---
version: 0.2
date: 2026-09-04
status: DRAFT — awaiting PI review
authors:
  - Rowan Amanna (draft)
  - reviewers TBD
---

# AI Legislation Codebook v0.1

Two-axis classification system for coding U.S. AI-governance bills. Every bill
can carry **zero or more** labels on each axis. Labels are meant to be
mutually informative (a bill can be both "Healthcare" and "Consumer
Protection"), not mutually exclusive.

## Coding rules (read first)

0. **First decide `is_ai_related`.** Every classification carries an explicit
   binary field: `is_ai_related = true` means the bill substantively regulates,
   defines, funds, or otherwise operates on AI / automated decision systems /
   algorithms. `is_ai_related = false` means the bill is a ceremonial
   resolution (honoring a tech workforce, recognizing Space Command, etc.),
   a pure appropriation with no AI content, or only mentions AI in passing
   without regulating it. **When `is_ai_related = false`, both axis lists MUST
   be empty** — labels only apply to AI-related bills. Human coders make this
   call in Step 1 of the Classify page; the LLM classifier makes the same
   call from its prompt.

1. **Multi-label is expected.** A single bill often regulates multiple domains
   and pulls multiple levers. Assign every label that clearly applies.
2. **Recall < precision.** When in doubt, leave the label off. A false
   negative (missed label) is easier to catch in review than a false positive
   (spurious label) that misleads downstream analysis.
3. **Text over intent.** Code what the bill *does* in statute, not what
   supporters or opponents *say* it does. Findings and preambles are context;
   the operative sections are the source of truth.
4. **Federal actions count too.** The `state = "US"` bills go through the
   same taxonomy. Nothing in either axis is state-only.
5. **Confidence flag.** If the automated classifier assigns a label with
   confidence < 0.6, treat it as tentative — human coders in the validation
   study should double-check.
6. **Codebook version travels with the classification.** Every entry in
   `classifications.json` records the codebook version it was produced against,
   so re-runs against a newer codebook are diffable.
7. **Every AI-related bill gets at least one Governance Mechanism label.**
   If `is_ai_related = true` AND the bill has any operative regulatory text —
   a prohibition, a requirement, a penalty, a study mandate — assign at least
   one Axis 2 label. Zero-mechanism on an AI-related bill is only correct in
   rare edge cases (e.g., a definitions-only bill that hasn't advanced yet).
   For non-AI bills (`is_ai_related = false`), both axes are always empty
   per Rule 0.
8. **General / Cross-sector is a fallback, not an addition.** Do not attach
   `General / Cross-sector` to a bill that already has a specific Axis-1 label
   unless the bill's operative sections substantively regulate 3+ distinct
   sectors. When in doubt, prefer the specific label.

---

## Axis 1 — Regulatory Target

The domain the law reaches into. Which sector's behavior does the bill
change? A bill is coded here even if it doesn't use the word "AI" — the
question is *whose activities the operative sections regulate*.

### 1.1 Healthcare
**Definition.** Regulates AI use in the delivery of medical care, clinical
decision-making, insurance coverage decisions for medical services, or
health-record handling.

**Include** if the bill regulates:
- Clinical decision-support systems, diagnostic AI, or triage tools
- Insurer use of AI for prior-authorization, claims, or coverage denials
- Health-record data processing where AI is a distinct actor

**Exclude:**
- Bills that only fund healthcare AI research without regulating deployment
- Data-privacy bills that cover healthcare as one of many sectors — code
  those as Privacy + General/Cross-sector

**Examples:**
- `AL HB515` — Regulates use of AI in health-coverage decisions
- `AL SB294` — Modernizes prior-authorization, restricts AI-only denials

### 1.2 Elections
**Definition.** Regulates AI-generated or AI-assisted content in political
campaigns, election administration, voter communication, or ballot integrity.

**Include:**
- Deepfake/synthetic-media rules targeting election periods
- Disclosure requirements for AI-generated campaign ads
- AI use by election officials (e.g., signature-matching)

**Exclude:**
- General deepfake bills that happen to mention elections in findings only —
  code those as Digital Content/IP unless elections are in the operative text

**Examples:**
- `AL HB172` — Criminal & civil penalties for materially deceptive
  AI-generated election media
- `AK HB358` — Deepfakes liability, election context

### 1.3 Employment/HR
**Definition.** Regulates AI use in hiring, promotion, discipline, wage
setting, monitoring, or termination decisions in employment contexts.

