Group 79536 Award 23435 – How to Use and AU Responsibilities Contract #

1/8

APPENDIX E: HOW TO USE and AU RESPONSIBILITIES

CONTRACT PN71065

BETWEEN

THE NEW YORK STATE OFFICE OF GENERAL

SERVICES AND

NEW YORK STATE TECHNOLOGY ENTERPRISE

CORPORATION (NYSTEC)

2/8

Effective Date: September 12, 2026

Authorized User Responsibilities When utilizing the Contract, the Authorized User should be familiar with the terms and conditions governing its use. The Authorized User is responsible for compliance with the requirements of public procurement processes. The Authorized User, when purchasing from OGS Contracts, should also hold the Contractor accountable for compliance with Contract terms, conditions, specifications, and other requirements. Also, in recognition of market fluctuations over time, Authorized Users are encouraged to seek improved pricing whenever possible. Authorized Users are reminded that Award 23435 has been established to authorize the State and State agencies to enter into agreements and/or contracts in order to access the resources of the United States Air Force’s Rome Laboratory for solutions to technology issues of concern to the State and its citizens.

A. Procurement Record. Authorized Users have the responsibility to document purchases which should include:

a. A statement of need/work and associated requirements;

b. Obtaining all necessary price approvals;

c. A summary of the Contract alternatives considered for the purchase, if any; and

d. The reasons supporting the resulting purchase (e.g., show that the selection among multiple Contracts at the time of purchase was the most practical and economical alternative and was in the best interest of the State).

B. Preferred Sources. Some Products in the resultant Contract may be available from one

(1) or more Preferred Source Program suppliers. An Authorized User is responsible for determining if a particular Product is an approved Preferred Source Product and follow the requirements of State Finance Law § 162(3) or (4)(b), respectively, before engaging the Contractor. All State agencies, political subdivisions, and public benefit corporations (which include most public authorities) having their own purchasing agency are required to purchase approved products and services from Preferred Sources in accordance with § 162 and § 163 of the New York State Finance Law. Before proceeding with their purchase, such Authorized Users shall check the list of Preferred Source Program offerings for Products that meet the form, function, and utility required. These Authorized Users are reminded that they must comply with State Finance Law § 162, which requires that they afford first priority to the commodities and services of Preferred Source suppliers, which include the Division of Correctional Industries (Corcraft), the NYS Preferred Source Program for People who are Blind (NYSPSP), and NYS Industries for the Disabled (NYSID), when such commodities or services meet the form, function, and utility of the Authorized User, and the price offered by Corcraft does not exceed a reasonable fair market price, and the price offered by NYSPSP and NYSID is within 15% of prevailing market prices. If a Preferred Source offering does not meet an Authorized User’s form, 3/8 function, and utility, or the Preferred Source price is more than fair market price or more than 15% above prevailing market prices, then the Authorized User may use this Contract.

C. Public Works. Installation work which is considered public works is excluded from purchase under this Contract. Historically, the New York State Bureau of Public Works has maintained that installation, maintenance and repair of equipment attached to any wall, ceiling or floor or affixed by hard wiring or plumbing is public work. In contrast, installation of a piece of equipment which is portable, or a “plug-in” free-standing unit would not be considered public work. Thus, this Contract does not authorize installation where the equipment becomes a permanent part of the building structure or is otherwise incorporated into the fabric of the building (e.g., installation on a wall, ceiling or floor in a fixed location, or affixed by hard-wiring or plumbing). See Appendix B – General Specifications, Section 7, Prevailing Wage Rates - Public Works and Building Services Contracts. For questions about whether a proposed installation constitutes public work, please contact the New York State Department of Labor’s Bureau of Public Work district office in your area. A listing of district offices and contact information is available at:

http://www.labor.ny.gov/workerprotection/publicwork/PWContactUs.shtm.

D. ITS offerings. Prior to making a purchase, any State Agency Authorized Users whose systems are managed or administered by New York State Office of Information Technology (ITS) must contact their Deputy Commissioner for Technology to determine if an ITS owned or managed service is available for use. Agencies are reminded of the requirement for an approved Plan to Procure in accordance with the ITS Plan to Procure Policy, available via https://its.ny.gov/system/files/documents/2023/07/nys-p08-001-plan-to-procure.pdf, with exceptions to technology standards granted in limited circumstances.

