Agency of Digital Services briefs House committee on consolidation, cybersecurity and AI oversight

Members of the Vermont House Energy and Digital Infrastructure Committee heard a briefing Thursday, Jan. 23, from Denise Riley Hughes, secretary of the Agency of Digital Services (ADS) and state chief information officer, on ADS’s consolidation work, cybersecurity priorities, artificial‑intelligence oversight and major IT projects including a planned enterprise resource planning replacement.

Hughes told the committee, “For the record ... I’m the secretary for the agency of digital services, and I’m also the state CIO, so that’s chief information officer,” and gave a broad overview of ADS’s mission, organization and near‑term priorities.

Why it matters: ADS centralizes IT services across most of state government and supports elected offices and many agencies. Decisions about standards, budgets, security and consolidation shape how Vermonters interact with state services, how the state responds to cyber incidents and how taxpayer dollars are spent on technology.

Hughes traced ADS’s origin to 2017, when it was created first by executive order and then by statute to reduce duplication across department IT units and produce consistent user experiences. She said ADS now organizes work around four strategic focus areas — user experience, standards, security and predictability — and is moving from an initial maturity phase into refinement and consolidation.

On technical debt, Hughes defined the term for the committee as “when we invest in technology and it, degrades and becomes outdated over time,” and said that while some elements are unpredictable, ADS is working to shift from a reactive to a predictive operating model to limit future costs and outages.

Security and cyber posture were a repeated theme. Hughes said ADS has a chief information security officer and a dedicated security division focused on intrusion detection and prevention, and that the agency uses a third‑party monitoring vendor for 24/7 coverage. “Security is nonnegotiable. We don’t get an option to choose security in the system,” she told the committee. Hughes also described ADS’s work with the state’s cyber advisory council, the Vermont Intelligence Center and other partners to support critical infrastructure and municipal cybersecurity preparedness.

On artificial intelligence, Hughes said ADS was an early adopter of a dedicated AI director and published a code of ethics for AI usage across state government. She reported the agency’s inventory of AI/automation systems rose from 24 last year to “past 37” this year, and described a limited pilot of an internal AI chatbot for state employees to allow restricted use of sensitive data while discouraging use of public tools for protected information.

Hughes outlined enterprise architecture and project management work: an EPMO dashboard that lists roughly 60–70 active projects, an enterprise case‑management platform used by nine agencies, and a consolidated enterprise services division formed in fiscal 2024 to replace scattered shared‑services teams. ADS also described vendor management and a growing finance/business operations team to track contracts, negotiate rates, and pursue cost savings.

The committee heard that ADS is cosponsoring a large ERP replacement with Secretary Clark; Hughes said the project is more than a technology upgrade because it will transform business processes across state government. She said many existing systems are out of support and limit automated reporting and other needed capabilities.

Hughes flagged accessibility obligations: ADS is working to meet Department of Justice Title II requirements for web accessibility and to reduce the state’s large inventory of web pages (she cited roughly 60,000 pages under vermont.gov) so content meets ADA and usability standards.

Committee members asked about consolidation impacts on agency staff, the balance between cloud and on‑premises hosting (Hughes called ADS a “cloud‑first” agency but said it maintains some diversity to reduce concentration risk), how much work is done in‑house versus by vendors (ADS said it does not track a single percentage but aims to run projects with internal leads and established vendor retainers when needed) and how the legislature would be notified in a serious cyber incident. Hughes said security matters are often handled in executive session because of sensitivity and confidentiality requirements.

The briefing included several near‑term deliverables for the committee: the AI report and inventory, the EPMO project dashboard, the cyber advisory council materials, and follow‑up discussion on executive‑session rules for security briefings. Committee leaders invited ADS to return for a second session to continue the overview and for future agency‑by‑agency briefings.

The presentation contained a mix of operational detail (staffing, an EPMO dashboard, vendor‑retainer arrangements) and programmatic items (municipal cybersecurity grants, Title II accessibility timeline, the ERP initiative) that members said they want to track in follow‑up meetings.