**Include:**
- Automated resume screening, interview scoring
- Workplace surveillance and productivity monitoring
- Algorithmic wage-setting or scheduling

**Exclude:**
- Workforce-development / STEM-training bills that don't regulate employer
  AI use — code as General/Cross-sector

**Examples:**
- `CA AB1883` — Workplace surveillance tools
- `CA AB1331` — Workplace surveillance
- [NYC Local Law 144–style bills once present in dataset]

### 1.4 Education
**Definition.** Regulates AI use in K–12 or higher education — by students,
teachers, admissions, or administration.

**Include:**
- AI in admissions, grading, plagiarism-detection
- Student-data processing by AI systems
- Mandated AI-literacy curriculum
- Task forces on AI-in-education

**Exclude:**
- Appropriations to education budgets that don't touch AI
- Bills funding AI research at universities without regulating classroom use

**Examples:**
- `CA SB1288` — Public schools AI working group
- [Grade-scoring / plagiarism-detection bill TBD]

### 1.5 Criminal Justice
**Definition.** Regulates AI use by police, prosecutors, courts, corrections,
or in sentencing and parole decisions.

**Include:**
- Predictive policing, facial recognition by law enforcement
- Risk-assessment tools in sentencing and parole
- AI-assisted evidence analysis

**Exclude:**
- Bills that criminalize AI-generated content (deepfake CSAM, election
  deepfakes) — code as the domain the content targets (Elections, Child
  Safety) + Digital Content/IP

**Examples:**
- [Predictive-policing bill TBD]
- [Facial-recognition-by-LE bill TBD]

### 1.6 Housing
**Definition.** Regulates AI use in housing decisions — rentals, mortgages,
tenant screening, or pricing algorithms.

**Include:**
- Algorithmic rent-setting (RealPage-style)
- Tenant-screening AI
- Discriminatory-outcome prohibitions in housing algorithms

**Exclude:**
- General consumer-protection bills that only mention housing in findings

**Examples:**
- `AZ HB2847` — Rental price fixing; algorithmic pricing
- `US HB10110` — Housing Price Transparency Act (algorithmic price fixing)

### 1.7 Finance/Credit
**Definition.** Regulates AI use in lending, credit-scoring, underwriting,
banking, or financial-product recommendations.

**Include:**
- Automated underwriting or credit-scoring
- Algorithmic-discrimination rules in lending
- AI in insurance underwriting (cross-listed with Insurance)

**Exclude:**
- Budget/appropriations bills that mention finance departments
- Corporate-tax bills

**Examples:**
- [Automated-underwriting bill TBD — likely CO SB205-style]

### 1.8 Insurance
**Definition.** Regulates AI use by insurers in underwriting, pricing,
claims, or coverage decisions.

**Include:**
- Health insurance AI (also Healthcare)
- Auto, life, homeowners insurance AI
- Actuarial-model transparency

**Exclude:**
- Bills that only mention insurance in appropriations

**Examples:**
- `AL HB515` — Health-coverage decisions (cross-listed with Healthcare)
- `AL SB294` — Health insurance prior-authorization

### 1.9 Child Safety
**Definition.** Regulates AI use where minors are the direct target — content
moderation, CSAM detection, age verification, or social-media protections.

**Include:**
- AI-generated CSAM criminalization
- Age-verification requirements on AI-enabled platforms
- Minor-specific consent or parental-control rules

**Exclude:**
- General obscenity bills that don't specify a minor target
- Education bills — code as Education

**Examples:**
- `AL HB168` — Raises maximum age for offenses involving obscene AI-generated
  materials
- `AL SB109` — Same, senate version

### 1.10 Consumer Protection
**Definition.** Regulates AI-enabled consumer-facing practices — deceptive
patterns, dark patterns, surveillance pricing, chatbots impersonating humans.