E. End Point Devices. Any State Agency, as defined in State Finance Law § 160, procuring End Point Devices (i.e., personal computing goods that include desktops, laptops, all-in-ones, tablets, mobile or cellular telephones, thin clients, and monitors of various sizes;

printers; and multi-functional devices that include imaging devices that combine operations such as copying, printing, scanning and faxing into one machine), must comply with the requirements of State Finance Law § 165(9) at the time of purchase. State Finance Law § 165(9) requires that State Agencies, when procuring End Point Devices, shall be consistent with any relevant standards, guidelines, or guidance developed as part of the National Institute of Standards and Technology (NIST) Cybersecurity Framework.

F. Artificial Intelligence (AI). Before implementing new tools and technology, including those that use generative artificial intelligence, State Agencies must consult applicable policies and guidance, including but not limited to:

• NYS Policy NYS-P24-001: Acceptable Use of Artificial Intelligence Technologies

• ITS Policy ITS-P19-005: Acceptable Use of Open-Source Software

• NYS-P14-001: Acceptable Use of Information Technology (IT) Resources http://www.labor.ny.gov/workerprotection/publicwork/PWContactUs.shtm https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fits.ny.gov%2Fsystem%2Ffiles%2Fdocuments%2F2023%2F07%2Fnys-p08-001-plan-to-procure.pdf&data=05%7C02%7CWendy.Reitzel%40ogs.ny.gov%7C296fb5e567574ccb90e308dd6d4a4d57%7Cf46cb8ea79004d108ceb80e8c1c81ee7%7C0%7C0%7C638786888126431391%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=sN%2BkiuTx%2F2Utyw5w7LF1Micgy5cKGpZpZo%2FfvxffTq4%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fits.ny.gov%2Fsystem%2Ffiles%2Fdocuments%2F2023%2F07%2Fnys-p08-001-plan-to-procure.pdf&data=05%7C02%7CWendy.Reitzel%40ogs.ny.gov%7C296fb5e567574ccb90e308dd6d4a4d57%7Cf46cb8ea79004d108ceb80e8c1c81ee7%7C0%7C0%7C638786888126431391%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=sN%2BkiuTx%2F2Utyw5w7LF1Micgy5cKGpZpZo%2FfvxffTq4%3D&reserved=0 https://its.ny.gov/acceptable-use-artificial-intelligence-technologies https://its.ny.gov/acceptable-use-open-source-software https://its.ny.gov/acceptable-use-information-technology-it-resources

4/8

• Appendix G – Artificial Intelligence Standards (an Appendix to this Contract)

• AI Usage Considerations Memo issued by ITS (affixed to this Appendix E – How to Use and AU Responsibilities)

The AI policies and guidance above apply to State Entities — all state agencies, employees, and third parties (including local governments, consultants, vendors, and contractors) using IT resources under state administrative responsibility. They are designed to guide agencies in driving innovation, improving efficiency, and serving New Yorkers, while ensuring accountability, safety, and fairness. Questions about these policies or specific purchases or use of AI should be directed to ITS at: https://its.ny.gov.

Other Authorized Users that may not have established AI policies are strongly encouraged to use these policies for guidance or as a model to develop their own internal AI policies.

USING THE CONTRACT

NYS Executive Agencies and other Authorized Users shall follow the process outlined below to contract for NYSTEC services, including 1) the creation of a clear, complete Statement of Work (SOW) for each engagement, 2) developing a sound Cost Proposal, 3) securing technology, budget, and/or other project approvals, as applicable, 4) issuing payment(s) to NYSTEC.

Additional procedures, requirements, and instructions applicable to pricing, invoicing engagement processes, approvals, travel reimbursement, and related administrative requirements, are set forth in Appendix D – Pricing Schedules.

Process for NYS Executive Agencies

1. A New York State Executive Agency (Agency) contacts NYSTEC with an identified project need or opportunity consistent with the intent and scope of this Agreement. NYSTEC subject matter experts and Agency staff shall confer to clarify expectations regarding the scope and desired outcomes for the proposed project.

