Vermont digital services chief outlines AI guardrails, cybersecurity work and IT modernization fund

Denise Riley Hughes, secretary of the Agency of Digital Services and Vermont's chief information officer, told a legislative committee the agency is expanding efforts to inventory and govern artificial intelligence, bolster cybersecurity for state and municipal systems, and use a recently created IT modernization fund to prioritize technology projects.

Hughes said the agency has adopted an "off by default" approach to AI, is maintaining an inventory of systems, and is working with an AI advisory council and a newly combined data-and-AI division to set ethics and use guidelines. "We have 37 AI systems that we're running through various departments," Hughes said, noting the number rose from about 21 last year.

The briefing framed why the work matters: the agency cited roughly $3,400,000 in savings and cost avoidance during the past year and a cumulative identified savings of about $5,000,000 from 2017 to 2020. Hughes also described a rapid Summer EBT deployment that delivered benefits to families: "First payments went out the July 1, and the last payment went out August," and she said about 40,000 children received benefits in the summer months.

Nut graf: The presentation combined program results and risk management. Hughes emphasized practical limits on AI use ("human in the loop" for eligibility decisions), the need for data controls to avoid re-identifying sensitive records, and investments in cybersecurity and municipal support to defend against account compromises, phishing, denial-of-service and other threats.

On artificial intelligence, Hughes said Vermont has written user guidelines and a code of ethics adopted by the state's AI advisory council. She described two practical early use cases: automating inventory for Agency of Transportation signage, which cut processing time, and other department pilots such as pavement- and guardrail-related classification work. Hughes warned the committee that AI tools must be carefully managed: "We don't want to just turn on a system or a function where artificial intelligence just enabled, and now you are running algorithms and sending data to places that you didn't intend."

Hughes said the agency has an internal, closed AI chat environment for handling nonpublic information and stressed that the state follows a principle of notifying users when AI is in use. She recommended committee members review the state's code of ethics and user guidelines and offered to provide links and follow-up materials.

On cybersecurity, Hughes highlighted investments in monitoring and partnerships with the Vermont Intelligence Center, the FBI and Homeland Security. She described a federal grant program (state-local cyber grant program) the agency is administering with the Vermont League of Cities and Towns to improve municipal security posture, noting Vermont has about 247 municipalities that are eligible for assistance. "It's going to force people to have to capture authentication. It's going to force them to use state devices when they want to access state systems," Hughes said about planned security changes such as multifactor authentication and .gov domain adoption.

Hughes said the agency has moved its mainframe and server infrastructure to hosted providers and that outsourcing hardware has reduced infrastructure costs. She explained that the public cloud remains managed by state staff even when the underlying hardware is provided by external vendors, and said she avoids naming specific hosting partners for security and procurement reasons.

Hughes reviewed program and project-management practices. She described an enterprise project-management office that tracks projects and uses independent third-party reviews for projects priced over $1 million. Hughes said the state uses a mix of project management methodologies, including agile and hybrid models, and that the agency is working to improve project and financial tracking tools.

On the IT modernization fund created in 2023, Hughes said the fund is appropriated by project and intended as a repository for project appropriations; the governor, CIO and legislature decide funded projects. She listed active projects funded through the IT modernization fund including DMV modernization phase work, a case-management system for the attorney general's office, and an asset-management system for the Department of Buildings and General Services.

Committee members asked for concrete examples, user-testing approaches and cost estimates for shifting municipal and legislative sites to .gov domains; Hughes said links to guidelines and additional materials would be provided by email and that the agency can return for deeper briefings on specific systems and use cases.

Ending: The committee concluded the session with a request for follow-up materials and additional briefings on AI examples and municipal cybersecurity work; Hughes said she and her team would provide links to the AI code of ethics, user guidelines, and other resources and welcomed further questions and future presentations.