Executed P-56202.46- R-337785- BOA Statewide AI Strategy- ROM Legal Stamp ABB 9.15.26.pdf

State of Illinois Chief Procurement Office General Services 1 BOA for Orders Against Master Contracts V.18.1 DoIT Legal – March 2023

.Communicatiosn

ORDERING INFORMATION

Item Description

(manufacturer, model, serial number, feature, etc.) Qty One Time Charge Periodic Charge

Unit Extension Unit Extension 1 Platform Agile Architect- Senior 2184 $123.00 $268,632.00 2 Platform Agile Architect- Senior 2184 $123.00 $268,632.00 3 Platform Agile Architect- Senior 1092 $123.00 $134,316.00 4 Platform Implementation Manager- Senior 2016 $120.00 $241,920.00 5 Platform Agile Architect- Senior 2016 $123.00 $247,968.00 6 Platform Product Owner- Senior 924 $125.00 $115,500.00 7 Platform Agile Architect- Senior 1008 $123.00 $123,984.00 8 Platform Product Owner- Senior 208 $125.00 $26,000.00

Total (NTE): $1,426,952.00

STATE OF ILLINOIS BASIC ORDERING AGREEMENT (BOA) for Orders Against Master Contracts The terms and conditions of this BOA, including those terms and conditions set forth in the additional documents referenced below, and any continuation sheets, constitute the entire agreement between the parties with respect to the subject matter of this BOA. State documents will prevail in the event of a conflict between State and Vendor documents. The State shall not be bound by terms and conditions contained in any other document except as attached herein.

CONTACT INFORMATION

Vendor Name: Zion Cloud Solutions LLC Address: 2700 Patriot Boulevard, Suite 250, Glenview, IL 60026 Contact: Arun Reddy Phone #: (224) 904-4905 Email: Arun.reddy@zionclouds.com Fax #:

State Agency Name: Department of Innovation and Technology Address: 120 W. Jefferson Street, Springfield, IL 62702 Contact: Christopher Werth Phone #: 217-785-6814 Email: Christopher.werth@illinois.gov

Bill To:

Dept of Innovation & Technology Attn: Accounts Payable 120 W. Jefferson Street Springfield, IL 62702 DoIT.AccountsPayable@illinois.gov

Ship To:

Dept of Innovation and Technology 120 W. Jefferson Street Springfield, IL 60702 DoIT. ITPO.Communications@illinois.gov

CONTRACT INFORMATION

Contract #: P: 56202:46 Action: New Acquisition Type: Purchase Payment Cycle: Monthly Terms and Conditions: Master Contract Number Master Contract # for Terms and Conditions:

P-56202/ CMT45202

Term:

Begin Date:

10/1/2026

End Date:

10/31/2027

In processing this BOA, Vendor affirms that the Certifications and Financial Disclosures and Conflicts of Interest, if any, as attached to the Master Contract referenced above are true and accurate as of the date of Vendor’s processing of this BOA.

mailto:Arun.reddy@zionclouds.com mailto:DoIT.AccountsPayable@illinois.gov mailto:DoIT.%20ITPO.Communications@illinois.gov

State of Illinois Chief Procurement Office General Services 2 BOA for Orders Against Master Contracts V.18.1 DoIT Legal – March 2023

ADDITIONAL INFORMATION / REFERENCES / ATTACHMENTS

Master Contract # P-56202/ CMT456202 (To the extent that the Master Contract, including any additional licensing/product specific terms or other attachments thereto, expires or terminates, the terms and conditions of the Master Contract shall survive and continue to apply to the products and services being provided under this BOA. Further, the terms and conditions of the Master Contract shall continue to govern beyond the Term of this BOA and throughout the life and duration of the products/licenses and any related services being provided hereunder.)

SOW: Statewide AI Strategy & Governance Program AI Strategy, Governance, Secure Architecture, and Enterprise Enablement Support: Dated August 4, 2026 SIGNATURES: The undersigned parties agree to these terms and conditions.

Vendor State of Illinois

Signature: N/A State Agency: Department of Innovation and Technology

Printed Name: Signature agency representative:

Title: Printed Name: Brandon Ragle

Date: Title: Secretary, State CIO

Date:

State of Illinois

ALL NOTICES TO:

Email: DoIT.ITPO.Communications@Illinois.gov and DoIT.GeneralCounsel@Illinois.gov State of Illinois

Signature agency representative: Signature agency representative:

Printed Name: Radhika Lakhani Printed Name: Mary Feagans

Title: General Counsel Title: Chief Fiscal Officer

Date: Date:

Reviewed as to Legal Clause Sufficiency ABB 9.15.26

STATE USE ONLY

Reference Number: R-337785/ P-56202:46 Source Selection Method: Order Against Master Is Financing Needed? No Using Agency Funding Source:

• Fiscal Year: 2027

• Type: State

Approp. Account Code: 304-448-01-1900-00-00-3900 Detailed Expenditure Object Code: N/A IPB Reference Number: B-31821 Award Code: B Original Procurement Method: RFP IPB Publication Date: 9/20/2023 Subcontractors Utilized? No Subcontractors Disclosed? No

09/18/2026

09/18/2026

09/18/2026 mailto:DoIT.ITPO.Communications@Illinois.gov mailto:DoIT.GeneralCounsel@Illinois.gov

Illinois Department of Innovation & Technology Office of the Chief AI Officer

Statewide AI Strategy & Governance Program AI Strategy, Governance, Secure Architecture, and

