Open registry · version 1.4

The activities that bring software law into scope

An open list of the things software does that the law reaches: crawling the web, generating content, recording calls, serving minors. Each activity has a page saying what triggers it, what does not, and which kinds of law it brings into scope. A repository declares the ones its code performs or enables in a file at its root, ACTIVITIES.md.

How a repository declares its activities in ACTIVITIES.md

37 activities
published 16 Oct 2026
CC BY 4.0

How the list is made

The list is derived from the law, not drawn up in advance. LexLint reads the software law of every jurisdiction in its law library, and for each law records what a product must do for that law to reach it: crawl the web, make content with a model, record a call, serve minors. The activities are the triggers that recur across those laws, each written so that one id means the same thing wherever a law turns on it. As of 19 Oct 2026, 3,651 laws in 271 jurisdictions name at least one of them.

An activity is added only when a law needs it. A new activity needs at least one law in the library that turns on something no activity on the list captures, and its entry in the changelog names that law. A proposal without such a law is not added, however reasonable it sounds.

What code does

Something the component's own code does. A component declares it as performs (the shipped software does it when run as documented) or enables (a product that calls it does it).

No.	Activity	What it is
1 of 37	Crawls the web `crawls_web`	Your app runs automated software that visits and downloads web pages at scale, rather than a person browsing them one at a time.
2 of 37	Trains models `trains_models`	Your app uses data to train or fine-tune a machine learning model, rather than only calling a model someone else already trained.
3 of 37	Generates content with AI `generates_content`	Your app uses artificial intelligence (AI) to produce text, images, audio, or video, rather than only publishing what a person wrote or recorded.
4 of 37	Deploys a chatbot `deploys_chatbot`	Your app runs a conversational interface that answers users in natural language, whether scripted or built on a language model.
5 of 37	Processes voice recordings `processes_voice`	Your app records, stores, or analyzes a person's spoken voice, whether a call, a voice memo, or a voice command.
6 of 37	Processes biometric data `processes_biometrics`	Your app collects or analyzes a physical or behavioral trait, such as a fingerprint, a face, or a voiceprint, to identify or verify a person.
7 of 37	Sends automated outreach `automated_outreach`	Your app contacts people through automated calls, texts, or messages that a person did not individually compose and send.
8 of 37	Makes high-risk automated decisions `high_risk_decisions`	Your app lets software decide, on its own, an outcome with a serious effect on a person, such as a loan, a job, or a benefit.
9 of 37	Under Makes high-risk automated decisions Makes employment decisions `employment_decisions`	Your app makes or scores decisions about a person's work, such as hiring, promotion, pay or termination.
10 of 37	Under Makes high-risk automated decisions Makes credit decisions `credit_decisions`	Your app makes or scores decisions about a person's credit, a loan or another financial service offered to them.
11 of 37	Under Makes high-risk automated decisions Makes insurance decisions `insurance_decisions`	Your app makes or scores decisions about a person's insurance, such as eligibility, a price or a claim.
12 of 37	Under Makes high-risk automated decisions Makes housing decisions `housing_decisions`	Your app makes or scores decisions about a person's housing, such as a rental application or tenant screening.
13 of 37	Under Makes high-risk automated decisions Makes education decisions `education_decisions`	Your app makes or scores decisions about a person's education, such as admission, a grade or a test result.
14 of 37	Under Makes high-risk automated decisions Makes health care decisions `health_care_decisions`	Your app makes or scores decisions about a person's access to health care, such as coverage, prior authorization or triage.
15 of 37	Under Makes high-risk automated decisions Makes public services decisions `public_services_decisions`	Your app makes or scores decisions about a person's public services or benefits, such as eligibility for public assistance.
16 of 37	Under Makes high-risk automated decisions Makes justice decisions `justice_decisions`	Your app makes or scores decisions about a person in law enforcement, migration, the courts or legal services.
17 of 37	Reuses other publishers' content `aggregates_content`	Your app republishes, excerpts, links to, or indexes content another publisher made first: headlines, articles, snippets, or images.
18 of 37	Files records requests `statutory_requests`	Your app automatically submits public-records or freedom-of-information requests to a government body on a user's behalf.
19 of 37	Records calls `records_calls`	Your app records, transcribes, or monitors people talking to each other, on a phone or video call or in a meeting.
20 of 37	Records text chat `records_text_chat`	Your app keeps what users type in a chat, or a vendor's chat feature inside it receives the text as it is typed, whether a person or an assistant answers.
21 of 37	Tracks devices `tracks_devices`	Your app identifies or follows a specific phone, browser, or other device across visits, or across other sites and apps.

