AI governance in Memphis

Public Chapter 466, the Preventing Deepfake Images Act, was signed May 9, 2025 and took effect July 1, 2025. It creates civil liability and criminal liability for disclosing an intimate digital depiction of an identifiable person without that person’s consent. Consent to creation is not consent to disclosure. A release that authorizes making an image does not, on its own, authorize sharing the image.

The civil side includes actual damages, attorney’s fees, injunctive relief, and liquidated damages up to $150,000. On the criminal side the exposure runs from a Class E felony to a Class C felony, and the class depends on the circumstances.

A hospital, a distribution operator, a food company, or a hotel meets this statute only in a narrow pattern: the depiction is intimate, the person is identifiable, and someone discloses it without consent. Ordinary training material that does none of those things is outside the act. A generated image that does all three of them is inside it, including when the person is an employee or a patient and the file is forwarded later. The control is specific consent to the disclosure.

The privacy statute beside the two deepfake acts is Public Chapter 408 of 2023, and it has been in force since July 1, 2025. A distribution operator, a hospital, a food company, or a hotel above the line owes a consumer opt-out where profiling is what moves a decision into legal or similarly significant effects. The same organization owes a data protection assessment where that profiling presents a heightened risk, where advertising is targeted, where personal information is sold, or where sensitive data is processed. Revenue has to clear $25 million, and the consumer-volume tests have to be met as well. A HIPAA-covered hospital, and a firm that is a Gramm-Leach-Bliley institution, fall out as entire entities rather than one data category at a time. A written privacy program kept in reasonable conformity with the NIST Privacy Framework is the affirmative defense, and Tennessee is the privacy statute that wrote a NIST framework into enforcement. The defense is not a certification TrustEdge issues.

Enforcement of that privacy statute is the Attorney General alone. There is no private plaintiff, and the cure period is 60 days. A Memphis hospital, or a firm that really is a Gramm-Leach-Bliley institution, should confirm that it actually qualifies for the entity-level exemption and should keep sector rules and contract terms on the list after that confirmation.

An identifiable voice, whether recorded or simulated, has been a property right since July 1, 2024. Who may sue, and which of the three theories requires an advertisement, is the Nashville page’s subject and is set out again on the Tennessee regulation page.

No Tennessee statute tells an employer how to use a model in hiring, tells an insurer how to use one in a claim, or tells a reviewer how to use one in utilization review. Chatbots are under no general disclosure duty either. What the legislature did with the broader project was to order two studies, not a private duty. Public Chapter 1066 asks the Tennessee Advisory Commission on Intergovernmental Relations to review AI risks and regulatory approaches and to return findings and legislative recommendations. That report comes due on January 31, 2027. Public Chapter 1082 is the other study, of AI systems and generative AI chatbots, and unlike Public Chapter 1066 it carries no statutory deadline. A Memphis employer cannot treat either chapter as its own filing date.

Enterprise Artificial Intelligence Policy 200-POL-007 is the procurement measure for a company selling AI to a Tennessee executive-branch department or agency. A Memphis distribution company, hospital, food processor, or hotel that is not in that sale is not measured against the policy.