool or implementation to go through the governance council and be endorsed by Strategic Technology Solutions (STS), and the state is in the process of implementing electronic policy enforcement and run-time monitoring so it can detect and turn off AI that has not been approved, including shadow AI. Darby also says a Department of Safety and Homeland Security chatbot handles the most common resident queries, currently a few thousand calls a day with a high customer satisfaction rating, and that the state is scaling it to other agencies.
Why it matters, evidence and limitations
- Why it matters
- Directly relevant to state CIOs: it moves AI governance from a written approval rule to technical enforcement across agencies, which is the step most states with AI policies (98% per NASCIO's survey) have not described publicly. Published Oct 5, after the last run.
- Evidence and measured results
- Opened the GovTech article and its video transcript (curl, UA SLED-research-bot/1.0, BeautifulSoup text extraction). Confirmed the Oct 5 publication date, the STS approval requirement, the run-time monitoring described as in progress, and the chatbot volume and satisfaction claims. The chatbot figures are the CIO's statement; no survey method, baseline or containment rate is given.
- Limitations and uncertainty
- Interview-based and operator-reported; monitoring is described as being implemented, not completed. Chatbot metrics ('a few thousand calls a day', 'high customer satisfaction') lack method, baseline and error data. No independent evaluation.
Utah's AI policy office signs six independent evaluators so pilot results don't rest on company self-reports, and says attestation receipts prove only that a check ran
Utah's Office of AI Policy says companies testing AI in its AI Learning Laboratory report on their own performance and that the office 'does not want to rely on those reports alone.' It has signed memoranda of understanding with six organizations (Coalition for Health AI, Stanford Clinical Excellence Research Center, Clarion AI Partners, mpathic, Vega Health, Glacis Technologies; signed between Aug 10 and Oct 2, 2026) that can review a proposal before approval and audit samples of a pilot's real activity while it runs. The agreements cover clinical and technical evaluation, an evaluator network, and runtime attestation, in which selected companies must produce a tamper-evident receipt each time a specified safety check runs. The company pays the evaluator directly; evaluators must certify independence, report any patient safety concern, and accept audit; a certification that does not match findings is grounds to pause, roll back or terminate a pilot. Evaluation criteria are still being finalized.
Why it matters, evidence and limitations
- Why it matters
- A state regulator is building an independent-verification layer for AI it authorizes, with explicit limits on what attestation proves. The design transfers to state agencies that buy or permit AI and currently rely on vendor self-reports. The page was updated Oct 5 alongside the governor's health care AI announcement.
- Evidence and measured results
- Opened the Office of AI Policy page over HTTPS (curl, UA SLED-research-bot/1.0, BeautifulSoup extraction); article:modified_time is 2026-10-05. Confirmed the six MOUs and signing dates, the three agreement types, the payment and independence safeguards, and the statement that criteria are still being finalized. MOU PDFs were not opened. Cross-checked against Fox13 and Deseret News coverage of the Oct 5 announcement.
- Limitations and uncertainty
- Framework announcement, not results: criteria are still being finalized and no evaluation has been reported. Company-pays funding raises independence questions the page addresses only through certification and audit. Health-sector sandbox; transferability to general agency procurement is interpretation.
Utah extends its AI sandbox into clinical care with three 12-month pilots and master agreements with two health systems, but officials say they haven't decided which decisions AI should never make
On Oct 5 Utah unveiled a health care pillar in its Pro-Human AI Initiative: master agreement frameworks with Intermountain Health and University of Utah Health covering data privacy and AI governance (individual departments may propose pilots the state must still approve), three new 12-month sandbox pilots (Nolla Health acne telehealth with dermatologist oversight; Expect Fitness AI-assisted pelvic-health physical therapy; August AI renewals of existing non-controlled prescriptions from a roughly 148-drug formulary, with no new prescriptions, dose changes or substitutions), and clinical advisory and third-party evaluation networks. Companies must submit plans for patient safety, consumer benefit and data reporting and notify the state before operating. The Medical Licensing Board, which objected to the earlier Doctronic renewal pilot, now has a working group supporting the office's review; a board member says this is not blanket approval. Commissioner Busse says officials don't yet know which clinical decisions AI should never make.
Why it matters, evidence and limitations
- Why it matters
- State agencies are using sandbox authority to grant temporary rule relief for AI, with licensing boards brought into the review. It is directly relevant to state regulators and to legislators who will use the results to set liability and transparency rules. Announced Oct 5.
- Evidence and measured results
- Opened the FOX 13 article (curl, UA SLED-research-bot/1.0, BeautifulSoup extraction); parsely-pub-date 2026-10-05. Confirmed the three pilots, 12-month terms, about 148 medications, master agreements, medical board working group, and the Busse quote. Cross-checked with Deseret News (Oct 5) and the Office of AI Policy evaluator page.
