v2.0.0

Dataset snapshot: the records in data/ on 20 October 2026, after the 2026-Q3 quarter (249 jurisdictions,
244 instruments of which 184 are verified, 117 obligations, 154 dated changes, 26 controls). Every policy,
obligation, change and control now carries a permanent id (AIPT-…).

Upgrade notes

This is a major version because two changes break existing installations:

• PHP 8.3 is the minimum (it was 8.2). The production image already ran 8.3.
• API tokens expire after a year unless SANCTUM_EXPIRATION_MINUTES says otherwise (0 or empty: until
  revoked). Tokens older than a year stop working on upgrade.

When upgrading a running copy:

1. Run php artisan migrate. 17 migrations are new since 1.0.0, among them permanent ids, record revisions,
   source checks, foreign-key indexes, digest deadlines by value, and a separate invitation_tokens table.
2. Re-send any invitation sent before the upgrade: invitations now have their own token table.
3. Compare your .env with .env.example. New keys include CHANGEDESK_*, SCHEDULER, SOCIAL_CARD_DISK,
   X_ENDPOINT and VERIFICATION_CRITICAL_BUDGET (now 98, with the reason in config/verification.php).
4. The Docker image's health check now also runs php artisan aip:health (database and scheduler).
5. The operations runbooks moved to docs/operations/, and the unused azure/ deployment files were removed.

Dependencies

• Composer: laravel/framework 12.70.0, inertiajs/inertia-laravel 3.5.1, dodopayments/client 6.29.2, tightenco/ziggy 2.6.5, laravel/pint 1.32.1, laravel/sail 1.69.0, with their Symfony, Carbon and Monolog patch releases.
• npm: @amcharts/amcharts5 5.21.0, @inertiajs/react 3.9.1, vite 8.3.4, @vitejs/plugin-react 6.1.2, eslint 10.12.0, @eslint-react/eslint-plugin 5.26.1, postcss 8.5.29.
• GitHub Actions: shivammathur/setup-php 2.40.0, actions/setup-node 7.1.0, actions/upload-artifact 7.0.2 (pinned by commit).

