LexLint

Know the law your code answers to.

  1. Analysis
  2. The exploration
  3. Why logs
  4. What is required
  5. By jurisdiction
  6. Locating the actor
  7. For framework builders

What the law requires, by geography

Written 20 September 2026 Updated 21 September 2026 Corpus read 22 September 2026 By the UnGovr team, from the LexLint software-law corpus

Eight things a law can ask a record to hold. For each one: whether any jurisdiction states the duty outright, whether it only implies one, and how many of the people governed by the jurisdictions we have read live under it.

The eight questions

These are not eight statutes or eight fields. Each one is a question you can ask of any instrument in any of the four topics, and the answer rolls up: a jurisdiction's answer is the strongest answer any instrument in force there gives.

A record at all
Does the law require that events be recorded in the first place, whether it calls the result a log, a record or an audit trail? For instance: Interim Measures for the Management of Generative AI Services, Article 14 (Article 14, second paragraph); Provisions on the Administration of Deep Synthesis Internet Information Services, Article 10 (Article 10, second and third paragraphs); Provisions on the Administration of Deep Synthesis Internet Information Services, Articles 16 and 17 (Article 16).
Which system, which actor
Must the record say which system ran and who was acting through it? For instance: Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings (Paragraph 6.1 and the Appendix (Form of Declaration for Use of Generative Artificial Intelligence)); Automated Employment Decision Tools Bias Audit and Notice Law (§ 20-871); Practice Direction No. 18 of 2025, ethical use of generative AI in court proceedings (Practice Direction No. 18 of 2025, ss. 3(3) and 3(5)).
Where a person was
Must the record show where a person was in the loop, and what they were able to do about the outcome? For instance: Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings (Paragraph 6.1 and the Appendix (Form of Declaration for Use of Generative Artificial Intelligence)); Digital Services Act, Article 37 (independent audit of very large online platforms and search engines) (Article 37(2) and (3), supplemented by Commission Delegated Regulation (EU) 2024/436, Article 14(3)); Digital Services Act, Article 37 (independent audit of very large online platforms and search engines) (Article 37(2) and (3), supplemented by Commission Delegated Regulation (EU) 2024/436, Article 14(3)).
What went in and out
Must the record reference the input, the output, or where the data the system used came from? For instance: Ordonnance n°0011/PR/2026, marquage des contenus générés par intelligence artificielle (Article 53, fourth indent); Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings (Paragraph 6.1 and the Appendix (Form of Declaration for Use of Generative Artificial Intelligence)); Automated Employment Decision Tools Bias Audit and Notice Law (§ 20-871).
Why the outcome
Must the record carry the basis for the decision, or the disclosure that was shown to the person at the time? For instance: Responsible AI Safety and Education Act (RAISE Act) (§ 1421(1)(d)); Automated Employment Decision Tools Bias Audit and Notice Law (§ 20-871); Practice Direction No. 18 of 2025, ethical use of generative AI in court proceedings (Practice Direction No. 18 of 2025, ss. 3(3) and 3(5)).
Which person, which place
Must the record identify the person affected, the state of their consent or age assurance, or the jurisdiction that was in play? For instance: Reform to the Federal Labor Law and the Federal Copyright Law, AI Voice and Image Consent Regime for Performing Artists (Ley Federal del Derecho de Autor, art. 121); Artificial Intelligence Video Interview Act (820 ILCS 42/20(a) and (b)); Private right of action for unlawful dissemination or publication of a sexually explicit depiction (digital replica) (§ 52-c(3)(a)).
Whether it can be trusted
Must the record be protected against later change, or kept continuously rather than assembled when someone asks? For instance: Digital Code, Chapter 23: AI system design and risk-management obligations (Art. 194(5)(4); Art. 196(1)(5)); Law on Artificial Intelligence, incident management and reporting obligation (art. 12(2)(b)); Law on Artificial Intelligence, risk classification and conformity assessment (art. 14(1)(c)).
Kept how long, shown to whom
Does the law set how long the record is kept, what may not be kept, or who may demand to see it? For instance: Ordonnance n°0011/PR/2026, marquage des contenus générés par intelligence artificielle (Article 53, fourth indent); Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings (Paragraph 6.1 and the Appendix (Form of Declaration for Use of Generative Artificial Intelligence)); Responsible AI Safety and Education Act (RAISE Act) (§ 1421(1)(d)).