- Limitations and uncertainty
- News report of an announcement; no pilot results. Company statements (formulary size) are unverified. Health care is outside core state-government operations; relevance here is the state regulatory model. The earlier Doctronic pilot and medical board letter are already archived.
Vermont oversight leaders' memo to ADS: the Anthropic evaluation agreement is silent on source-code retention and training, and may have skipped required contract approvals
The Sep 24 memo from JITOC chair Sen. Plunkett and Reps. Sibilia and Priestley asks ADS for written answers on three issues: protection of state source code, the contracting process, and whether a NIST impact and risk assessment was done before the trial. It says Claude tools run in a customer environment but send code to an externally hosted model, so local operation does not by itself keep code inside state systems, and that the agreement shown to legislators has no provisions on retention, use, human access, model training or deletion of state source code. It cites Bulletin 3.5 requirements (sole-source justification approved by the CTO; Secretary of Administration and Attorney General review of zero-dollar contracts) and asks ten questions plus the executed agreement, approvals, pre-deployment assessment, and which hosting option (Anthropic, AWS, Microsoft Foundry or Google Cloud) Vermont used. The attached unsigned form provides $100,000 in credits for six months, limits use to defensive cybersecurity, provides services 'as is', labels Claude Security a beta service, and caps each party's liability at the greater of $1,000 or fees paid.
Why it matters, evidence and limitations
- Why it matters
- This is the document our Oct 4 edition listed as not located. It turns the Vermont dispute into a reusable checklist for any state taking free or credit-funded AI tools: data terms for code, sole-source and zero-dollar contract approvals, gift acceptance, and a documented pre-deployment risk assessment. Why now: ADS's written answers are due Oct 7.
- Evidence and measured results
- Opened the 7-page JITOC PDF over HTTPS (curl, UA SLED-research-bot/1.0) and extracted text with pdftotext; PDF metadata shows creation Sep 24, 2026. Confirmed the three concern areas, the Bulletin 3.5 citations, the ten questions and document requests, the hosting options question, and the evaluation agreement terms (credits, period, approved use, as-is disclaimer, beta label, liability cap).
- Limitations and uncertainty
- Advocacy document from the legislators raising the questions; it states concerns and requests, not findings of violation. The attached agreement is an unsigned standard form, so executed terms may differ. ADS's written answers were not yet available. Vermont Bulletin 3.5 and statutes are state-specific.
At the Sep 30 hearing, Vermont's digital services secretary said the AI saw only test code and future trials will get full contract review; the signed terms and model used remain open
Compass Vermont's account of the Sep 30 JITOC hearing gives the agency's side. Secretary Denise Reilly-Hughes said Vermont signed on June 15 to Anthropic's free six-month, $100,000 evaluation (ending in December), that developers submitted pieces of test and development code rather than live systems, that no large system was reviewed in full, and that staff reviewed the AI's reports. Code did leave state computers for Anthropic's, with the state remaining administrator of its account. ADS did not treat the free evaluation as a procurement, but after consulting the Secretary of Administration said future trials will go through full contract review and this trial will be added to the annual public AI inventory. Written answers are due Oct 7. Unresolved: the signed terms (only the unsigned form is public), whether the scanner was used after Anthropic switched it to its Mythos model on Aug 21 (which affects 30-day retention), and what the trial found; the secretary had no count of systems reviewed.
Why it matters, evidence and limitations
- Why it matters
- Pairs with the legislators' memo to show both sides, and records concrete process changes (full contract review for future trials, inventory listing) that other states can adopt now. Why now: it supplies the ADS response our Oct 4 edition lacked, and the Oct 7 deadline falls this week.
- Evidence and measured results
- Opened the Compass Vermont post (curl, UA SLED-research-bot/1.0, BeautifulSoup extraction); article:modified_time 2026-09-30. Confirmed the June 15 signing, test-code-only description, process commitments, Oct 7 deadline and open questions, and checked the agreement description against the memo's attached form. The hearing video was not reviewed.
- Limitations and uncertainty
- Independent Substack reporting of testimony; ADS statements are the secretary's account and not independently verified. Compass describes the liability cap as $1,000 or 1 percent of the trial's value; the attached form says the greater of $1,000 or fees paid. Claims about Anthropic's Mythos switch and retention come from Compass's linked sources, which were not opened. No measured security outcomes.
How to read this edition
Source findings, measured results and limitations come from the cited publications. Patterns, operating questions, role takeaways and implementation considerations are Lighthouse Advisory interpretation, stated as questions to validate locally rather than guaranteed outcomes. Vendor and operator claims are labeled as claims. Full research method.
- Independent reporting
- Independent reporting with attributable sources but without a formal evaluation design.
- Standards or public-body guidance
- Normative or advisory guidance from a standards body or public institution.
- Government evaluation
- A public body’s measured evaluation or documented pilot.