Management of Information, Licensing, and Enforcement System (MILES)

RFI No. FGCC 25/26-13

Number Question Response

The RFI references leveraging modern assistive artificial intelligence capabilities to improve process efficiency and end user support. Is the Commission interested in seeing built-in Private AI features—such as automated document extraction (ID/tax document parsing) and contextual prompt guidance—where state data is securely ring-fenced and never used to train public LLM models?

FGCC is looking for respondents to supply information related to the functionality their solution offers.

Are there specific operational workflows—such as automated triage of public complaints or license fraud anomaly detection—targeted for the integration of Artificial Intelligence capabilities?

FGCC is looking for respondents to supply information related to the functionality their solution offers.

Given the requirement for an end-to-end Configurable Workflow Engine managed completely via low-code/no-code tools without vendor intervention, does the Commission prioritize platforms with a natively unified workflow engine, data layer, and interface designer over fragmented suites that tie multiple separate vendor products together?

FGCC is interested in solutions with a natively unified workflow engine, data layer, interface designer, etc.

Does the agency require the physical replication and mass movement of historical legacy data into the new system, or is virtualized, zero-copy data access (e.g. connecting to existing data sources) preferred to minimize storage costs and preserve downstream data definitions?

Yes, the agency will require the physical replication and mass movement of historical legacy data.

What is the estimated total volume, document count, and underlying storage format of the unstructured binary assets (PDFs, images, attachments) currently housed within the DBPR OnBase system that will need to be migrated into the centralized MILES document library?

FGCC cannot provide at this time.

Can the Commission provide the relational schema size, database volume, and total file storage capacity (TB) of the historical documentation currently maintained within the DBPR’s OnBase system?

FGCC cannot provide at this time.

1 / 52

Is the intent to fully replace OnBase for FGCC documents, or integrate with OnBase during a transition period?

The document repository may not utilize a pre-existing repository. It should be a component that is fully integrated or native to the solution seamless to the user.

For long-term technical support, would the state prefer to train existing/internal development resources or to outsource this service?

FGCC prefers training existing/internal development resources but interested in a potential maintenance support contract post deployment.

To help respondents appropriately focus their implementation timelines and cost estimates , does the Commission intend to roll out all functional domains simultaneously, or is there a prioritized subset of capabilities (such as Entity Management and Application Processing) designated for an initial Minimum Viable Product (MVP) phase?

The intention is to roll out all functional domains simultaneously.

With regard to the implementation portion of the project and given that the Commission seeks information regarding cost ranges, scale, and system availability to actively plan for funding... does the State prefer an implementation methodology that provides rapid, production-ready, iterative feature software drops (Minimum Viable Products) within weeks, rather than a single, multi-year "Big Bang" delivery cycle?

The Commission is not considering a minimum viable scope at this time.

What are the exact interface protocols (e.g., real-time RESTful APIs, scheduled SFTP flat files, or SOAP web services) utilized by the state enterprise systems (FLAIR, PALM, and the Department of Revenue) to which MILES needs to integrate?

FGCC cannot provide exact specifications for integrations to the enterprise systems mentioned in the solicitation. However, the vast majority are inbound and outbound file layout integrations.

Does the agency have or plan to hire technical staff to support this application either during or after implementation? If so, please describe the number of resources and their general background/roles.

Yes, we intend for FGCC technical staff to have the ability to perform configuration changes and updates to the solution after go-live.

To better understand overall scope and ensure an efficient and low-risk project timeline. would the agency be open to an initial discovery project to adequately size and determine implementation approach(es) to inform a subsequent implementation project for the system?

The Commission will review and consider any and all ideas provided by vendors in their responses to this Request for Information.

2 / 52

Does FGCC anticipate vendor demonstrations or proof-of-concept sessions as part of any future competitive solicitation, and are there specific workflows FGCC would want demonstrated?

The Commission has not made this determination yet.

For the mandated public-facing interfaces and license verification tools, does the agency require independent third-party Section 508 / WCAG 2.1 AA accessibility audits, or will standard automated compliance testing suffice?

Standard automated compliance testing will suffice. FGCC may inquire about the tools used to conduct this compliance auditing.

The RFI specifies absolute "US-only data residency and no non-CONUS access" under the State of Florida Cybersecurity Act 60GG-4. Does the Commission favor platforms that natively provide an isolated, fully managed cloud environment already certified at the FedRAMP moderate or high-compliant levels?

Although the solution does not require a natively isolated environment, it does require CJIS compliance within a CONUS data center.

To ensure accurate pricing structures and subscription sizing , could the Commission provide the estimated number of internal agency staff users (administrators and caseworkers) and the anticipated volume of concurrent external portal users expected to interact with the system simultaneously?

Current estimates are roughly 120 internal staff users will require access to the system. Due to current system limitations, FGCC cannot currently provide an approximate number of external users.

Artificial Intelligence: Does the Commission have a position on which categories of AI functionality are acceptable within MILES — for example, document summarization, application triage, workflow automation, or decision-support recommendations?