Enterprise Enablement Support

August 4, 2026

SUBMITTED BY:

Zion Cloud Solutions LLC 111 S. Pfingsten Dr., Suite 450 Deerfield, IL 60015

POINT OF CONTACT:

Stephanie Stroubler Customer Success Manager Cell: 773-507-9143 stephanie.stroubler@zionclouds.com

Statement of Work Table of Contents 1 Executive Summary

2 Approach and Methodology

2.1 Operating Cadence

2.2 Governance Intake Operation

2.3 Algorithmic Impact Assessment

2.4 Deliverable Quality Control

2.5 Escalation Model

3 Scope of Services

3.1 Key Capabilities & Service Areas

4 Activities and Deliverables

4.1 Phase 1 – Mobilization & Governance Baseline (Month 1)

4.2 Phase 2 – Full Operations (Months 2–11)

4.3 Phase 3 – Transition & Knowledge Transfer (Months 12–13)

4.4 Deliverable Schedule

5 Key Personnel

5.1 Chandra Pillutla — AI Strategy and Delivery Lead

5.2 Stephanie Allen — AI Project Manager

6 Roles and Responsibilities

6.1 Zion Cloud Solutions Roles and Responsibilities

6.2 Customer Roles and Responsibilities

7 Project Timeline

7.1 Key Milestones

8 Financials

8.1 Cost by Phase

8.2 Detailed Cost Breakdown

9 Risk Management Approach

9.1 Engagement Risk Register

10 Acceptance Criteria

10.1 Deliverable Review Process

11 Reporting and Meetings 12 Knowledge Transfer

12.1 Transfer Mechanisms

12.2 Processes Transferred

13 Security, Privacy, and Confidentiality 14 Organizational Conflict of Interest 15 Past Performance

15.1 Google AI Showroom — Generative AI Platform on Google Cloud

15.2 Generative AI Landing Zone and Gemini Enterprise Pilot

15.3 OMI DataLake — HIPAA and NIST Compliant Data and Analytics Platform

15.4 Group Insurance Management System — Benefits Administration Platform

16 Compliance Matrix

16.1 Scope of Services (Section 6)

16.2 Key Deliverables (Section 7)

16.3 Proposal Response Requirements (Section 16)

16.4 Other Requirements

17 Dependencies/Assumptions

17.1 General Assumptions

17.2 Out of Scope

18 Intellectual Property 19 Change Requests 20 Outcomes at Engagement Close 21 Authorization

1 Executive Summary The Illinois Department of Innovation & Technology (DoIT) is establishing a statewide artificial intelligence capability that allows Illinois to innovate quickly while keeping AI secure, governed, supportable, and aligned to enterprise technology standards. Under the direction of the Chief AI Officer or otherwise designated State lead, this engagement provides the strategy, governance, secure architecture, project delivery, and enterprise enablement support the State needs to move from AI planning into practical, controlled adoption across agencies.

The engagement is structured to ensure:

• Rapid Team Mobilization: Core team members begin within 30 days of contract execution, target September 1, 2026. Seven of eight resources are operational October 1, 2026, and the full team complement is in place November 1, 2026.

• Governance-First Approach: Establish the statewide AI operating model, intake process, risk rubric, and algorithmic impact assessment methodology before scaling agency delivery.

• Secure by Design: Align every AI recommendation to enterprise networking, infrastructure, cloud, identity, monitoring, logging, and data protection requirements so that solutions are supportable in production.

• Measurable Delivery: Advance up to five priority agency AI projects and up to three legacy refactoring efforts concurrently with the strategy and governance workstreams.

• Compliance with State IT Standards: Align all deliverables with DoIT's technology framework, security policies, accessibility requirements, and procurement standards.

Zion Cloud Solutions builds and operates AI in production for the State of Illinois today. ZCS delivered the Google AI Showroom for this Department, a governed generative AI environment running inside DoIT's own Google Cloud tenant with Vertex AI model access, Microsoft Entra ID federation, NIST 800-53 control mapping, and department-level cost attribution. ZCS built a secure Google Cloud Landing Zone and Gemini Enterprise pilot for the Illinois Office of Comptroller, deploying six governed agents against accounting, project, and local government financial data with human-in-the-loop controls and audit logging throughout. ZCS designed, operated, and then fully handed over a HIPAA- and NIST-compliant data platform for the University of Illinois Chicago Office of Medicaid Innovation. ZCS is currently delivering the Case Management System for the Illinois Department of Central Management Services, Department of Labor replacing decades old business processes and technology, under a four-body governance structure with contractual accountability. This is delivery experience rather than advisory theory, and it is why ZCS governance recommendations are tested against systems ZCS currently operates inside State infrastructure.

Zion Cloud Solutions holds senior partnerships across all three major hyperscalers. ZCS is a Google Cloud Premier Partner with Data and AI and Public Sector specializations, a Microsoft partner across Azure data and business applications, and an AWS partner. The State is asking its advisor to recommend AI platforms, foundation model access patterns, master vendor agreements, and reference architectures.

Zion Cloud Solutions also has a direct working history inside DoIT, supporting the Enterprise Architecture function and delivering SAP SuccessFactors business analysis for the ActsERP deployment. ZCS understands how DoIT governance, security review, and procurement operate in practice, which shortens the interval between engagement start and first delivered outcome.

ZCS transfers capability to State staff throughout the engagement, so the State owns and operates the AI governance and delivery model once the work concludes.

