Statement of Work 02

1. Definitions

• "Agreement" means, collectively, the Master Consulting Services Agreement between ACME Highland Health ("Client") and Pulaski Advisory Group ("Consultant") dated August 3, 2026 (the "MSA"), this Statement of Work, and all Exhibits attached hereto.
• "Program Charter" means the Program Charter for "Project Catalyst" (the ACME Highland Health AI Transformation Program), dated August 3, 2026, as may be amended, which is incorporated into this SOW by reference.
• "Deliverables" means the work product, documentation, software configurations, models, and reports identified in the Deliverables section of this SOW.
• "Confidential Information" has the meaning given in the Confidentiality section below.
• "PHI" means Protected Health Information as defined under the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA").
• Capitalized terms not otherwise defined in this SOW have the meanings given in the MSA or the Program Charter.

2. Relationship to Master Agreement and Program Charter

This SOW is issued pursuant to, and is governed by the terms and conditions of, the MSA between Client and Consultant. In the event of a conflict between the terms of this SOW and the MSA, the terms of the MSA shall control unless this SOW expressly states that a specific MSA provision is superseded for purposes of this SOW. In the event of a conflict between this SOW and the Program Charter, this SOW controls as to the commercial and legal terms of the engagement described herein, and the Program Charter controls as to program governance, decision rights, and technical/functional scope not otherwise addressed in this SOW.

3. Background & Purpose

This Statement of Work is issued under the Program Charter for "Project Catalyst," following Client's acceptance of all Year 1 Deliverables under SOW-01, including the full production scale of Claims & Prior Authorization AI (BRD-01) and the standing AI Governance & Center of Excellence, Independent Model Validation, and Data Privacy Office functions established in Year 1. This SOW governs Year 2 only.

Year 2 runs the Program's two remaining flagship AI capabilities in parallel: Member & Provider Experience AI (BRD-02) and Underwriting & Risk AI (BRD-03). This is the Program's heaviest concurrent-staffing year, reflecting two full delivery workstreams running simultaneously under the governance foundation built in Year 1.

4. Scope of Services

BRD-02: Member & Provider Experience AI

• JAD session series with mandatory Legal, Compliance, Enterprise Architecture, Cybersecurity, and Customer Service Operations/Customer UX participation.
• Design, build, and test of conversational AI and agent-assist capability for member self-service, call-center support, and provider-facing tools, modeled on production patterns already live at peer national payers.
• Mandatory escalation-to-human protocols and pre-release consistency testing against official policy documentation, in direct response to the liability exposure demonstrated by Moffatt v. Air Canada.
• Independent Model Validation testing prior to pilot and full production release.

BRD-03: Underwriting & Risk AI

• JAD session series with mandatory Legal, Compliance, Enterprise Architecture, and actuarial SME participation.
• Design, build, and test of predictive risk-scoring and pricing-assist capability for underwriting.
• Mandatory fairness/disparate-impact testing by the independent Model Validation team before any model influences a pricing or coverage decision.

Out of Scope for This SOW

• Enterprise-wide integration across all three BRDs and MLOps maturity hardening — governed by SOW-03.
• Any modification to Claims & Prior Authorization AI (BRD-01) beyond routine production support already established under SOW-01.

5. Approach

Year 2 builds member and provider-facing capability, which changes what care is owed. A model that supports an internal decision is reviewed by staff who know its limits; a conversational agent speaks directly to a member who does not. The Consultant's method reflects that asymmetry throughout.

Design work proceeds from production patterns already live at peer national payers rather than from first principles. The Client is not the first organization to put an agent in front of members, and originality in this layer buys risk rather than advantage.

Escalation-to-human protocols and pre-release consistency testing against official policy documentation are treated as build requirements, not as safeguards added at hardening. The reference is Moffatt v. Air Canada, where an organization was held to what its automated agent said rather than to what its published policy said. Consistency testing exists so those two cannot diverge; an agent that is merely accurate most of the time is a liability surface.

Independent Model Validation reviews each capability before release, on the same second-line separation established in Year 1. The Consultant does not validate its own build, and a validation finding is closed by evidence rather than by explanation.

6. Deliverables

Each Deliverable shall be submitted to Client for written acceptance per the Acceptance Criteria below. Client shall notify Consultant of acceptance or specific, written grounds for rejection within ten (10) business days of submission; a Deliverable not rejected in writing within that period is deemed accepted.