At this time there is not an acceptable list for AI features.

Legacy Systems and Data Migration: Can the Commission provide an approximate record count breakdown within VERSA REG — for example, active licenses, inactive licenses, permit holders, in-process applications, and closed historical records?

Approximate current license count is 112,708. All others would be inactive/historical.

Legacy Systems and Data Migration: Will the Commission provide data dictionaries, schema documentation, or entity-relationship diagrams for VERSA REG and OnBase to selected respondents or future ITN participants?

These will be provided upon the contact being awarded.

3 / 52

Legacy Systems and Data Migration: Will VERSA REG data be made available via direct database access, structured exports (CSV/XML), or API? Has DBPR's cooperation in the migration been confirmed, or will that be addressed as part of the procurement?

FGCC is currently working with DBPR to determine data access and export.

Legacy Systems and Data Migration: Does the Commission anticipate a parallel run period during which both VERSA REG and the new MILES platform operate simultaneously? If so, what is the expected duration?

At this time there is not a cutoff period determined with DBPR's VERSA REG.

Legacy Systems and Data Migration: What is the approximate volume of content currently stored in OnBase — document count and estimated storage size — and what file types predominate?

FGCC cannot provide at this time.

Legacy Systems and Data Migration: Is full historical data migration required with complete fidelity, or would a hybrid approach — migrating active records with historical data accessible via read-only reference — be acceptable?

A complete historical data migration is required.

Procurement Scope: Will the Commission conduct one-on-one vendor meetings or demonstrations as part of this RFI process, in addition to the August 3–7 presentation window?

See updated timeline on Addendum 1.

Functional Scope and Integrations: Are the financial system integrations cited in Section 6 (FLAIR, PALM, Wells Fargo, Department of Revenue) expected to be built and delivered by the MILES vendor, or managed separately through the state's enterprise integration layer?

The Vendor is expected to build and deliver the integrations.

Functional Scope and Integrations: Does enforcement and investigation require integration with FCIC/NCIC or other FDLE criminal justice data systems? If so, is that integration in scope for the MILES vendor or managed separately?

At this time there is not a plan to integrate.

4 / 52

Functional Scope and Integrations: For field audits and inspections, are inspectors typically working in facilities with reliable connectivity, or is true offline-first capability required?

True offline-first capability is required.

Procurement Scope: Is there an anticipated budget range or appropriation target the Commission is preparing to request from the Legislature? An order-of-magnitude range would assist vendors in calibrating response detail.

The Commission has not established a budget for this project.

Procurement Scope: Is the Commission seeking a purpose-built regulatory COTS product, a configurable enterprise platform adaptable to regulatory use cases, or is either approach considered equally responsive?

FGCC is looking for respondents to supply information related to the solution they believe will best fit FGCC's needs.

Technical and Compliance Requirements: Which specific functional areas or data types does the Commission consider Criminal Justice Information subject to CJIS 6.0 — for example, does investigation and enforcement case data fall under CJIS, or is that determination still pending?

Determination of types of CJIS data captured and stored is still pending.

Technical and Compliance Requirements: Does the US-only data residency and no non-CONUS access requirement (60GG-4) extend to implementation and ongoing support personnel? Are offshore or non-US-person resources barred from system or data access at any point?

The US-only data residency and no non-CONUS applies to all aspects of the solution, including the items listed in this question.

Technical and Compliance Requirements: Does the Commission require FedRAMP High authorization specifically, or would StateRAMP equivalent or FedRAMP Moderate with supplemental controls be considered for lower sensitivity data domains?

The State of Florida does not have a direct requirement for FedRamp, although data containing PII, CJIS, tax, or sensitive information should follow NIST / CJIS. As such, FedRamp Moderate is the fastest route to ensuring this.

Technical and Compliance Requirements: Is Microsoft Entra ID the Commission's current identity provider for all staff? Will SSO/SAML federation with Entra be a mandatory requirement in the ITN?

Yes, Microsoft Entra ID is the Commission's current identity provider. FGCC is requiring SSO/SAML federation with Entra for internal users.

Artificial Intelligence: Given CJIS and CONUS data residency requirements, must AI models be FedRAMP-authorized and US-hosted? Are commercially available large language models acceptable within a compliant boundary?

LLMs are to be hosted in CONUS data centers, which are owned/operated by US entities. The LLM provider must be owned/operated by US entities. Foreign LLMs, such as DeepSearch are not permitted. Commercial LLMs which offer segregation for government entities within a compliant boundary may be used.

5 / 52

Functional Scope and Integrations: For Tribal Gaming Compact facilitation: is the requirement limited to document management and correspondence tracking, or does it include active workflow integration with tribal entities or external gaming systems?

Tribal Gaming Compact functionality should fall in line with permit holder functionality and items listed in the RFI. In addition, it should be tightly integrated with all other functional business areas.

Procurement Scope: Does the Commission anticipate a single solicitation for the full MILES scope, or a phased procurement (e.g., licensing core first, enforcement and case management in a subsequent phase)?

