What the law makes you able to show

1 · Prompts, traces and tool calls

The record of what ran and what it did.

This is the class an incident responder cares about most and the one binding law says least about. What privacy law asks for is a record of processing: the purposes, the categories of people and data, the recipients, the transfers. That is an organisational register, and it can be complete while telling you nothing about what happened at eleven o'clock on Tuesday.

The first law in the corpus to ask for the other thing is the EU AI Act, and it is not in force yet. Its Article 12 (record-keeping) requires automatic event logging to be built into a high-risk system so that it can record events over the system's lifetime, designed to support identifying an emerging risk, a substantial modification, and monitoring by the provider and the deployer; Article 19 and Article 26(6) put the keeping duty on the provider and the deployer respectively; and Article 21(2) lets a competent authority ask for those logs on a reasoned request. All four apply from 2027-12-02, not yet in effect.

In force today, the nearest thing is sectoral: India's CERT-In Cyber Security Directions require an organisation's system logs to be enabled, retained securely within Indian jurisdiction on a rolling basis, and provided with an incident report or on the authority's direction.

What each jurisdiction's law requires of a log, category by category and at length, is the research at What the law requires of logs. This class states what an operator can be made to produce; that section states which law asks for it, where, and in what form.

44 requirement lines in force · 56 provisions · 45 jurisdictions · from: privacy 28 · AI 17 · cybersecurity 15 · scraping 5

2 · Agent and workload identity

Which system acted, and on whose authority.

An AGENT acting on behalf of a person raises a question the corpus barely asks: which system acted, and whose authority was it using? The identity duties in force are about people and organisations. Privacy law asks who the controller is and whether a unique identifier may be assigned to a person at all, which is the opposite question. Where an identity duty does reach a machine, it is usually the duty to say that a machine is what you are dealing with, which sits with the disclosure rules in Global AI law: 8 common threads rather than here.

This is the widest gap on the page between what a responder needs and what a statute requires, and it is worth stating plainly: if your record cannot say which agent, which version and which delegation chain produced an action, almost nothing in force today will have told you so. Jurisdiction in logs takes one part of the same problem, the jurisdiction a request was served under, and argues it as a field the record has to carry.

11 requirement lines in force · 13 provisions · 12 jurisdictions · from: privacy 5 · cybersecurity 4 · AI 3 · scraping 1

3 · Permissions and credentials at run time

What the run could reach while it ran.

What the run could reach while it ran is the difference between an incident and a catastrophe, and it is nearly absent from binding law as a record-keeping duty. Where it appears, it appears inside security regulations as a monitoring duty with a period attached rather than as evidence to be produced: an automatic mechanism that monitors access to a database's systems, with the record kept, is the shape.

The related duty that is everywhere is the control itself rather than the record of it, which is why this class is thin here and its counterpart is not: see the tools layer of What you must constrain.

10 requirement lines in force · 9 provisions · 8 jurisdictions · from: scraping 5 · cybersecurity 3 · privacy 2

4 · Human approval and intervention

Where a person was, and what they could do.

Where a person was, and what they could do about the outcome, is the evidence question privacy law answers best. The right not to be subject to a solely automated decision produces a duty of meaningful human review before such a decision is finalised, and that review is a fact somebody can later be asked to show. The corpus holds it jurisdiction by jurisdiction, as a national reading of the EU GDPR's data-subject rights chapter in Europe and as its own provision elsewhere.

AI law is about to ask for the same ground in its own right. The EU AI Act's Article 14 (human oversight) (from 2027-12-02, not yet in effect; that date is for a system classified as high-risk under Annex III, and a system classified under Annex I follows on the later date the instrument's page states) makes the provider design the system so the people assigned to oversee it can understand its capacities and limits, interpret its output, decide not to use it, override or reverse it, and stop it, and makes the deployer assign that oversight to people with the competence, training and authority to exercise it. Read as evidence, that is two things to produce rather than one: what the system was built to let a person do, and who held the authority to do it on the day.

