SBA · SBA-33 · record R3189

Developer Code Assistant AI

Small Business Administration · OCIO: Office of the Chief Information Officer

Overview

Development stage: In development or acquisitionSource: a) Pre-deployment – The use case is in a development or acquisition status.
High-impact designation: Not high-impactSource: c) Not high-impact
Impact justification: Not high impact: This AI system does not meet the criteria of any of the six pillars that make up High Impact AI in Memorandum M-25-21.
Start date: 2026-01-01 (day precision)Source: 01/01/2026 00:00:00
Withheld from public reporting: NoSource: a) No

Mission

Topic area: Information Technology
Operational functions: Software development assistance, Translation and transcription Derived by keyword rules; see methodology

Problem the AI is intended to solve

Software developers spend significant time on repetitive coding tasks, writing boilerplate code, creating documentation, generating unit tests, and conducting code reviews. Legacy code modernization is complex and time-consuming. Understanding large codebases requires extensive manual analysis. Developers need context-aware assistance that understands company-specific code patterns and AWS best practices.

Expected benefits

Accelerates software development by up to 57% through intelligent code completion and generation. Reduces time spent on documentation, unit testing, and code reviews through autonomous agentic capabilities. Transforms legacy applications automatically (e.g., .NET upgrades, Java version migrations). Improves code quality with AWS-specific best practices and security recommendations. Enables faster onboarding to complex codebases. Customizes to private repositories for company-specific relevance. Supports inline chat for contextual help. Provides CLI natural language translation for command-line efficiency.

System outputs

Generative AI-powered coding assistant for building, operating, and transforming software with advanced agentic capabilities. Provides real-time code suggestions from snippets to full functions based on comments and existing code. Features inline chat in IDE, CLI completions, natural language-to-bash translation, and customization with private repositories for company-specific recommendations. Agentic capabilities autonomously perform multi-step tasks including unit testing, documentation, code reviews, refactoring, and legacy code transformation. Achieved highest scores on SWE-Bench Leaderboard. Input: natural language prompts, code context, GitHub issues, repository code. Output: code suggestions, full functions, documentation, unit tests, code reviews, pull requests, diagrams, refactored code.

Technology

AI classification: Generative AISource: Generative AI: AI that generates new or synthetic content (e.g., images, videos, audio, text, code).
System name(s): Amazon Q Developer
Custom-developed code: No
Public source code: Not applicable - No custom code

Sourcing

How it was built: Purchased from vendorSource: a) Purchased from a vendor
Vendor (as reported): Amazon Web Services (AWS)
Vendors (standardized): Amazon Web Services

A vendor is the supplier named by the agency. It does not identify the underlying model or AI technology.

Data and privacy

Involves PII: Yes
Privacy Impact Assessment: Not publicly available
Authorization to Operate: Yes
Demographic features: k) None of the above
Training and evaluation data: Commercial vendor-managed training data including public code repositories and technical documentation
Federal Data Catalog: Not applicable - Proprietary vendor training data

Governance

8 of 8 minimum-practice questions answered. A blank answer means the agency reported nothing; it does not mean the practice is absent.

Pre-deployment testingReported in placeSource: a) Yes

AI impact assessmentReported in placeSource: a) Yes

Independent reviewReported in placeSource: a) Yes – by another appropriate agency office or reviewer not directly involved in the AI’s development

Ongoing monitoringReported in placeSource: a) Yes, sufficient monitoring protocols have been established

Operator trainingReported in placeSource: a) Yes, sufficient and periodic training has been established

Fail-safeReported in placeSource: a) Yes

Appeal processNot applicableSource: b) Not applicable

User and public consultationOther or ambiguous answerSource: Conducted pilot testing with development teams across multiple projects, collected feedback on code suggestion quality and accuracy, monitored acceptance rates of AI-generated code, established feedback loops through developer surveys and usage analytics, incorporated security team input on code safety, validated autonomous agent outputs through code review processes, and continuously refined recommendations based on developer acceptance patterns and AWS best practices evolution.Flag: free-text answer

Potential impacts and how they were identified

Potential impacts include code quality, security vulnerabilities from AI-generated code, and automated changes to production systems. Impacts identified through developer pilot testing, security code reviews of AI suggestions, and analysis of autonomous agent actions. Mitigation includes mandatory human code review before deployment, security scanning of AI-generated code, developer training on validating AI suggestions, version control safeguards, and restricted permissions for automated changes requiring approval workflows.