The Commission has not made this determination yet.

AI Capabilities: Is the Commission interested in AI-assisted decision-making, AI generative capabilities (e.g., correspondence drafting)?

FGCC is looking for respondents to supply information related to the functionality their solution offers.

Scope and Timeline: When does the current MOU with DBPR for VERSA REG and OnBase expire, and what is the Commission's target go-live date for the new system

There is no expiration at this time.

Data and Migration: Does the Commission have a defined data model or data dictionary for the 350,000 records that need to be migrated?

FGCC cannot provide at this time.

Data and Migration: The RFI cites 350,000+ records across VERSA REG and OnBase. Of these, how many are active and in-scope for migration versus historical/archival records? What is the general state of data quality, and what is the approximate document volume in OnBase?

Approximate license count is 112,708 of current licenses. All others would be inactive/historical.

Historical records are in-scope for migration. FGCC cannot provide the approximate document volume at this time.

Data and Migration: Does the Commission have internal staff with subject-matter knowledge of the current VERSA REG and OnBase systems who would be available to support requirements clarification and data migration?

Yes.

6 / 52

Document Management: Does the Commission require a new document management system as part of the solution, or would a pre-existing repository (e.g., SharePoint, AWS S3, Azure Blob) suffice?

The document repository may not utilize a pre-existing repository. It should be an integrated or native component of the solution seamless to the user.

Enforcement and Legal: Should the solution support criminal investigation case management (e.g., evidence tracking, chain of custody), or is enforcement limited to administrative actions?

Currently this should be limited to administrative actions.

Tribal Gaming: What specific functionality is envisioned under "Tribal Gaming Compact Facilitation" — primarily document/correspondence management, or active workflow and data exchange with tribal entities?

Tribal Gaming Compact functionality should fall in line with permitholder functionality and items listed in the RFI. In addition, should be tightly integrated with all other functional business areas.

Financial & Integrations: Do the integrations with PALM, FLAIR, Wells Fargo, or the Department of Revenue require real-time bidirectional communication?

No.

Licensing Operations: Does "physical license" distribution require the vendor to support card printing and mailing, or only generation of a printable electronic document?

Only generation of printable, electronic documents.

Integrations: The RFI references multiple external systems (FLAIR, PALM, Treasury, Wells Fargo, Entra ID, FDLE, SSN/driver's license verification, Department of Revenue). Can the Commission provide the definitive list of integrations in scope, and indicate which are required at go-live versus future phases?

Integrations are still being evaluated at this time.

Scope and Timeline: Is a phased implementation acceptable, or does the Commission require all functional areas to be fully operational simultaneously?

As stated in the RFI, this should be a single phase implementation with all functional areas fully operational at go-live.

Scope and Timeline: Will the existing system and the new solution be required to run in parallel during transition?

Yes, the systems will run in parallel.

7 / 52

Scope and Timeline: Will the Commission require contractors to lead implementation, or will work be performed by Commission staff?

Contractors will lead implementation.

Entity and License Management: Does the solution need to support reviewing and/or editing the 9 currently inactive license types?

Yes.

Entity and License Management: Does the agency have separate data models for different entity types, and will some entities have multiple roles?

A single entity may have more than one license at any given time.

Entity and License Management: Will each license type require its own workflow, or is there a unified flow with exceptions per license type?

Each license type may have its own unique workflow. Additionally, multiple license types could use a single workflow.

Enforcement and Legal: Are there different enforcement workflows by entity type, or a single enforcement workflow applied to all?

Each entity type may have its own unique workflow. Additionally, multiple entity types could use a single workflow.

Enforcement and Legal: Does "Legal Case and Correspondence Activities" require managing hearings, or is it limited to correspondence generation and tracking associated with enforcement actions?

At this time legal case management is limited to correspondence and tracking associated with enforcement actions.

Offline and Field Operations: What offline functionality is required, and in what specific field scenarios (e.g., inspectors conducting site visits without connectivity)?

Inspections, audits, and enforcement activities should have offline functionality.

8 / 52

Licensing Operations: What Service Level Agreements are currently in place for licensing, enforcement, and audits?

FGCC follows specific State Statutes and Rules related to these requirements.

Reporting: Does the Commission intend to provide non-technical staff with the ability to create ad-hoc reports?

Business units (including non technical) should have the ability to create ad-hoc reports and dashboards.

Reporting: Are legislative or statutory reports required? If so, what formats are expected, and can the Commission share examples?

A variety of formats may be needed. Please respond with formats that are offered.

Response Logistics: Are there any page limits, formatting requirements, or a preferred response template beyond the structure outlined in Section VII? There are no page limits or formatting requirements beyond what is outlined in Section VII.

Appendix A: Section VII.3 instructs respondents to complete Appendix A (desired system requirements), but Appendix A does not appear in the posted RFI. Can the Commission confirm where Appendix A can be obtained?

Appendix A can be obtained on the Vendor Information Portal (VIP) as a downloadable attachment to the Request for Information.