Stated against implied, and why the difference is on every table

A clause that names logs, records, event recording or an audit trail states the duty. A clause that requires a party to demonstrate, prove or produce on demand something that cannot be shown without a record implies one. Both are real duties and they are not the same duty: the first tells you what to record, and the second tells you only that you will need to have recorded something.

So a stated duty reads yes on every table in this analysis and an implied one reads partial. European data-protection law's accountability principle is the clearest example of the second: it never mentions a log, and there is no way to satisfy it without one.

How much of this is measured. 204 of the 1,547 instruments in force across the four topics have been read for the logging question, covering 112 of 267 jurisdictions. Every cell below that says not researched is one we have not read yet, and it says nothing about the law there.

What the law expects of an audit is a separate question, answered by earlier work on a different wave, and it has been read for 128 jurisdictions. It sits on the same tables and moves on its own schedule, so a jurisdiction can carry an audit answer and no category answer, or the other way round.

39 instruments are queued for this question, first filed 7 September 2026 and covering 146 jurisdictions in the AI topic. Nothing has been filed yet for Privacy, Age assurance or Scraping.

What the four states mean

yes
An instrument in force names logs, records or an audit trail outright.
partial
An instrument in force requires something that cannot be shown without a record, without naming one. The duty is real and its shape is not stated.
no duty
Every instrument in force in that topic has been read, and none of them asks for a record. This is a finding about the law.
not researched
We have not read the instruments for this question yet. This is a gap in our work and says nothing about the law.

Share of the people governed

Weighted by resident population, over national jurisdictions only. A jurisdiction we have not read is outside the denominator, not counted as a no, which is why the last column is there: it says how many jurisdictions the percentage beside it was computed from. A percentage over a denominator of nothing is not printed at all, because zero over zero is not a finding.

What the law can ask for People under a stated duty People under a stated or implied duty Jurisdictions counted
A record at all 32.1% 46.9% 5 of 62
Which system, which actor 0.1% 10.7% 1 of 62
Where a person was 0.1% 11.1% 1 of 62
What went in and out 2.3% 12.9% 3 of 62
Why the outcome 0.0% 11.2% 0 of 62
Which person, which place 0.0% 2.8% 0 of 62
Whether it can be trusted 2.3% 3.0% 2 of 62
Kept how long, shown to whom 2.3% 13.5% 3 of 62

Population comes from national statistical agencies and the World Bank, with the source and the year printed beside every jurisdiction on the jurisdictions page. Gross domestic product is carried as an alternate weight for the same rows, on the reasoning that a duty's reach over economic activity is a different question from its reach over people. Counted in the jurisdictions column of at least one row above and left out of the percentage beside it, for want of a population figure: Vatican City.

What a record can show, and what the law asks it to show

The eight questions above are asked of the law. The two figures below ask them of a running system, which is where the gap between the two becomes visible: an engine records what it can see, and the law asks about things that are not in that list.