2. NYSTEC, at no cost to the Agency, will develop an SOW that identifies the steps, resources and timing required to accomplish the proposed project together with proposed tasking and a schedule. The SOW shall include the following:

a. Technical Proposal which shall include the following:

i. Project Schedule: MS Project Plan or equivalent with time intervals allocated for each process and/or task.

ii. Prescribed reporting, inspection and/or audit requirements.

iii. All deliverables associated with the project.

iv. Acceptance process and criteria for all deliverables and/or efforts performed by NYSTEC.

v. Demonstration that the staff proposed meets the job title requirements.

b. Cost Proposal which shall include the following:

i. Detailed description of and basis for costs that shall include:

https://its.ny.gov/

5/8

1. Total Not-to-Exceed Cost.

2. For Time and Materials Agreements, NYSTEC shall provide the estimated number of hours per individual and job title broken out by Agency Contract Year or other period of time as specified by the Authorized User. See the sample table below illustrating this detail.

Consultant Name

Estimated Individuals and Associated Labor Costs Per Authorized User Contract Year Contract Yr1

Labor Labor

Labor Category Hours Dollars

Consultant A Senior Engineer/Manager X $X.XX

Consultant B Senior Engineer/Manager X $X.XX

Consultant L Engineer/Analyst IV X $X.XX

Consultant M Engineer/Analyst IV X $X.XX

Consultant N Engineer/Analyst I X $X.XX

Consultant R Engineer/Analyst I X $X.XX

Consultant S Engineer/Analyst I X $X.XX

Consultant T Engineer/Analyst I X $X.XX

3. For Fixed Price Engagements, NYSTEC shall provide a detailed description of tasks, deliverables, and associated payment points.

4. If travel and/or other direct costs are included in the Cost Proposal, NYSTEC shall provide detailed backup indicating how the costs were estimated.

5. Reference to similar engagements as applicable.

ii. Payment Schedule

1. For Time and Materials Agreements, Agencies are reminded that NYSTEC may not invoice more frequently than once per month.

2. Where determined by the Agencies, the amount of retainage/performance assurance to be applied and the procedures for release of retainage/performance assurance shall be included.

iii. Certification that the rates are the same as those provided per the terms of this OGS Contract.

6/8

3. The Agency reviews NYSTEC’s proposed SOW and collaborates with NYSTEC to make any refinements/adjustments that may be necessary to ensure that the proposed project parameters align with the Agency’s expectations. The development of the SOW may go through multiple iterations to ensure a mutual and clear understanding of the Agency’s needs and objectives. The Agency shall inform NYSTEC of any additional or required language as a condition of funding and/or Agency requirements.

The Agency submits the mutually agreed-upon SOW to ITS to secure the requisite Plan to Procure (PTP) approval as required. Information on the PTP process may be found at the following link:https://its.ny.gov/document/plan-procure. Should the ITS PTP process change in the future, the Agency will follow the new process to secure the appropriate approval.

4. Upon PTP approval, the Agency will then submit the proposal to the Division of the Budget for B- 1184 approval as required.

5. After securing ITS and DOB approvals, the Agency will request a signed SOW from

NYSTEC (if not requested already) and acquire formal internal Agency signature approval.

6. Upon internal Agency signature and approval, the executed SOW is now fully approved and the Agency should provide NYSTEC with a copy of the signed SOW.

a. Contractor shall not begin work on any engagement prior to the receipt of an executed Purchase Order.

b. Should OSC review and approval be required in the future for SOWs, Agencies will comply with the new requirement when implemented.

7. All Authorized Users subject to SFS processing are required to contact the OGS

Procurement Services Contract Administrator for this contract to obtain an individual contract identification number specific to each project under this contract.

Process for Authorized Users Other than Executive Agencies

1. The Authorized User contacts NYSTEC with an identified project need or opportunity consistent with the intent and scope of this Agreement. NYSTEC subject matter experts and the Authorized User staff shall confer to clarify expectations regarding the scope and desired outcomes for the proposed project.

