Statement of Work 01

1. Definitions

• "Agreement" means, collectively, the Master Consulting Services Agreement between ACME Highland Health ("Client") and Pulaski Advisory Group ("Consultant") dated August 3, 2026 (the "MSA"), this Statement of Work, and all Exhibits attached hereto.
• "Program Charter" means the Program Charter for "Project Catalyst" (the ACME Highland Health AI Transformation Program), dated August 3, 2026, as may be amended, which is incorporated into this SOW by reference.
• "Deliverables" means the work product, documentation, software configurations, models, and reports identified in the Deliverables section of this SOW.
• "Confidential Information" has the meaning given in the Confidentiality section below.
• "PHI" means Protected Health Information as defined under the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA").
• Capitalized terms not otherwise defined in this SOW have the meanings given in the MSA or the Program Charter.

2. Relationship to Master Agreement and Program Charter

This SOW is issued pursuant to, and is governed by the terms and conditions of, the MSA between Client and Consultant. In the event of a conflict between the terms of this SOW and the MSA, the terms of the MSA shall control unless this SOW expressly states that a specific MSA provision is superseded for purposes of this SOW. In the event of a conflict between this SOW and the Program Charter, this SOW controls as to the commercial and legal terms of the engagement described herein, and the Program Charter controls as to program governance, decision rights, and technical/functional scope not otherwise addressed in this SOW.

3. Background & Purpose

This Statement of Work is issued under, and incorporates by reference, the Program Charter for "Project Catalyst" (the ACME Highland Health AI Transformation Program), dated August 3, 2026. The Charter authorizes a 36.5-month, three-year program delivered across three annual legs of scope; this SOW governs the first leg only — Year 1, Foundation & Flagship — and does not by itself commit either party to Years 2 or 3, which are governed by their own, separately-executed Statements of Work (SOW-02, SOW-03) issued at the start of their respective years following Client's separate budget approval for each subsequent Year.

Year 1 establishes the governance, platform, and organizational foundation the entire Program depends on, and delivers the first production AI capability: Claims & Prior Authorization AI (BRD-01), the workstream most directly tied to the CMS-0057-F regulatory deadline and the competitive pressure described in the Charter.

4. Scope of Services

Phase 0 — AI Readiness & Governance Foundation

• AI readiness assessment across data, technology, and organizational dimensions.
• Stand-up of the AI Governance & Center of Excellence (hub-and-spoke model), aligned to the NIST AI Risk Management Framework and ISO/IEC 42001.
• Stand-up of Independent Model Validation as an organizationally separate second-line function, and of the Data Privacy Office, Cybersecurity/InfoSec function, and Clinical/Medical Policy & Informatics team.
• Regulatory mapping against CMS-0057-F, state AI-in-insurance requirements, and the NAIC model AI bulletin.
• Cloud/SaaS AI platform vendor evaluation and selection.

Phase 1 — Platform Foundation & BRD-01 Delivery

• Build-out of the Data & Cloud AI Platform Foundation (shared MLOps pipelines, data governance tooling, integration layer) that all three BRDs will build on.
• Joint Application Design (JAD) session series for BRD-01, with mandatory Legal, Compliance, Enterprise Architecture, Cybersecurity, and clinical/UM SME participation.
• Design, build, and test of Claims & Prior Authorization AI: intake automation, clinical documentation review, criteria matching, adjudication assist, and fraud/anomaly detection, with a mandatory human-review protocol for adverse determinations.
• Independent Model Validation testing (accuracy, fairness/disparate-impact, explainability) prior to pilot and prior to full production release.
• Pilot deployment, monitored rollout, and full production scale of BRD-01.

Out of Scope for This SOW

• Member & Provider Experience AI (BRD-02) and Underwriting & Risk AI (BRD-03) — governed by SOW-02.
• ACME's separate CMS-0057-F baseline electronic prior-authorization compliance project.
• Enterprise-wide integration and MLOps maturity hardening across all three BRDs — governed by SOW-03.