**Include:**
- Chatbot-disclosure requirements ("you are talking to a bot")
- Surveillance-pricing prohibitions
- Deceptive-AI-content in commerce

**Exclude:**
- Sector-specific consumer laws (housing, healthcare) — code those primarily
  under the sector

**Examples:**
- `CA AB2564` — Surveillance pricing
- `AL HB516` — Consumer protection when using AI to interact with a consumer

### 1.11 Privacy
**Definition.** Regulates the collection, processing, or use of personal
information by AI systems.

**Include:**
- Biometric data (facial, voice, gait) processing
- Comprehensive consumer-privacy laws with AI provisions
- Data-minimization requirements for AI training

**Exclude:**
- Sector-specific privacy (health-record only) — cross-list with the sector

**Examples:**
- `AL HB283` — Data privacy, processing regulation, consumer actions
- `AL HB351` — Same, house version

### 1.12 Digital Content/IP
**Definition.** Regulates AI-generated content — deepfakes, synthetic media,
training-data provenance, copyright of AI outputs.

**Include (always):**
- **Bills requiring disclosure of what data was used to train an AI system.**
  These count as Digital Content/IP; do NOT default such bills to
  `General / Cross-sector`.
- **Deepfake / synthetic media bills.** Always Digital Content/IP even if
  also cross-listed with Elections, Child Safety, or Consumer Protection.
- Watermarking / provenance marking of AI outputs.
- Copyright rules for AI-generated works.

**Exclude:**
- Bills that only reference generative AI in findings/preamble without
  regulating the content or its training data.

**Examples:**
- `AK SB33` — Synthetic media liability, elections
- `CA AB2013` — Generative AI: training-data disclosure (Digital Content/IP,
  NOT General/Cross-sector)

### 1.13 Government Procurement
**Definition.** Regulates AI use by government agencies — what agencies can
buy, how they must vet AI vendors, transparency of government AI use.

**Include:**
- State-agency procurement standards for AI
- Public inventories of government AI systems
- Vendor-attestation requirements

**Exclude:**
- Bills that create study committees only — code as Task Force/Study on the
  mechanism axis + General/Cross-sector on the target axis

**Examples:**
- `CA SB892` — Public contracts, automated decision systems, procurement
  standards
- `CA SB313` — Office of AI, state agency public interface

### 1.14 Public Safety
**Definition.** Regulates AI use in public-safety contexts outside criminal
justice — emergency response, hazard prediction, public surveillance.

**Include:**
- 911 dispatch AI
- Public-space surveillance not tied to law enforcement
- Emergency-response optimization

**Exclude:**
- Police use of AI — code as Criminal Justice
- Workplace surveillance — code as Employment/HR

**Examples:**
- [911-AI bill TBD]
- [Public-surveillance bill TBD]

### 1.15 Transportation
**Definition.** Regulates AI in vehicles, traffic systems, or transportation
infrastructure.

**Include:**
- Autonomous / self-driving vehicles
- AI-enabled traffic-signal control
- Delivery robot / drone rules

**Examples:**
- [Autonomous-vehicle bill TBD — grep matched noise, need cleaner example]

### 1.16 Telecommunications
**Definition.** Regulates AI use in telecom services — robocalls with AI
voices, network management, broadband deployment decisions.

**Include:**
- AI-generated voice in robocalls
- Automated dialing with synthetic voices
- Network-neutrality-adjacent AI provisions

**Examples:**
- `CA AB2905` — Telecommunications: automatic dialing-announcing devices:
  artificial voices
- `CA AB2512` — Same topic, sibling bill

### 1.17 Cybersecurity
**Definition.** Regulates AI use in cybersecurity — offensive AI use, defensive
tooling requirements, breach reporting where AI is implicated.

**Include:**
- AI-enabled intrusion-detection mandates
- Rules on adversarial ML in state systems
- Cybersecurity workforce provisions where AI is central

**Examples:**
- `AK SB177` — AI, deepfakes, cybersecurity, data transfers (multi-target)
- `AK HB306` — Same, house version

### 1.18 Licensing
**Definition.** Regulates professional licensing where AI is either used by
licensees or the subject of a new license (e.g., AI-developer registration).

**Include:**
- Licensure of AI developers or high-risk AI systems
- Rules restricting AI use by licensed professions (medicine, law, therapy)

**Exclude:**
- General occupational-licensing bills that don't touch AI

**Examples:**
- `IL HB5649` — DFPR AI mental-health service (licensure angle)

### 1.19 General / Cross-sector
**Definition.** Bills that regulate AI horizontally — comprehensive AI acts,
definitions statutes, or cross-cutting task forces without a single sector
focus.

