docs/codebook.md

metadata

version: 0.2
date: 2026-09-04T00:00:00.000Z
status: DRAFT — awaiting PI review
authors:
  - Rowan Amanna (draft)
  - reviewers TBD

AI Legislation Codebook v0.1

Two-axis classification system for coding U.S. AI-governance bills. Every bill can carry zero or more labels on each axis. Labels are meant to be mutually informative (a bill can be both "Healthcare" and "Consumer Protection"), not mutually exclusive.

Coding rules (read first)

0. First decide is_ai_related. Every classification carries an explicit binary field: is_ai_related = true means the bill substantively regulates, defines, funds, or otherwise operates on AI / automated decision systems / algorithms. is_ai_related = false means the bill is a ceremonial resolution (honoring a tech workforce, recognizing Space Command, etc.), a pure appropriation with no AI content, or only mentions AI in passing without regulating it. When is_ai_related = false, both axis lists MUST be empty — labels only apply to AI-related bills. Human coders make this call in Step 1 of the Classify page; the LLM classifier makes the same call from its prompt.

1. Multi-label is expected. A single bill often regulates multiple domains and pulls multiple levers. Assign every label that clearly applies.

2. Recall < precision. When in doubt, leave the label off. A false negative (missed label) is easier to catch in review than a false positive (spurious label) that misleads downstream analysis.

3. Text over intent. Code what the bill does in statute, not what supporters or opponents say it does. Findings and preambles are context; the operative sections are the source of truth.

4. Federal actions count too. The state = "US" bills go through the same taxonomy. Nothing in either axis is state-only.

5. Confidence flag. If the automated classifier assigns a label with confidence < 0.6, treat it as tentative — human coders in the validation study should double-check.

6. Codebook version travels with the classification. Every entry in classifications.json records the codebook version it was produced against, so re-runs against a newer codebook are diffable.

7. Every AI-related bill gets at least one Governance Mechanism label. If is_ai_related = true AND the bill has any operative regulatory text — a prohibition, a requirement, a penalty, a study mandate — assign at least one Axis 2 label. Zero-mechanism on an AI-related bill is only correct in rare edge cases (e.g., a definitions-only bill that hasn't advanced yet). For non-AI bills (is_ai_related = false), both axes are always empty per Rule 0.

8. General / Cross-sector is a fallback, not an addition. Do not attach General / Cross-sector to a bill that already has a specific Axis-1 label unless the bill's operative sections substantively regulate 3+ distinct sectors. When in doubt, prefer the specific label.

---

Axis 1 — Regulatory Target

The domain the law reaches into. Which sector's behavior does the bill change? A bill is coded here even if it doesn't use the word "AI" — the question is whose activities the operative sections regulate.

1.1 Healthcare

Definition. Regulates AI use in the delivery of medical care, clinical decision-making, insurance coverage decisions for medical services, or health-record handling.

Include if the bill regulates:

• Clinical decision-support systems, diagnostic AI, or triage tools
• Insurer use of AI for prior-authorization, claims, or coverage denials
• Health-record data processing where AI is a distinct actor

Exclude:

• Bills that only fund healthcare AI research without regulating deployment
• Data-privacy bills that cover healthcare as one of many sectors — code those as Privacy + General/Cross-sector

Examples:

• AL HB515 — Regulates use of AI in health-coverage decisions
• AL SB294 — Modernizes prior-authorization, restricts AI-only denials

1.2 Elections

Definition. Regulates AI-generated or AI-assisted content in political campaigns, election administration, voter communication, or ballot integrity.

Include:

• Deepfake/synthetic-media rules targeting election periods
• Disclosure requirements for AI-generated campaign ads
• AI use by election officials (e.g., signature-matching)

Exclude:

• General deepfake bills that happen to mention elections in findings only — code those as Digital Content/IP unless elections are in the operative text

Examples:

• AL HB172 — Criminal & civil penalties for materially deceptive AI-generated election media
• AK HB358 — Deepfakes liability, election context

1.3 Employment/HR

Definition. Regulates AI use in hiring, promotion, discipline, wage setting, monitoring, or termination decisions in employment contexts.

