LexLint

Know the law your code answers to.

  1. Analysis
  2. The exploration
  3. Why logs
  4. What is required
  5. By jurisdiction
  6. Locating the actor
  7. For framework builders

What the law requires of logs

Written 20 September 2026 Updated 21 September 2026 Corpus read 22 September 2026 By the UnGovr team, from the LexLint software-law corpus

A governance working group treated "logging required" as a common outcome across AI instruments. Two things were missing from that picture, and this analysis supplies both: how common the outcome really is and where, and what the logs are actually for.

The question, in two halves

The first half is a counting question, and the corpus can answer it. For each jurisdiction we hold law for, and weighted by how many people that jurisdiction governs: is there a duty to keep a record at all; is it stated outright or only implied by a duty to demonstrate something; what must the record contain; how long must it be kept; who may demand it; and does the law expect an audit on request, at intervals, or continuously.

The second half is not a counting question, and it is the one that decides the fields. A log that says "this agent took this action against this entity" is a technical log. The duties in AI and privacy law pivot on where the parties are: an unauthenticated user of a freemium chat product who is in the European Union is served under Union law whether or not they ever signed in, and a page of agent-generated content read from the Union raises the same question again at the moment it is read. So a log can only show the right law was followed if it can show which law was in play, and the moment it records that, it starts describing a person.

Who the duty reaches, and through whom

Nothing in this analysis reaches a system directly. A law reaches a party and the party is running the system, so the first question in front of any of the eight categories is which of the six parties around an agent the duty binds, and what brings that party into a jurisdiction at all.

Who is around an agent, and what binds each The six parties of the gateway brief, with the hook that brings law onto each. operator, runs the agent; bound by establishment; principal, asked for the action; bound where they are; provider, made the model; bound by placing on a market; counterparty, other side of the action; bound where they sit; affected person, changed by the action; bound by where it lands; data subject, their data in the payload; bound by residence. Six Parties Who is around an agent, and what binds each 1 Operator runs the agent; bound by establishment 2 Principal asked for the action; bound where they are 3 Provider made the model; bound by placing on a market 4 Counterparty other side of the action; bound where they sit 5 Affected person changed by the action; bound by where it lands 6 Data subject their data in the payload; bound by residence
The hook differs by party, which is why one action can sit under several jurisdictions at once. An operator is reached through where it is established; a data subject through where they reside; a provider through having placed the system on a market. These are the same six parties the corpus uses elsewhere, defined in the glossary.

How much of this is measured. 204 of the 1,547 instruments in force across the four topics have been read for the logging question, covering 112 of 267 jurisdictions. Every cell below that says not researched is one we have not read yet, and it says nothing about the law there.

What the law expects of an audit is a separate question, answered by earlier work on a different wave, and it has been read for 128 jurisdictions. It sits on the same tables and moves on its own schedule, so a jurisdiction can carry an audit answer and no category answer, or the other way round.

39 instruments are queued for this question, first filed 7 September 2026 and covering 146 jurisdictions in the AI topic. Nothing has been filed yet for Privacy, Age assurance or Scraping.

How to read the five documents

They are in order, and the order is an argument: why anyone wants a record, then what the law asks for, then where, then the problem that makes the last one hard, then what a record would have to hold to satisfy it.

  1. Document 1

    Why legislators ask for logs

    What drafters said they wanted a record for, by family of instrument, and how the expectation moved from paperwork to a running account.

  2. Document 2

    What the law requires, by geography

    The eight categories, what share of the people governed by the researched jurisdictions live under each, and the split between a stated duty and an implied one.

  3. Document 3

    Every jurisdiction, against the eight categories

    One row per jurisdiction the corpus holds law for, with its population weight and the source of that weight beside it.

  4. Document 4

    Knowing which law applied, without making the log personal data

    A log that shows the right law was followed has to show which law was in play, and the moment it does it starts describing a person.

  5. Document 5

    What a checkable record would have to hold

    The eight categories mapped onto the record shapes the standards bodies are converging on, and two configurations that produce one.

The short statement of the same ground, written for a reader building or governing an agent rather than reading the law, is What the law makes you able to show, the evidence document in the agents handbook. This analysis is the statutory reading behind its first class.

What is in scope, and what is not

Four topics: AI, privacy, age assurance and scraping. Every instrument in them, which is 2,266 today, of which 1,547 are in force.

In force means in force today, not enacted. An instrument counts toward a jurisdiction's answer only when its status is in effect and its commencement date has passed. The European Union's own AI law is the case that makes this load-bearing rather than pedantic: its logging articles are the clearest in AI law, they are in the corpus, and a later regulation deferred the chapter they sit in to 2027 and 2028. A predicate that counted enacted law as binding would show the Union as the best-covered jurisdiction on a page about what the law requires of logs today.

Standards are not law and are not counted. The record shapes the standards bodies are converging on appear only in the last document, as the shape a duty can be checked against. Nothing in them enters a table here.

Shares are of people, and only of national jurisdictions. A Californian is already counted in the United States, so a state row is shown and never summed; and because a Union instrument is inherited by each member state, the Union's own row is shown and never summed either. Population and the year it was measured in are printed beside every jurisdiction on the jurisdictions page, so a share can be checked rather than taken.

  1. Analysis
  2. The exploration
  3. Why logs
  4. What is required
  5. By jurisdiction
  6. Locating the actor
  7. For framework builders

LexLint is a research index and a lint, not a lawyer. These pages describe published law as read on the date beside each figure, and set out what would have to be recorded to show it was followed. They do not apply that law to any product, project or organisation, and they are not a certification, an assurance or a compliance programme. Whether a duty reaches a particular system, and what to do about it, is a question for counsel.

The instruments behind every figure are on the LexLint software-law corpus, indexed by jurisdiction and dated on every row. The terms these pages share are defined in the LexLint glossary.