**Include:**
- Omnibus state AI acts (e.g., CO SB205, CA SB1047)
- Standalone definition statutes
- General AI task forces / study commissions

**Exclude (strictly):**
- Bills that touch multiple sectors but each in a substantive way — code
  all applicable sector labels instead, NOT General/Cross-sector.
- Bills that are primarily about **training-data disclosure** — those are
  Digital Content/IP, not General.
- Bills that primarily regulate one identifiable sector plus some ancillary
  spillover — code just the primary sector.
- **Never assign General/Cross-sector as a second label alongside a specific
  sector** unless the bill's operative sections substantively regulate 3+
  distinct sectors.

**Examples:**
- `AK SB262` — Artificial Intelligence Task Force
- [CA SB1047-style omnibus bill]

---

## Axis 2 — Governance Mechanism

The regulatory lever the bill pulls. What does the operative text of the bill
*do*? Bills routinely combine mechanisms (a bias-audit bill often has
disclosure + enforcement + private right of action).

### 2.1 Definitions of AI/ADS
**Definition.** Establishes or amends statutory definitions of "artificial
intelligence," "automated decision system," "high-risk AI," etc.

**Include:**
- Bills whose operative section is a definition statute
- Definitional amendments to existing code

**Exclude:**
- Bills that reference existing definitions without amending them

**Examples:**
- [Standalone definition statute TBD]
- Most omnibus AI acts include this as a section

### 2.2 Disclosure / Transparency
**Definition.** Requires disclosure to consumers, employees, or regulators
that AI is being used, how it was trained, or what its outputs are.

**Include:**
- Chatbot self-identification requirements
- Training-data disclosure
- Watermarking / provenance marking
- AI-in-ad disclosures

**Examples:**
- `AL HB516` — Consumer disclosure when AI interacts with consumer
- `CA AB2013` — Generative AI training-data disclosure

### 2.3 Impact Assessments
**Definition.** Requires the deployer or developer to conduct and document a
pre-deployment assessment of risks, harms, or civil-rights impacts.

**Include:**
- Algorithmic impact assessments (AIAs)
- Data-protection impact assessments where AI-specific
- Mandated risk-classification exercises (like the EU AI Act's high-risk tier)

**Examples:**
- [CO SB205-style AIA requirement]
- [State agency AIA bill]

### 2.4 Bias Audits
**Definition.** Requires periodic, independent, or self-conducted testing of
an AI system for discriminatory outcomes across protected classes.

**Include:**
- NYC Local Law 144-style employment bias-audit bills
- Requirements for third-party audits with published results
- Testing-and-reporting cycles

**Exclude:**
- Impact-assessment bills that don't require post-deployment audits — code as
  Impact Assessments

**Examples:**
- [NYC Local Law 144-style employment audit TBD]

### 2.5 Algorithmic-Discrimination Prohibition
**Definition.** Directly prohibits discriminatory outcomes from AI systems
against protected classes.

**Include:**
- Standalone anti-discrimination statutes for AI
- Explicit private-cause-of-action for algorithmic discrimination
- Ban on use of protected-class proxies

**Examples:**
- [CO SB205 sections on discrimination TBD]

### 2.6 Private Right of Action
**Definition.** Grants individuals the ability to sue in their own name over
AI-related harms.

**Include:**
- Explicit PRA sections
- Deceptive-practices acts extended to AI

**Exclude:**
- Enforcement-by-attorney-general only — code as Enforcement/Penalty Scheme

**Examples:**
- Illinois BIPA-style biometric privacy bills

### 2.7 Licensing / Registration
**Definition.** Requires developers, deployers, or specific AI systems to
register with, or obtain a license from, a state agency.

**Include:**
- AI-developer registries
- High-risk-system pre-approval
- Sandboxes with registration requirements

**Examples:**
- [Registration-of-AI-devs bill TBD]

### 2.8 Procurement Requirements
**Definition.** Rules that constrain how public agencies buy or use AI.

**Include:**
- Vendor-attestation clauses
- Mandatory inventories of state AI
- Prohibitions on procuring specific systems

**Examples:**
- `CA SB892` — Public contracts AI procurement standards

### 2.9 Deepfake / Synthetic Media Rules
**Definition.** Criminalizes, civilly penalizes, or otherwise directly
regulates the creation or distribution of AI-generated synthetic media
in specified contexts.