Zion Cloud Solutions is uniquely positioned to deliver success for DoIT's statewide AI initiative due to:

• Proven Delivery Record with DoIT: ZCS has stood up and run technical delivery programs inside DoIT and transitioned operating ownership to State staff at close.

• Applied AI in State Production: AI-driven document intelligence delivered on Google Cloud through the AI Showroom, and AI-enabled replacement of legacy manual workflows for Illinois constitutional offices.

• Proven Collaboration with DoIT: Direct experience working with DoIT on integration with Okta for identity and access management, ensuring secure and seamless authentication.

Additionally, Zion Cloud Solutions worked closely with DoIT accessibility specialists to ensure compliance with Section 508 requirements, delivering an inclusive and accessible user experience.

• Security & Compliance Excellence: Alignment with state security standards, ensuring AI governance and architecture recommendations adhere to DoIT security policies, NIST frameworks, and data privacy regulations.

• Adaptable Delivery Model: The engagement's workstream mix shifts as governance matures, moving effort from framework build to agency delivery and State enablement without renegotiating scope.

Zion Cloud Solutions holds Joint Purchase Master Contract (JPMC) CMT456202, Agency Reference “TOPS Category 4 – Architects and Platform” with DoIT. This enables expedited procurement and ensures that the pricing in this Statement of Work aligns with the pre-negotiated hourly rates for professional technical resources.

2 Approach and Methodology ZCS runs this engagement as a governed delivery program, not as a set of advisory documents.

The methodology below defines how the team operates, how decisions are made and recorded, how work is assessed, and how quality is controlled. It applies across every service area in Section 3.

2.1 Operating Cadence

○ The engagement runs on a two-week planning cycle aligned to the Chief AI Officer's priorities, with a weekly status meeting, a weekly written status report, and a monthly executive report.

○ Each planning cycle opens with a commitment review against the deliverable schedule in Section 4.4 and closes with a working session demonstrating completed artifacts to the State.

○ A single engagement workplan, maintained by the AI Project Manager, is the authoritative record of scope, schedule, dependencies, risks, issues, and decisions.

2.2 Governance Intake Operation

○ ZCS operates the intake queue rather than only designing it. Each submission receives an initial risk screen within three business days, classification against the State AI rubric, and routing to the required reviewers.

○ Low-risk use cases follow an expedited pathway with documented conditions. Moderate and high-risk use cases route to full governance review with a completed risk profile and recommended mitigations attached.

○ Every intake decision is logged in the AI catalog with owner, risk level, review pathway, conditions, and re-review date, so the State inherits a defensible record.

2.3 Algorithmic Impact Assessment

○ Assessments are scored against a published rubric covering fairness, transparency, explainability, privacy, security, legal exposure, human oversight, operational risk, public impact, accessibility, data quality, and data movement.

○ Each dimension is rated on a defined scale with written evidence. Ratings drive a composite risk tier, and the tier determines the required mitigations and the level of governance approval.

○ Findings are adjudicated in a working session with Legal, Privacy, Cybersecurity, Data Governance, and the sponsoring agency before a recommendation reaches the Chief AI Officer, so decisions arrive pre-socialized.

2.4 Deliverable Quality Control

○ Every deliverable passes a two-stage internal review before it reaches the State: a technical review by the relevant specialist and an editorial and completeness review by the AI Strategy and Delivery Lead against the acceptance criteria in Section 10.

○ Deliverables are drafted against the Deliverable Expectation Document format agreement established in the first ten business days, so the State never receives an artifact in an unexpected structure.

○ Draft artifacts are shared at the halfway point of their development cycle for directional feedback, reducing the volume of change at formal review.

2.5 Escalation Model

○ Delivery issues are resolved by the AI Project Manager within the planning cycle. Issues affecting schedule, scope, or cost escalate to the AI Strategy and Delivery Lead within two business days.

○ Matters requiring a State decision escalate to the Chief AI Officer with a written recommendation, the options considered, and the consequence of delay.

○ Cross-agency or cross-division blockers escalate to DoIT executive leadership with the Chief AI Officer's concurrence.

3 Scope of Services Zion Cloud Solutions will provide an eight-person team totaling 5.6 full-time equivalents at steady state to deliver AI strategy, governance, secure architecture, project management, and enterprise enablement support to the Illinois Department of Innovation & Technology under the direction of the Chief AI Officer. The team will establish the statewide AI operating model, operate the AI governance and intake process, perform responsible AI assessments, manage priority agency AI projects and legacy refactoring efforts, and stand up the enterprise capabilities required for secure and sustainable AI adoption. The engagement spans 13 months, beginning within 30 days of contract execution with a target start of September 1, 2026 and concluding September 30, 2027, with a staggered team ramp-up.

3.1 Key Capabilities & Service Areas

i. AI Strategy and Roadmap Support ZCS builds the roadmap from evidence rather than from workshops alone. The team inventories current agency AI activity, tests each candidate against operational readiness and enterprise constraints, and sequences the roadmap so that early wins fund credibility for harder work.

○ Produce agendas, decks, presentations, decision materials, and executive briefings for AI Working Group, Advisory Group, agency, executive, and external stakeholder sessions.

○ Facilitate strategy sessions with the Chief AI Officer, AI Working Group, AI Advisory Group, DoIT leadership, and agency CIOs.

○ Support identification, evaluation, and prioritization of statewide, multi-agency, and agency-specific AI use cases.

○ Develop a statewide AI strategic roadmap covering near-term priorities, KPIs, sequencing, dependencies, operational readiness, governance requirements, implementation risks, and technical enablement needs.

