AI governance in Nashville

Nashville is not one AI buyer. The metro holds a national concentration of health systems, physician groups, health plans, and the companies that sell into them, beside a music and entertainment industry that treats a recorded voice as the product. Tourism, higher education, and professional services sit around those two cores. A governance conversation that opens with “AI in Nashville,” and never says which buyer is in the room, answers the wrong question.

Healthcare buyers are usually putting a tool inside work they already do: clinical documentation, utilization review, patient or member outreach, scheduling, and the ordinary back office. Music and entertainment buyers are often closer to the output itself. The recording, the advertisement, or a tool that produces a particular person’s voice is the thing being sold. Tennessee did not write one comprehensive statute for both. It wrote a set of narrow laws, and the one that matters depends on which of those businesses you are actually in.

The ELVIS Act is the provision a Nashville reader should not skip, and it is a right-of-publicity amendment rather than an AI-governance regime. Our Tennessee regulation page states the point in the provision title: voice is now a property right, and simulated voice counts. A sound readily identifiable as a particular individual is covered whether it is that person’s actual voice or a simulation of it. That is what brings a synthetic clip inside a statute written for a right of publicity.

Three separate liability theories sit in the Act, and only one of them requires an advertisement or a fundraising use. The second reaches publishing, performing, distributing, or otherwise making a voice or likeness available to the public with knowledge that the use was not authorized. That theory has no commercial-use element. The third reaches a vendor that distributes a tool whose primary purpose is producing a particular individual’s photograph, voice, or likeness, and our Tennessee regulation page is explicit that there is no platform safe harbor. A company can be in scope without having published the clip itself.

Who can sue is why this is not a theoretical exposure for the music business. The individual can sue. So can an exclusive licensee. So can a party that holds an exclusive personal-services contract with a recording artist, or exclusive distribution rights in that artist’s sound recordings, which means a label can sue without holding the publicity right itself. Heirs or the estate can sue for ten years after death, and longer where commercial exploitation continues. Our Tennessee regulation page describes that plaintiff class as well-resourced and already represented, which is why the ELVIS Act is the Tennessee statute most likely to produce litigation. There is no cure period once a claim is filed.

For a hospital, a plan, or a professional-services firm the same statute is usually quiet, until someone generates an identifiable person. Cloning a named clinician’s voice for outreach, generating a video of a named executive for training or marketing, or leaving a former employee’s likeness in generated material after they leave is the narrow band where a regulated buyer walks into it. The compliance action on our Tennessee regulation page is specific written authorization that survives the person’s departure. Consent is the defense. The exclusions, including news, comment, satire, and parody, are real. Those exclusions are stated in full on the Tennessee regulation page.

TIPA, the Tennessee Information Protection Act, is the obligation most Tennessee businesses actually have, and it is a privacy statute. It took effect July 1, 2025. Consumers can opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, and profiling that presents a heightened risk requires a documented data protection assessment. It applies to businesses exceeding $25 million in revenue that also meet consumer-volume thresholds. HIPAA-covered entities and GLBA financial institutions are exempt at the entity level. A Nashville health system or bank should confirm that exemption rather than assume the name on the door is enough, and should not treat the exemption as a finding that no other law applies. Sector rules and contracts travel regardless of TIPA.

A written privacy program that reasonably conforms to the NIST Privacy Framework is an affirmative defense under TIPA. Our Tennessee regulation page is clear that Tennessee is the state that built that defense into the statute. It is a defense about the privacy program. It is not a general safe harbor for every AI use, and it is not a certification TrustEdge issues.

What we will do in Nashville is scope the systems, say which of these narrow laws reach them, and say which do not. The provision titles on this page are looked up from our Tennessee regulation page, and the descriptions under them are that page’s words, not a second summary written for this city. The Tennessee regulation page holds the rest, including remedies, enforcement, and the record of what 2026 did not enact. If you sell AI into Tennessee state government, that page is also where Enterprise Artificial Intelligence Policy 200-POL-007 is described. It governs AI use by executive-branch departments and agencies, and it is the document procurement answers are measured against. It is not the statute a studio or a clinic is under.