AI Reg Atlas

Methodology

How this dataset is built, what "primary source" means, what is and isn't in scope, and the maintenance cadence. This page exists for two audiences: the hiring-manager / compliance-professional who wants to know if they can trust the rows, and future-me, who will forget why Colorado's row reads the way it does.

Data-quality rule (non-negotiable)

Every row's source_url resolves to a primary source: the regulator's own site, the bill text, or the official bulletin. Secondary sources (law-firm alerts, blog posts) are fine for finding facts during research; they are not acceptable as the citation itself. If a row's primary source stops resolving, the row is pulled from the public dataset until the citation is fixed.

How a row gets added

  1. Identify the primary source (regulator's URL, bill text, official bulletin).
  2. Verify the source resolves and matches the summary being written.
  3. Write the summary in plain language; do not copy-paste from any source.
  4. Add a last_verified date equal to the day the row was last checked.
  5. If the framework changes (repeal, replacement, amendment), update the row and add a changelog entry on the same day.

Status taxonomy

  • adopted — the framework is in force in the jurisdiction.
  • pending — the framework exists at a parent level (e.g. NAIC model bulletin itself, EU AI Act Annex III obligations) but has not yet been adopted/transposed in this jurisdiction.
  • proposed — a draft exists that, if enacted, would change the row.
  • repealed-and-replaced — the framework was repealed and replaced by a newer one. The row is retained for historical reference (Colorado's SB 24-205 is the canonical example).
  • pilot — the framework is being run as a pilot, typically with a fixed end date (NAIC AI Systems Evaluation Tool pilot, Jan–Sep 2026).

Scope: what's in, what's out

In (v1): insurance (NAIC AI Model Bulletin adoption, state-specific insurance frameworks, NAIC AI Systems Evaluation Tool pilot), fintech/lending (CFPB adverse-action / ECOA, the April 2026 replacement of SR 11-7, Colorado's SB 26-189), and the EU AI Act's Annex III for credit scoring and life/health insurance risk-pricing.

Out (v1): AI regulation outside financial services and insurance (no general employment AI, healthcare AI, etc.), no compliance methodology or "how to comply" content, no claims or underwriting data, no paid or gated content.

Map source

The repo ships a schematic US-states GeoJSON in public/us-states-schematic.geojson — a hand-laid-out grid of 50 states + DC that renders correctly under d3-geo's geoIdentity projection. This is the build-time fallback when the npm registry is unreachable. In a normal build (with network access), the production site should swap this for us-atlas/states-10m.json and use geoAlbersUsa. The components are written to accept either; see app/page.tsx.

Maintenance cadence

Quarterly full review of every row against its primary source, plus ad hoc updates when a tracked law changes (the Colorado rewrite, the EU Digital Omnibus resolution, the next SR 11-7-style replacement).