Include:

• Automated resume screening, interview scoring
• Workplace surveillance and productivity monitoring
• Algorithmic wage-setting or scheduling

Exclude:

• Workforce-development / STEM-training bills that don't regulate employer AI use — code as General/Cross-sector

Examples:

• CA AB1883 — Workplace surveillance tools
• CA AB1331 — Workplace surveillance
• [NYC Local Law 144–style bills once present in dataset]

1.4 Education

Definition. Regulates AI use in K–12 or higher education — by students, teachers, admissions, or administration.

Include:

• AI in admissions, grading, plagiarism-detection
• Student-data processing by AI systems
• Mandated AI-literacy curriculum
• Task forces on AI-in-education

Exclude:

• Appropriations to education budgets that don't touch AI
• Bills funding AI research at universities without regulating classroom use

Examples:

• CA SB1288 — Public schools AI working group
• [Grade-scoring / plagiarism-detection bill TBD]

1.5 Criminal Justice

Definition. Regulates AI use by police, prosecutors, courts, corrections, or in sentencing and parole decisions.

Include:

• Predictive policing, facial recognition by law enforcement
• Risk-assessment tools in sentencing and parole
• AI-assisted evidence analysis

Exclude:

• Bills that criminalize AI-generated content (deepfake CSAM, election deepfakes) — code as the domain the content targets (Elections, Child Safety) + Digital Content/IP

Examples:

• [Predictive-policing bill TBD]
• [Facial-recognition-by-LE bill TBD]

1.6 Housing

Definition. Regulates AI use in housing decisions — rentals, mortgages, tenant screening, or pricing algorithms.

Include:

• Algorithmic rent-setting (RealPage-style)
• Tenant-screening AI
• Discriminatory-outcome prohibitions in housing algorithms

Exclude:

• General consumer-protection bills that only mention housing in findings

Examples:

• AZ HB2847 — Rental price fixing; algorithmic pricing
• US HB10110 — Housing Price Transparency Act (algorithmic price fixing)

1.7 Finance/Credit

Definition. Regulates AI use in lending, credit-scoring, underwriting, banking, or financial-product recommendations.

Include:

• Automated underwriting or credit-scoring
• Algorithmic-discrimination rules in lending
• AI in insurance underwriting (cross-listed with Insurance)

Exclude:

• Budget/appropriations bills that mention finance departments
• Corporate-tax bills

Examples:

• [Automated-underwriting bill TBD — likely CO SB205-style]

1.8 Insurance

Definition. Regulates AI use by insurers in underwriting, pricing, claims, or coverage decisions.

Include:

• Health insurance AI (also Healthcare)
• Auto, life, homeowners insurance AI
• Actuarial-model transparency

Exclude:

• Bills that only mention insurance in appropriations

Examples:

• AL HB515 — Health-coverage decisions (cross-listed with Healthcare)
• AL SB294 — Health insurance prior-authorization

1.9 Child Safety

Definition. Regulates AI use where minors are the direct target — content moderation, CSAM detection, age verification, or social-media protections.

Include:

• AI-generated CSAM criminalization
• Age-verification requirements on AI-enabled platforms
• Minor-specific consent or parental-control rules

Exclude:

• General obscenity bills that don't specify a minor target
• Education bills — code as Education

Examples:

• AL HB168 — Raises maximum age for offenses involving obscene AI-generated materials
• AL SB109 — Same, senate version

1.10 Consumer Protection

Definition. Regulates AI-enabled consumer-facing practices — deceptive patterns, dark patterns, surveillance pricing, chatbots impersonating humans.

Include:

• Chatbot-disclosure requirements ("you are talking to a bot")
• Surveillance-pricing prohibitions
• Deceptive-AI-content in commerce

Exclude:

• Sector-specific consumer laws (housing, healthcare) — code those primarily under the sector

Examples:

• CA AB2564 — Surveillance pricing
• AL HB516 — Consumer protection when using AI to interact with a consumer

1.11 Privacy

Definition. Regulates the collection, processing, or use of personal information by AI systems.