Timeline: Section X provides the RFI process timeline. Does the Commission have a target implementation start date or go-live timeframe for the solution itself?

No. The Commission has not established an implementation or "go-live" date.

Demonstrations: For the estimated August 3–7 demonstrations, what specific scenarios or use cases would the Commission want to see demonstrated, and will demos be conducted in person in Tallahassee or virtually?

The Commission doesn't have a preference regarding in person or virtual demonstrations. The Commission will provide instructions to the vendors selected for demonstration during scheduling.

9 / 52

Response Logistics: Is there an estimated budget range or appropriation target the Commission can share to help right-size proposed solutions?

No. The Commission has not established a budget for this project.

Tribal Gaming: Do tribal entities require a separate external portal distinct from the general licensing portal?

Tribal entities will not require a separate external portal.

Hosting and Compliance: Is commercial cloud hosting (e.g., a FedRAMP/StateRAMP-authorized environment) acceptable, or is hosting within a State of Florida data center required? Is FedRAMP authorization required at the time of response, or may it be in progress?

Cloud hosting solution must meet CJIS compliance requirements within a CONUS data center.

Users and Scale: Approximately how many internal Commission staff users will need system access, and are there distinct user categories (e.g., licensing staff, investigators, auditors, legal)?

PMW/Slots Operations 56 PMW Investigations & Inspectors 20 PMW Auditing 10 Legal 7

IT 4

F&A / Admin 3 Executive Director Office 1 Gaming Enforcement 6

69 Users and Scale: Will Entra ID be the primary identity provider for the solution? Yes, for internal staff users.

User and Volume Sizing: How many internal/staff users will use the system (named and concurrent)?

Current estimates are roughly 120 internal staff users will require access to the system.

10 / 52

71 User and Volume Sizing: Approximately how many public/external users are anticipated?

Due to current system limitations, FGCC cannot currently provide an approximate number of external users.

User and Volume Sizing: What are the approximate annual transaction volumes (new applications, renewals, inspections, enforcement cases, and payments per year)?

Total Expected Transactions for 2026 - Approx 23,000 - 25,000

User and Volume Sizing: How many physical facilities/locations are subject to site visits and inspections?

All facilities are subject to site visits, inspections, and additional regulatory activities.

Has the Commission evaluated whether a single-vendor system or a best-of-breed integrated ecosystem better serves long-term flexibility, as regulatory requirements and technology capabilities evolve?

FGCC preference is single-vendor systems, however vendors are welcome to respond with their suggested approach.

Has the Commission considered a modular or layered procurement approach; where a core system handles operational workflows and purpose-built specialist tools are integrated for higher-complexity functions such as risk assessment or behavioral analytics?

FGCC is looking for respondents to supply information related to the solution they believe will best fit FGCC's needs.

How does the Commission currently define "risk assessment" within its audit, inspection, and enforcement workflows; and to what degree is it expecting that capability to be native to the procured system versus integrated from a specialist solution?

Specific requirements will be defined at a later time. Vendors are welcome to respond with their recommended approach.

Are there specific enforcement or compliance scenarios where the Commission has found existing tools insufficient, particularly around assessing credibility, risk, or genuine representations in regulated individuals or applicants?

Inspections and audits cannot be done within the current system. FGCC does not have the ability to configure the current system as it is DBPR’s system

11 / 52

Does the Commission anticipate this procurement resulting in a single award, or is it open to multiple awards where specialized vendors may address distinct functional domains (e.g., audit & inspection, compliance monitoring, enforcement support) more effectively than, or in support of, a single system?

The Commission has not made this determination yet.

What level of commitment is available for Commission staff to give us walkthroughs of current processes, discussion of limitations of these processes and desired improvements, and detailed description of regulatory requirements for this data?

Access cannot be provided until a vendor is selected.

Will we only migrate current data from DBPR, or will we need to migrate historical data, and if so, how far back?

All FGCC/PMW related files within Versa Regulation and OnBase, current and historical.

81 What is the desired time frame for implementation? Pending Legislative approval.

Will systems be expected to run in parallel with DBPR for some period of time, or will there be a single point of cutover? If cutover, how much down time is acceptable during cutover?

At this time it is expected to run in parallel with DBPR.

What agreements are in place or anticipated to allow us bulk access to DBPR resources for data extraction? Will these agreements include access to DBPR staff?

We have a standing MOU with DBPR. FGCC cannot provide at this time.

Is the Commission open to an iterative agile process to develop this, or is a waterfall approach preferred?

The Commission is asking for respondents to provide their recommended approach.

12 / 52

Appendix A / General Functionality: Please clarify what is meant by “SQL rules.” Is the Commission expecting business rules configured through an administrative interface, direct SQL authored by Commission staff, or both? Please also describe any expected governance, approval, testing, or promotion process for these rules.

In this context, SQL Rules is referring to business rules implemented using SQL, SQL-based validation logic, rule engines, etc. FGCC is expecting business rules configured through an administrative interface, as well as the ability for certain FGCC staff to do direct SQL injections.