**Include (mandatory):**
- **Any bill that penalizes, criminalizes, or requires disclosure of
  AI-generated synthetic media** MUST get this label — even if it also
  gets other mechanism labels like Enforcement/Penalty Scheme, Disclosure,
  or Definitions of AI/ADS.
- Election deepfake bans, campaign-ad synthetic-media rules
- Non-consensual intimate imagery generated by AI
- CSAM synthetic-media bans
- Watermarking mandates specific to synthetic media
- Synthetic-voice rules in telecom (robocalls, autodialing)

**Examples:**
- `AL HB172` — Deceptive AI election media criminalization → also gets
  Enforcement/Penalty Scheme; both labels apply.
- `AK SB33` — Synthetic media liability, elections → also gets Private
  Right of Action; both labels apply.
- `CA AB2905` — Synthetic voices in autodialing (Telecommunications
  domain) → also gets Disclosure/Transparency.

### 2.10 Data-Rights Provisions
**Definition.** Grants individuals rights (access, deletion, opt-out,
portability) over data that AI systems collect or use.

**Include:**
- Right to opt out of automated decision-making
- Right to explanation of an automated decision
- Data-deletion rights specific to training corpora

**Examples:**
- `AL HB283` — Data privacy consumer actions

### 2.11 Preemption / Savings Clauses
**Definition.** Bill text explicitly preempts local ordinances, cedes to
federal law, or preserves other state statutes.

**Include:**
- Express preemption clauses ("no political subdivision shall...")
- Savings clauses preserving other consumer-protection laws
- Anti-preemption language explicitly foreclosing federal preemption

**Examples:**
- [Preemption-clause bill TBD]

### 2.12 Enforcement / Penalty Scheme
**Definition.** Specifies who enforces the bill and what penalties apply for
violations.

**Include:**
- Attorney-general enforcement provisions
- Civil monetary penalties
- Criminal penalties tied to AI misuse

**Exclude:**
- Bills that create an offense without an explicit enforcement scheme

**Examples:**
- `AL HB172` — Criminal & civil penalties for deceptive election media

### 2.13 Task Force / Study
**Definition.** Creates a study committee, advisory council, or working group
to investigate AI policy without imposing operative restrictions.

**Include:**
- Interim study committees
- Standing AI advisory councils
- Report-back-in-X-months bills

**Examples:**
- `AK SB262` — Artificial Intelligence Task Force
- `CA SB1288` — Public schools AI working group

### 2.14 Sectoral Carve-Outs
**Definition.** The bill exempts a specific sector or use case from otherwise-
general AI regulation.

**Include:**
- "This section does not apply to healthcare providers..."
- Research-use exemptions
- Small-business exemptions

**Exclude:**
- Bills that are sector-specific from the start — those aren't carve-outs

**Examples:**
- [Carve-out bill TBD]

---

## Change log

- **v0.2 (2026-09-04)** — Post-verification refinements from a 13-bill
  smoke test that missed 3 labels:
  - **Coding rule 7 added**: substantive bills must have ≥1 mechanism
    label (empty mechanism only valid for ceremonial/appropriations).
  - **Coding rule 8 added**: `General/Cross-sector` is fallback-only,
    never additive alongside a specific sector.
  - **Digital Content/IP (1.12)**: training-data-disclosure bills must
    get this label (not `General`); deepfake bills always get it.
  - **General/Cross-sector (1.19)**: strengthened exclusion criteria.
  - **Deepfake/Synthetic Media Rules (2.9)**: mandatory label for any
    bill penalizing or requiring disclosure of synthetic media, even
    when other mechanism labels also apply.
- **v0.1 (2026-09-04)** — Initial draft. 19 targets, 14 mechanisms,
  examples seeded from real bills in the current dataset; a handful marked
  `TBD` for domains where the current dataset didn't surface a clean anchor.

## Open questions for review

1. Should **Insurance** be folded into **Finance/Credit** as one label, given
   most AI-insurance bills are health-insurance and would already double-code
   as Healthcare?
2. Should **General/Cross-sector** be a fallback (only used when nothing else
   applies) or an additive label (used alongside sector labels for omnibus
   bills)? Draft assumes the former.
3. Is the **Definitions of AI/ADS** mechanism useful, given nearly every AI
   bill contains definitions? Consider narrowing to "amends existing statutory
   definitions."
4. The `TBD` example slots need real bills. Two approaches: (a) enrich the
   dataset by pulling more federal/state bills we know regulate those areas,
   or (b) accept that some categories are legitimately empty in the current
   corpus and note it in the analysis.