Developer duties

Section 6-1-1702 of Colorado SB 26-189 gives three duties to a developer of a covered ADMT. The developer is a person doing business in Colorado, as specified in § 6-1-1701(8). The developer must make documentation available to each deployer, give each deployer notices of changes, and keep records.

A person that is not a developer as specified in § 6-1-1701(8) does not have these duties. Thus a deployer that gets a covered ADMT from such a person cannot use § 6-1-1702 to get information from that person. That deployer can get the information by contract, but part 17 does not make this necessary.

A deployer or a different person that "intentionally and substantially modifies an ADMT such that it becomes a covered ADMT" is a developer (§ 6-1-1701(8)(a)(III)). But the persons that § 6-1-1701(8)(b) names are not developers. That provision and, on their conditions, § 6-1-1708(1) to (4) also limit how § 6-1-1702 applies to a developer. For these provisions, see Coverage and roles.

The accessibility duty in § 6-1-1704(8) applies to developers and deployers for the notices and disclosures that part 17 makes necessary.

The effective date of § 6-1-1702 is January 1, 2027 (Section 5 of SB 26-189). SB 26-189 applies to consequential decisions made on or after that date. For all dates, see When SB 26-189 applies.

When the section applies

Two provisions of § 6-1-1702 of SB 26-189 set when a developer has the duties of § 6-1-1702. The conditions of the two provisions are different.

Section 6-1-1702(5) sets when the section applies. The section applies in one of these conditions:

The developer "creates a covered ADMT that is intended, documented, marketed, advertised, configured, or contracted to be used to make consequential decisions".
The developer "becomes aware that the covered ADMT is being used to make consequential decisions in a manner consistent with the intended and contracted uses".

Section 6-1-1702(5) does not make a person a developer. It sets only when § 6-1-1702 applies to a developer.

Section 6-1-1702(3) limits the documentation and the notices:

A developer is subject to the disclosure requirements described in subsections (1) and (2) of this section only for a deployer's use of a covered ADMT where the ADMT was marketed, advertised, configured, contracted, sold, or licensed to be used to materially influence a consequential decision.

Section 6-1-1702(3) limits only the disclosure duties of subsection (1) and subsection (2). It does not limit the record duty in subsection (4).

Documentation for each deployer — § 6-1-1702(1)

Section 6-1-1702(1) of SB 26-189 gives this duty to a developer:

On and after January 1, 2027, a developer shall make available to each deployer of a covered ADMT developed by the developer, in a form and manner that is reasonably understandable to a deployer and that protects trade secrets or information protected from disclosure by state or federal law:

The documentation has five items (§ 6-1-1702(1)(a) to (e)):

Item	The developer makes available
(a)	"a general statement describing the intended uses and known harmful or inappropriate uses of the covered ADMT"
(b)	"a description of the categories of data, including personal data, used to train the covered ADMT, to the extent known"
(c)	"known limitations of the covered ADMT, including known risks and circumstances in which the covered ADMT should not be used"
(d)	"instructions for the deployer's appropriate use, monitoring, and meaningful human review, where applicable"
(e)	"information reasonably necessary for the deployer to comply with section 6-1-1704"

Section 6-1-1702(1)(e) then gives one more duty to the developer: "If information is withheld, the developer shall notify the deployer."

More information about this documentation:

Make available. Section 6-1-1702(1) tells the developer to make the documentation available. No provision of part 17 tells a deployer to request it. A deployer can get and use it, but part 17 does not make this necessary.
The deployer disclosure with a condition about the developer. In part 17, § 6-1-1704(3)(b) is the only deployer duty with a condition about information from the developer. The "instructions and a simple-to-follow process to request additional information" apply "to the extent the deployer receives the necessary information from the developer in compliance with section 6-1-1702".
Meaningful human review. In § 6-1-1702(1)(d), the developer must make available instructions for meaningful human review "where applicable".

Notices of material updates and other changes — § 6-1-1702(2)

Section 6-1-1702(2)(a) of SB 26-189 gives this duty to a developer:

A developer shall provide to each deployer of a covered ADMT developed by the developer a notice of material updates, intentional and substantial modifications, and changes to the intended use of, limitations for, or risk mitigation for the covered ADMT within a reasonable time.

Three types of change make a notice necessary:

Material update (§ 6-1-1701(14)(a)). This is "an update, patch, release, revision, or new version of a covered ADMT, including associated software, model parameters, default settings, or documentation, that a developer knows or reasonably should know is likely to materially affect" one of these:
- "the covered ADMT's outputs or performance in a manner relevant to its intended use"
- "the developer's stated intended use for the covered ADMT".
The exclusion for "routine maintenance, cosmetic changes, or bug fixes" has all of these conditions (§ 6-1-1701(14)(b)):
- They do not materially influence "a covered ADMT's outputs or performance in a manner relevant to its intended use".
- They do not materially influence the developer's "stated intended use" for the covered ADMT.
Intentional and substantial modification (§ 6-1-1701(12)). This is "a deliberate change made to an ADMT that results in a material change to the system's intended, documented, advertised, configured, or contracted use".
Other changes. These are "changes to the intended use of, limitations for, or risk mitigation for the covered ADMT". A change of this type makes a notice necessary also when the change is not a material update or an intentional and substantial modification.

Section 6-1-1702(2)(b) gives a method to comply with the notice duty. A developer "may use public release notes containing the information required by subsection (2)(a) of this section to comply with this subsection (2) if the developer provides direct notice of the public release to each deployer of the covered ADMT". If the developer uses public release notes to comply, it must also give direct notice of the "public release" to each deployer of the covered ADMT.

The limit of § 6-1-1702(3) also applies to this notice duty (see When the section applies).

Developer records — § 6-1-1702(4)

Section 6-1-1702(4) of SB 26-189 gives this duty to a developer:

A developer shall retain, for not less than three years after the creation of a record required or created under this section or for a longer period if required by applicable state or federal law, records reasonably necessary to demonstrate compliance with this section. Records include system version identifiers, changelogs, and documentation and notices of material updates provided to deployers pursuant to subsection (2) of this section.

More information about these records:

Keep, not give. Section 6-1-1702(4) does not tell the developer to give the records to a deployer or to a different person.
Minimum period. The period of three years is a minimum, with more time if applicable state or federal law makes it necessary.
The deployer records. The developer period starts "after the creation of a record". The deployer period starts with the date of a consequential decision (§ 6-1-1703, see Deployer compliance records).

Developer liability — § 6-1-1707

Section 6-1-1707(5) of SB 26-189 gives conditions for developer liability in an action of § 6-1-1707(1), that is, an action "alleging unlawful discrimination under state anti-discrimination laws". For those conditions and the effects of developer compliance with § 6-1-1702 in subsection (6) and subsection (7)(b), see Liability and contract terms.