AI governance in Chattanooga

Chattanooga’s AI question is an operations question. The metro’s weight sits in manufacturing, logistics and freight, insurance operations, energy and utilities, and healthcare delivery, with a technology sector that has grown alongside the city’s fiber network rather than around recorded music. Buyers here turn on inspection models, routing and scheduling optimizers, claims triage, customer-line assistants, and the vendor features that arrived inside software they already pay for. Very few of them are in the business of selling a particular person’s voice.

That is why the provisions on this page are not the set a Nashville reader should start with. The ELVIS Act is still law in Chattanooga. A plant or a carrier can walk into it with a training film of a named executive or a synthetic voice on a service line. It does not describe the rest of the deployment. These two Tennessee pages are different subsets of our Tennessee regulation page, chosen by who is actually reading. They are not one page with the city swapped.

The Tennessee Information Protection Act took effect July 1, 2025, and our Tennessee regulation page’s own title for the provision is the right description: it is the adjacent obligation most Tennessee businesses actually have. Consumers may opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. A data protection assessment is required for targeted advertising, sale of personal data, sensitive-data processing, and profiling that presents a heightened risk. The statute reaches businesses over $25 million in revenue that also meet the consumer-volume thresholds. HIPAA-covered entities and GLBA-regulated financial institutions are exempt at the entity level.

A Chattanooga health system, or an insurer that is actually a GLBA financial institution, should confirm the exemption instead of assuming it. A manufacturer or a logistics company above the thresholds should assume the assessment duty might apply and then check, rather than skip the check because the business does not think of itself as a privacy company. The affirmative defense is a written privacy program that reasonably conforms to the NIST Privacy Framework. That defense is about the privacy program. It is not a finding that a model is fit for a use, and maintaining the program is not a certification.

The useful first engagement in this market is a list of what is running, not a framework rollout. Procurement’s register is shorter than the set of systems that can affect a customer, a claimant, a patient, a worker, or a hiring decision. TrustEdge’s governance readiness assessment is the engagement that produces the inventory, reads what already sits inside a certification boundary, and reads the contracts that have started to mention AI. The AI Academy readiness assessment is a different product: a short diagnostic and a scorecard, not that review. Chattanooga organizations that want the governance assessment discussed for this metro, rather than only on the national service page, have a separate page for the assessment itself.

TrustEdge serves organizations in Chattanooga and across Tennessee. Assessors do the work on-site with the people who own the system. TrustEdge is a HITRUST Authorized External Assessor. That is a credential to assess other organizations. It is not a claim that TrustEdge, or a client, holds a HITRUST certification, and it is not a claim of SOC 2, FedRAMP, ISO, or EU AI Act status.

The regulation block below quotes our Tennessee regulation page’s titles and that page’s descriptions. Thresholds, dates, and bill numbers in this page are the ones that page already states. The Tennessee regulation page is the full record.