Tennessee is asking whether AI-written code belongs inside the system that routes law-enforcement database traffic. That question appears in a Tennessee Bureau of Investigation request for information issued August 24. The same seven-page document calls for an established NCIC-compliant product, connections to 288 interfaces and support around the clock.
Those demands pull in opposite directions.
One asks what a new development method might produce. The others ask for an established product that must be able to serve a large, regulated network.
The response deadline is September 30. This is a market inquiry, not a contract award, and TBI says a response creates no contract rights. Security-software vendors still have a reason to read it closely: the answers may shape a later competition, while the questions reveal where the state sees risk in its current path. Read TBI’s message-switch RFI.
The AI question concerns development, not live police decisions
TBI’s wording is narrower than the headline it could generate. The agency asks for information about a vendor using AI to write code for message-switch software that the state would own. The document says that software could be new or built from TBI’s legacy code. It also asks what maintenance and support could be supplied for an AI-generated, TBI-owned product.
The RFI does not ask for a generative model to decide which person matches a record, write an officer’s query or operate as an autonomous layer inside NCIC traffic. Its AI question concerns how code might be produced. That distinction should stay visible in any response.
It also leaves hard questions open. The document does not identify a model, a code-review method, rules for exposing state code to an outside service, or a process for checking third-party intellectual-property claims in generated output. It does not say how a vendor would prove which code was produced by a person and which came from a tool.
A useful market response should supply those missing boundaries. Name the development tools. Explain what data and source code they can access. State who reviews each change, where prompts and outputs are retained, and how the state can reproduce the build after the original vendor leaves. If a vendor cannot document that chain, state ownership on paper may deliver less control than it appears to promise.
That is the first test.
The acronym “AI” is easy to put in a proposal. A maintainable source tree is harder.
The installed product still has to satisfy Tennessee’s network
The RFI gives experimental pitches little room to hide. It says time constraints require a provider with an established product that complies with NCIC communication standards. The proposed switch must also work with NIEM, Nlets and Tennessee’s DMPP 2020 protocol variations. TBI calls for Microsoft Windows, Microsoft SQL Server, a secure web-based REST API and current programming technology.
Then comes the connection count: 288 interfaces. They include law-enforcement agencies, NCIC, Nlets and Tennessee files such as driver-license, registration and computerized criminal-history records. TBI wants a dashboard that reports connection changes and sends real-time alerts to the vendor, the state and agency contacts.
Availability language adds another constraint. The switch may run on TBI premises or in a cloud environment, according to the RFI, and it must exceed 99 percent uptime outside planned outages. TBI asks for speed, queue-clearing and restart metrics, plus load balancing, redundancy or failover details. A help desk must operate 24 hours a day, seven days a week. The project would have to finish within one calendar year.
These are not interchangeable claims. A product can have a polished demonstration and still lack tested Tennessee interfaces. It can meet an uptime percentage while taking too long to restore a failed connection. It can support an API while leaving the state dependent on a third-party license that TBI says it will not sign.
Vendors should map each answer to evidence: current installations, measured load, recovery tests, supported message keys, named third-party components and a transition sequence. TBI says the new switch will not run in tandem with the legacy system after go-live. That raises the cost of an assumption discovered late.
The RFI points respondents to FBI CJIS requirements without naming a version. The FBI currently posts CJIS Security Policy version 6.1, dated June 25, 2026. A response should identify the policy version behind each control claim and explain how later changes would enter testing and maintenance. Check the FBI’s current CJIS Security Policy.
An RFI is market research, not a purchase order
Tennessee’s Central Procurement Office defines an RFI as a solicitation used to develop strategy, build a supplier database, or prepare for an RFP or request for qualifications. That definition matters here. See the state’s CPO glossary.
TBI makes the limit explicit. Responding is not required to compete in a future solicitation. The response does not create contract rights, becomes state property, and will not be reimbursed. The document gives no budget, evaluation date or promise that a later solicitation will be issued.
The schedule is short and specific. TBI issued the RFI on August 24. Its deadline for vendor questions was August 31, answers are scheduled for September 14, and responses are due September 30. The Central Procurement Office’s public listing remained active when checked September 1 and warns that posted documents may be amended. Check the current Tennessee professional-services posting.
The state record also contains an identifier conflict. The procurement listing, PDF filename and cover identify the matter as RFI 34800-042826. Section 3.3 inside the PDF tells vendors to reference RFI 34800-082026 in communications.
That may be a clerical error.
The posted documents do not resolve it. A prospective respondent should preserve the discrepancy, use only the contact listed in the RFI for any clarification, and monitor the scheduled September 14 answers and the CPO page for amendments. The August 31 question deadline has passed, so a vendor should not assume TBI will provide an individual reply. Guessing which number the agency intended adds avoidable risk to a deadline-driven response.
A serious response should expose the seams
TBI’s technical form asks for more than a product sheet. It requests experience on similar work, a project timeline, hardware and third-party software needs, performance figures, archive functions, transition and training plans, estimated state responsibilities and time for installation, testing and go-live, and four years of maintenance pricing. Fixed pricing is requested rather than a time-and-materials description.
The personnel requirement deserves its own workstream. The RFI says all employees working on the project must have fingerprints taken, complete an eligibility form and sign the CJIS security addendum; out-of-state employees must also supply a driver’s license. A prime contractor should identify which employees would work on the project before promising a schedule. The answer should explain how substitutions would be cleared without leaving a support gap.
Code ownership needs the same treatment. TBI asks about state-owned software, while another section says the vendor bears the cost of required third-party licenses and that the state will not enter those licenses. A response should separate code the state would own from operating systems, databases, libraries, cloud services and development tools governed by someone else’s terms. It should state what the state can maintain, modify and rebuild on its own.
Operations evidence belongs beside that ownership map. Show how message-key changes enter a release, how NCIC or Nlets updates are tested, who approves a maintenance window, and what happens when one of the 288 interfaces rejects a new format. Include the limit of the evidence. A test in another state may prove scale; it does not prove Tennessee-specific compatibility.
The public RFI leaves room for alternative approaches. Use it. If the one-year schedule, single cutover or ownership structure conflicts with a safer delivery plan, document the conflict and the proposed remedy. Market research is most useful when it surfaces a constraint before the state turns that constraint into scored contract language.
Track the posting, then prepare for the possible competition
The RFI directs responses to the email address named in the document. Tennessee’s supplier pages play a different role. The state says a business can review opportunities without registering in Edison, while registration is needed to receive solicitation notices or be awarded state business. Registered suppliers are also told to keep their profiles and commodity codes current. Review Tennessee’s supplier instructions.
For this inquiry, follow the submission channel in the RFI and watch the public posting for answers or amendments. For any later competition, verify the live event, supplier record, required forms and submission route instead of carrying assumptions forward from the market-research stage.
Tennessee is not yet choosing its next message switch. It is gathering information that could shape the questions in any later competition.