Appendix A / General Functionality: Please clarify what is meant by “views.” Is this referring to user interface forms, saved search/result views, reporting/database views, or another type of system view?

Generally, "Views" is a broad term to encompass all screens that display data across the solution.

Scope Prioritization: How is the Commission prioritizing functional areas for implementation, and which are being considered for initial deployment?

All functional areas should be complete and deployed during implementation.

Scope Prioritization: What would the Commission consider a minimum viable scope to deliver early value?

The Commission is not considering a minimum viable scope at this time.

Funding Approach: How is the Commission evaluating potential funding approaches, such as phased implementation, alternative funding sources, or multi-year investment strategies?

The Commission hasn't established specific evaluation criteria for potential funding sources for this project.

Delivery/Pricing Alignment: What level of cost detail or pricing structure would be most useful to support the Commission’s internal planning and decision-making?

The Commission is seeking budget information that includes all costs associated with the response provided.

Timeline Progression: How does the Commission anticipate progressing from this RFI to a potential formal procurement process?

The Commission hasn't established a timeline for the release of any future solicitation relating to this project.

13 / 52

Timeline Progression: What key decision points or planning milestones following the RFI should respondents be aware of?

The Commission hasn't identified any specific decision points or planning milestones after the conclusion of this RFI.

Prior Markert Research: What types of solutions or approaches has the Commission evaluated through prior vendor demonstrations or market research?

FGCC has not yet had vendor demonstrations.

Prior Market Research: How will insights from prior engagements influence the direction of this initiative?

The Commission utilized responses from the previous Request for Information to help provide more detailed and specific information for the current Request for Information.

Operational Volumes: Can the Commission provide estimated volumes for:

• Number of internal (State) users requiring access to the system

• Number of enforcement agent users requiring access via a Mobile app for field inspections

Current estimates are roughly 120 internal staff users will require access to the system.

Approximately 30 staff would require mobile app.

Scope: Tribal Gaming Compact Facilitation is listed as a business area in Section IV but doesn't show up in the Section VI functional questions. Can you give us a little more detail on what that actually needs to do in the system?

Ability to process tax received from Gaming Compact and disperse.

14 / 52

VERSA REG & OnBase Migration: Is there any way to get a sense of the VERSA REG data structure ahead of time, even just a breakdown of the 350,000+ records by license type and how many are active vs. historical? It would help us give you a much more realistic migration timeline in our response.

Approximate license count 112,708 of Current licenses. All others would be inactive/historical.

Profession Types: Permit to Conduct Pari-Mutuel Wagering Permitholder Annual License & Operating Day Cardroom License Permitholder App for Annual Slot License Indian Gaming Revenue (Not a license type, however it is mentioned here as it is considered an integral category of data that we receive) Cardroom Business Occupational Cardroom Employee Occupational Cardroom Business ODS Pari-Mutuel Business Occupational PMW Professional Individual Occupational PMW General Individual Occupational PMW/CR Combo Supervisor PMW/CR Combo General Horse Slot Machine Business Slot Machine Professional Individual Slot Machine General Individual Slot Machine Business Employee Off/Dir/Shareholders Slot/Cardroom/Pari-Mutuel Individual Combo Slot Combo General Slots Educational Facility Slot Combo Business

VERSA REG & OnBase Migration: For OnBase is there an export path already available, or would we be coordinating a direct database pull through DBPR? And roughly how many documents are we talking about, and in what formats?

FGCC cannot provide at this time.

VERSA REG & OnBase Migration: Does VERSA REG have any API access, or is the assumption a direct database extraction? Also, how long does the Commission expect DBPR to keep both systems running during a transition?

The systems will run in parallel. At this time the method will be a direct database extraction.

Integrations: For the state systems (FLAIR, PALM, DOR, Wells Fargo, Treasury) which of those actually have vendor-facing API documentation available right now? We'd rather be upfront in our response about which ones we can hit the ground running on versus which ones will need agency coordination after award.

Integration file documentation is available for FLAIR, PALM, DOR, and Treasury, however none of these are vendor-facing APIs.

15 / 52

Integrations: Does the Commission already have a Wells Fargo merchant services agreement in place, or would standing that up be part of the project scope?

The Commission already has a Wells Fargo agreement in place.

102 Scope: Is there an existing vendor or partner already working with FGCC on the MILES planning? No.

Compliance: On FedRAMP is the intent that the vendor needs a standalone ATO, or does running on an already-authorized platform like Azure Government or AWS GovCloud check that box?

An already authorized platform would suffice.

Compliance: For CJIS 6.0 does FGCC have a Security Addendum process we'd plug into, or would the vendor be responsible for kicking that off independently?

Beginning with page 14 through page 273 of the CJIS Security Policy 6.0 (https://le.fbi.gov/file-repository/cjis_security_policy_v6-0_20241227.pdf), vendor shall provide attestation of control fulfillment or compensating controls.