○ Work with agency CIOs and DoIT portfolio teams to modify existing technology roadmaps to include AI workstreams or develop new agency AI roadmaps.

○ Ensure roadmap recommendations account for secure connectivity, infrastructure readiness, cloud and hosting patterns, cybersecurity controls, data protection, identity and access management, monitoring, logging, resilience, and service operations.

○ Work with People Operations, Legal, Statewide Personnel, Labor Relations, and agency leadership to develop a DoIT workforce impact strategy, including AI team job descriptions, org structure, and broader workforce review.

○ Provide analysis and responses to Statewide Personnel questions related to AI, including support to Labor Relations, Statewide Personnel, and Agency Personnel offices.

○ Develop a communications approach supporting consistent AI messaging across agencies and stakeholder groups.

ii. AI Governance and Intake Support ZCS operates the governance process while improving it. The team runs the intake queue from the first month so the State sees a working process rather than a proposed one, and refines the rubric and pathways against real submissions.

○ Review current AI governance policies, processes, intake forms, review criteria, risk rubrics, approval pathways, and governance bodies.

○ Recommend updates to AI governance policies, templates, procedures, rubrics, standards, and risk mitigation protocols, including the classification framework in the current AI rubric.

○ Define an AI intake and review process covering proposed use cases, vendor solutions, agency pilots, enterprise tools, AI-assisted development tools, and production deployments.

○ Recommend differentiated review pathways for low, moderate, and high-risk AI use cases.

○ Support day-to-day governance intake and processing, including initial AI Policy assessment evaluations, client communications, documentation, status tracking, and routing to required reviewers.

○ Create and maintain an AI catalog of known, proposed, approved, piloted, and deployed AI use cases.

○ Review existing AI implementations to identify ownership, risk level, compliance status, remediation needs, monitoring requirements, and support expectations.

○ Support the definition of the ongoing AI governance operating model, including decision rights, required reviewers, escalation paths, approval authorities, documentation requirements, and periodic re-review expectations.

○ Design and implement standards for regular model review, including review triggers, evaluation criteria, documentation requirements, and remediation pathways.

○ Track and provide feedback on agency AI policies.

○ Support the Security team’s integration into the AI intake and continuous review process.

iii. AI Policy Reviewsand Algorithmic Impact Assessments

ZCS assesses against a published, scored rubric so that two assessors reach the same rating and the State can defend a decision publicly. Findings are adjudicated with Legal, Privacy, and Cybersecurity before they reach the Chief AI Officer.

○ Facilitate conversations with DoIT units and client agencies and identify outside experts able to work with State leaders on AI ethics and refinement of the State's responsible AI approach.

○ Develop or refine the State's algorithmic impact assessment methodology in accordance with accepted standards (NIST, ISO, others), templates, scoring guidance, and review criteria.

○ Perform, or provide administrative support to a third party performing, algorithmic impact assessments for selected priority projects and agency use cases.

○ Evaluate fairness, transparency, explainability, privacy, security, legal exposure, human oversight, operational risk, public impact, accessibility, data quality, data movement, and potential unintended consequences.

○ Identify recommended risk mitigation measures, including human-in-the-loop controls, monitoring, documentation, bias testing, transparency notices, appeal processes, audit logging, model limitations, access controls, segmentation, and operational safeguards.

○ Coordinate with Legal, Privacy, Cybersecurity, Data Governance, Enterprise Architecture, Infrastructure, Networking, agency CIOs, and agency business owners throughout assessment activities.

○ Produce written findings, risk ratings, recommended mitigations, and decision-ready summaries for governance review.

iv. Public Transparency and Communications ZCS treats public transparency as an accessibility and plain-language problem first. Content is drafted for a general reader, cleared through Legal and Privacy, and structured so the State can publish updates without vendor support.

○ Work with Web Services, Communications, Legal, Privacy, Accessibility, and the Chief AI Officer to define content for a public-facing AI transparency website.

○ Support website planning, content development, information architecture, and publication approach.

○ Develop public-facing descriptions of AI governance, policies, approved uses, impact assessments, and advisory materials approved by the State.

○ Ensure public-facing materials are accessible, understandable, plain-language where appropriate, and aligned with State communication standards.

○ Support preparation of briefings, FAQs, talking points, stakeholder updates, and external communication materials.

○ Track agency AI liaisons and ensure regular communication and coordination with DoIT policies.

v. Priority AI Project Support ZCS applies a consistent readiness assessment to each priority project covering data, security, network, operational ownership, and business readiness, so the State can compare projects against one another rather than against their sponsors' enthusiasm.

○ Conduct discovery and readiness assessments for up to five (5) priority client agency AI projects.

○ Develop project charters, workplans, timelines, milestones, risk logs, issue logs, dependency maps, decision logs, and governance alignment plans.

○ Coordinate with agency CIOs, agency business owners, DoIT delivery teams, Enterprise Architecture, Cybersecurity, Legal, Procurement, Data Governance, Infrastructure, Networking, and Enterprise Applications.

○ Ensure each priority project follows the State's AI governance process and required technical, cybersecurity, data, privacy, procurement, accessibility, and operational review pathways.

○ Identify network and security implications for each project, including connectivity needs, segmentation, access controls, logging, monitoring, data movement, threat exposure, vulnerability management, and incident response considerations.

○ Identify resource needs, funding considerations, operational impacts, workforce impacts, and service ownership requirements.

○ Provide recurring status reporting to the Chief AI Officer and designated governance bodies.