How software is offered

A property of how the software is offered. Only an application or service component declares it, and only as performs; distributes_software_product is implied for every component with a package URL.

No.	Activity	What it is
22 of 37	Publishes adult content `publishes_adult_content`	Your app hosts or distributes sexually explicit material, or other content a jurisdiction classifies as harmful to minors.
23 of 37	Operates a social platform `operates_social_platform`	Your app lets users create accounts, post content, and interact with each other's posts in a shared public or semi-public space.
24 of 37	Serves under-18s `serves_minors`	Your app is used by, or knowingly allows, people under the age of eighteen, whether or not it was designed for them.
25 of 37	Operates an app store `operates_app_store`	Your app is itself a storefront that lists, distributes, or lets people download other companies' apps.
26 of 37	Ships a mobile app `ships_mobile_app`	Your app is distributed as a native application for a phone or tablet, through an app store or a direct install.
27 of 37	Distributes a software product `distributes_software_product`	Your app is itself a software product a maker ships to customers, rather than a service you operate and run yourself.

Who the operator is

Who the operator is. A component never declares a role: a payments SDK does not make a product a bank. Roles are declared in a product's own lexlint.yml.

No.	Activity	What it is
28 of 37	Handles health records `handles_health_records`	Your app stores or processes a person's medical history, diagnosis, treatment, or other health information.
29 of 37	Provides financial services `provides_financial_services`	The company behind your app holds a financial-services license, as a bank, lender, insurer, securities firm or payment provider, or supplies software to a firm that does.
30 of 37	Under Provides financial services Is a bank `is_bank`	The company behind your app is a bank, credit union or other deposit-taker, or supplies software to one.
31 of 37	Under Provides financial services Is a lender `is_lender`	The company behind your app regularly lends or arranges credit as a business, such as consumer, business or mortgage loans or buy now, pay later, or supplies software to a lender.
32 of 37	Under Provides financial services Is an insurer `is_insurer`	The company behind your app is an insurer, reinsurer or insurance producer, or a utilization-review organization acting for a health insurer, or supplies software to one.
33 of 37	Under Provides financial services Is a securities firm `is_securities_firm`	The company behind your app is a broker-dealer, investment firm or investment adviser, or a fund or portfolio manager, or supplies software to one.
34 of 37	Under Provides financial services Is a payment provider `is_payment_provider`	The company behind your app is a payment or e-money institution, a money transmitter or a crypto-asset service provider, or supplies software to one.
35 of 37	Runs an essential service `operates_essential_service`	Your app supports infrastructure a government has designated essential, such as energy, water, transport, or health delivery.
36 of 37	Is a listed company `is_listed_company`	The company behind your app has shares traded on a public stock exchange.
37 of 37	Provides telecom services `provides_telecom_services`	Your app carries other people's calls, texts, or internet traffic, rather than only using someone else's network to reach its own users.

The machine files

The list	https://lexlint.io/activities/v1/registry.json: every id with its scope, status, short and long description, and what replaced a retired one.
Its history	https://lexlint.io/activities/v1/changelog.json: every addition, rewording and retirement, dated.
The schema	https://lexlint.io/schema/activities.schema.json: the JSON Schema for the front matter. The LexLint plugin ships the same file.
In CycloneDX	The same record in a bill of materials, through the `lexlint` property namespace.

Retired

An id is never reused. A retired one stays in the list, with what replaced it, so a declaration written against it is told what to write instead.

records_conversations Replaced by records_calls and records_text_chat.

Who keeps the list

LexLint publishes the list and decides additions for now, written so that an open body can take it over. To propose an activity, or a change to one, open an issue at github.com/ungovr/lexlint with its scope, its short and long description, and at least one law that turns on it and that no activity on the list captures. The address carries a major version: an addition or a rewording moves the minor version, and a body that takes the list over gets a new address while this one keeps resolving, so no file breaks.

© 2026 UnGovr, publishing as LexLint. The list's text, its ids and the schema are licensed under Creative Commons Attribution 4.0: use them for any purpose, including commercially, with credit to LexLint (UnGovr).