Include:

• Biometric data (facial, voice, gait) processing
• Comprehensive consumer-privacy laws with AI provisions
• Data-minimization requirements for AI training

Exclude:

• Sector-specific privacy (health-record only) — cross-list with the sector

Examples:

• AL HB283 — Data privacy, processing regulation, consumer actions
• AL HB351 — Same, house version

1.12 Digital Content/IP

Definition. Regulates AI-generated content — deepfakes, synthetic media, training-data provenance, copyright of AI outputs.

Include (always):

• Bills requiring disclosure of what data was used to train an AI system. These count as Digital Content/IP; do NOT default such bills to General / Cross-sector.
• Deepfake / synthetic media bills. Always Digital Content/IP even if also cross-listed with Elections, Child Safety, or Consumer Protection.
• Watermarking / provenance marking of AI outputs.
• Copyright rules for AI-generated works.

Exclude:

• Bills that only reference generative AI in findings/preamble without regulating the content or its training data.

Examples:

• AK SB33 — Synthetic media liability, elections
• CA AB2013 — Generative AI: training-data disclosure (Digital Content/IP, NOT General/Cross-sector)

1.13 Government Procurement

Definition. Regulates AI use by government agencies — what agencies can buy, how they must vet AI vendors, transparency of government AI use.

Include:

• State-agency procurement standards for AI
• Public inventories of government AI systems
• Vendor-attestation requirements

Exclude:

• Bills that create study committees only — code as Task Force/Study on the mechanism axis + General/Cross-sector on the target axis

Examples:

• CA SB892 — Public contracts, automated decision systems, procurement standards
• CA SB313 — Office of AI, state agency public interface

1.14 Public Safety

Definition. Regulates AI use in public-safety contexts outside criminal justice — emergency response, hazard prediction, public surveillance.

Include:

• 911 dispatch AI
• Public-space surveillance not tied to law enforcement
• Emergency-response optimization

Exclude:

• Police use of AI — code as Criminal Justice
• Workplace surveillance — code as Employment/HR

Examples:

• [911-AI bill TBD]
• [Public-surveillance bill TBD]

1.15 Transportation

Definition. Regulates AI in vehicles, traffic systems, or transportation infrastructure.

Include:

• Autonomous / self-driving vehicles
• AI-enabled traffic-signal control
• Delivery robot / drone rules

Examples:

• [Autonomous-vehicle bill TBD — grep matched noise, need cleaner example]

1.16 Telecommunications

Definition. Regulates AI use in telecom services — robocalls with AI voices, network management, broadband deployment decisions.

Include:

• AI-generated voice in robocalls
• Automated dialing with synthetic voices
• Network-neutrality-adjacent AI provisions

Examples:

• CA AB2905 — Telecommunications: automatic dialing-announcing devices: artificial voices
• CA AB2512 — Same topic, sibling bill

1.17 Cybersecurity

Definition. Regulates AI use in cybersecurity — offensive AI use, defensive tooling requirements, breach reporting where AI is implicated.

Include:

• AI-enabled intrusion-detection mandates
• Rules on adversarial ML in state systems
• Cybersecurity workforce provisions where AI is central

Examples:

• AK SB177 — AI, deepfakes, cybersecurity, data transfers (multi-target)
• AK HB306 — Same, house version

1.18 Licensing

Definition. Regulates professional licensing where AI is either used by licensees or the subject of a new license (e.g., AI-developer registration).

Include:

• Licensure of AI developers or high-risk AI systems
• Rules restricting AI use by licensed professions (medicine, law, therapy)

Exclude:

• General occupational-licensing bills that don't touch AI

Examples:

• IL HB5649 — DFPR AI mental-health service (licensure angle)

1.19 General / Cross-sector

Definition. Bills that regulate AI horizontally — comprehensive AI acts, definitions statutes, or cross-cutting task forces without a single sector focus.