Is there a current vendor providing this service? If so, could you please provide the current contract documents/information?

As noted in Section III - Background Information in the Request For Information, we utilize VERSA REG via a memorandum of understanding with another State agency, Department of Business and Professional Regulation. We cannot provide the current MOU at this time.

106 Does the department have an estimated total contract value for this solicitation? No. The Commission doesn't have an estimated contract value for this project.

Lastly, if the department issues a solicitation, what would be the estimated timeframe for procurement?

The Commission has not established a timeline for the release of any future potential solicitations for this project.

16 / 52

Data Migration Volume: Regarding the migration from VERSA REG and OnBase, what is the estimated data size (in gigabytes/terabytes) of the legacy datasets and document repositories?

FGCC cannot provide at this time.

Data Export Format: Will the legacy data and documents be provided to the awarded vendor in standard formats (e.g., CSV, SQL dumps, flat files with metadata mapping), or will the vendor be responsible for extracting the data directly from the DBPR systems?

FGCC cannot provide at this time.

Public Portal Traffic: For infrastructure scaling, what is the estimated volume of external entities (licensees/applicants) expected to utilize the public-facing portals concurrently during peak renewal periods?

All individual and business licenses expire June 30th, and winter racing occurs from October through December. Peak volumes for application submission and renewals will occur during these timeframes. During February and March, there will be peak volumes for PMW operating and cardroom licenses. Slot machine facility licenses are renewed throughout the year. There will be no more than 26,000 open renewals at any given time.

Infrastructure Provisioning: Given the strict security requirements (State of Florida Cybersecurity Act 60GG-4, CJIS 6.0, FedRAMP), does the Commission expect the vendor to provision and manage the compliant cloud hosting environment (e.g., Azure Government, AWS GovCloud), or will the system be deployed on state-managed infrastructure?

The Commission expects the vendor to provision and manage the compliant cloud hosting environment.

User Licensing: Odoo Enterprise operates on a per-user licensing model. Approximately how many internal administrative/Commission staff users will require core access to the MILES system?

Current estimates at this time are approximately 120 users will need to be licensed.

How does FGCC envision leveraging artificial intelligence and advanced analytics to enhance regulatory oversight and enforcement activities?

To enhance regulatory oversight and enforcement activities. We are looking for recommendations from the Vendor.

Is FGCC open to vendors utilizing AI-enabled tools to support project delivery (e.g., implementation, testing, training, or operations)?

The vendor is welcome to respond with their desired approach.

17 / 52

What are the priority external integrations (PALM, FLAIR, FDLE, Treasury, identity providers) required at go-live vs later phases?

Integrations should be completed during this single phase implementation. Priority has not been established for integrations as they are all equally important.

How does FGCC envision the future operating model across licensing, enforcement, and legal functions once MILES is implemented?

FGCC envisions MILES as a single, modern system that unifies licensing, enforcement, and legal activities. The goal is to replace fragmented legacy tools with an integrated, cloud based platform that streamlines workflows, improves case management, enhances transparency, and empowers staff through configurable, scalable, and self service capabilities.

What are the primary success metrics FGCC will use to evaluate a future solution (e.g., cycle time reduction, cost savings, enforcement effectiveness)?

The Commission has not identified evaluation criteria for any potential solicitation for this project at this point in time.

Can FGCC provide anticipated timing for the release of a formal Request for Proposal (RFP) following this RFI process?

No. The Commission has not identified a timeline for the release of any future solicitation relating to this project.

How much time will be allotted for vendors to provide demonstrations for the proposed solution and will demo script be provided to guide vendor presentations?

The Commission has not established a time allotment for demonstrations at this point in time.

Vendors selected for demonstrations will be provided instructions during scheduling.

To provide realistic pricing models and architectural scoping, could the Commission clarify whether the MILES system will actively collect or process Protected Health Information (PHI) subject to HIPAA, or data of European Union citizens subject to the GDPR? If not, may vendors note these frameworks as "Not Applicable" for a Florida gaming and licensing system?

FGCC does not anticipate that MILES data will be subject to HIPAA or the GDPR. Data protection must comply with Florida law, including chapter 119, Florida Statutes.

Proposed Solution: What solution do you use today for email and SMS notifications? Should the new system continue using that solution?

No current SMS provider, and the current email solution is not appropriate for bulk notifications.

Vendor is to respond with recommended service.

18 / 52

Proposed Solution: The RFI mentions Artificial Intelligence (AI). Which AI features are most important, such as document processing, application reviews, chatbots, knowledge search, document summaries, or letter generation?

At this time there is not a priority list for AI features.

Proposed Solution: Will AI be used only by Commission staff, or should it also be available to applicants and licensees through the public portal?

Requirements for AI functionality within the public portal are not yet defined. FGCC is open to suggestions from respondents regarding the use of AI.

Proposed Solution: Which parts of the system should Commission staff be able to manage without vendor assistance, such as license types, forms, fee schedules, correspondence templates, dashboards, business rules, or security roles?

