LexLint

Know the law your code answers to.

  1. Analysis
  2. The exploration
  3. Why logs
  4. What is required
  5. By jurisdiction
  6. Locating the actor
  7. For framework builders

What the law requires, by geography

Written 20 September 2026 Corpus read 20 September 2026 By the UnGovr team, from the LexLint software-law corpus

Eight things a law can ask a record to hold. For each one: whether any jurisdiction states the duty outright, whether it only implies one, and how many of the people governed by the jurisdictions we have read live under it.

The eight questions

These are not eight statutes or eight fields. Each one is a question you can ask of any instrument in any of the four topics, and the answer rolls up: a jurisdiction's answer is the strongest answer any instrument in force there gives.

Each one would normally carry a worked example, an instrument from the corpus that shows what the category looks like in real statutory language. None does yet, because no instrument has been read for this question. The examples appear on the build after the first answers are loaded.

A record at all
Does the law require that events be recorded in the first place, whether it calls the result a log, a record or an audit trail? not researched
Which system, which actor
Must the record say which system ran and who was acting through it? not researched
Where a person was
Must the record show where a person was in the loop, and what they were able to do about the outcome? not researched
What went in and out
Must the record reference the input, the output, or where the data the system used came from? not researched
Why the outcome
Must the record carry the basis for the decision, or the disclosure that was shown to the person at the time? not researched
Which person, which place
Must the record identify the person affected, the state of their consent or age assurance, or the jurisdiction that was in play? not researched
Whether it can be trusted
Must the record be protected against later change, or kept continuously rather than assembled when someone asks? not researched
Kept how long, shown to whom
Does the law set how long the record is kept, what may not be kept, or who may demand to see it? not researched

Stated against implied, and why the difference is on every table

A clause that names logs, records, event recording or an audit trail states the duty. A clause that requires a party to demonstrate, prove or produce on demand something that cannot be shown without a record implies one. Both are real duties and they are not the same duty: the first tells you what to record, and the second tells you only that you will need to have recorded something.

So a stated duty reads yes on every table in this analysis and an implied one reads partial. European data-protection law's accountability principle is the clearest example of the second: it never mentions a log, and there is no way to satisfy it without one.

None of the eight categories is measured yet, and the tables say so on every row. The corpus holds 1,545 instruments in force across the four topics, and as of 20 September 2026 none of them has been read for the question this analysis asks. So every one of the eight category cells reads not researched, and that is a statement about our work rather than about the law.

The pages are published in this state on purpose. The categories, the weighting, the sources and the shape of every table are the parts worth reviewing before the research is written against them, and a reader can see exactly what is claimed today: nothing, in eight columns.

What the law expects of an audit is a separate question, answered by earlier work on a different wave, and it has been read for 70 jurisdictions. Today it is the one column on these pages that carries findings, while the eight beside it carry none. Reporting the two the same way would publish our backlog as the world's legal position.

298 instruments are queued for this question, filed 7 September 2026 and covering 123 jurisdictions in the AI topic. Nothing has been filed yet for Privacy, Age assurance or Scraping.

What the four states mean

yes
An instrument in force names logs, records or an audit trail outright.
partial
An instrument in force requires something that cannot be shown without a record, without naming one. The duty is real and its shape is not stated.
no duty
Every instrument in force in that topic has been read, and none of them asks for a record. This is a finding about the law.
not researched
We have not read the instruments for this question yet. This is a gap in our work and says nothing about the law.

Share of the people governed

Weighted by resident population, over national jurisdictions only. A jurisdiction we have not read is outside the denominator, not counted as a no, which is why the last column is there: it says how many jurisdictions the percentage beside it was computed from. A percentage over a denominator of nothing is not printed at all, because zero over zero is not a finding.

What the law can ask for People under a stated duty People under a stated or implied duty Jurisdictions counted
A record at all not researched not researched 0 of 0
Which system, which actor not researched not researched 0 of 0
Where a person was not researched not researched 0 of 0
What went in and out not researched not researched 0 of 0
Why the outcome not researched not researched 0 of 0
Which person, which place not researched not researched 0 of 0
Whether it can be trusted not researched not researched 0 of 0
Kept how long, shown to whom not researched not researched 0 of 0

Population comes from national statistical agencies and the World Bank, with the source and the year printed beside every jurisdiction on the jurisdictions page. Gross domestic product is carried as an alternate weight for the same rows, on the reasoning that a duty's reach over economic activity is a different question from its reach over people. It is not shown as a second table here because with nothing researched the two would be identical.

What a record can show, and what the law asks it to show

The eight questions above are asked of the law. The two figures below ask them of a running system, which is where the gap between the two becomes visible: an engine records what it can see, and the law asks about things that are not in that list.