Include:

• Omnibus state AI acts (e.g., CO SB205, CA SB1047)
• Standalone definition statutes
• General AI task forces / study commissions

Exclude (strictly):

• Bills that touch multiple sectors but each in a substantive way — code all applicable sector labels instead, NOT General/Cross-sector.
• Bills that are primarily about training-data disclosure — those are Digital Content/IP, not General.
• Bills that primarily regulate one identifiable sector plus some ancillary spillover — code just the primary sector.
• Never assign General/Cross-sector as a second label alongside a specific sector unless the bill's operative sections substantively regulate 3+ distinct sectors.

Examples:

• AK SB262 — Artificial Intelligence Task Force
• [CA SB1047-style omnibus bill]

---

Axis 2 — Governance Mechanism

The regulatory lever the bill pulls. What does the operative text of the bill do? Bills routinely combine mechanisms (a bias-audit bill often has disclosure + enforcement + private right of action).

2.1 Definitions of AI/ADS

Definition. Establishes or amends statutory definitions of "artificial intelligence," "automated decision system," "high-risk AI," etc.

Include:

• Bills whose operative section is a definition statute
• Definitional amendments to existing code

Exclude:

• Bills that reference existing definitions without amending them

Examples:

• [Standalone definition statute TBD]
• Most omnibus AI acts include this as a section

2.2 Disclosure / Transparency

Definition. Requires disclosure to consumers, employees, or regulators that AI is being used, how it was trained, or what its outputs are.

Include:

• Chatbot self-identification requirements
• Training-data disclosure
• Watermarking / provenance marking
• AI-in-ad disclosures

Examples:

• AL HB516 — Consumer disclosure when AI interacts with consumer
• CA AB2013 — Generative AI training-data disclosure

2.3 Impact Assessments

Definition. Requires the deployer or developer to conduct and document a pre-deployment assessment of risks, harms, or civil-rights impacts.

Include:

• Algorithmic impact assessments (AIAs)
• Data-protection impact assessments where AI-specific
• Mandated risk-classification exercises (like the EU AI Act's high-risk tier)

Examples:

• [CO SB205-style AIA requirement]
• [State agency AIA bill]

2.4 Bias Audits

Definition. Requires periodic, independent, or self-conducted testing of an AI system for discriminatory outcomes across protected classes.

Include:

• NYC Local Law 144-style employment bias-audit bills
• Requirements for third-party audits with published results
• Testing-and-reporting cycles

Exclude:

• Impact-assessment bills that don't require post-deployment audits — code as Impact Assessments

Examples:

• [NYC Local Law 144-style employment audit TBD]

2.5 Algorithmic-Discrimination Prohibition

Definition. Directly prohibits discriminatory outcomes from AI systems against protected classes.

Include:

• Standalone anti-discrimination statutes for AI
• Explicit private-cause-of-action for algorithmic discrimination
• Ban on use of protected-class proxies

Examples:

• [CO SB205 sections on discrimination TBD]

2.6 Private Right of Action

Definition. Grants individuals the ability to sue in their own name over AI-related harms.

Include:

• Explicit PRA sections
• Deceptive-practices acts extended to AI

Exclude:

• Enforcement-by-attorney-general only — code as Enforcement/Penalty Scheme

Examples:

• Illinois BIPA-style biometric privacy bills

2.7 Licensing / Registration

Definition. Requires developers, deployers, or specific AI systems to register with, or obtain a license from, a state agency.

Include:

• AI-developer registries
• High-risk-system pre-approval
• Sandboxes with registration requirements

Examples:

• [Registration-of-AI-devs bill TBD]

2.8 Procurement Requirements

Definition. Rules that constrain how public agencies buy or use AI.

Include:

• Vendor-attestation clauses
• Mandatory inventories of state AI
• Prohibitions on procuring specific systems

Examples:

• CA SB892 — Public contracts AI procurement standards

2.9 Deepfake / Synthetic Media Rules

Definition. Criminalizes, civilly penalizes, or otherwise directly regulates the creation or distribution of AI-generated synthetic media in specified contexts.

