Deployer or Developer? Which One Are You Under Colorado’s AI Law

SB 26-189 assigns duties by role. A developer builds the technology. A deployer uses it. Most Colorado businesses are deployers and nothing else, which is the simpler position to be in. A meaningful number are quietly both, and they are usually the ones who have not thought about it.

The definitions

A deployer is a person doing business in Colorado that deploys a covered automated decision-making technology. Deploying means putting it to use in your operation to make, guide, or assist a consequential decision.

A developer is a person doing business in Colorado that does any of three things: develops, offers, sells, leases, licenses, or otherwise makes a covered ADMT commercially available; develops a component designed, marketed, intended, documented, advertised, configured, or contracted to be used as part of a covered ADMT; or intentionally and substantially modifies an ADMT such that it becomes a covered ADMT.

The internal-use exclusion, which changes the answer for a lot of businesses

The Act says a developer does not include a person that develops and uses an ADMT for internal purposes, including use and development activities by affiliates and commercial support functions, so long as that person does not make the system available to another person for use in a consequential decision.

So a staffing firm that built its own candidate ranking tool and runs it only on its own hiring is not a developer. It is a deployer, with deployer obligations, and that is the whole answer. Building something for yourself does not put you on the developer side of the line. Handing it to someone else does.

There is a parallel exclusion for research: developing and using an ADMT solely for research, where it is not used in a consequential decision within that research.

What “intentionally and substantially modifies” actually means

This one is defined too, and more narrowly than the plain words suggest. An intentional and substantial modification is a deliberate change to an ADMT that results in a material change to the system’s intended, documented, advertised, configured, or contracted use.

The test is whether you changed what the system is for, not how hard you tuned it. Fine-tuning a hiring tool to work better on your own hiring is not obviously a change in intended use. Repurposing a marketing tool into a tenant screening tool plainly is. If you customized heavily but the documented purpose never moved, you have a real argument that you did not modify it within the meaning of the Act.

The Attorney General has asked for comment on what facts should determine whether a component is designed, marketed, intended, documented, advertised, configured, or contracted for use as part of a covered ADMT. Expect the rules to say more here.

Two more exclusions worth knowing

A preceding developer that makes an ADMT commercially available is not a developer as to changes an unaffiliated person makes that alter the system’s intended, documented, marketed, advertised, configured, or contracted use. If a customer repurposes your product into something you never built it for, that is on them.

Likewise, someone who supplied a component is not a developer where the component was integrated into a covered ADMT without that person’s actual knowledge.

When you really are both

The overlap case that survives all of the above is selling. A Colorado software company that added a scoring feature its customers use in consequential decisions is a developer, even if it thinks of itself as selling workflow software, and it is separately a deployer as to anything it runs internally.

That catches Front Range companies who do not consider themselves AI companies at all. If your product scores, ranks, or classifies people, and customers use those outputs in one of the seven covered domains, the statute is looking at you regardless of how the product is described.

What each role owes

Deployer obligations are the ones most Colorado businesses will live with: clear and conspicuous notice before covered ADMT materially influences a consequential decision, notice within 30 days of an adverse outcome describing the role the technology played, and records retained at least three years. Plus a working process for consumers who ask to correct inaccurate personal data or request meaningful human review.

Developer obligations run to disclosure and documentation that lets deployers meet their own duties. A developer who tells customers nothing about how the system works is selling a product its customers cannot lawfully deploy in Colorado, which is a commercial problem before it is a legal one.

Do not read the split as a way to pass the duty along. A deployer who licenses a tool still owes the notices. Buying the software does not transfer anything.

How to place yourself

Work through it in order:

• Do you use software that scores, ranks, classifies, or recommends people in education enrollment or an education opportunity; employment or an employment opportunity that creates or may create an employer-employee relationship; the lease or purchase of residential real estate in Colorado; a financial or lending service; insurance, including underwriting, pricing, coverage, and claims adjudication; health-care services; and essential government services and public benefits, including eligibility and renewal determinations decisions? If yes, you are a deployer.
• Did you build any of it, tune it on your own data, or assemble tools into something that produces a new output? If yes, look hard at developer status.
• Do you sell, license, or offer any of it to others who use it that way? If yes, you are a developer as to that product.

Most businesses answer yes to the first and no to the others. If you answered yes to more than one, you are carrying two sets of obligations and they do not collapse into each other.

Why this is worth settling now

In short, the effective date is January 1, 2027 and the Attorney General’s rules are due the same day, which means operational detail arrives close to the deadline. A business that knows its role can absorb the rules when they issue. A business still arguing about whether it is a developer will be starting from zero in December.

If you are somewhere in the middle, that is a reason to work it through rather than a reason to wait. Start with the compliance checklist, and see the coverage article for why company size does not resolve it. If placing yourself is not obvious, I would welcome the chance to work through it with you.