○ Develop implementation recommendations and transition plans for projects moving from concept to pilot to production.

vi. Legacy System Refactoring Support ZCS screens refactoring candidates for whether AI assistance actually reduces risk, and recommends against it where code sensitivity, data exposure, or test coverage make automated generation the wrong tool.

○ Assess up to three (3) candidate legacy refactoring projects for feasibility, risk, readiness, and appropriate use of AI-enabled tools.

○ Develop workplans and governance alignment plans for selected projects.

○ Coordinate with Enterprise Applications, Enterprise Architecture, Infrastructure, Networking, Cybersecurity, QA, DevSecOps, agency CIOs, and agency business owners.

○ Identify risks related to code quality, cybersecurity, data exposure, intellectual property, vendor tooling, automated code generation, testing, connectivity, environment access, and operational support.

○ Recommend safeguards for AI-assisted refactoring, including secure code handling, restricted data use, test automation, quality gates, code scanning, auditability, and human review.

○ Recommend reusable patterns for future AI-assisted modernization work.

vii. Enterprise AI Procurement and Vendor Strategy

ZCS develops procurement recommendations under the conflict of interest protocol in Section

14. Evaluation criteria are set with the State before any vendor category is assessed, and ZCS partner relationships are disclosed in every recommendation.

○ Work with Legal, Procurement, Cybersecurity, Privacy, Enterprise Architecture, Enterprise Applications, Infrastructure, Networking, Finance, and the Chief AI Officer to develop a master vendor agreement strategy covering AI platforms, foundation models, consulting partners, implementation support, testing tools, and development tools.

○ Identify recommended categories of AI vendors and services, including AI platforms, foundation model providers, consulting partners, development tools, testing tools, implementation support, secure sandbox capabilities, monitoring tools, and managed services.

○ Recommend standard procurement pathways for AI pilots, enterprise platforms, agency use cases, secure development environments, and production solutions.

○ Recommend standard contract terms and evaluation criteria addressing data protection, algorithmic bias, privacy, cybersecurity, auditability, model training restrictions, intellectual property, indemnification, transparency, performance, service levels, accessibility, network connectivity, logging, monitoring, and termination rights.

○ Support development of vendor evaluation rubrics, procurement templates, technical evaluation criteria, security review criteria, and decision materials.

○ Review existing contracts to identify those most in need of AI addenda and provide coordination support between the Procurement and Legal Offices.

viii. Enterprise AI-Assisted Development Practices ZCS defines development practice from working reference artifacts rather than policy documents. Prompt libraries, patterns, and quality gates are built and validated with State developers, then handed over as maintainable assets.

○ Work with State developers, Enterprise Applications, Enterprise Architecture, Cybersecurity, QA, DevSecOps, Infrastructure, and Networking teams to define AI-assisted development workflows.

○ Develop guidance for appropriate and inappropriate use of AI coding assistants and AI development tools.

○ Create reusable prompt libraries, development patterns, code review practices, documentation templates, and testing patterns.

○ Develop and deliver training for State developers on responsible, secure, and effective use of AI-assisted development tools.

○ Recommend safeguards to prevent exposure of secrets, credentials, sensitive data, protected code, restricted information, regulated information, or confidential State information.

○ Support implementation of automated testing suites and quality gates for AI-generated or AI-assisted code.

○ Recommend integration points with enterprise CI/CD pipelines, code scanning tools, security review processes, vulnerability management, release management, and change control practices.

ix. AI Business Requirements, Training, and Change Management ZCS trains through applied practice. Business analysts and project managers work their own agency use cases through the requirements framework during training, so the State finishes each session with completed artifacts rather than attendance records.

○ Develop a framework for gathering AI business requirements.

○ Develop and deliver training for business analysts and project managers on AI use case discovery, requirements definition, risk identification, governance navigation, technical dependency identification, security considerations, change management, and operational readiness.

○ Develop and deliver training for agencies seeking to implement AI products or policies.

○ Develop materials to help agency teams understand AI capabilities, limitations, risks, governance requirements, technical requirements, security requirements, and implementation expectations.

○ Facilitate conversations between Communications and Training teams on enterprise trainings.○ Coordinate with, develop trainings for, and support the agency CIOs’ and Architecture teams’ conversations with agencies. This is to include the “focus on one AI project” message to agencies and the updating of agency roadmaps.

○ Support workforce impact analysis in coordination with HR, labor relations, agency leadership, and the Chief AI Officer.

○ Recommend change management practices for AI adoption, including communications, training, stakeholder engagement, user readiness, support readiness, and post-deployment feedback.

x. Token Accounting, Usage Tracking, and Cost Governance ZCS designs cost governance to survive contact with Finance. The framework maps to existing State budget structures and reporting cycles rather than introducing a parallel accounting model.

○ Develop a token accounting and AI usage tracking framework for foundation models and AI platforms.

○ Recommend methods to track consumption by agency, use case, application, model, user group, environment, project, or service.

○ Support cost allocation, budgeting, forecasting, and chargeback or showback considerations.

○ Recommend usage controls, thresholds, alerts, reporting dashboards, and governance review points.

○ Coordinate with Finance, Enterprise Applications, Infrastructure, Cloud, Networking, Procurement, Cybersecurity, and the Chief AI Officer to align AI cost governance with existing financial management, technical monitoring, and operational processes.

xi. Enterprise AI Data, Development, and Testing Environments ZCS defines the target environment against the State's existing network, identity, and monitoring estate rather than a reference architecture from a vendor. Every boundary recommendation names the control that enforces it.

