Open AI policy dataset, schema and API
AIPolicyTracker publishes its policy records as open data under CC BY 4.0. The dataset currently holds 249 jurisdictions, 244 policy instruments, 117 obligations and 341 change events , last updated 16 October 2026. Every record carries an official source URL, review status, confidence level and verification dates so you can judge it before you use it.
Dataset description
Record types: jurisdiction, policy instrument, policy version, section, obligation, applicability rule, deadline, enforcement event, procurement rule, framework mapping, evidence artifact, change event and source document, plus controlled vocabularies for ai actor, ai system type, sector, risk category, evidence type, ai use case, obligation category. Summaries are original plain-language descriptions; no copyrighted commentary or standards text is included.
Schema documentation
Records are validated against JSON Schema (draft 2020-12) before import. Each schema is served at the URL its own $id declares, so a validator can resolve it: change.schema.json · common.schema.json · control.schema.json · implementation-measure.schema.json · jurisdiction.schema.json · policy.schema.json · reviewer.schema.json · taxonomy.schema.json · transition-indicator.schema.json · transition-measure.schema.json . Version 1.0.0.
| Field | Meaning |
|---|---|
| official_source_url | Primary official document or page the record is based on |
| source_title / source_publisher / source_document_date | Bibliographic details of that source |
| source_reference | Article, section or page reference inside the source |
| source_tier | 1 official primary; 2 official guidance/consultation; 3 labelled secondary; 4 community submission |
| last_checked_at | When a maintainer last opened the source |
| last_verified_at | When a human reviewer confirmed the record against the source |
| review_status | draft, pending_review, verified or needs_update |
| confidence_level | high, medium, low or unavailable |
| content_version / change_summary | Record version and what changed in it |
| reviewed_by | Reviewer name or handle, when safe to expose |
Bulk exports and per-record context files
The bundle above is one nested document you load whole. These are the other shape: one self-contained row or file at a time, for a spreadsheet, a pipeline or a model's context window. Every row and every file carries its own provenance — official source, review status, confidence and the date the facts were last confirmed — because a record that travels on its own without them invites somebody to treat an unverified summary as a fact.
| Dataset | Formats |
|---|---|
| Jurisdiction profiles | CSV · NDJSON |
| Policy instruments | CSV · NDJSON |
| Obligations | CSV · NDJSON |
| Change log entries | CSV · NDJSON |
| Dated deadlines | CSV · NDJSON |
| Controls | CSV · NDJSON |
| Enforcement actions | CSV · NDJSON |
| Implementation measures and standards | CSV · NDJSON |
Per-record Markdown, one file an assistant can read without scraping a page: /policies/{slug}.md, /jurisdictions/{slug}.md, /obligations/{slug}.md and /changes/{slug}.md — for example the EU AI Act as a context file.
https://aipolicytracker.org/open-data/health.json reports in one document how far the corpus can be trusted right now: how many records are past their re-check date, how many are missing required fields and how many have been verified by a named reviewer. Read it before quoting a record as settled.
Agent server
An assistant can query these surfaces directly through the Model Context Protocol server in the repository's agent/ directory: read-only, unauthenticated, no dependencies. It offers the corpus health check first and repeats in every result that these records are structured summaries with links to official texts, not legal advice. See the repository for setup.
Data licence
Data: CC BY 4.0. Code: Apache-2.0. Official documents linked from records remain under their publishers' terms.
Commercial licences, SLAs and custom coverage
Commercial use of the records is already allowed on every plan under CC BY 4.0, with attribution. Write to us for a white-label licence without attribution, a freshness commitment in writing, a team plan or a jurisdiction we do not cover yet. Nothing is charged until a written agreement is signed.
API documentation
Read-only, no authentication, rate limited (120 requests per minute per IP), cached for 10 minutes, CORS enabled. Base URL https://aipolicytracker.org/api/v1.
| Endpoint | Description |
|---|---|
| /jurisdictions | List published jurisdictions |
| /jurisdictions/{slug} | One jurisdiction with its policies |
| /policies?q=&jurisdiction=&status=§or=&use_case=&actor=&binding=&sort= | Search and filter policy instruments (paginated) |
| /policies/{slug} | Full policy record with obligations, deadlines and sources |
| /obligations?category=&jurisdiction=&binding= | Search obligations |
| /obligations/{slug} | One obligation with mappings, evidence examples and the controls that meet it |
| /controls?kind=&framework= | Controls: what an organisation operates, the duties each serves, evidence and clause references |
| /controls/{slug} | One control with every duty it satisfies or supports |
| /changes?since=YYYY-MM-DD&jurisdiction= | Change events, newest first |
| /taxonomies | Controlled vocabularies |
Third-party datasets (attribution required)
- AI Incident Database, metadata for every incident (CC BY-SA 4.0): CSV · JSON · browse
- MIT AI Risk Repository, risk database (CC BY 4.0): CSV · JSON · browse
- MIT domain taxonomy with our use-case mapping: data/external/mit_ai_risk_domains.json in the repository
Each policy page also exposes its record at /policies/{slug}.json, and the change log at RSS.
Contribution workflow
- Fork the repository and edit or add a YAML record under
data/. - Run
php artisan policy:validate. - Open a pull request listing each changed field and its official source URL.
- A reviewer verifies against the source and sets
review_status: verified. - Merged records are imported and published. No web form can publish directly; see Contribute.
Release history
- Schema 1.0.0, live · 2026-10-16 — Current dataset: 249 jurisdictions, 244 policy instruments, 117 obligations, 341 dated changes; 184 instruments verified against their official source.
- First release · 2026-09-10 — Historical figures: 10 jurisdictions, 18 policy instruments, 57 obligations and a dated change log, all pending human verification at the time.
Citation guidance
Cite the specific record URL and the date you accessed it, and cite the official source alongside it. Suggested format:
AIPolicyTracker (year). "Record title". https://aipolicytracker.org/... (accessed date). Data licensed CC BY 4.0.
For AI assistants and crawlers, see /llms.txt and /llms-full.txt.
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.
Frequently asked questions
Do I need an API key?
No. The REST API is read-only, public and rate limited, and needs no registration. The same records are available as bulk CSV and newline-delimited JSON, and every record is also served as a single Markdown context file with its provenance.
What licence applies, and what must I include?
The records are published under CC BY 4.0. Attribution is a condition: cite the record URL and the date accessed, and cite the linked official source alongside it. Mirrored third-party datasets carry their own licence and citation in every response and export.
How should an assistant or agent use this?
Start at llms.txt, which lists the canonical pages, the exports, the schemas and the data-health document. Read the health document before quoting any record as settled, because it reports how many records are unverified or past their re-check date.