SB 26-189 Vendor Requirements: What AI Developers Must Provide to Deployers

If you sell, license, or provide AI systems that deployers use in consequential decisions, SB 26-189 imposes specific documentation requirements on you as a developer. These obligations exist independent of any contractual terms — the statute requires them.

The Documentation Package

Section 6-1-1702 requires developers to make available to deployers "reasonably detailed" information about their AI systems. The statute specifies several categories.

Intended uses and known limitations. You must describe what the system is designed to do and, critically, what it should not be used for. If your credit scoring model was trained on data from one demographic segment, the limitations section should say so. If your system has known failure modes under certain input conditions, those must be documented.

Training data categories. You must describe the categories of data used to train the system. This does not require disclosing proprietary datasets by name, but it requires enough specificity that a deployer can understand the data foundations of the system. "Various public and proprietary datasets" is insufficient. "Consumer credit bureau records, employment verification data, and publicly available financial filings from 2018-2025" is the level of specificity the statute contemplates.

Evaluation and performance. How was the system tested? What metrics were used? What were the results? Deployers need this information to make informed decisions about whether the system is appropriate for their use case.

Instructions for meaningful human review. This is the requirement most vendors overlook. You must provide deployers with enough information to implement meaningful human review of the system's outputs. This means explaining what the system outputs, what factors drive those outputs, and what a human reviewer should check before acting on the system's recommendation.

Ongoing Update Obligations

The documentation obligation is not one-and-done. Developers must provide updated information when material changes occur — new training data, significant model updates, newly discovered limitations, or changes in the system's intended use scope.

The statute does not define "material" or specify a timeframe for updates. Best practice is to establish a cadence (quarterly at minimum) and to push critical updates immediately when safety-relevant limitations are discovered.

How This Affects Vendor Contracts

Smart deployers will embed SB 26-189 requirements directly into vendor contracts. Expect to see provisions requiring developers to deliver the documentation package before deployment, provide updates within a specified timeframe, cooperate with deployer compliance efforts, and maintain documentation records for the required retention period.

Developers who proactively build these capabilities into their product documentation gain a competitive advantage. An AI Clear transparency rating of B or above signals to deployers that the vendor's governance practices already meet the documentation standard SB 26-189 requires.