7. Staffing

Consultant will provide onshore and offshore consulting staff for the BRD-02 and BRD-03 delivery teams (Member & Provider Experience AI, 22; Underwriting & Risk AI, 14), Customer UX/Design, and continued AI Governance & CoE, Independent Model Validation, and Data Privacy Office support across both new BRDs. Client will provide Customer Service Operations, actuarial subject-matter experts, and continued Executive Steering Board, Legal, Compliance, SOX, and Enterprise Architecture participation. This is the Program's peak concurrent-staffing year; approximately 230–250 of the 262-person life-of-program roster are active at peak during Year 2, the highest of the Program's three years. The Quality Assurance & Testing and User Acceptance Testing teams are engaged across both BRD-02 and BRD-03 test and UAT cycles, and the Customer UX / Design team engages in full for the member and provider experience work.

The table below sets out the functions engaged under this SOW and their peak concurrent staffing. Headcount reflects peak concurrency within the year, not the Program's 262-person life-of-program roster, which ramps on and off by phase.

Function / Team	Peak Engaged	Staffing Model	Role in This Year
Program Leadership & PMO	16	Pulaski onshore + Client	Program direction, controls, EVM reporting
AI Governance & Center of Excellence	12	Pulaski onshore	Model governance across three production models
Enterprise Architecture	8	Mixed	Architecture authority for parallel delivery
Data & Cloud AI Platform	20	Onshore + offshore	Platform scaling for BRD-02/03 workloads
Claims & Prior Authorization AI (BRD-01)	28	Onshore + offshore	Production support, optimization, retraining
Member & Provider Experience AI (BRD-02)	22	Onshore + offshore	Full delivery lifecycle to production
Underwriting & Risk AI (BRD-03)	14	Onshore + offshore	Full delivery lifecycle incl. shadow mode
Customer UX / Design	8	Mixed	Experience design for member and provider channels
Quality Assurance & Testing	18	Onshore + offshore	Test execution across BRD-02 and BRD-03
User Acceptance Testing	11	Client (non-billable)	UAT cycles for both delivery legs
Independent Model Validation	6	Pulaski onshore	Second-line validation for both new models
Cybersecurity / InfoSec	10	Mixed	Controls assurance and penetration testing
Legal	6	Client onshore only	Contract, liability and IP review
Compliance	7	Client onshore only	Regulatory review, NAIC and state AI law
SOX / Financial Controls	6	Client onshore only	Controls testing on payment-affecting scope
Data Privacy Office	5	Client onshore only	DPIA and PHI controls assurance
Clinical / Medical Policy & Informatics	6	Client	Clinical policy and actuarial SME input
IT Operations / Infrastructure	10	Client	Environments, cutover, operations readiness
Change Management & Training	8	Mixed	Adoption and training at scale
Program Finance	6	Client	Budget, EVM, invoice reconciliation
HR / Workforce Planning	6	Client	Peak-year staffing management
Corporate Communications	4	Client	Member, provider and internal communications
Vendor / SaaS Partner Management	4	Mixed	Vendor performance and SLA management
Customer Service Operations	12	Client	Frontline readiness and pilot support
Year 2 peak concurrency	253	Of the 262-person life-of-program roster. Excludes the Executive Steering & Governance Board (9), which governs rather than delivers.

8. Fees, Payment Schedule & Acceptance

Fees are fixed-fee per milestone as set out above and are not subject to adjustment except through formal Change Order (see below). Client shall pay each milestone invoice within thirty (30) days of acceptance of the corresponding Deliverable. Undisputed amounts unpaid after thirty (30) days accrue interest at 1.0% per month or the maximum rate permitted by law, whichever is lower. Reasonable, pre-approved travel and out-of-pocket expenses are billed at cost, without markup, monthly in arrears.

Change Orders

Any change to this SOW's scope, fee, or schedule baseline requires a written Change Order signed by both parties' Program Director/Executive Sponsor and approved by the Executive Steering Board, consistent with the Program's Change Control Log. No verbal or informal modification is binding.

Acceptance Criteria

• Each Deliverable is accepted only upon written sign-off from the Executive Steering Board, and, where applicable, the AI Governance Board and Enterprise Architecture Review Board, per the decision-rights structure in Charter Section 6.
• Any Deliverable involving a production AI model additionally requires a clean Independent Model Validation certification with zero uncorrected Critical/High findings.

9. Service Levels & Performance Measures

Consultant performance under this SOW is measured against the following service levels. Measures are reported monthly by the PMO to the Executive Steering Board as part of standard program reporting, and reviewed formally at each phase gate. Persistent failure to meet a service level is a material performance issue under Section 16.

