LexLint

Know the law your code answers to.

  1. Analysis
  2. The exploration
  3. Why logs
  4. What is required
  5. By jurisdiction
  6. Locating the actor
  7. For framework builders

What the law requires of logs

Written 20 September 2026 Corpus read 20 September 2026 By the UnGovr team, from the LexLint software-law corpus

A governance working group treated "logging required" as a common outcome across AI instruments. Two things were missing from that picture, and this analysis supplies both: how common the outcome really is and where, and what the logs are actually for.

The question, in two halves

The first half is a counting question, and the corpus can answer it. For each jurisdiction we hold law for, and weighted by how many people that jurisdiction governs: is there a duty to keep a record at all; is it stated outright or only implied by a duty to demonstrate something; what must the record contain; how long must it be kept; who may demand it; and does the law expect an audit on request, at intervals, or continuously.

The second half is not a counting question, and it is the one that decides the fields. A log that says "this agent took this action against this entity" is a technical log. The duties in AI and privacy law pivot on where the parties are: an unauthenticated user of a freemium chat product who is in the European Union is served under Union law whether or not they ever signed in, and a page of agent-generated content read from the Union raises the same question again at the moment it is read. So a log can only show the right law was followed if it can show which law was in play, and the moment it records that, it starts describing a person.

Who the duty reaches, and through whom

Nothing in this analysis reaches a system directly. A law reaches a party and the party is running the system, so the first question in front of any of the eight categories is which of the six parties around an agent the duty binds, and what brings that party into a jurisdiction at all.

Who is around an agent, and what binds each The six parties of the gateway brief, with the hook that brings law onto each. operator, runs the agent; bound by establishment; principal, asked for the action; bound where they are; provider, made the model; bound by placing on a market; counterparty, other side of the action; bound where they sit; affected person, changed by the action; bound by where it lands; data subject, their data in the payload; bound by residence. Six Parties Who is around an agent, and what binds each 1 Operator runs the agent; bound by establishment 2 Principal asked for the action; bound where they are 3 Provider made the model; bound by placing on a market 4 Counterparty other side of the action; bound where they sit 5 Affected person changed by the action; bound by where it lands 6 Data subject their data in the payload; bound by residence
The hook differs by party, which is why one action can sit under several jurisdictions at once. An operator is reached through where it is established; a data subject through where they reside; a provider through having placed the system on a market. These are the same six parties the corpus uses elsewhere, defined in the glossary.

None of the eight categories is measured yet, and the tables say so on every row. The corpus holds 1,545 instruments in force across the four topics, and as of 20 September 2026 none of them has been read for the question this analysis asks. So every one of the eight category cells reads not researched, and that is a statement about our work rather than about the law.

The pages are published in this state on purpose. The categories, the weighting, the sources and the shape of every table are the parts worth reviewing before the research is written against them, and a reader can see exactly what is claimed today: nothing, in eight columns.

What the law expects of an audit is a separate question, answered by earlier work on a different wave, and it has been read for 70 jurisdictions. Today it is the one column on these pages that carries findings, while the eight beside it carry none. Reporting the two the same way would publish our backlog as the world's legal position.

298 instruments are queued for this question, filed 7 September 2026 and covering 123 jurisdictions in the AI topic. Nothing has been filed yet for Privacy, Age assurance or Scraping.

How to read the five documents

They are in order, and the order is an argument: why anyone wants a record, then what the law asks for, then where, then the problem that makes the last one hard, then what a record would have to hold to satisfy it.

  1. Document 1

    Why legislators ask for logs

    What drafters said they wanted a record for, by family of instrument, and how the expectation moved from paperwork to a running account.

  2. Document 2

    What the law requires, by geography

    The eight categories, what share of the people governed by the researched jurisdictions live under each, and the split between a stated duty and an implied one.

  3. Document 3

    Every jurisdiction, against the eight categories

    One row per jurisdiction the corpus holds law for, with its population weight and the source of that weight beside it.

  4. Document 4

    Knowing which law applied, without making the log personal data

    A log that shows the right law was followed has to show which law was in play, and the moment it does it starts describing a person.

  5. Document 5

    What a checkable record would have to hold

    The eight categories mapped onto the record shapes the standards bodies are converging on, and two configurations that produce one.

What is in scope, and what is not

Four topics: AI, privacy, age assurance and scraping. Every instrument in them, which is 2,254 today, of which 1,545 are in force.

In force means in force today, not enacted. An instrument counts toward a jurisdiction's answer only when its status is in effect and its commencement date has passed. The European Union's own AI law is the case that makes this load-bearing rather than pedantic: its logging articles are the clearest in AI law, they are in the corpus, and a later regulation deferred the chapter they sit in to 2027 and 2028. A predicate that counted enacted law as binding would show the Union as the best-covered jurisdiction on a page about what the law requires of logs today.

Standards are not law and are not counted. The record shapes the standards bodies are converging on appear only in the last document, as the shape a duty can be checked against. Nothing in them enters a table here.

Shares are of people, and only of national jurisdictions. A Californian is already counted in the United States, so a state row is shown and never summed; and because a Union instrument is inherited by each member state, the Union's own row is shown and never summed either. Population and the year it was measured in are printed beside every jurisdiction on the jurisdictions page, so a share can be checked rather than taken.

  1. Analysis
  2. The exploration
  3. Why logs
  4. What is required
  5. By jurisdiction
  6. Locating the actor
  7. For framework builders

LexLint is a research index and a lint, not a lawyer. These pages describe published law as read on the date beside each figure, and set out what would have to be recorded to show it was followed. They do not apply that law to any product, project or organisation, and they are not a certification, an assurance or a compliance programme. Whether a duty reaches a particular system, and what to do about it, is a question for counsel.

The instruments behind every figure are on the LexLint software-law corpus, indexed by jurisdiction and dated on every row. The terms these pages share are defined in the LexLint glossary.