2. NYSTEC, at no cost to the Authorized User, will develop a Statement of Work (SOW) that identifies the steps, resources and timing required to accomplish the proposed project together with proposed tasking and schedule. The Statement of Work shall include the following:

a. Technical Proposal which shall include the following:

i. Project Schedule: MS Project Plan or equivalent with time intervals allocated for each process and/or task

ii. Prescribed reporting, inspection and/or audit requirements.

iii. All deliverables associated with the project.

iv. Acceptance process and Criteria for all deliverables and/or efforts https://its.ny.gov/document/plan-procure

7/8 performed by NYSTEC.

v. Demonstration that the staff proposed meets the job title requirements.

b. Cost Proposal which shall include the following:

i. Detailed description of and basis for costs that shall include the following:

1. Total Not-to-Exceed Cost

2. For Time and Materials Agreements, NYSTEC shall provide the number of hours per individual and job title. NYSTEC shall also provide the detail broken out by Authorized User Contract Year or as otherwise specified by the Authorized User. See the sample table below illustrating this detail.

3. For Fixed Price Engagements, NYSTEC shall provide a detailed description of tasks, deliverables, and payment points associated.

4. If travel and/or other direct costs are included, NYSTEC shall provide details of how travel costs were estimated.

Consultant Name

Estimated Individuals and Associated Labor Costs Per Authorized User Contract Year

Contract Yr1

Labor Labor

Labor Category Hours Dollars

Consultant A Senior Engineer/Manager X $X.XX

Consultant B Senior Engineer/Manager X $X.XX

Consultant L Engineer/Analyst IV X $X.XX

Consultant M Engineer/Analyst IV X $X.XX

Consultant N Engineer/Analyst I X $X.XX

Consultant R Engineer/Analyst I X $X.XX

Consultant S Engineer/Analyst I X $X.XX

Consultant T Engineer/Analyst I X $X.XX

8/8

5. Reference to similar engagements as applicable.

ii. Payment Schedule

1. For Time and Materials Agreements, Authorized Users are reminded that NYSTEC may not invoice more frequently than once per month.

2. Where determined by the Authorized User, the amount of retainage/performance assurance to be applied and the procedures for release of retainage/performance assurance

iii. Certification that the rates are the same as those provided per the terms of this OGS Contract.

3. The Authorized User reviews NYSTEC’s proposed SOW and collaborates with

NYSTEC to make any refinements/adjustments that may be necessary to ensure that the proposed project parameters align with the Authorized User’s expectations. The development of the SOW may go through multiple iterations to ensure a mutual and clear understanding of the Authorized User’s needs and objectives. The Authorized User shall inform NYSTEC of any additional or required language as a condition of funding and/or agency requirements.

4. The Authorized User will then request a signed SOW from NYSTEC and obtain final

Authorized User internal signature approvals.

5. The contract approval process for the Authorized User shall be followed. When the SOW has been fully signed and has received all required approvals, the Authorized User shall notify NYSTEC and provide documentation of the approval.

6. All Authorized Users subject to NY State Comptroller SFS processing are required to contact the OGS Procurement Services Contract Administrator for this contract to obtain an individual contract identification number specific to each project under this contract.

7. For payment of Contract purchases made by an Authorized User when the NY State

Comptroller is not responsible for issuing such payment, all Orders and remittances shall be forwarded to the following address:

NYSTEC

99 Otis Street, Second Floor

Rome, NY 13441

Supplement to

Authorized User Responsibilities, Section F. Artificial Intelligence

The following AI Usage Considerations Memo issued by ITS, is supplemental to all other Artificial Intelligence communication referenced in this document and contains additional considerations that could be included in individual purchase terms related to an AI purchase, if applicable for your State Agency.

Please note that for the purpose of this Contract, references to “Appendix C – AI: AI Procurement for NYS OITS”, should be directed to the document “Appendix G – Artificial Intelligence Standards” from this Contract.

KATHY HOCHUL

Governor

DRU RAI

NYS Chief Information Officer

MEMORANDUM

To: NYS Agencies Considering AI Technology From: ITS DLA Subject: Agency Best Practices for AI Acquisition

ITS has provided base language, found in Appendix C-AI: AI Procurement for NYS Office of Information Technology Services, that should be included in all contracts for the purchase or use of Artificial Intelligence. Please note that this language may not be sufficient for all use cases.

