local-government ai-governance florida public-records

Florida Public Records Law Already Governs County AI

Encephalon Team 7 min read
Florida Public Records Law Already Governs County AI

Ask a Florida county which state law governs its use of AI and the usual answer is that the Legislature has not gotten to it yet. That answer is half right. We found no statute in the 2026 Florida Statutes written to govern a county’s or city’s own use of AI. Several general statutes already bind how a county uses AI without naming it: s. 112.22 on applications from foreign countries of concern on public devices, s. 287.138 on contracts that give entities tied to those countries access to personal information, s. 282.3185 on local government cybersecurity, and above all Chapter 119, the public records law.

This is the last of four posts on how the Integrated Requirements Methodology, the method behind the Encephalon Enterprise AI Governance Practice and Tools, maps to, or draws on, the standards and laws local governments are asked about. Part 1 covers the NIST AI RMF, part 2 covers ISO/IEC 42001, and part 3 covers the EU AI Act. Nothing here is legal advice. County attorneys and each office’s own counsel decide how the law applies to their records.

What Florida has actually enacted on AI

In the 2026 Florida Statutes, the sections we found that use the phrase “artificial intelligence” deal with political advertising, a state advisory council, health care innovation, school funding and tutoring grants, and university institutes. None of them governs how a county or city uses AI in its own operations.

The two that come up most in local government conversations do not reach that far. Section 106.145 requires a disclaimer on political advertisements that use generative AI to depict a real person doing something that did not happen, made with intent to injure a candidate or deceive about a ballot issue. It binds the sponsor of the ad. Section 282.802 created the Government Technology Modernization Council, which it calls “an advisory council,” to study AI use and make recommendations to the Governor and Legislature. It regulates nobody.

The bills that would have gone further did not pass. CS/SB 482, the “Artificial Intelligence Bill of Rights,” passed the Senate in the 2026 regular session; its last recorded action is “3/13/2026 House - Died in Messages.” SB 2-D, filed under the same title in Special Session D, shows “4/29/2026 House - Died in Information Technology Budget & Policy Subcommittee.”

Florida’s comprehensive privacy statute does not fill the gap either. Section 501.703(2) says the part of the statutes containing the Florida Digital Bill of Rights “does not apply to any of the following: (a) A state agency or a political subdivision of the state.”

A county that waits for an AI statute before governing AI is waiting on a Legislature where both bills that would have written one died this year. In the meantime, the records law already applies.

Why Chapter 119 reaches prompts, outputs and logs

Start with the definition. Section 119.011(12) says “Public records” means “all documents, papers, letters, maps, books, tapes, photographs, films, sound recordings, data processing software, or other material, regardless of the physical form, characteristics, or means of transmission, made or received pursuant to law or ordinance or in connection with the transaction of official business by any agency.”

The Florida Supreme Court read that definition in Shevin v. Byron, Harless, Schaffer, Reid & Associates, 379 So. 2d 633 (Fla. 1980), holding that a public record “is any material prepared in connection with official agency business which is intended to perpetuate, communicate, or formalize knowledge of some type.” In 2003, in State v. City of Clearwater, 863 So. 2d 149, the Court added that “The determining factor is the nature of the record, not its physical location.” (Both decisions cite the definition as subsection (1). It has since been renumbered to (12).)

We are not aware of a Florida court decision or Attorney General opinion, as of September 2026, that applies those holdings to AI. Applying them is analysis, and it points one way. A prompt a staff member writes to draft a permit letter is made in connection with official business. So is the output. A log of both is material, “regardless of the physical form.” Some of it will be closer to what Shevin called “mere precursors” of records, drafts and notes not intended as final evidence. Which items fall on which side is a content question, answered item by item, and a custodian who assumes the whole category can be deleted at will is taking a risk the statute does not offer.

