What counts as an “AI law”
Every coverage number we publish is produced by one written rule, and this is that rule. It decides which instruments count, which are kept but never counted, and which we refuse to classify by machine at all. We publish it because a coverage figure without a definition behind it is a marketing number, and because you should be able to disagree with our line and see exactly where we drew it.
The numbers this definition produces
Read live from the database every time this page rebuilds — not typed in by hand. The rule that produces them, stated exactly: ai_scope = 'ai_specific' AND source NOT LIKE 'curated:%'.
Outside that line, and held in full: 72 ai_relevant, 22 out_of_scope and 90 needs_review records, plus 90 curated context frameworks — a separate, overlapping count, since a curated row also carries an ai_scope of its own. None of them is counted above.
Why a definition was necessary
The corpus is assembled by keyword-driven scraping of legislative sources. Those queries pull in instruments whose subject is adjacent to AI but is not AI: general data-protection statutes, cybercrime decrees, online-safety codes, telecom acts. Until 5 August 2026 every one of those rows was counted in our published coverage figures. That overstated real AI-law coverage, and we tell customers our numbers are live and honest.
So we drew the line, wrote it down, and re-counted against it. The published figures went down. Nothing was deleted, nothing was hidden, and the claim is now one we can defend record by record.
The four buckets
Every record carries exactly one ai_scope value. Exactly one of the four feeds a coverage claim.
ai_specificCounted in every published coverage figure.The instrument’s own subject matter is AI, algorithmic systems, or automated decision-making.
Evidence standard: the AI/ADM provision is express in the instrument’s title, or — where a human has opened the official text — in its primary text (a named chapter, a defined term, an operative article). Either way the locator and wording are recorded on the record itself, in ai_scope_reason, so any single row can be checked against its primary source in seconds.
Examples: EU AI Act · Colorado SB 24-205 · China’s Algorithmic Recommendations and Deep Synthesis Provisions · Korea’s AI Framework Act · New York automated-employment-decision-tool bills · Ontario Employment Standards Act s. 8.4.
ai_relevantRetained and queryable. Never counted as coverage.A general instrument that our editorial layer documents as carrying AI-applicable obligations.
This bucket is an editorial assertion, not a machine-verified fact about the statute text. We have not parsed HIPAA to confirm an AI clause — we have written a note explaining how HIPAA bites on AI systems handling PHI, which is a weaker and different claim. That is exactly why it is excluded from the coverage number instead of counted beside it.
Examples: GDPR (Art. 22 automated decision-making) · the Digital Services Act (recommender-system duties) · Directive (EU) 2024/2831 (Chapter III, algorithmic management) · curated federal sector frameworks (HIPAA, GLBA, FERPA, Title VII).
out_of_scopeRetained. Not counted.The title names a different, recognised subject — data protection, cybercrime, online safety, social media, telecom, intermediary liability — and nothing anywhere claims an AI angle.
These arrived because the corpus is assembled by keyword-driven scraping of legislative sources, which pulls in instruments adjacent to AI that are not about AI. They stay in the database and stay addressable; they simply stop inflating the headline.
Examples: Singapore Cybersecurity Act 2018 · UAE Federal Decree-Law 34/2021 on Rumours and Cybercrimes · UK Online Safety Act 2023.
needs_reviewA human queue. Counted in nothing until a person rules.No signal either way, or a genuinely ambiguous subject. The classifier refuses to guess.
The largest ambiguous class is biometric legislation: “biometric recognition technology” is AI, while “biometric data consent and deletion” is data privacy wearing similar words. These reach a human rather than being silently counted or silently dropped — both of which would be dishonest, in opposite directions.
The review queue is public too
90 records currently sit in needs_review. They are counted in nothing — not in coverage, not in a separate “potential coverage” figure — until a human adjudicates them one at a time. Most are biometric-privacy bills in US states, where the same words describe recognition technology in one bill and data-retention rules in the next.
A human decision is recorded with ai_scope_locked, which means the automated classifier will never overwrite it on a later run. That is why the queue shrinks rather than churns.
Scope and bindingness are two different axes
ai_scope answers one question — is this instrument about AI? — and nothing else. Whether an instrument is binding is a separate axis, carried by in_force and lifecycle. Conflating the two is what produced the original overclaim: a pending bill and an enacted act were both simply “records”.
So we state coverage on both axes and never on one. A record count measures what we track. An in-force count measures what binds you today. Anyone quoting only the larger number — including us, previously — is telling you less than they know.
Curated context frameworks are excluded
Records whose source begins curated: are hand-maintained sector and applicability context — the NIST AI Risk Management Framework, EEOC technical assistance, OMB memoranda, HIPAA-as-applied. Some are genuinely AI-specific in subject. None is a legislative instrument, so none is counted as legislative coverage. They remain fully available.
This also closed a real inconsistency: the site’s own pages had always excluded these rows while the API and the homepage counted them. One rule now applies everywhere.
Nothing is ever deleted
Records are labelled, never removed. An out_of_scope record keeps its ID, keeps its primary source link, and stays reachable through the API with an explicit filter — ?ai_scope=all returns everything we hold, and every response carries a meta.ai_scope field naming the filter that produced it. What changed in August 2026 is what we claim, not what we hold.
Duplicates are handled the same way. Where the same instrument reached us twice — the EU AI Act arrived both from EUR-Lex and from our curated landmark set — we mark the canonical record rather than deleting the other.
Developers: the API reference documents the ai_scope parameter in full.
How we stop this drifting
The prose you are reading and the executable classifier are kept in step deliberately: the rule runs as code, the code is unit-tested, and an automated monitor watches the per-jurisdiction coverage counts, so a jurisdiction collapsing to zero raises an alarm instead of quietly shrinking a headline number. The full internal version of this document, including the machine rules and the open items we have not closed yet, lives in the repository as docs/AI-SCOPE-DEFINITION.md.
If you think we drew a line in the wrong place, we would rather hear it than not — tell us, with the record you disagree about.