Florida Local Government AI Policy and What NIST Misses

Every few weeks a city or county IT director asks me some version of the same question, which is what to build a Florida local government AI policy on top of. I point them at the NIST AI Risk Management Framework every time. It is free, it is vendor neutral, and no commissioner is going to pick a fight with NIST. People find Miami Mike looking for the version of this that survives contact with an actual agency, so here is the part that usually gets skipped. The RMF gets you about a third of the way. The other two thirds are all Florida, and none of it is in the framework.

The short answer

Use the NIST AI RMF as the skeleton of your policy. It gives you structure, defensible language, and political cover. Then bolt on the three things it does not cover for a Florida agency: public records exposure under Chapter 119, records retention, and procurement. Those are where your real risk lives.

Why the NIST AI RMF is still the right starting point

NIST released version 1.0 in January 2023. It is voluntary, it is organized around four functions called Govern, Map, Measure and Manage, and if your shop already runs on the Cybersecurity Framework the rhythm will feel familiar on day one.

The underrated benefit is political. When a commissioner asks what standard you used, “the federal standard from NIST” ends the conversation. Try answering that question with the name of a consulting firm and see how the meeting goes. For a public agency, an answer that does not require defending is worth more than an answer that is marginally better on the merits.

So the recommendation stands. My problem is not with the framework. It is with what people expect from it.

A framework is not a policy, and agencies keep confusing the two

Directors open the RMF expecting something they can adopt. What they find is a set of outcomes to aim for with no artifacts attached. No acceptable use language. No intake form. No vendor questionnaire. No incident definition. The companion Playbook helps and it is also dense enough that nobody on a five person team is going to read it end to end.

The Measure function is the clearest example. It assumes staff who can evaluate how a model behaves. A county with fifteen people covering all of IT cannot do that and never will. Writing a policy that commits to it produces a document nobody follows, which is worse than having no document, because now you have a written standard you are provably not meeting.

Cut those commitments. A policy you can actually execute beats a thorough one you cannot.

Florida still has no AI statute, which puts more weight on your policy

This is the part most people have wrong, including a few law firm blogs still circulating.

SB 482, the Artificial Intelligence Bill of Rights, passed the Florida Senate 35 to 2 on March 4, 2026. It would have restricted how governmental entities contract for AI products, and it carried an effective date of July 1, 2026. Then it died in House Messages on March 13. No chapter law citation. It is not on the books. I went through the politics behind that collapse, and what four speakers made of it on stage in Coral Gables, in my writeup on Florida AI regulation.

If your legal shop drafted procurement language against a July 1 effective date, go check it. I have seen compliance calendars still carrying that date.

What Florida has instead is a patchwork. The Digital Bill of Rights, the Florida Information Protection Act for breach notification, and a deepfake disclosure statute for political advertising. The one piece of the governor’s AI agenda that did get signed, SB 484 in May, keeps data center costs off utility ratepayers. Useful, narrow, and none of it tells a city whether it can put a chatbot on its permitting page. In the absence of a statute your internal policy is the operative rule, which is a heavier job than most agencies realize they are handing it.

Are AI prompts public records under Chapter 119

Probably yes, and nobody has definitively settled it. Chapter 119 covers records made or received by an agency in the course of official business, and the definition has expanded over decades to cover essentially every digital format anyone has invented. A prompt typed by a city planner into a chatbot to draft a staff memo is a record made in the course of official business. I would not want to be the records custodian arguing otherwise.

This is not a hypothetical concern invented by consultants. Representative Fiona McFarland raised it directly in a 2025 legislative discussion, saying local governments had come to her worried that queries typed into AI tools would become public record under the Sunshine Law. The vendors on the panel answered with product features. Nobody answered the legal question.

Three practical consequences, and the RMF mentions none of them:

• If prompts are records, a consumer account where an employee cannot export their own history is a compliance problem the day someone files a request
• Shadow AI on personal accounts creates records living on infrastructure you do not control and cannot produce
• Anything an employee pastes into a prompt, including a draft with exempt information in it, may now be sitting in a second location with different retention behavior

Retention is the part nobody plans for

Florida agencies retain under GS1-SL, the general records schedule for state and local agencies. Nobody has mapped AI chat logs to a retention category cleanly. Meanwhile the tools have their own defaults, and some enterprise offerings retain by policy while consumer tiers do whatever the vendor decides that quarter.

If you self host, you own retention completely, and data that never leaves the building is nobody’s disclosure problem. Some agencies decide that is worth the trouble. I went through when on premise AI inference actually pencils out, and the deciding variable is utilization rather than the legal picture. The hardware is the easy part. The operational load is what people underestimate.