Agencies should evaluate their specific needs to determine if additional language, documentation, controls, regulations, or other processes are required. Sample language for several items is provided but should be tailored to meet the agency’s specific needs. ITS Supported Agencies are encouraged to reach out to their ITS DCT teams for assistance in reviewing vendor AI solutions.

This guide is informational only and is not intended as legal advice. Each agency counsel should conduct its own legal analysis before implementing ITS sample terms and conditions or the guidelines contained herein.

Agencies should consider the following.

1) Documentation that may be required prior to the use of AI.

Section 2 of Appendix C - AI requires notice of AI usage but does not specify the types of documentation to be provided. Agencies that may use AI to process confidential or regulated data, or may use AI to interact with the public, may want to obtain additional documentation.

This should be done prior to award or use. Additionally, agencies may want to clarify the approval process pursuant to Section 3- Appendix C – AI.

In section 4.6 of the Acceptable Use of Artificial Intelligence Technologies (“AUAI”) policy, ITS is responsible for creating and maintaining a public inventory of AI systems. ITS will separately issue guidance to State Entities regarding the manner and composition of information to be furnished under this section. State Entities (“SE”) will then be required to submit information on new and existing AI systems that meet the requirements of the guidance within 180 days of its issuance. This submission will include AI systems in use by state entities, whether developed internally or acquired externally, documenting operational, analytical, or decision-making processes. Consequently, State Entities should maintain detailed records of AI systems in use and their locations.

2) Approval for AI Usage Considerations.

In Section 4.1 of the AUAI, SEs are required to have SE leadership approval prior to adopting new AI systems. Such approval should include SE executive, legal, and operational leadership.

The agency may consider adding language allowing for shorter notice periods in exceptional circumstances or for less impactful AI deployments. The agency may also consider including

AI Usage Considerations Memo Page 2 of 4

Empire State Plaza, P.O. Box 2062, Albany, NY 12220 │ https://its.ny.gov language to detail the approval process, what constitutes “AI tools not integral to the system," and what criteria will be used for approval.

3) Human Oversight.

Pursuant to Section 4.2 of the ITS AI Policy, agencies must ensure that there is human oversight for AI decisions that impact that public and that there are not automated final decisions. The agency may also require that the vendor ensure appropriate oversight of these systems, either prior to or during their utilization. All decisions made by AI systems should be explainable to the maximum extent practicable.

Sample language for consideration: “If Generative AI is being utilized in decision making, prior to delivery of any output generated, the vendor shall subject such output to thorough human evaluation and oversight. This evaluation shall assess the accuracy, relevance, and appropriateness of AI-generated content, ensuring the delivery of high-quality, reliable results.”

4) Safety regulations that the agency may need to remain in compliance with third party regulators [i.e. CJIS, IRS, SSA, etc.].

AI that may use, access, or process certain regulated or confidential data may require additional controls such as background checks and training. The agency should consider whether additional vetting is required, who should conduct such vetting, and who should bear the cost.

Section 4.8 of the AUAI states that all AI systems must comply with NYS-P03-002: Information Security Policy, NYS-P14-001 Acceptable Use of Information Technology Resources, and all associated standards which can be found at https://its.ny.gov/policies. Any additional controls required by applicable Federal or State law, rule, or regulation (e.g., IRS Publication 1075) must also be incorporated. AI systems must be developed and reviewed in alignment with NYS-S13- 001: Secure Systems Development Lifecycle. In addition, SEs should ensure there are adequate security controls including encryption and pseudonymization, where appropriate depending on the risk throughout the data lifecycle.

Sample language for consideration: “The State may require that, prior to beginning any work under any contract or agreement, vendor staff with access to State data undergo the same background check and training requirements as State staff, at no charge to State.”

5) Access Control

Data access control should be clearly defined and enforced, giving the appropriate individuals and AI Applications the proper access rights to protected sensitive information, and consequently prohibiting individuals and AI who should not possess access rights to sensitive data and information. Data visibility is crucial to understanding the location, lineage, and usage of data across your organization.