5. Approach

Year 1 is sequenced so that governance exists before anything is built. Phase 0 stands up the AI Governance and Center of Excellence function, Independent Model Validation as an organizationally separate second line, and the Data Privacy, Cybersecurity and Clinical Policy functions, before the first BRD-01 model is trained. That order is deliberate: a model validated by the team that built it has not been validated, and retrofitting separation after a model is in production means revalidating work already relied upon.

The Consultant works assessment-first. The AI readiness assessment across data, technology and organizational dimensions establishes what the Client actually has rather than what its architecture diagrams claim, and the regulatory mapping against CMS-0057-F, state AI-in-insurance requirements and the NAIC model bulletin fixes the compliance boundary before design choices harden. Both are cheap to do first and expensive to discover later.

Vendor selection is run as an evaluation with an executed contract as its deliverable, not as a recommendation. A selection that ends in a preferred option leaves the Client to negotiate alone, at the point its alternatives have already been dismissed.

Requirements are elaborated through JAD sessions with mandatory Legal, Compliance, Enterprise Architecture and Cybersecurity participation. Mandatory means the session does not proceed without them: in a regulated payer environment the constraints those functions carry are not review comments, they are inputs, and hearing them at design review costs a rebuild.

6. Deliverables

Each Deliverable shall be submitted to Client for written acceptance per the Acceptance Criteria below. Client shall notify Consultant of acceptance or specific, written grounds for rejection within ten (10) business days of submission; a Deliverable not rejected in writing within that period is deemed accepted.

7. Staffing

Consultant will provide onshore and offshore consulting staff across Program Leadership & PMO, Legal, Compliance, AI Governance & CoE, Enterprise Architecture, Independent Model Validation, Data Privacy Office, Cybersecurity, Clinical/Medical Policy, Data & Cloud Platform engineering, and the BRD-01 delivery team, per the roles and rates in the Program's Resource Plan. Client will provide Executive Steering Board participation, SOX/Financial Controls, Program Finance, IT Operations liaison, HR/Workforce Planning, Corporate Communications, and clinical/UM subject-matter experts. Approximately 185–205 of the Program's 262-person life-of-program roster are active at peak during Year 1. The Member & Provider Experience AI and Underwriting & Risk AI delivery teams (BRD-02/BRD-03, 36 people combined) and the Customer UX / Design team are not engaged under this SOW and ramp on under SOW-02. The Quality Assurance & Testing team engages from the BRD-01 test phase, and the Client's User Acceptance Testing team engages for BRD-01 UAT cycles. Consultant may substitute personnel of substantially equivalent skill and experience upon notice to Client's Program Director liaison, provided such substitution does not materially disrupt Deliverable timelines.

The table below sets out the functions engaged under this SOW and their peak concurrent staffing. Headcount reflects peak concurrency within the year, not the Program's 262-person life-of-program roster, which ramps on and off by phase.

