LexLint.ioBeta

Know the law your code answers to.

  1. Analysis
  2. The exploration
  3. Why logs
  4. What is required
  5. By jurisdiction
  6. Locating the actor
  7. For framework builders

What the law requires, by geography

Written Updated Law library as of By the UnGovr team, from the LexLint law library

Eight things a law can ask a record to hold. For each one: whether any jurisdiction states the duty outright, whether it only implies one, and how many of the people governed by the jurisdictions we have read live under it.

The eight questions

These are not eight statutes or eight fields. Each one is a question you can ask of any instrument in any of the four topics, and the answer rolls up: a jurisdiction's answer is the strongest answer any instrument in force there gives.

A record at all
Does the law require that events be recorded in the first place, whether it calls the result a log, a record or an audit trail? For instance: LQPD, personal data breach notification (Article 36(5)); LQPD, transfers of personal data to third countries or international organisations (Article 45(3) (documenting the assessment and safeguards in the register of processing activities)); LQPD, Llei 29/2021 del 28 d'octubre (Article 34 (register of processing activities), with Article 7(1) (proof of consent)).
Which system, which actor
Must the record say which system ran and who was acting through it? For instance: Law on the Protection of Personal Data (Article 31(1)(g)); Audiovisuelle Mediendienste-Gesetz (AMD-G, Audiovisual Media Services Act), Section 54e, measures by video-sharing platform providers (AMD-G Section 54e(2) point 3); Law on the Protection of Personal Data of Bosnia and Herzegovina (Article 32 (record of processing activities), with Article 57(6) (use records of a video surveillance system) and Articles 80 and 81 (a competent authority's records and automatic log)).
Where a person was
Must the record show where a person was in the loop, and what they were able to do about the outcome? For instance: CIRO Rule 3600, communications with the public (CIRO IDPC Rule 3600, s. 3602(6)); CIRO Rule 3900, supervision (CIRO IDPC Rule 3900, s. 3908; s. 3915(4); s. 3926(2)); CERT-In Artificial Intelligence Security Auditing Guidelines, Version 1.0 (Section 9.7 (execution-chain logging for agentic AI), with Section 8.6, Section 10.1 and Principle 6 in Section 6.2.6).
What went in and out
Must the record reference the input, the output, or where the data the system used came from? For instance: Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E. (Guidance Note, Section 5(a), with the model inventory in Section 2(f)); Audiovisuelle Mediendienste-Gesetz (AMD-G, Audiovisual Media Services Act), Section 54e, measures by video-sharing platform providers (AMD-G Section 54e(2) point 3); GBA/APD Biometric Recommendation and Enforcement, Special Categories (GDPR Article 30(1), points (a) to (d), as applied in Litigation Chamber Decision 114/2024, paragraphs 136 to 142 and 204).
Why the outcome
Must the record carry the basis for the decision, or the disclosure that was shown to the person at the time? For instance: App Distribution Services Online Safety Code (Class 1C and Class 2 Material) (App Distribution Services Online Safety Code (Class 1C and Class 2 Material), compliance measure 1(e)(iv)); Designated Internet Services Online Safety Code (Class 1C and Class 2 Material) (Designated Internet Services Online Safety Code (Class 1C and Class 2 Material), clause 4.3(a)(iv) and (v)); ANPD Regulation on Reporting Security Incidents (Resolution CD/ANPD No. 15/2024) (Resolução CD/ANPD nº 15/2024, Anexo, art. 10).
Which person, which jurisdiction
Must the record identify the person affected, the state of their consent or age assurance, or the jurisdiction that was in play? For instance: LQPD, Llei 29/2021 del 28 d'octubre (Article 34 (register of processing activities), with Article 7(1) (proof of consent)); ADGM Data Protection Regulations, comprehensive regime (Section 28 (record of processing activities), with section 6(4) (demonstrating consent) and section 7(3) (appropriate policy document)); DIFC Data Protection Law, comprehensive regime (Article 15 (records of processing activities), with Article 41(6) (documenting every breach) and Article 12(2) and (9) (demonstrating consent)).
Whether it can be trusted
Must the record be protected against later change, or kept continuously rather than assembled when someone asks? For instance: Law No. 124/2024, international data transfer (Article 42(2)(e) (binding company rules must provide for audits and for reporting and recording breaches, rectifying actions and changes to the rules)); GDPR Chapter V, Cross-Border Transfer of Personal Data from Austria (Article 49(6) (the assessment and safeguards behind a derogation transfer are documented in the Article 30 records)); Law on the Protection of Personal Data of Bosnia and Herzegovina, cross-border transfer (Article 51(7) (the assessment and safeguards behind a derogation transfer are documented in the Article 32 records) and Articles 93(3), 94(3) and 95(4) (a competent authority documents a transfer)).
Kept how long, shown to whom
Does the law set how long the record is kept, what may not be kept, or who may demand to see it? For instance: LQPD, personal data breach notification (Article 36(5)); LQPD, Llei 29/2021 del 28 d'octubre (Article 34 (register of processing activities), with Article 7(1) (proof of consent)); ADGM Data Protection Regulations, comprehensive regime (Section 28 (record of processing activities), with section 6(4) (demonstrating consent) and section 7(3) (appropriate policy document)).