○ Work with Infrastructure, Networking, Cloud, Enterprise Architecture, Cybersecurity, Enterprise Applications, QA, DevSecOps, the State Data Practice, and development teams to define the target environment for AI development, testing, experimentation, and pilot activity.

○ Recommend architectural boundaries for model access, data access, secure sandboxes, development environments, testing environments, logging, monitoring, network connectivity, and production pathways.

○ Identify required cybersecurity controls, identity and access controls, network controls, data protection controls, monitoring requirements, logging requirements, operational support requirements, and incident response considerations.

○ Support development of foundational prompt libraries, reusable patterns, model access patterns, reference architectures, secure development standards, and technical standards.

○ Recommend an approach for moving AI solutions from sandbox to pilot to production.

○ Develop production readiness criteria covering security review, network review, infrastructure review, operational support review, data review, privacy review, accessibility review, and service ownership confirmation.

xii. Initial Enterprise AI Solutions ZCS plans each release against a production readiness gate, so no enterprise solution reaches State users without a named service owner, a support pathway, and a defined set of success and cost metrics.

○ Support solution selection, readiness assessment, governance review, and implementation planning for enterprise AI solutions selected by the State, which may include productivity tools, agentic sandboxes, AI workflow accelerators, AI-assisted development tools, an AI app store, document processing tools, or knowledge assistants.

○ Develop release plans, stakeholder plans, training plans, support plans, security review plans, communications plans, and operational transition plans.

○ Assign and track tasks agreed to by stakeholders within those plans.

○ Coordinate with Enterprise Applications, Infrastructure, Networking, Cybersecurity, Service Operations, Accessibility, Communications, Procurement, Legal, Privacy, and agency stakeholders.

○ Define success metrics, adoption metrics, risk indicators, operational metrics, usage metrics, cost metrics, and post-launch review processes.

○ Support transition to the appropriate product owner or service owner after deployment.

xiii. AI Product and Service Ownership Model

ZCS writes the ownership model as an operating document the State can enforce, with named accountabilities and re-review triggers rather than principles.

○ Define product ownership and service ownership expectations for deployed AI solutions.

○ Define the support model, help desk routing, and incident response responsibilities.

○ Define vendor management, cost monitoring, and usage monitoring responsibilities.

○ Define responsibilities for model, prompt, and configuration updates, and for monitoring, logging, and reporting.

○ Define periodic governance re-review requirements, decommissioning and retirement expectations, and agency versus enterprise ownership criteria.

○ Define operational readiness criteria that must be satisfied before production deployment.

xiv. Engagement Tooling and Standards

The following represents the initial tooling and standards baseline. ZCS will confirm final selections with the State during Phase 1.

○ Governance and Catalog Tooling: State-approved collaboration and tracking platforms for AI intake, catalog, and governance workflow.

○ Assessment Frameworks: NIST AI Risk Management Framework, NIST Cybersecurity Framework, and the State AI rubric as the basis for risk and impact assessment methodology.

○ AI Development Tooling: Cursor, Claude, Gemini, or equivalent State-approved AI development platforms for AI-assisted development practice definition.

○ Identity & Access: Microsoft Entra ID and Okta, integrated with State identity services, as reference patterns for AI solution access control.

○ Documentation & Delivery: Microsoft 365, SharePoint, and Azure DevOps, or equivalent State-standard platforms, for deliverables, workplans, and status reporting.

4 Activities and Deliverables

4.1 Phase 1 – Mobilization & Governance Baseline (Month 1)

The AI Strategy and Delivery Lead, the Network, Infrastructure, and AI Solutions Architect, and the Cybersecurity and Responsible AI Specialist begin the engagement to establish governance foundations and the engagement workplan before the full team joins.

Activities

○ Conduct onboarding sessions with the Chief AI Officer and DoIT leadership to align on objectives, priorities, decision rights, and success criteria.

○ Submit the Deliverable Expectation Document establishing the agreed format, structure, and review workflow for all deliverables.

○ Review existing AI governance policies, intake forms, review criteria, risk rubrics, approval pathways, and governance bodies.

○ Assess the current state of AI activity across agencies, including known, proposed, piloted, and deployed implementations.

○ Draft the statewide AI operating model, including decision rights, required reviewers, escalation paths, and approval authorities.

○ Establish the engagement workplan, schedule, milestones, risk register, issue log, and status reporting cadence.

○ Confirm the priority agency AI projects and legacy refactoring candidates the State will bring into scope.

○ Prepare onboarding materials and environment access for incoming team members.

Deliverables

○ Engagement workplan with schedule, milestones, risks, dependencies, roles, and deliverable timeline

○ Deliverable Expectation Document (format and review workflow agreement)

○ AI operating model (draft) defining governance structure, decision rights, roles, and escalation paths

○ Current-state AI governance assessment and gap analysis

○ Initial AI catalog structure and intake process design

○ Confirmed list of priority agency AI projects and legacy refactoring candidates

○ Engagement risk register, baselined and published

4.2 Phase 2 – Full Operations (Months 2–11)

Phase 2 produces the deliverable set defined in Section 4.4 on the schedule stated there. The team reaches full complement in Month 3 when the Change Management and Training Lead joins. Work is sequenced within the committed deliverables through a two-week planning cycle agreed with the Chief AI Officer, who sets priority order among the committed items.

Knowledge transfer is embedded throughout this phase rather than deferred to closeout.

Activities

○ Operate the AI governance intake process, including risk evaluations, documentation, status tracking, and routing to required reviewers.