Function / Team	Peak Engaged	Staffing Model	Role in This Year
Program Leadership & PMO	16	Pulaski onshore + Client	Program direction, controls, EVM reporting
AI Governance & Center of Excellence	12	Pulaski onshore	CoE charter, governance framework, board stand-up
Enterprise Architecture	8	Mixed	Architecture authority, EARB review
Data & Cloud AI Platform	20	Onshore + offshore	Platform foundation build to Mar 12, 2027 go-live
Claims & Prior Authorization AI (BRD-01)	28	Onshore + offshore	Flagship delivery to production
Quality Assurance & Testing	18	Onshore + offshore	Engages from BRD-01 test phase
User Acceptance Testing	11	Client (non-billable)	BRD-01 UAT cycles and sign-off
Independent Model Validation	6	Pulaski onshore	Second-line validation gate
Cybersecurity / InfoSec	10	Mixed	Threat modeling, controls, penetration testing
Legal	6	Client onshore only	Contract, liability and IP review
Compliance	7	Client onshore only	Regulatory review and liaison
SOX / Financial Controls	6	Client onshore only	Controls testing on payment-affecting scope
Data Privacy Office	5	Client onshore only	DPIA, PHI controls assurance
Clinical / Medical Policy & Informatics	6	Client	Utilization-management SME input
IT Operations / Infrastructure	10	Client	Environments, cutover, operations readiness
Change Management & Training	8	Mixed	Adoption, training, readiness
Program Finance	6	Client	Budget, EVM, invoice reconciliation
HR / Workforce Planning	6	Client	Staffing ramp and onboarding
Corporate Communications	4	Client	Stakeholder communications
Vendor / SaaS Partner Management	4	Mixed	Platform vendor selection and contracting
Customer Service Operations	8	Client	Operational readiness for BRD-01
Year 1 peak concurrency	205	Of the 262-person life-of-program roster. Excludes BRD-02 (22), BRD-03 (14), Customer UX / Design (8) and the Executive Steering & Governance Board (9).

8. Fees, Payment Schedule & Acceptance

Fees are fixed-fee per milestone as set out above and are not subject to adjustment except through formal Change Order (see below). Client shall pay each milestone invoice within thirty (30) days of acceptance of the corresponding Deliverable. Undisputed amounts unpaid after thirty (30) days accrue interest at 1.0% per month or the maximum rate permitted by law, whichever is lower. Reasonable, pre-approved travel and out-of-pocket expenses are billed at cost, without markup, monthly in arrears.

Change Orders

Any change to this SOW's scope, fee, or schedule baseline requires a written Change Order signed by both parties' Program Director/Executive Sponsor and approved by the Executive Steering Board, consistent with the Program's Change Control Log. No verbal or informal modification is binding.

Acceptance Criteria

• Each Deliverable is accepted only upon written sign-off from the Executive Steering Board, and, where applicable, the AI Governance Board and Enterprise Architecture Review Board, per the decision-rights structure in Charter Section 6.
• Any Deliverable involving a production AI model additionally requires a clean Independent Model Validation certification with zero uncorrected Critical/High findings.

9. Service Levels & Performance Measures

Consultant performance under this SOW is measured against the following service levels. Measures are reported monthly by the PMO to the Executive Steering Board as part of standard program reporting, and reviewed formally at each phase gate. Persistent failure to meet a service level is a material performance issue under Section 16.

Performance Measure	Target	Measurement Basis	Remedy
Milestone delivery to agreed dates	≥ 95% on time	Milestone acceptance record	Recovery plan within 10 business days; no milestone payment until accepted
Deliverable first-pass acceptance	≥ 90%	Client acceptance log (Section 8)	Rework performed at Consultant's cost
Critical / high-severity defects escaping to production	0 critical	Post-release defect log	Hypercare remediation at no additional charge
Key-personnel continuity	≤ 10% unplanned turnover per year	Quarterly staffing review	Replacement of substantially equivalent skill within 15 business days
Independent Model Validation turnaround	5–10 business days per submission	IMV queue log	Escalation to the AI Governance Board
Security incidents attributable to Consultant	0	InfoSec incident log	Immediate remediation and root-cause analysis
Monthly program & EVM reporting	100% delivered on cadence	PMO reporting record	Escalation to Program Director

Service levels are measured only against work within Consultant's control. Delays caused by Client dependencies described in Section 10, or by Client-directed changes processed under the Program's change-control procedure, are excluded from the measurement.

10. Client Responsibilities & Assumptions

• Client will provide timely access to legacy claims systems, historical data, and named clinical/UM subject-matter experts for JAD sessions.
• Client's separate CMS-0057-F compliance project remains independently resourced and on its own schedule.
• Cloud/SaaS platform vendor contracts are executed by Client on Consultant's recommendation, with vendor delivery risk tracked per Charter Section 8.

