Indiana chief privacy officer outlines state AI governance, review process and trusted sandboxes

Ted Cotterill, Indiana’s chief privacy officer and general counsel for the Management Performance Hub, told the Indianapolis Artificial Intelligence Commission that the state has built an AI review process intended to balance innovation with privacy and security.

Cotterill said the state has vetted about 60 AI proposals and has created role-based review teams that include legal, privacy, data science and data governance experts to assess risk, data sources and sustainment costs. “We have some commonalities that we also look at to to understand risk—the risk posture of the proposal,” Cotterill said.

The state presentation explained why a centralized approach matters. Cotterill described the Management Performance Hub’s work to treat enterprise data as a strategic asset—centralizing governance so agencies such as the Department of Health or the Department of Child Services can focus on mission delivery while relying on enterprise infrastructure, security and legal review.

Cotterill said the review system uses a risk framework that layers the NIST AI Risk Management Framework and a cybersecurity maturity assessment, and adapts the EU AI Act’s…