○ Develop and maintain the statewide AI strategic roadmap and the agency AI roadmap framework.

○ Facilitate AI Working Group, AI Advisory Group, and executive sessions, and produce the supporting agendas, decks, presentations, decision materials, and briefing documents.

○ Perform algorithmic impact assessments for selected priority projects and agency use cases, and produce written findings and recommended mitigations.

○ Provide project management support for up to five priority agency AI projects, including charters, workplans, milestone tracking, and risk and issue management.

○ Provide assessment and planning support for up to three legacy system refactoring projects.

○ Define AI-assisted development workflows, prompt libraries, reusable patterns, quality gates, and developer training, and deliver that training to State developers.

○ Define the enterprise AI development, testing, and sandbox environment in coordination with Infrastructure, Networking, Cloud, Cybersecurity, and the State Data Practice.

○ Develop the AI procurement and vendor strategy in coordination with Legal, Procurement, and Finance.

○ Develop and operate the token accounting, usage tracking, and cost governance framework.

○ Deliver business analyst, project manager, and agency training, and execute the change management and communications approach.

○ Support release planning for initial enterprise AI solutions selected by the State.

○ Conduct embedded knowledge transfer through paired working sessions, State staff shadow assignments on each workstream, and quarterly knowledge transfer checkpoints against the eight processes named in Section 12.

○ Conduct a weekly status meeting with the Chief AI Officer or designated State lead, issue a weekly written status report, and produce a monthly executive report.

○ Maintain the engagement risk register and decision log, documenting all significant governance and technical decisions, rationale, and alternatives considered.

Deliverables

○ Statewide AI strategic roadmap and agency AI roadmap framework

○ AI strategy and stakeholder materials, produced on a recurring basis (agendas, decks, presentations, decision materials, executive briefing documents)

○ AI operating model and AI governance process package (intake forms, risk rubrics, review and approval templates, status tracking approach)

○ AI catalog, maintained and updated throughout the engagement

○ Algorithmic impact assessment methodology and completed assessments for selected use cases

○ Priority project workplans and legacy refactoring project plans

○ AI procurement and vendor strategy

○ AI-assisted development framework, including prompt libraries, reusable patterns, and quality gate recommendations

○ AI business requirements and change management framework, with delivered training materials

○ AI staffing plan, including proposed org chart, job descriptions, and recruitment plans

○ Workforce impact strategy

○ Token accounting and cost governance model

○ AI development and testing environment recommendations

○ Network, infrastructure, and security readiness package

○ Enterprise AI solution release plans

○ Public AI transparency website content plan

○ Knowledge transfer log with quarterly checkpoint records

○ Weekly status reports and monthly executive reports

4.3 Phase 3 – Transition & Knowledge Transfer (Months 12–13)

The final two months focus on ensuring the State can continue operating the AI governance and delivery model without vendor support. Knowledge transfer conducted throughout Phase 2 is consolidated and verified here through State-led operation of each process with ZCS observing.

Activities

○ Conduct consolidated knowledge transfer sessions covering all eight processes named in

Section 12, with State staff operating each process and ZCS observing.

○ Finalize all documentation, including process guides, templates, runbooks, and operational procedures.

○ Complete in-progress assessments and project planning work and hand off all artifacts in

State-approved editable formats.

○ Produce the AI product and service ownership model and confirm ownership assignments for deployed solutions.

○ Execute data retention, return, and certified destruction obligations under Section 13.

○ Support transition planning for internal team succession or contract continuation as determined by the State.

○ Deliver a final report and executive briefing summarizing work performed, deliverables completed, unresolved risks, recommendations, and next steps.

Deliverables

○ AI product and service ownership model

○ Complete governance operating documentation, templates, process guides, and runbooks

○ Knowledge transfer session recordings, materials, and completion attestation

○ Certificate of data destruction

○ Final report and executive briefing

○ Transition plan and recommendations report

4.4 Deliverable Schedule

Target months are measured from engagement start. Each deliverable follows the acceptance process in Section 10: ZCS submits, the State provides consolidated written feedback within 10 business days, and ZCS submits a revised version within 5 business days. Two rounds of review are included per deliverable.

Ref Deliverable Target State Approver R1 Engagement workplan M1 — Sep 2026 Chief AI Officer R2 AI strategy and stakeholder materials Recurring, M1–M13 Chief AI Officer R5 AI operating model (draft M1, final M4) M4 — Dec 2026 Chief AI Officer

R7 AI catalog (initial M2, maintained through M13) M2 — Oct 2026 Chief AI Officer

RX AI Training Plan and Materials M3 — Nov 2026 Chief AI Officer

R9 Algorithmic impact assessment methodology M3 — Nov 2026 CAIO / Legal / Privacy R3 Statewide AI strategic roadmap M4 — Dec 2026 Chief AI Officer R6 AI governance process package M4 — Dec 2026 Chief AI Officer R4 Agency AI roadmap framework M5 — Jan 2027 CAIO / Agency CIOs R11 Priority project workplans M5 — Jan 2027 CAIO / Agency CIOs R8 AI staffing plan M6 — Feb 2027 CAIO / People Operations R12 Legacy refactoring project plans M6 — Feb 2027 CAIO / Enterprise Applications R10 Completed impact assessments M7 — Mar 2027 CAIO / Legal / Cybersecurity

R16 Workforce impact strategy M7 — Mar 2027 CAIO / People Operations / Labor Relations