11. Independent Contractor Status

Consultant is an independent contractor and not an employee, agent, joint venturer, or partner of Client. Nothing in this SOW shall be construed to create an employment, partnership, or agency relationship between Client and Consultant or any of Consultant's personnel, whether onshore or offshore, all of whom remain employees or subcontractors of Consultant. Consultant is solely responsible for the payment of all compensation, benefits, and applicable federal, state, and local taxes and withholdings for its personnel. Consultant retains sole discretion over the manner and method by which its personnel perform the Services, subject to the governance, quality, and acceptance standards set out in this SOW and the Program Charter.

12. Confidentiality

Each party acknowledges that it may receive Confidential Information of the other party in the course of performing this SOW. "Confidential Information" means all non-public business, technical, financial, and member/patient information disclosed by either party, including without limitation Client's claims data, member and provider information, underwriting criteria, and system architecture, and Consultant's methodologies, tools, and pricing. Each party agrees to protect the other's Confidential Information using at least the same degree of care it uses to protect its own confidential information of similar nature, and in no event less than a reasonable degree of care, and to use such Confidential Information solely to perform its obligations under this SOW. This Section survives termination or expiration of this SOW for a period of five (5) years, except with respect to PHI and other information required by law to be protected for a longer period, as to which the confidentiality obligation survives for so long as required by applicable law.

13. Data Protection, Privacy & Business Associate Terms

To the extent Consultant's performance of the Services requires access to, use of, or disclosure of PHI, the parties shall execute a Business Associate Agreement ("BAA") consistent with HIPAA and its implementing regulations prior to any such access, and Consultant's obligations with respect to PHI shall be governed by that BAA in addition to this SOW. Consultant shall ensure that any de-identification, offshore data-access, or subcontracting arrangement affecting PHI or other member-identifiable data is reviewed and approved in advance by Client's Data Privacy Office, consistent with the data governance and de-identification standards established under the Program Charter. Consultant shall promptly notify Client of any suspected or actual unauthorized access to, use of, or disclosure of PHI or other Confidential Information in accordance with the notification timelines set out in the BAA and applicable law.

14. Intellectual Property Ownership

Except as set forth below, all Deliverables specifically created for Client under this SOW, including all AI models, prompts, configurations, and documentation developed specifically for Client's use (excluding Consultant's pre-existing tools, accelerators, methodologies, and generalized know-how, collectively "Consultant IP"), shall be deemed "work made for hire" to the extent permitted by law and, to the extent not so deemed, are hereby assigned to Client upon full payment of all fees attributable to the applicable Deliverable. Consultant retains all right, title, and interest in Consultant IP, and grants Client a perpetual, non-exclusive, royalty-free license to use any Consultant IP embedded in the Deliverables solely as necessary for Client's use of the Deliverables. For clarity, third-party cloud/SaaS AI platform licenses remain governed by the applicable vendor's license terms and are not assigned under this SOW.

15. Representations and Warranties

Consultant represents and warrants that: (a) the Services will be performed in a professional and workmanlike manner consistent with generally recognized industry standards for AI program management and delivery; (b) it has the right to engage the onshore and offshore personnel assigned to this SOW; and (c) to its knowledge, the Deliverables will not infringe the intellectual property rights of any third party. EXCEPT AS EXPRESSLY SET FORTH IN THIS SECTION, CONSULTANT MAKES NO OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, AND EXPRESSLY DISCLAIMS ANY WARRANTY THAT ANY AI MODEL DELIVERED UNDER THIS SOW WILL BE ERROR-FREE OR WILL OPERATE WITHOUT INTERRUPTION, IT BEING UNDERSTOOD THAT THE INDEPENDENT MODEL VALIDATION, HUMAN-REVIEW, AND ESCALATION PROTOCOLS DESCRIBED IN THIS SOW AND THE PROGRAM CHARTER ARE THE PARTIES' AGREED MECHANISM FOR MANAGING THAT INHERENT RISK.