What a chat engine records, and the law asks An unauthenticated user in the EU on a freemium chat product. What the engine can record; request time, the moment the prompt arrived; country from the IP address, a guess, not a fact; browser timezone and language, two more guesses; session identifier, no login, no name; model and version, what produced the answer; prompt and output digests, provable later, undisclosed now; disclosure shown, the notice the user saw; What the law asks to be shown; which law was in play, an EU user brings EU law; the transparency duty was met, the notice, at the time; no prohibited practice, what the answer did not do; kept for the required period, months, not minutes; a human could step in, and did, if they did; produced on request, to the regulator, in a readable form. One Conversation What a chat engine records, and the law asks What the engine can record 1 Request time the moment the prompt arrived 2 Country from the IP address a guess, not a fact 3 Browser timezone and language two more guesses 4 Session identifier no login, no name 5 Model and version what produced the answer 6 Prompt and output digests provable later, undisclosed now 7 Disclosure shown the notice the user saw What the law asks to be shown 8 Which law was in play an EU user brings EU law 9 The transparency duty was met the notice, at the time 10 No prohibited practice what the answer did not do 11 Kept for the required period months, not minutes 12 A human could step in and did, if they did 13 Produced on request to the regulator, in a readable form
An unauthenticated user of a freemium chat product, in the European Union. Everything in the upper group is available to the engine at the moment of the request. Nothing in the lower group is, and each line of it is something a law asks to be shown later. The two guesses at the top are the subject of the next document.
Recorded when published, asked when read Agent-generated content published, then read from the EU. Recorded when the page was made; generation time, when the text was produced; model and version, what produced it; prompt and output digests, the exact text, provably; the publisher's establishment, where the operator sits; the label attached, if one was; Asked when the page is read; the reader's jurisdiction was in play, at read time, not publish time; the label that jurisdiction requires, was on the page; who the deployer is for this reading, the site, the agent, or both; what the record must still show a year on, the retention clock runs from use. One Page, Read Later Recorded when published, asked when read Recorded when the page was made 1 Generation time when the text was produced 2 Model and version what produced it 3 Prompt and output digests the exact text, provably 4 The publisher's establishment where the operator sits 5 The label attached if one was Asked when the page is read 6 The reader's jurisdiction was in play at read time, not publish time 7 The label that jurisdiction requires was on the page 8 Who the deployer is for this reading the site, the agent, or both 9 What the record must still show a year on the retention clock runs from use
The same gap with a delay in it. Agent-generated content is published once and read many times, from places nobody chose, so the jurisdiction question is asked again at each reading and the answer can differ from the one that held at publication. A record made at publication has to anticipate a question asked a year later.

How an instrument's answer becomes a jurisdiction's

Per topic first, then across topics, taking the strongest answer at each step. Strongest means a stated duty beats an implied one, an implied one beats a researched absence, and a researched absence beats silence from us. That last step is the one worth stating: a jurisdiction where we have read one instrument and not another reads as not researched, not as a no, because the instrument we have not read is the one that might carry the duty.

Union instruments are inherited by each member state before any of this runs. A developer in Germany is bound by Union law; the corpus records that law once, against the Union. Without the inheritance step Germany would read as having no duty, and the Union would read as a jurisdiction with a population of its own, counting roughly 450,000,000 people twice.

The four topics are AI, Privacy, Age assurance, Scraping. An instrument is counted under the topic it is filed in, and a jurisdiction with instruments in several topics gets one answer across all of them, with the per-topic answers kept underneath so a reader can see which body of law supplied it.

Where these figures come from

Every number on this page is read from the corpus on the date in the byline, and none of it is typed into the page. The instruments behind an answer are linked from the jurisdictions page, each to the corpus page carrying its citation, its status and its source. What a checkable record would have to hold, and which of these categories the emerging standards actually cover, is the last document. Nothing published by a standards body, including the IETF drafts discussed there, is counted as law anywhere on this page.

  1. Analysis
  2. The exploration
  3. Why logs
  4. What is required
  5. By jurisdiction
  6. Locating the actor
  7. For framework builders

LexLint is a research index and a lint, not a lawyer. These pages describe published law as read on the date beside each figure, and set out what would have to be recorded to show it was followed. They do not apply that law to any product, project or organisation, and they are not a certification, an assurance or a compliance programme. Whether a duty reaches a particular system, and what to do about it, is a question for counsel.

The instruments behind every figure are on the LexLint software-law corpus, indexed by jurisdiction and dated on every row. The terms these pages share are defined in the LexLint glossary.