Include (mandatory):

• Any bill that penalizes, criminalizes, or requires disclosure of AI-generated synthetic media MUST get this label — even if it also gets other mechanism labels like Enforcement/Penalty Scheme, Disclosure, or Definitions of AI/ADS.
• Election deepfake bans, campaign-ad synthetic-media rules
• Non-consensual intimate imagery generated by AI
• CSAM synthetic-media bans
• Watermarking mandates specific to synthetic media
• Synthetic-voice rules in telecom (robocalls, autodialing)

Examples:

• AL HB172 — Deceptive AI election media criminalization → also gets Enforcement/Penalty Scheme; both labels apply.
• AK SB33 — Synthetic media liability, elections → also gets Private Right of Action; both labels apply.
• CA AB2905 — Synthetic voices in autodialing (Telecommunications domain) → also gets Disclosure/Transparency.

2.10 Data-Rights Provisions

Definition. Grants individuals rights (access, deletion, opt-out, portability) over data that AI systems collect or use.

Include:

• Right to opt out of automated decision-making
• Right to explanation of an automated decision
• Data-deletion rights specific to training corpora

Examples:

• AL HB283 — Data privacy consumer actions

2.11 Preemption / Savings Clauses

Definition. Bill text explicitly preempts local ordinances, cedes to federal law, or preserves other state statutes.

Include:

• Express preemption clauses ("no political subdivision shall...")
• Savings clauses preserving other consumer-protection laws
• Anti-preemption language explicitly foreclosing federal preemption

Examples:

• [Preemption-clause bill TBD]

2.12 Enforcement / Penalty Scheme

Definition. Specifies who enforces the bill and what penalties apply for violations.

Include:

• Attorney-general enforcement provisions
• Civil monetary penalties
• Criminal penalties tied to AI misuse

Exclude:

• Bills that create an offense without an explicit enforcement scheme

Examples:

• AL HB172 — Criminal & civil penalties for deceptive election media

2.13 Task Force / Study

Definition. Creates a study committee, advisory council, or working group to investigate AI policy without imposing operative restrictions.

Include:

• Interim study committees
• Standing AI advisory councils
• Report-back-in-X-months bills

Examples:

• AK SB262 — Artificial Intelligence Task Force
• CA SB1288 — Public schools AI working group

2.14 Sectoral Carve-Outs

Definition. The bill exempts a specific sector or use case from otherwise- general AI regulation.

Include:

• "This section does not apply to healthcare providers..."
• Research-use exemptions
• Small-business exemptions

Exclude:

• Bills that are sector-specific from the start — those aren't carve-outs

Examples:

• [Carve-out bill TBD]

---

Change log

• v0.2 (2026-09-04) — Post-verification refinements from a 13-bill smoke test that missed 3 labels:
  • Coding rule 7 added: substantive bills must have ≥1 mechanism label (empty mechanism only valid for ceremonial/appropriations).
  • Coding rule 8 added: General/Cross-sector is fallback-only, never additive alongside a specific sector.
  • Digital Content/IP (1.12): training-data-disclosure bills must get this label (not General); deepfake bills always get it.
  • General/Cross-sector (1.19): strengthened exclusion criteria.
  • Deepfake/Synthetic Media Rules (2.9): mandatory label for any bill penalizing or requiring disclosure of synthetic media, even when other mechanism labels also apply.
• v0.1 (2026-09-04) — Initial draft. 19 targets, 14 mechanisms, examples seeded from real bills in the current dataset; a handful marked TBD for domains where the current dataset didn't surface a clean anchor.

Open questions for review

1. Should Insurance be folded into Finance/Credit as one label, given most AI-insurance bills are health-insurance and would already double-code as Healthcare?
2. Should General/Cross-sector be a fallback (only used when nothing else applies) or an additive label (used alongside sector labels for omnibus bills)? Draft assumes the former.
3. Is the Definitions of AI/ADS mechanism useful, given nearly every AI bill contains definitions? Consider narrowing to "amends existing statutory definitions."
4. The TBD example slots need real bills. Two approaches: (a) enrich the dataset by pulling more federal/state bills we know regulate those areas, or (b) accept that some categories are legitimately empty in the current corpus and note it in the analysis.