Performance Measure	Target	Measurement Basis	Remedy
Milestone delivery to agreed dates	≥ 95% on time	Milestone acceptance record	Recovery plan within 10 business days; no milestone payment until accepted
Deliverable first-pass acceptance	≥ 90%	Client acceptance log (Section 8)	Rework performed at Consultant's cost
Critical / high-severity defects escaping to production	0 critical	Post-release defect log	Hypercare remediation at no additional charge
Key-personnel continuity	≤ 10% unplanned turnover per year	Quarterly staffing review	Replacement of substantially equivalent skill within 15 business days
Independent Model Validation turnaround	5–10 business days per submission	IMV queue log	Escalation to the AI Governance Board
Security incidents attributable to Consultant	0	InfoSec incident log	Immediate remediation and root-cause analysis
Monthly program & EVM reporting	100% delivered on cadence	PMO reporting record	Escalation to Program Director

Service levels are measured only against work within Consultant's control. Delays caused by Client dependencies described in Section 10, or by Client-directed changes processed under the Program's change-control procedure, are excluded from the measurement.

10. Client Responsibilities & Assumptions

• Client will provide timely access to member/provider engagement data, call-center systems, and named actuarial and Customer Service Operations subject-matter experts for JAD sessions.
• Client will maintain the AI Governance & CoE, Independent Model Validation, and Data Privacy Office functions established under SOW-01 as active, funded functions throughout Year 2.
• Cloud/SaaS platform capacity established under SOW-01 is assumed sufficient for two additional concurrent AI workstreams; material capacity shortfalls are a Change Order trigger.

11. Independent Contractor Status

Consultant is an independent contractor and not an employee, agent, joint venturer, or partner of Client. Nothing in this SOW shall be construed to create an employment, partnership, or agency relationship between Client and Consultant or any of Consultant's personnel, whether onshore or offshore, all of whom remain employees or subcontractors of Consultant. Consultant is solely responsible for the payment of all compensation, benefits, and applicable federal, state, and local taxes and withholdings for its personnel. Consultant retains sole discretion over the manner and method by which its personnel perform the Services, subject to the governance, quality, and acceptance standards set out in this SOW and the Program Charter.

12. Confidentiality

Each party acknowledges that it may receive Confidential Information of the other party in the course of performing this SOW. "Confidential Information" means all non-public business, technical, financial, and member/patient information disclosed by either party, including without limitation Client's claims data, member and provider information, underwriting criteria, and system architecture, and Consultant's methodologies, tools, and pricing. Each party agrees to protect the other's Confidential Information using at least the same degree of care it uses to protect its own confidential information of similar nature, and in no event less than a reasonable degree of care, and to use such Confidential Information solely to perform its obligations under this SOW. This Section survives termination or expiration of this SOW for a period of five (5) years, except with respect to PHI and other information required by law to be protected for a longer period, as to which the confidentiality obligation survives for so long as required by applicable law.

13. Data Protection, Privacy & Business Associate Terms

To the extent Consultant's performance of the Services requires access to, use of, or disclosure of PHI, the parties shall execute a Business Associate Agreement ("BAA") consistent with HIPAA and its implementing regulations prior to any such access, and Consultant's obligations with respect to PHI shall be governed by that BAA in addition to this SOW. Consultant shall ensure that any de-identification, offshore data-access, or subcontracting arrangement affecting PHI or other member-identifiable data is reviewed and approved in advance by Client's Data Privacy Office, consistent with the data governance and de-identification standards established under the Program Charter. Consultant shall promptly notify Client of any suspected or actual unauthorized access to, use of, or disclosure of PHI or other Confidential Information in accordance with the notification timelines set out in the BAA and applicable law.

14. Intellectual Property Ownership

Except as set forth below, all Deliverables specifically created for Client under this SOW, including all AI models, prompts, configurations, and documentation developed specifically for Client's use (excluding Consultant's pre-existing tools, accelerators, methodologies, and generalized know-how, collectively "Consultant IP"), shall be deemed "work made for hire" to the extent permitted by law and, to the extent not so deemed, are hereby assigned to Client upon full payment of all fees attributable to the applicable Deliverable. Consultant retains all right, title, and interest in Consultant IP, and grants Client a perpetual, non-exclusive, royalty-free license to use any Consultant IP embedded in the Deliverables solely as necessary for Client's use of the Deliverables. For clarity, third-party cloud/SaaS AI platform licenses remain governed by the applicable vendor's license terms and are not assigned under this SOW.