What a chat engine records, and the law asks An unauthenticated user in the EU on a freemium chat product. What the engine can record; request time, the moment the prompt arrived; country from the IP address, a guess, not a fact; browser timezone and language, two more guesses; session identifier, no login, no name; model and version, what produced the answer; prompt and output digests, provable later, undisclosed now; disclosure shown, the notice the user saw; What the law asks to be shown; which law was in play, an EU user brings EU law; the transparency duty was met, the notice, at the time; no prohibited practice, what the answer did not do; kept for the required period, months, not minutes; a human could step in, and did, if they did; produced on request, to the regulator, in a readable form. One Conversation What a chat engine records, and the law asks What the engine can record 1 Request time the moment the prompt arrived 2 Country from the IP address a guess, not a fact 3 Browser timezone and language two more guesses 4 Session identifier no login, no name 5 Model and version what produced the answer 6 Prompt and output digests provable later, undisclosed now 7 Disclosure shown the notice the user saw What the law asks to be shown 8 Which law was in play an EU user brings EU law 9 The transparency duty was met the notice, at the time 10 No prohibited practice what the answer did not do 11 Kept for the required period months, not minutes 12 A human could step in and did, if they did 13 Produced on request to the regulator, in a readable form
An unauthenticated user of a freemium chat product, in the European Union. Everything in the upper group is available to the engine at the moment of the request. Nothing in the lower group is, and each line of it is something a law asks to be shown later. The two guesses at the top are the subject of the next document.
Recorded when published, asked when read Agent-generated content published, then read from the EU. Recorded when the page was made; generation time, when the text was produced; model and version, what produced it; prompt and output digests, the exact text, provably; the publisher's establishment, where the operator sits; the label attached, if one was; Asked when the page is read; the reader's jurisdiction was in play, at read time, not publish time; the label that jurisdiction requires, was on the page; who the deployer is for this reading, the site, the agent, or both; what the record must still show a year on, the retention clock runs from use. One Page, Read Later Recorded when published, asked when read Recorded when the page was made 1 Generation time when the text was produced 2 Model and version what produced it 3 Prompt and output digests the exact text, provably 4 The publisher's establishment where the operator sits 5 The label attached if one was Asked when the page is read 6 The reader's jurisdiction was in play at read time, not publish time 7 The label that jurisdiction requires was on the page 8 Who the deployer is for this reading the site, the agent, or both 9 What the record must still show a year on the retention clock runs from use
The same gap with a delay in it. Agent-generated content is published once and read many times, from places nobody chose, so the jurisdiction question is asked again at each reading and the answer can differ from the one that held at publication. A record made at publication has to anticipate a question asked a year later.

How an instrument's answer becomes a jurisdiction's

Per topic first, then across topics, taking the strongest answer at each step. Strongest means a stated duty beats an implied one, an implied one beats a researched absence, and a researched absence beats silence from us. That last step is the one worth stating: a jurisdiction where we have read one instrument and not another reads as not researched, not as a no, because the instrument we have not read is the one that might carry the duty.

Union instruments are inherited by each member state before any of this runs. A developer in Germany is bound by Union law; the corpus records that law once, against the Union. Without the inheritance step Germany would read as having no duty, and the Union would read as a jurisdiction with a population of its own, counting roughly 450,000,000 people twice.

The four topics are AI, Privacy, Age assurance, Scraping. An instrument is counted under the topic it is filed in, and a jurisdiction with instruments in several topics gets one answer across all of them, with the per-topic answers kept underneath so a reader can see which body of law supplied it.

Where these figures come from

Every number on this page is read from the corpus on the date in the byline, and none of it is typed into the page. The instruments behind an answer are linked from the jurisdictions page, each to the corpus page carrying its citation, its status and its source. What a checkable record would have to hold, and which of these categories the emerging standards actually cover, is the last document. Nothing published by a standards body, including the IETF drafts discussed there, is counted as law anywhere on this page.

  1. Analysis
  2. The exploration
  3. Why logs
  4. What is required
  5. By jurisdiction
  6. Locating the actor
  7. For framework builders

LexLint is a research index and a lint, not a lawyer. These pages describe published law as read on the date beside each figure, and set out what would have to be recorded to show it was followed. They do not apply that law to any product, project or organisation, and they are not a certification, an assurance or a compliance programme. Whether a duty reaches a particular system, and what to do about it, is a question for counsel.

The instruments behind every figure are on the LexLint software-law corpus, indexed by jurisdiction and dated on every row. The terms these pages share are defined in the LexLint glossary.