AI Usage Considerations Memo Page 3 of 4

6) Data Management and Quality

If there is design involved, data architecture is crucial for AI data management. Data quality management should ensure that an organization’s data is accurate, complete and consistent.

Clear policies and procedures for data collection, use, and sharing should be established to strengthen data governance procedures affected by instituting AI.

Data classification supports these objectives. Organizations should categorize data based on its sensitive, value, security required, storage requirements, and regulatory considerations. Well-structured data architecture allows for efficient data flow when necessary, minimizing unnecessary movement and ensures data integrity.

7) Risk of bias or inequality in the use of the AI systems.

In accordance with 4.3 in the AUAI policy, State entities must use AI systems fairly and equitably, and monitor and remediate biases. Use of AI systems should be fair and equitable in accordance with applicable State and Federal laws, rules, and regulations. Agencies should review the potential use of AI to determine what, if any, standards should be set for the vendor to comply with our AUAI policy.

8) Closed Versus Open Systems.

Closed AI is an artificial intelligence system where the code, data, and model architecture are private and inaccessible to the public, prioritizing control, and security. These are self-contained and don't interact with external environments or data sources. Their behavior is predictable and determined by their internal logic and data. Open AI is an artificial intelligence system which is accessible with its code and details largely available to the public, interacting with external environments or data sources. Their behavior can be influenced by external factors and data.

Regulations, privacy, risk, security and controls may differ depending on which system is used.

Agencies should consider additional controls based on the type and usage of AI

Agencies should also be familiar with Non-grounded AI and Grounded AI systems. Non-grounded AI are like closed systems in that its responses are primarily generated from its internal, user input, and static training data. Grounded AI is similar with the concept of open systems, as it retrieves and utilizes external information.

9) Acceptable and Unacceptable use of AI Examples

All use of AI must comply with State policies, standards, procedures, and guidelines, as well as Executive Orders, any applicable license agreements, Federal and State, laws, rules, and regulations, ITS technical standards and), as well as the AUAI. A list of illustrative examples of acceptable and unacceptable use of AI, though not a comprehensive list of all potential AI use, can be found in Appendix A of the AUAI.

AI Usage Considerations Memo Page 4 of 4

10) Audits and/or Monitoring.

Consider whether the agency will need to allow for regular audits of the AI system’s performance and compliance with State or Federal laws, rules or regulations. If so, the agency should tailor the contractual language to include the right to access relevant data and documentation, and/or whether the agency expects the vendor to produce certain audit or performance reports. Though future legislation could potentially provide guidance, we must ensure compliance through contractual obligations at this time. Consider your agency establishing procedures for ongoing monitoring and evaluation of the AI software's performance. Plan for regular updates and maintenance, which are essential to address emerging security vulnerabilities, improve accuracy, and adapt to changing regulatory requirements. Your agency may consider clarifying what constitutes the reports necessary for auditing purposes and the required content of the AI impact assessment.

11) Check Whether the Product May Be Blocked or Restricted.

From time to time, certain AI products may be restricted or banned by New York State government or ITS. These restrictions are implemented with a focus on the responsible and secure use of AI technologies within New York State government. Such bans align with our established policies, aiming to mitigate cyber threats, ensure data privacy, and safeguard critical infrastructure. Users can investigate whether an application has been blocked and request to use the software via ITSM. Via "Desktop Software Request" for the Desktop, New Software Direct Registry for an approval to the registry, and/or the "Internet Access Permission Elevation" for websites, which can be found via the Service Catalog.

12) Other Considerations.

a) Develop clear requirements by defining specific needs and objectives for the AI software.

b) Conduct pilot programs by testing the software in a controlled environment before full implementation.

c) Define clear criteria for assessing the software's performance.

d) Provide training by equipping your staff with the knowledge and skills to effectively use the

AI software.

e) Involve stakeholders and relevant parties throughout the procurement and implementation process.

f) Maintain detailed records of the procurement process, including vendor selection, testing results, and implementation plans.

Appendix E _ HowToUse_AU Responsibilities_AI supplement.docx