Non-technical business users should be able to make data corrections, build/manage custom reports, etc. Additional requirements for more-technical business users will be defined at a later date.

Business Need: Please provide the annual number of new applications, renewals, amendments, transfers, inspections, investigations, complaints, and enforcement actions for each license type.

All Application types and Renewals by Fiscal Year.

FY2022/19,959/ Renewals 1,419 FY2023/19,255/ Renewals 2,591 FY2024/17,565/ Renewals 1,951 FY2025/14,441/ Renewals 1,871

Proposed Solution: The RFI mentions mobile inspections. What other work should staff be able to complete from a mobile device, such as investigations, photo capture, document access, electronic signatures, payment collection, or offline work?

Each of the functional items listed in the RFI should be mobile friendly. Offline capabilities will need to extend to Inspections, Audits and Investigations.

Operational Inefficiencies: What reporting and dashboard tools do you use today? Can business users create their own reports and dashboards? Do you also need public-facing dashboards?

Qlik is used currently. FGCC staff are not able to create their own reports and dashboards, however, in the new solution, it will be a requirement for FGCC staff to create their own reports and dashboards. FGCC would be interested in online dashboard information for applicants and licensees and possibly public facing dashboard data.

Proposed Solution: Besides Florida PALM and the Department of Revenue, what other systems will need to exchange data with the new solution?

Wells Fargo, Totes, and Treasury.

19 / 52

Proposed Solution: What integration platform or middleware do you use today? Are there integration standards that all new systems must follow?

FGCC currently utilizes DBPR's licensing system and does not have oversight of integration configurations. Vendors should respond with their approach.

Operational Inefficiencies: What payment processor and merchant service provider do you use today for online and in-person payments? Should the new system continue using those providers?

FGCC requires use of an approved gateway and merchant services provider. Wells Fargo is the current merchant services provider.

131 Change In Mission: Are there any planned licensing programs, regulatory changes, or new laws that should be considered as part of the new solution? Not at this time.

Proposed Benefits: Beyond license lookup, what services should be available through the public portal, such as applications, renewals, payments, document uploads, complaint submission, appointment scheduling, or application status?

The portal should allow for application related activities such as submission, payments, document uploads, etc., in addition to complaint submission. Additional requirements will be provided at a later time.

Proposed Benefits: Will businesses, attorneys, or other authorized representatives need to manage multiple licenses or organizations from one portal account?

Yes.

Change In User Experience: Is Identity Management needed only for Commission employees, or should it also support applicants, licensees, businesses, and other users of the public portal?

Identity Management will be needed for all users of the system.

20 / 52

Business Need: Please provide the estimated number of users by business area (Licensing, Enforcement, Investigations, Legal, Finance, Administration, Management, and external users).

Please also include how many users will need mobile access.

Due to current system limitations, FGCC cannot currently provide an approximate number of external users.

PMW/Slots Operations 56 PMW Investigations & Inspectors 20 PMW Auditing 10 Legal 7

IT 4

F&A / Admin 3 Executive Director Office 1 Gaming Enforcement 6

AI: Section VI.17 references AI and assistive technology capabilities. Does FGCC have an existing AI governance policy or acceptable use framework that respondents should reference when describing AI-powered features? Are there categories of decisions (e.g., license denial, enforcement action initiation) where AI-assisted recommendations are prohibited from being the sole basis for action?

Yes. Commission staff must make the final decision on any action.

General: Can FGCC clarify expected case volumes (complaints, investigations, enforcement actions)?

These will vary.

Document Management: Approximately how many documents currently reside in OnBase? What is the average annual document growth rate?

FGCC cannot provide at this time.

Business Scope: The RFI states FGCC manages 34 pari-mutuel license types, 24 active and 9 inactive. Can the Commission confirm whether the remaining license type is in a suspended or pending status, and whether inactive license types must still be supported with full workflow functionality or read-only access?

There are 34 gaming license types regulated by Florida Gaming Control Commission, with 25 active and 9 inactive. Inactive license types must still be retained with the ability to return to active dependent on future legislative changes.

Business Scope: The RFI references both "Compliance & Enforcement" and "Investigative Cases and Reports" as distinct functional areas. Does the Commission envision these as two separate case management modules with distinct workflows and access controls, or as a single unified case management system with role-based views?

These should be within a single unified case management module with role-based views and dynamic workflow configuration.

21 / 52

General: Can FGCC elaborate on the most critical limitations experienced with the existing VERSA REG platform, particularly related to workflows, reporting, and system integrations?

The licensing system that we currently operate within does not utilize workflows, creating cumbersome manual processes, offers limited reporting capabilities, and does not offer modern methods for integrations.

General: What percentage of transactions does FGCC expect to be fully digital and/or handled via self-service capabilities?

100% of transactions, however processors should still have the ability to process mailed applications.

Financial: What key reconciliation challenges does FGCC currently encounter (e.g., payments, licensing fees, financial tracking)?

Due to our MOU with DBPR, FGCC does not own the licensing system, therefore all financial processes contain limitations.