R13 AI procurement and vendor strategy M8 — Apr 2027 CAIO / Procurement / Legal

R22 Network, infrastructure, and security readiness package M8 — Apr 2027 CAIO / Cybersecurity /

Infrastructure

R18 AI development and testing environment recommendations M9 — May 2027 CAIO / Enterprise Architecture

R14 AI-assisted development framework M10 — Jun 2027 CAIO / Enterprise Applications R17 Token accounting and cost governance model M10 — Jun 2027 CAIO / Finance

R15 AI business requirements and change management framework M11 — Jul 2027 Chief AI Officer

R21 Public AI transparency website content plan M11 — Jul 2027 CAIO / Communications / Legal

R19 Enterprise AI solution release plans M11 — Jul 2027 CAIO / Service Operations R20 AI product and service ownership model M12 — Aug 2027 Chief AI Officer

Ref Deliverable Target State Approver R23 Final report and executive briefing M13 — Sep 2027 Chief AI Officer

5 Key Personnel ZCS names the following key personnel for this engagement. Key personnel will not be replaced without prior written notice to the Chief AI Officer and the State's acceptance of a substitute with equivalent or superior qualifications.

5.1 Chandra Pillutla — AI Strategy and Delivery Lead

○ Role on this engagement: overall engagement coordination, statewide AI roadmap development, governance alignment, deliverable quality, and direct coordination with the Chief AI Officer.

○ Experience: 25+ years in enterprise technology strategy, AI and emerging technology programs, and public sector delivery leadership.

○ Relevant engagements: Illinois Office of Comptroller, leading the Generative AI Landing Zone and Gemini Enterprise pilot including identity federation, governed agent deployment, and human-in-the-loop controls; Illinois State Treasurer; and the Wisconsin Department of Workforce Development.

○ Relevant domains: AI and emerging technology programs, public sector governance, cybersecurity-aware delivery, and cross-functional stakeholder management across executive, technical, and agency audiences.

○ Credentials: Master of Business Administration, Kellogg School of Management, Northwestern University.

○ Availability: full-time (168 hours per month) for the duration of the engagement.

5.2 Stephanie Allen — AI Project Manager

○ Role on this engagement: project management for the priority agency AI projects and legacy refactoring efforts, ownership of the engagement workplan, risk register and decision log, and production of the weekly status report and monthly executive report to the Chief AI Officer.

○ Experience: 25+ years managing large-scale public sector technology implementations, including enterprise programs coordinating workforce teams of 150 or more through the full system development life cycle.

○ Illinois engagements: currently delivering for the Illinois Department of Central Management Services on the Group Insurance Management System benefits administration platform, the Illinois Department of Early Childhood, and the U.S. Department of Labor.

○ Prior public sector engagements: Program Integration Manager for the Ohio Medicaid Enterprise System across the Fiscal Intermediary and Single Pharmacy Benefits Manager modules, presenting at the federal CMS Certification operational readiness review prior to go-live; Pennsylvania MMIS System Integrator and Data Hub, a $175M implementation;

and the Puerto Rico MMIS program, $38.6M and $31.5M implementations for the Puerto Rico Department of Health.

○ Relevant domains: multi-stakeholder program governance across government clients, IV&V, and partner vendors; integrated master schedule and critical path management; risk, issue, and change management; and client-facing executive reporting.

○ Credentials: Project Management Professional (PMP), Project Management Institute.

Bachelor of Science in Mechanical Engineering, University of Florida.

○ Availability: full-time (168 hours per month) from Month 2 for the duration of the engagement.

Remaining team members will be assigned from the ZCS bench. ZCS will assign personnel meeting the qualifications defined for each role in Section 6, subject to State review of proposed assignments prior to onboarding.

6 Roles and Responsibilities The project shall include the following resources from Zion Cloud Solutions and Customer.

6.1 Zion Cloud Solutions Roles and Responsibilities

Role Role Description

Executive Sponsor

○ Hold ZCS accountability for the engagement at the firm level

○ Serve as the escalation authority above the AI Strategy and Delivery Lead for the Chief AI Officer

○ Chair a monthly engagement quality review covering deliverable quality, schedule, and risk posture

○ Authorize ZCS resource changes, corrective action, and any commitment beyond the engagement workplan

○ Participate in executive and Advisory Group briefings at the State's request

AI Strategy and Delivery Lead

○ Serve as the senior lead responsible for overall engagement coordination and deliverable quality

○ Develop the statewide AI strategic roadmap and supporting executive materials

○ Facilitate AI Working Group, AI Advisory Group, and executive sessions

○ Coordinate directly with the Chief AI Officer on priorities, escalations, and governance alignment

○ Ensure all recommendations align with enterprise technology, security, and operational standards

Cybersecurity and Responsible AI Specialist

○ Lead AI risk management, responsible AI governance, and algorithmic impact assessments

○ Develop risk rubrics, fairness review criteria, and data protection recommendations

Role Role Description

○ Align AI governance with security review processes covering identity, access control, logging, monitoring, threat management, vulnerability management, and incident response

○ Produce written findings, risk ratings, and recommended mitigations for governance review

Network, Infrastructure, and AI Solutions Architect

○ Ensure AI initiatives align with enterprise networking, infrastructure, cloud, hosting, identity, integration, and model access requirements

○ Design and review secure AI development, testing, sandbox, pilot, and production environments

○ Support the CTO and Chief Enterprise Architect in building an AI roadmap for legacy infrastructure

○ Define production readiness criteria and the network, infrastructure, and security…