For an AGENT the practical trap is that the review has to be real and has to be recorded as what it was. A person who clicked approve on a queue of four hundred items has not reviewed them, and a record that cannot distinguish that from a considered decision is evidence of the wrong thing.

48 requirement lines in force · 52 provisions · 50 jurisdictions · from: privacy 44 · AI 10

5 · Artefacts created or changed

What the run made, marked or moved.

What the run made, and what it changed. Two duties meet here. The first is marking: the EU AI Act's Article 50 (transparency) (since 2026-08-02) requires synthetic content to be marked in a machine-readable way, and South Korea's AI Framework Act, Article 31 requires the same of AI outputs there, so the artefact itself carries part of the evidence. The second is integrity: a record that can be altered without trace is not evidence, and several security regimes say so in their own words.

An AGENT that writes files, posts content or edits records produces artefacts in other people's systems, which is where the COUNTERPARTY sits. Those artefacts are somebody else's evidence as much as yours.

29 requirement lines in force · 39 provisions · 38 jurisdictions · from: AI 20 · privacy 13 · scraping 7 · cybersecurity 2

6 · Detection, containment and recovery

What was noticed, stopped and put back.

What was noticed, what was stopped, and what was put back. The EU NIS2 Directive's Article 21 names incident handling, business continuity including backup management, and crisis management among its minimum measures, so the existence of the capability is itself a duty. The evidence duty arrives through the notification rules: most breach and incident regimes in the corpus require the notification to describe the measures taken or proposed, which means the response has to be recorded as it happens rather than reconstructed afterwards.

67 requirement lines in force · 71 provisions · 61 jurisdictions · from: privacy 40 · cybersecurity 36 · scraping 4

7 · The incident timeline

When each of those things happened.

When each of those things happened is the most heavily regulated class on this page, because almost every reporting duty in the corpus is stated as a period running from a moment. That makes two facts legally significant that an engineer might not log at all: the moment the organisation became aware, and the moment the incident began.

The EU Cyber Resilience Act's Article 14, which puts the duty on the manufacturer, is the clearest example of a staged timeline: an early warning within 24 hours of becoming aware, a notification within 72, and a final report no later than fourteen days after a corrective measure becomes available. Every such deadline in the corpus, with the sentence it was read from, is drawn on one axis in Incident reporting clocks.

341 requirement lines in force · 252 provisions · 142 jurisdictions · from: privacy 259 · cybersecurity 121 · AI 29 · scraping 1

8 · Reproduction and remediation

What was fixed, and how that was shown.

What was fixed, and how that was shown. The final-report duties are where this becomes evidence rather than engineering: the EU NIS2 Directive's Article 23 and the EU Cyber Resilience Act's Article 14 both end their staged sequence with a report, and the EU AI Act's Article 55 requires a provider of a model with systemic risk to document and report corrective measures taken or planned. Elsewhere the same idea appears as a corrective-action duty attached to a regulator's finding.

Reproduction is the half the law does not ask for and an incident needs most. Nothing in the corpus requires an OPERATOR to be able to run the failing case again, which for a non-deterministic system is the difference between a fix and a hope.

58 requirement lines in force · 58 provisions · 49 jurisdictions · from: cybersecurity 54 · privacy 12 · AI 6

9 · How long the record has to last

The one class the law states in periods.

How long any of it has to last is the one question the law answers in numbers. The corpus states the period as prose inside the obligation sentence, so the periods below are read out of those sentences when this page is built, by the rule in section 2, and each is shown with the sentence it came from.

Two things this table does not show. Periods stated as a test rather than a number, no longer than is necessary for the purpose being the commonest of them, bind just as hard and cannot be drawn on a scale. And the period that will matter most to an agent is not here yet: the EU AI Act's Article 19 and Article 26(6) require the automatically generated logs of a high-risk AI system to be kept for a period appropriate to the intended purpose and at least six months, and both apply from 2027-12-02, not yet in effect.

128 requirement lines in force · 139 provisions · 101 jurisdictions · from: privacy 112 · cybersecurity 22 · AI 11 · scraping 8