Business Scope: FGCC has referenced approximately 350,000 past and current licenses. Can FGCC provide an annual breakdown of licenses issued from 2022 to present?

Count of Initial applications and renewals approved by Fiscal Year.

FY2022/13,126 / Renewals 1,419 FY2023/12,824 / Renewals 2,591 FY2024/10,897 / Renewals 1,951 FY2025/9,277 / Renewals 1,871

Reports: Can FGCC share representative examples of current reports and dashboards used for operational and executive decision-making?

Examples of current reports and dashboards include counts of applications submitted by dates, by types, by statuses, etc. License counts by type, by date issued, etc. Additional specific examples will be provided upon the contract being awarded.

Reports: What KPIs are most important for leadership? Can FGCC provide examples of current reports and dashboards?

Examples of current reports and dashboards include counts of applications submitted by dates, by types, by statuses, etc. License counts by type, by date issued, etc. Additional specific examples will be provided upon the contract being awarded.

General: Can FGCC summarize the key findings, lessons learned, and insights derived from the prior market sounding process?

The Commission has learned that the Request for Information process is a valuable method of obtaining information from the vendor community. The Commission learned several new and innovative approaches to developing and implementing this project during the previously released Request for Information.

22 / 52

148 General: What is the approximate number of: (1) Internal users (2) External portal users Current estimates are roughly 120 internal users. Due to current system limitations, FGCC cannot currently provide an approximate number of external users.

IT Security: Does FGCC currently hold or anticipate holding a FedRAMP-authorized ATO (Authority to Operate), or is the FedRAMP/equivalent requirement directed at the solution provider's cloud infrastructure?

FedRAMP/equivalent requirement is directed at the solution provider's cloud infrastructure.

Costs: The RFI requests pricing information, including implementation and ongoing costs. Should respondents provide pricing based on a specific number of named users, concurrent users, or a transaction/volume model? Can FGCC provide approximate user counts (internal staff and external licensees) to ensure pricing comparability across respondents?

Due to current system limitations, FGCC cannot currently provide an approximate number of external users.

PMW/Slots Operations 56 PMW Investigations & Inspectors 20 PMW Auditing 10 Legal 7

IT 4

F&A / Admin 3 Executive Director Office 1 Gaming Enforcement 6

Given the emphasis on no-code/low-code configuration "without Contractor intervention", is the Commission seeking a solution with in-house configuration capability post-implementation, and does it anticipate building internal staff capacity (admins/configurators) to maintain the system long-term?

FGCC is seeking a solution with in-house configuration capability post-implementation. FGCC is requiring the solution to allow FGCC staff to perform configuration changes and updates.

Are there existing integrations between VERSA REG/OnBase and other state systems (FLAIR, PALM, Treasury, Entra ID) that the Commission expects to be replicated, replaced, or retired as part of

MILES?

Inbound integration file documentation is available for FLAIR, PALM, DOR, and Treasury, however none of these are vendor-facing APIs. FGCC's preference is that the solution can support various outbound API integrations.

Can the Commission provide additional detail on the data volume, structure, and quality of the 350,000+ license/entity records currently in VERSA REG, including whether historical data is well-structured or will require significant cleansing prior to migration?

Approximate current license count is 112,708. All others would be inactive/historical

23 / 52

Document Library items state the solution should remove "the need for external document libraries or document storage", can the Commission confirm if this means OnBase is intended to be fully decommissioned and replaced, with no continued OnBase dependency post-implementation?

FGCC currently has an MOU with DBPR who owns the OnBase document repository. After go-live FGCC will no longer have access to OnBase.

Can the Commission provide additional information regarding the expected future procurement strategy (e.g., standalone software solicitation, software plus implementation services, or a combined enterprise solution)?

The Commission has not yet finalized our procurement strategy at this point in time.

156 Is there a preferred page limit or recommended level of detail for the narrative response? No. There is not a page limit minimum or maximum.

If selected for a demonstration, will respondents receive an agenda or demonstration objectives in advance?

The Commission will provide instructions to the vendors selected for demonstration during scheduling.

Is the Commission seeking high-level budgetary estimates for planning purposes, or should respondents provide detailed implementation and subscription pricing?

The Commission is seeking budget information that includes all costs associated with the response provided.

Can the Commission provide the anticipated number of internal and external users for the proposed solution, including estimated user counts by user type? A defined user count will enable us to provide better licensing estimates.

Due to current system limitations, FGCC cannot currently provide an approximate number of external users. *PMW/Slots Operations 56 PMW Investigations & Inspectors 20 PMW Auditing 10 Legal 7

IT 4

F&A / Admin 3 Executive Director Office 1 Gaming Enforcement 6

24 / 52

Current Architecture: Can FGCC provide a current-state architecture diagram and further details regarding the existing technology landscape?

Not at this time.

Data Migration: Can FGCC provide additional details regarding the volume of data and the specific data sources within the scope of this migration?

FGCC cannot provide at this time.

Integration…