16. Indemnification

Consultant shall indemnify, defend, and hold harmless Client from and against third-party claims, damages, and reasonable expenses (including reasonable attorneys' fees) arising from Consultant's gross negligence, willful misconduct, or material breach of its confidentiality or data-protection obligations under this SOW. Client shall indemnify, defend, and hold harmless Consultant from and against third-party claims arising from Client's use of the Deliverables in a manner inconsistent with the acceptance criteria, human-review protocols, or governance requirements set out in this SOW and the Program Charter, or from Client's breach of its payment obligations. Neither party's indemnification obligation extends to claims arising from the other party's own negligence or misconduct.

17. Limitation of Liability

EXCEPT FOR (A) BREACHES OF CONFIDENTIALITY OR DATA PROTECTION OBLIGATIONS, (B) INDEMNIFICATION OBLIGATIONS ABOVE, OR (C) GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, NEITHER PARTY'S AGGREGATE LIABILITY ARISING OUT OF THIS SOW SHALL EXCEED THE TOTAL FEES PAID OR PAYABLE UNDER THIS SOW IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM. NEITHER PARTY SHALL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING LOST PROFITS OR LOST DATA, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

18. Insurance

Throughout the term of this SOW, Consultant shall maintain, at its own expense: (a) Commercial General Liability insurance with limits of not less than $2,000,000 per occurrence; (b) Professional Liability / Errors & Omissions insurance, including coverage for technology and AI-related services, with limits of not less than $10,000,000 per claim; (c) Cyber Liability insurance with limits of not less than $10,000,000 per occurrence, given the Services' access to PHI and member-identifiable data; and (d) Workers' Compensation insurance as required by applicable law. Consultant shall furnish Client with certificates of insurance evidencing this coverage upon request.

19. Non-Solicitation

During the term of this SOW and for twelve (12) months thereafter, neither party shall directly solicit for hire any employee of the other party who was materially involved in the Services, without the other party's prior written consent, except pursuant to a general solicitation not specifically directed at such employee.

20. Force Majeure

Neither party shall be liable for any delay or failure to perform resulting from causes beyond its reasonable control, including acts of God, natural disaster, act of government, change in law materially affecting the scope of Services, labor dispute, or failure of third-party cloud/SaaS infrastructure providers, provided the affected party gives prompt notice and uses commercially reasonable efforts to mitigate the impact. If a force majeure event continues for more than sixty (60) consecutive days, either party may terminate the affected portion of this SOW upon written notice.

21. Assignment

Neither party may assign this SOW without the prior written consent of the other party, except that either party may assign this SOW to a successor in connection with a merger, acquisition, or sale of substantially all of its assets, upon written notice to the other party.

22. Dispute Resolution & Governing Law

The parties shall attempt in good faith to resolve any dispute arising out of this SOW through escalation to the Executive Steering Board within thirty (30) days of written notice of the dispute. If unresolved, either party may pursue binding arbitration under the Commercial Arbitration Rules of the American Arbitration Association, seated in Nashville, Tennessee. This SOW is governed by the laws of the State of Tennessee, without regard to its conflict-of-laws principles.

23. Notices

All notices under this SOW shall be in writing and delivered to the Executive Sponsor (for Client) and the Program Director (for Consultant) identified in the meta-table above, by email with confirmed receipt or by certified mail.

24. Entire Agreement; Order of Precedence; Counterparts

This SOW, together with the MSA and the Program Charter, constitutes the entire agreement between the parties with respect to the Year covered by this SOW, and supersedes all prior discussions, negotiations, and proposals relating to that Year. In the event of conflict, the order of precedence is: (1) this SOW's commercial terms (fees, payment schedule, term), (2) the MSA, (3) the Program Charter, (4) this SOW's scope/deliverables narrative. This SOW may be executed in counterparts, including by electronic signature, each of which is deemed an original.

25. Approval