Relationships between developers and deployers

(a) Developer responsibilities A developer shall do the following: (1) Upon the reasonable request of the deployer, make available to the deployer information necessary to demonstrate the compliance of the deployer with the requirements of this Act, including— (A) making available a report of the pre-deployment evaluation described in section 102(a) or the annual review of assessments conducted by the developer under section 102(c); and (B) providing information necessary to enable the deployer to conduct and document a pre-deployment evaluation under section 102 (a) or an impact assessment under section 102(b). (2) Either— (A) allow and cooperate with reasonable assessments conducted by the deployer or the deployer’s designated independent auditor; or (B) arrange for an independent auditor to conduct an assessment of the developer’s policies and practices in support of the obligations under this Act using an appropriate and accepted control standard or framework and assessment procedure for such assessments, and provide a report of such assessment to the deployer upon request. (b) Contracts between developers and deployers (1) Requirements A developer may offer or license a covered algorithm to a deployer pursuant to a written contract between the developer and deployer, provided that the contract— (A) clearly sets forth the data processing procedures of the developer with respect to any collection, processing, or transfer of data performed on behalf of the deployer; (B) clearly sets forth— (i) instructions for collecting, processing, transferring, or disposing of data by the developer or deployer in the context of the use of the covered algorithm; (ii) instructions for deploying the covered algorithm as intended; (iii) the nature and purpose of any collection, processing, or transferring of data; (iv) the type of data subject to such collection, processing, or transferring; (v) the duration of such processing of data; and (vi) the rights and obligations of both parties, including a method by which the developer shall notify the deployer of material changes to its covered algorithm; (C) shall not relieve a developer or deployer of any requirement or liability imposed on such developer or deployer under this Act; (D) prohibits both the developer and deployer from combining data received from or collected on behalf of the other party with data the developer or deployer received from or collected on behalf of another party; and (E) shall not prohibit a developer or deployer from raising concerns to any relevant enforcement agency with respect to the other party. (2) Retention of contract Each developer shall retain for a period of 10 years a copy of each contract entered into with a deployer to which it provides requested products or services. (c) Rule of construction For purposes of this section, any requirement for a developer to contract with, assist, and follow the instructions of a deployer shall be read to include a requirement to contract with, assist, and follow the instructions of a government entity if the developer is providing a service to a government entity.