Three mistakes the statute exposes

The first is assuming that because the vendor holds the data, the county does not. Section 119.011(2) defines “agency” to include “any other public or private agency, person, partnership, corporation, or business entity acting on behalf of any public agency.” Section 119.0701 requires service contracts with a contractor acting on the county’s behalf to oblige it to keep and maintain the public records, and at the end either transfer them to the county at no cost or keep them under the retention rules. Whether a vendor is acting on the county’s behalf is decided on the facts (News & Sun-Sentinel Co. v. Schwab, Twitty & Hanser Architectural Group, 596 So. 2d 1029 (Fla. 1992)); records the county’s own staff create are county records wherever the vendor stores them, so the county must be able to retrieve them. Section 119.01(2)(c) bars an agency from entering a contract for a public records database that “impairs the ability of the public to inspect or copy the public records of the agency.” If an AI vendor holds the prompts and outputs and the contract is silent, the county has a records problem that no AI policy will fix.

The second is applying one retention period to everything. Section 257.36(6) says “A public record may be destroyed or otherwise disposed of only in accordance with retention schedules established by the division.” The state’s general schedule for state and local agencies, GS1-SL, has no item for AI prompts or outputs. Its note on electronic communications says “There is no single retention period that applies to all electronic messages or communications,” and that “Retention periods are determined by the content, nature, and purpose of records.” An AI output that becomes the basis of a determination does not become a transitory message just because it came from a chat window. And a county is not one records custodian. Clerks of court, supervisors of elections, property appraisers and tax collectors each have a program schedule of their own (GS11, GS3, GS12 and GS13) alongside GS1-SL. Court records a clerk holds are outside Chapter 119 altogether (Times Publishing Co. v. Ake, 660 So. 2d 255 (Fla. 1995)): access is governed by Rule 2.420 and retention by Rule 2.430, not by GS11.

The third is scoring a use case before asking whether its records can be released. Section 119.07(1)(d) requires a custodian who asserts an exemption to “redact that portion of the record to which an exemption has been asserted and validly applies” and produce the rest. An AI system that reads non-exempt records can produce an output that infers content that may itself be exempt. That output is a record, and whether the inference must be redacted is a question for the custodian’s counsel. If the custodian cannot redact it defensibly at the volume the use case generates, the method treats the use case as not feasible, however good its return on investment looks.

How the method handles it

The method treats Chapter 119 as a design input, not a review step at the end. What follows is how it is designed; Encephalon has not yet run this method under a public-sector contract.

The public records feasibility gate checks each candidate use before it is scored. A candidate whose training data, prompt logs or outputs would become records the custodian could not defensibly redact at scale is dropped or re-scoped, and the finding is recorded. The custodian is the office that holds the record. Only candidates that survive the gate are scored for impact and feasibility.

The policy carries a records layer covering AI outputs, prompt logs and audit trails as records, with dispositions taken from the schedule that governs each office rather than one schedule for all of them.

The risk tier governs reliance, not records status. The method’s tiers decide how much checking an output needs and who accepts it. They do not decide whether it is a record. The method treats prompts, retrieval traces and outputs as records at every tier, including the lowest, and the gate’s finding and schedule disposition travel with the tier assignment onto the Authorization Record.

Contracts carry Section 119.0701. The method’s recommended vendor contract provisions include it. Whether a consultant is itself acting on the county’s behalf under s. 119.011(2) depends on the facts of the engagement. The contract should settle which records the consultant keeps and how they are handed over, under s. 119.0701. Encephalon does not place material an office holds as exempt or confidential before any third-party hosted AI service; where the work needs it, Encephalon works from an extract the owning office has redacted.

The whitepaper covers the governance gap and the Kimball roots of the method. If your county or city is weighing an AI use case and nobody has asked the records custodian yet, book a 30-minute discovery call with the founding team and start with the custodian.

Primary sources cited

Encephalon Team 7 min read

Related Reading

Keep exploring

See Encephalon's Governance Practice
in Action

30-minute discovery call with the founding team. We'll show you how context engineering works with your stack.

Book a 30-minute discovery call

No sales pitch. Just a technical conversation. Live demos available.

Not ready for a call? Send a note.

or

Tell Us What You're Working Through

We'll respond within one business day.

The Practice is a full-service implementation, not a self-serve subscription. We require an executive sponsor for every engagement because AI adoption is organizational change, not a technology deployment.

Book a discovery call