Methodology / What the law library holds
What the law library holds
Every document LexLint reads, or reads against, is one of four kinds. One question decides which: who can hold you to it?
- Law. A court or regulator can hold you to it. Statutes, regulations and court rulings.
- Guidance. A regulator's reading of a law it enforces. It holds you to the law, not to the guidance.
- Frameworks. Practices and controls, from any publisher. No one holds you to them unless a law names them.
- Policy. Strategies and charters. They hold no one, so the law library does not.
Law
Statutes, regulations, ordinances, directives and court rulings, each linked to its official text. The law library holds 1,871 laws, and law is what a lint run checks your app against. A court ruling that states a duty of its own is held as law; a ruling that reads a statute is shown with that statute.
Guidance
A regulator's published reading of a law it enforces: an attorney general on consumer-protection law, a data protection authority on its own act. It is often the clearest public signal of how a duty will be enforced, so it is shown with the law it reads, on that law's page and beside that law's finding in a run. It never counts as a law and never fires on its own.
Frameworks
Sets of practices and controls, from a government agency, a standards body, an industry group or a nonprofit. 9 frameworks are read against the law: under each control, the laws that bear on it. A mapping says a law bears on a control, never that running the control meets the law.
Policy
National strategies, ethics charters and statements of principle. They set aims but hold no one to them, so the law library does not hold them.
Where each kind sits
Scroll the figure sideways to see the frameworks board.
When a law gives one an effect
Some laws give a framework or a piece of guidance a legal effect: following a named framework can be a defense in court, or the ground for presuming a product conforms, and some guidance is something a court must take into account. That effect is a fact about the law, so it is recorded on the law's page. Laws that name a framework lists them.
Examples
Each figure on this page is drawn from these rows.
| Kind | Example | Who can hold you to it | What LexLint does with it |
|---|---|---|---|
| Law | EU AI Act, Article 5 (prohibited AI practices) | The EU and its member states | Counted, and checked in a lint run |
| Law | General Data Protection Regulation | Each EU member state's data protection authority, and the courts | Counted, and checked in a lint run |
| Law | Ohio Data Protection Act, cybersecurity program safe harbor | Ohio's courts | Counted, and checked in a lint run |
| Law (ruling) | Court rulings that read the Computer Fraud and Abuse Act | The courts | Shown with the law they read |
| Guidance | Ireland's Data Protection Commission on the General Data Protection Regulation and large language models | The authority, through the regulation it enforces | Shown with the General Data Protection Regulation |
| Framework | NIST AI Risk Management Framework | No one: the agency that publishes it enforces nothing | Mapped to the laws under each control |
| Framework | CIS Critical Security Controls | No one, unless a law names them | Mapped to the laws under each control |
| Framework | CSBS AI Supervisory Framework | No one: its publisher is an association of regulators, not a regulator | Not mapped yet |
| Policy | A national AI strategy | No one | Not in the law library |
A document about how a government itself must behave is the subject of law.ungovr.org, UnGovr's site for the law that governs governments.