15. Representations and Warranties

Consultant represents and warrants that: (a) the Services will be performed in a professional and workmanlike manner consistent with generally recognized industry standards for AI program management and delivery; (b) it has the right to engage the onshore and offshore personnel assigned to this SOW; and (c) to its knowledge, the Deliverables will not infringe the intellectual property rights of any third party. EXCEPT AS EXPRESSLY SET FORTH IN THIS SECTION, CONSULTANT MAKES NO OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, AND EXPRESSLY DISCLAIMS ANY WARRANTY THAT ANY AI MODEL DELIVERED UNDER THIS SOW WILL BE ERROR-FREE OR WILL OPERATE WITHOUT INTERRUPTION, IT BEING UNDERSTOOD THAT THE INDEPENDENT MODEL VALIDATION, HUMAN-REVIEW, AND ESCALATION PROTOCOLS DESCRIBED IN THIS SOW AND THE PROGRAM CHARTER ARE THE PARTIES' AGREED MECHANISM FOR MANAGING THAT INHERENT RISK.

16. Indemnification

Consultant shall indemnify, defend, and hold harmless Client from and against third-party claims, damages, and reasonable expenses (including reasonable attorneys' fees) arising from Consultant's gross negligence, willful misconduct, or material breach of its confidentiality or data-protection obligations under this SOW. Client shall indemnify, defend, and hold harmless Consultant from and against third-party claims arising from Client's use of the Deliverables in a manner inconsistent with the acceptance criteria, human-review protocols, or governance requirements set out in this SOW and the Program Charter, or from Client's breach of its payment obligations. Neither party's indemnification obligation extends to claims arising from the other party's own negligence or misconduct.

17. Limitation of Liability

EXCEPT FOR (A) BREACHES OF CONFIDENTIALITY OR DATA PROTECTION OBLIGATIONS, (B) INDEMNIFICATION OBLIGATIONS ABOVE, OR (C) GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, NEITHER PARTY'S AGGREGATE LIABILITY ARISING OUT OF THIS SOW SHALL EXCEED THE TOTAL FEES PAID OR PAYABLE UNDER THIS SOW IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM. NEITHER PARTY SHALL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING LOST PROFITS OR LOST DATA, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

18. Insurance

Throughout the term of this SOW, Consultant shall maintain, at its own expense: (a) Commercial General Liability insurance with limits of not less than $2,000,000 per occurrence; (b) Professional Liability / Errors & Omissions insurance, including coverage for technology and AI-related services, with limits of not less than $10,000,000 per claim; (c) Cyber Liability insurance with limits of not less than $10,000,000 per occurrence, given the Services' access to PHI and member-identifiable data; and (d) Workers' Compensation insurance as required by applicable law. Consultant shall furnish Client with certificates of insurance evidencing this coverage upon request.

19. Non-Solicitation

During the term of this SOW and for twelve (12) months thereafter, neither party shall directly solicit for hire any employee of the other party who was materially involved in the Services, without the other party's prior written consent, except pursuant to a general solicitation not specifically directed at such employee.

20. Force Majeure

Neither party shall be liable for any delay or failure to perform resulting from causes beyond its reasonable control, including acts of God, natural disaster, act of government, change in law materially affecting the scope of Services, labor dispute, or failure of third-party cloud/SaaS infrastructure providers, provided the affected party gives prompt notice and uses commercially reasonable efforts to mitigate the impact. If a force majeure event continues for more than sixty (60) consecutive days, either party may terminate the affected portion of this SOW upon written notice.

21. Assignment

Neither party may assign this SOW without the prior written consent of the other party, except that either party may assign this SOW to a successor in connection with a merger, acquisition, or sale of substantially all of its assets, upon written notice to the other party.

22. Dispute Resolution & Governing Law

The parties shall attempt in good faith to resolve any dispute arising out of this SOW through escalation to the Executive Steering Board within thirty (30) days of written notice of the dispute. If unresolved, either party may pursue binding arbitration under the Commercial Arbitration Rules of the American Arbitration Association, seated in Nashville, Tennessee. This SOW is governed by the laws of the State of Tennessee, without regard to its conflict-of-laws principles.

23. Notices

All notices under this SOW shall be in writing and delivered to the Executive Sponsor (for Client) and the Program Director (for Consultant) identified in the meta-table above, by email with confirmed receipt or by certified mail.

24. Entire Agreement; Order of Precedence; Counterparts

This SOW, together with the MSA and the Program Charter, constitutes the entire agreement between the parties with respect to the Year covered by this SOW, and supersedes all prior discussions, negotiations, and proposals relating to that Year. In the event of conflict, the order of precedence is: (1) this SOW's commercial terms (fees, payment schedule, term), (2) the MSA, (3) the Program Charter, (4) this SOW's scope/deliverables narrative. This SOW may be executed in counterparts, including by electronic signature, each of which is deemed an original.

25. Approval