Stated against implied, and why the difference is on every table

A clause that names logs, records, event recording or an audit trail states the duty. A clause that requires a party to demonstrate, prove or produce on demand something that cannot be shown without a record implies one. Both are real duties and they are not the same duty: the first tells you what to record, and the second tells you only that you will need to have recorded something.

So a stated duty reads yes on every table in this analysis and an implied one reads partial. European data-protection law's accountability principle is the clearest example of the second: it never mentions a log, and there is no way to satisfy it without one.

How much of this is measured. 2,563 of the 2,611 instruments in force across the four topics have been read for the logging question, covering 258 of 282 jurisdictions. Every cell below that says not researched is one we have not read yet, and it says nothing about the law there.

What the law expects of an audit is a separate question, answered by earlier work on a different wave, and it has been read for 257 jurisdictions. It sits on the same tables and moves on its own schedule, so a jurisdiction can carry an audit answer and no category answer, or the other way round.

25 instruments are queued for this question, first filed and covering 279 jurisdictions in Age assurance, AI, Privacy, Scraping.

What the four states mean

yes
An instrument in force names logs, records or an audit trail outright.
partial
An instrument in force requires something that cannot be shown without a record, without naming one. The duty is real and its shape is not stated.
no duty
Every instrument in force in that topic has been read, and none of them asks for a record. This is a finding about the law.
not researched
We have not read the instruments for this question yet. This is a gap in our work and says nothing about the law.

Share of the people governed

Weighted by resident population, over national jurisdictions only. A jurisdiction we have not read is outside the denominator, not counted as a no, which is why the last column is there: it says how many jurisdictions the percentage beside it was computed from. A percentage over a denominator of nothing is not printed at all, because zero over zero is not a finding.

What the law can ask for People under a stated duty People under a stated or implied duty Jurisdictions counted
A record at all 81.5% 87.9% 111 of 179
Which system, which actor 38.9% 39.0% 59 of 179
Where a person was 19.4% 26.0% 4 of 179
What went in and out 36.8% 36.9% 42 of 179
Why the outcome 13.5% 19.9% 36 of 179
Which person, which jurisdiction 68.0% 76.6% 77 of 179
Whether it can be trusted 37.6% 43.6% 46 of 179
Kept how long, shown to whom 77.3% 81.9% 96 of 179

Population comes from national statistical agencies and the World Bank, with the source and the year printed beside every jurisdiction on the jurisdictions page. Gross domestic product is carried as an alternate weight for the same rows, on the reasoning that a duty's reach over economic activity is a different question from its reach over people. Counted in the jurisdictions column of at least one row above and left out of the percentage beside it, for want of a population figure: Cook Islands, Vatican City.

What a record can show, and what the law asks it to show

The eight questions above are asked of the law. The two figures below ask them of a running system, which is where the gap between the two becomes visible: an engine records what it can see, and the law asks about things that are not in that list.

