Tennessee is building a way to find AI tools that state workers use without approval, and to switch them off. State CIO Kristin Darby described the plan, which she called run-time monitoring, in an interview with GovTech at the NASCIO annual conference in late September. She said it is still being implemented. The state watches for shadow AI alongside unapproved software more broadly.
The monitoring enforces a policy Tennessee already has. Its Enterprise Artificial Intelligence Policy, 200-POL-007, was approved in September 2025. It covers state employees, contractors, vendors, and outsourced staff, plus cloud providers that handle state data.
- Every AI solution must be reviewed and approved by the AI Review Committee at Strategic Technology Solutions, the state’s IT agency.
- Employees may not create accounts in AI tools with state credentials unless the committee approves the tool or it is on the state’s Standard Products List.
- Tools that aren’t on the list go through an exception process before anyone can use them on state devices.
- Personal or confidential information may not go into platforms that aren’t managed on state-controlled servers. State data may not be used to train outside generative AI models.
- AI should not be the primary decision-maker for operations that affect residents or employees. Inputs and outputs must be reviewed by a person.
- Departments must train users, including on AI features built into tools that are already approved.
The policy sets out what is allowed. It states no consequences for breaking it, and it doesn’t address AI that nobody brought to the committee. The monitoring is meant to cover that gap.
A policy says what’s allowed. Monitoring is how you find out what’s actually happening.
Why an approval process isn’t enough
An approval process only sees the tools people bring to it. A browser chatbot, a free trial signed up with a work email, or an AI feature switched on inside software the agency already owns may never reach the committee.
Switching tools off has its own risk. If the approved list is thin or the exception process is slow, blocking can push use onto personal phones and laptops, where monitoring can’t see it. The public reporting doesn’t say what Tennessee’s monitoring will look at, what it records about employees, or when it will be fully running.
Questions before you build your own
- Do you have a written list of approved AI tools, and an exception process that answers quickly enough that people use it?
- Does your approval process cover AI features that appear inside software you already own?
- What will monitoring actually see: network traffic, browser extensions, sign-ups with work credentials?
- When a tool is blocked, who is told, and what is the employee told?
- What will you do with the data on which unapproved tools keep showing up?
- Have employees been told that monitoring exists?
Tennessee wrote the rules a year ago. Now it is building the part that notices when they’re broken.
Sources