The AI procurement gap NIST leaves open

Here is the mismatch that matters most. The RMF is written largely from the perspective of an organization building or deploying a model. Almost no local agency is doing that. They are buying a permitting system, a 311 platform, an agenda management tool, and discovering in a release note that AI features arrived last Tuesday.

That means your leverage is at contract signing and nowhere else. Once the tool is in production with a public facing workflow attached, you are not ripping it out over a data handling clause. The questions that actually protect you are procurement questions:

• Is our data used for training, and is that in the contract or just in a marketing FAQ
• Can we export prompt and output logs in a format a records request can be answered from
• What happens to our data at termination, and how long does deletion take
• Which subprocessors touch it, and does that list change without notice
• If the vendor adds a new AI feature to an existing product, does our contract cover it or did the scope just change silently

That last one catches people. Most agencies did not procure AI. AI arrived inside something they already owned.

Budget side, do not sign anything running three years on per seat AI pricing without understanding how the vendor’s own costs move. I wrote about why AI inference costs behave differently from the software line items procurement is used to. And you will end up with more than one vendor whether or not you planned it, so a multi model AI strategy is not an enterprise luxury. It is the default state of any agency that bought software from more than one company.

Where to get templates instead of writing them

The GovAI Coalition, started by the City of San José and public since March 2024, publishes exactly the artifacts NIST does not. Vendor agreement language, use case worksheets, incident response plans, AI inventory templates, all free and all written by people who work in government.

The vendor questionnaire alone is worth the download. It exists because San José asked vendors data handling questions and got stonewalled, which is a familiar experience for anyone who has tried it from a mid sized Florida city.

On the legal side, the Florida League of Cities published a legal overview of AI for municipalities that walks through Chapter 119, GS1-SL, FIPA, CJIS constraints, and automated hiring exposure. It is written for Florida cities specifically, which makes it more useful to you than most national guidance.

The RMF is being rewritten, so do not cite it clause by clause

NIST has confirmed that AI RMF 1.0 is being revised as part of the White House AI Action Plan. Separately, on April 7, 2026 NIST released a concept note for a critical infrastructure profile aimed at operators in energy, water, healthcare and similar sectors.

Practical implication for how you write the document: reference the current NIST AI Risk Management Framework generally. Do not pin your policy to specific subcategory numbers. Otherwise you are reopening it in front of a commission in a year to change citations, and that is a painful meeting for something purely clerical.

Florida’s courts already ran through their own version of this churn. Broward and Miami-Dade each issued their own AI disclosure requirements for filings, and both were superseded by a statewide rule in June. Local rules written ahead of state action tend to get overwritten. Build for that.

What a Florida city is actually shipping right now

Policy conversations go abstract fast, so here is a concrete one. Miami commissioner Damian Pardo laid out his city’s AI work on stage in Coral Gables this week, and the list is more useful than any maturity model I have seen.

• Permitting systems rebuilt so applications move through review faster
• A code compliance chatbot residents can question directly instead of filing for an answer
• Planning and zoning verification letters, funded by a Google grant of roughly $250,000, which he said is the piece residents actually notice
• An ambition he floated rather than announced, which is querying city contracts after the fact to surface the ones that came in well above their contracted value

Notice what is missing. No general purpose assistant handed to every employee on day one. Every item is a narrow workflow with a defined input and a defined output, which happens to be the easiest kind of system to write a policy around. Start where Miami started and the governance problem stays a size you can actually staff.

How to start an AI policy for a city in the first ninety days

Inventory first. You cannot govern what you have not found, and every agency I have talked to underestimated how much AI was already running inside tools they bought years ago. Read release notes for your major platforms going back eighteen months.

Then write an acceptable use policy that answers one question plainly, which is what an employee is allowed to type into which tool. That single page prevents more damage than the rest of the framework combined, because the failure mode you will actually see is a well meaning employee pasting something sensitive into a consumer chatbot.

Get your records custodian and city attorney in the room before the policy is final, not after. The Chapter 119 question has no clean answer yet and you want their reasoning documented alongside your decision. Then go pull the GovAI Coalition templates rather than paying anyone to draft from scratch.

What I am watching next is whether an AI Bill of Rights comes back in the 2027 session with the government contracting provisions intact. If it does, agencies that already built vendor data handling questions into procurement will absorb it without much pain, and agencies that did not will be renegotiating contracts under a deadline. That is the whole argument for doing the procurement work now while it is still voluntary.