What a chat engine records, and the law asks An unauthenticated user in the EU on a freemium chat product. What the engine can record; request time, the moment the prompt arrived; country from the IP address, a guess, not a fact; browser timezone and language, two more guesses; session identifier, no login, no name; model and version, what produced the answer; prompt and output digests, provable later, undisclosed now; disclosure shown, the notice the user saw; What the law asks to be shown; which law was in play, an EU user brings EU law; the transparency duty was met, the notice, at the time; no prohibited practice, what the answer did not do; kept for the required period, months, not minutes; a human could step in, and did, if they did; produced on request, to the regulator, in a readable form. One Conversation What a chat engine records, and the law asks What the engine can record 1 Request time the moment the prompt arrived 2 Country from the IP address a guess, not a fact 3 Browser timezone and language two more guesses 4 Session identifier no login, no name 5 Model and version what produced the answer 6 Prompt and output digests provable later, undisclosed now 7 Disclosure shown the notice the user saw What the law asks to be shown 8 Which law was in play an EU user brings EU law 9 The transparency duty was met the notice, at the time 10 No prohibited practice what the answer did not do 11 Kept for the required period months, not minutes 12 A human could step in and did, if they did 13 Produced on request to the regulator, in a readable form
An unauthenticated user of a freemium chat product, in the European Union. Everything in the upper group is available to the engine at the moment of the request. Nothing in the lower group is, and each line of it is something a law asks to be shown later. The two guesses at the top are the subject of the next document.
Recorded when published, asked when read Agent-generated content published, then read from the EU. Recorded when the page was made; generation time, when the text was produced; model and version, what produced it; prompt and output digests, the exact text, provably; the publisher's establishment, where the operator sits; the label attached, if one was; Asked when the page is read; the reader's jurisdiction was in play, at read time, not publish time; the label that jurisdiction requires, was on the page; who the deployer is for this reading, the site, the agent, or both; what the record must still show a year on, the retention clock runs from use. One Page, Read Later Recorded when published, asked when read Recorded when the page was made 1 Generation time when the text was produced 2 Model and version what produced it 3 Prompt and output digests the exact text, provably 4 The publisher's establishment where the operator sits 5 The label attached if one was Asked when the page is read 6 The reader's jurisdiction was in play at read time, not publish time 7 The label that jurisdiction requires was on the page 8 Who the deployer is for this reading the site, the agent, or both 9 What the record must still show a year on the retention clock runs from use
The same gap with a delay in it. Agent-generated content is published once and read many times, from jurisdictions nobody chose, so the jurisdiction question is asked again at each reading and the answer can differ from the one that held at publication. A record made at publication has to anticipate a question asked a year later.

How an instrument's answer becomes a jurisdiction's

Per topic first, then across topics, taking the strongest answer at each step. Strongest means a stated duty beats an implied one, an implied one beats a researched absence, and a researched absence beats silence from us. That last step is the one worth stating: a jurisdiction where we have read one instrument and not another reads as not researched, not as a no, because the instrument we have not read is the one that might carry the duty.

Union instruments are inherited by each member state before any of this runs. A developer in Germany is bound by Union law; the law library records that law once, against the Union. Without the inheritance step Germany would read as having no duty, and the Union would read as a jurisdiction with a population of its own, counting roughly 450,000,000 people twice.

The four topics are AI, Privacy, Age assurance, Scraping. An instrument is counted under the topic it is filed in, and a jurisdiction with instruments in several topics gets one answer across all of them, with the per-topic answers kept underneath so a reader can see which body of law supplied it.

Where these figures come from

Every number on this page is read from the law library on the date in the byline, and none of it is typed into the page. The instruments behind an answer are linked from the jurisdictions page, each to its page in the law library, carrying its citation, its status and its source. What a checkable record would have to hold, and which of these categories the emerging standards actually cover, is the last document. Nothing published by a standards body, including the IETF drafts discussed there, is counted as law anywhere on this page.

  1. Analysis
  2. The exploration
  3. Why logs
  4. What is required
  5. By jurisdiction
  6. Locating the actor
  7. For framework builders

LexLint is a research index and a lint, not a lawyer. These pages describe published law as read on the date beside each figure, and set out what would have to be recorded to show it was followed. They do not apply that law to any product, project or organization, and they are not a certification, an assurance or a compliance program. Whether a duty reaches a particular system, and what to do about it, is a question for counsel.

The instruments behind every figure are on the LexLint law library, indexed by jurisdiction and dated on every row. The terms these pages share are defined in the LexLint glossary.