Added

• ai_specific in the API, the CSV and NDJSON exports and the OpenAPI schema.
• People who send a correction or suggestion with an email address get a receipt, and later the decision (accepted, not accepted, needs more information) with the reviewer's public note; internal notes are never sent.
• Site search also finds risks, frameworks and published transition measures, with full counts and links to the filtered listing.
• Obligations and changes can be sorted and downloaded as CSV; the download uses the same query as the listing on screen.
• Admin dashboard: recent admin activity (for accounts that can view the audit log), status badges on the latest submissions, and set-up links for email and bot protection.
• /developers (the read-only API, its endpoints, bulk data and the licence) and /mcp (the open-source MCP server, how to install it and its 16 tools), indexed with FAQ markup, in the sitemap and in llms.txt. The MCP page says there is no hosted endpoint yet.
• php artisan admin:invite <email> "<name>" --role=reviewer creates an account with an admin role and sends the same invitation as Admin → Users; an existing account is left unchanged.
• Reviewer roster: Joyce Loksee Ho and Kailash Bohara, unpublished until their declarations of interest are received; the editorial desk lists info@aipolicytracker.org.
• ai_specific on policy records: pages that say whether a jurisdiction has binding AI law (country FAQs, regional hubs, the world map, comparisons, the quarterly report) count only instruments about AI itself, and name privacy or cyber laws that also apply to AI separately. The validator requires it on a binding record whose name does not mention AI.
• /pricing is indexed and linked from the footer whether or not checkout is on, and shows four tiers: Open (free), Builder ($29 a month or $290 a year, the existing Pro checkout), Team ($149 a month) and Commercial (from $6,000 a year) by written agreement, each listing only what exists today, with unbuilt items marked "Coming, not built yet". It carries five pricing questions as FAQPage markup. A licence and custom-coverage enquiry form on /pricing and /open-data stores each enquiry (licence_enquiries) before mailing the contact address, and is throttled, honeypotted and Turnstile-checked; Admin → Audience → Licence enquiries lists them with CSV export. Every policy, template and tool page says commercial use is allowed under CC BY 4.0 and links to the form.
• php artisan aip:health fails when the database does not answer or, where the container schedules, when the scheduler has not ticked for 5 minutes (5 minutes' grace after start). The Docker health check runs it beside /up.
• deploy/cron-install.sh also installs the nightly deploy/backup.sh entry, only when BACKUP_RCLONE_REMOTE is set and /etc/cron.d/aip-backup does not exist.
• Permanent record ids (AIPT-POL-0073, AIPT-OBL-0004, AIPT-CHG-0121, AIPT-CTL-0001) on every policy, duty, change and control: never changed or reused, resolved at /id/{id} wherever the record lives, and carried by the API, alert webhooks, context files and the MCP server (resolve_record_id). Citations name the id, the record version, the reviewer and the date.
• Record history: each import records which tracked fields of a record changed, from what to what, and the record pages show it. A one-line standing on policy and duty pages says whether the record is still good: no longer in force, a date moved, changed recently, or no change since the last source check.
• Change desk (Admin → Content): official sources due a look on a cadence, most watched first, with one-line check logging, and "Deepen next" for watched instruments with few duties. /freshness publishes the target (3 days from an official text to its entry here) and measures it month by month.
• /independence: who verifies the records, the Certifyi relationship and its rules, how to check a record yourself, and what is not yet independent.
• Reliance measure: alert links carry src=alert, and the admin dashboard shows accounts that acted on an alert in each of the last four weeks.
• deploy/backup.sh: nightly checked database dumps, copied off the host with rclone, rotated after 14 days, with --verify-latest to rehearse a restore.
• Site search covers AI Incident Database records by headline, and a search with no result offers the main listings.
• scripts/npm-audit.mjs audits every npm dependency, build tools included, against a short allowlist with reasons; the security workflow runs it.
• Sub-national AI laws and policies: 53 records across 37 new states, provinces, regions and cities (pending review), including the Illinois AI Safety Measures Act (SB 315), California's training-data, AI transparency, companion-chatbot and CPPA automated decision-making rules, Connecticut SB 5, Washington's companion-chatbot law, Executive Order 14365 on state AI laws, Galicia's and Calabria's regional AI laws, Shanghai's and Shenzhen's AI regulations, NSW's AI policy, assessment framework and digital work systems act, and the Australian state, Indian state, Scottish, Welsh, Canadian provincial, Brazilian state and UAE emirate instruments. See docs/reference/subnational-research-2026-10-15.md.
• Country pages list their states' and provinces' AI laws in the body, not only by name in the sidebar.
• Singapore's agentic AI testing: the Starter Kit for Testing Agentic Systems for Safety and Reliability (launched 14 October 2026), the Model AI Governance Framework for Agentic AI, the LLM application testing starter kit and the AI Tester Accreditation Programme (pending review). See docs/reference/singapore-agentic-testing-2026-10-15.md.
• Posting to X: each new verified change is posted with a flag, headline, one sentence, its link, hashtags and mentions (@aipolicytracker @8h45k4r by default). Automatic or with approval, within a monthly cap, with failures kept and rate limits retried. Admin → Operations → Posts to X previews, edits, approves and sends; keys live under Settings → Posting to X. Change pages now have their own preview card, which is what shows under each post.
• Obligation pages are titled by article and topic, the way people search ("EU AI Act Article 14: Human oversight"), instead of a duty sentence cut off mid-phrase. Each obligation record can carry a short_title; 114 now do. Long instrument names give way to their plain form, acronym or country. South Korea's Framework Act is shown as the AI Basic Act, as its official title names it.
• Admin interface: side panels for invite and funder forms, toasts for results, a confirmation dialog that names the count and the consequence, buttons that show they are working, and Ctrl/⌘ K to jump to any page, action, person, policy record or submission. Poppins is self-hosted, and no page loads fonts from a third party.
• Admin errors (refused, missing, expired, too many requests) are explained inside the admin, naming your role and the permission you'd need. Signed-in administrators have their own limit of 600 requests a minute.
• Users and roles: invite from a side panel with role cards that list what each role can do; roles are changed by name on the account's page with a confirmation; bulk actions have one button each; phones get one card per account; the permissions matrix keeps its headers in view and counts unsaved changes.
• Settings: each group has its own Save that changes only that group, keeps what was typed after an error and labels every value as saved here, from the environment or the default. Switches that change the live site sit apart and ask first.
• Review queue: admins not on the reviewer roster are told before they try to verify; bulk status and confidence default to "Keep current"; publishing asks first; Submissions, Subscribers and alert deliveries can act on every row the filters match and say when a run hit its limit.
• The audit log reads in words ("Changed a role to Editor") with Success and Refused badges and a link to the record.
• The dashboard le...

v1.0.0

First tagged release. It covers everything built since the project moved to structured, source-backed records, and closes the ten-phase search-and-growth roadmap (docs/plans/roadmap.md). The entries after this summary are the detailed history, newest first.

Added

• Titles and addresses: one title generator with a 60-character budget, no internal identifiers in titles, headings or slugs, descriptive slugs with 301s from every old address, and a crawl of every sitemap URL in CI (php artisan seo:audit).
• An AI policy updates hub with significance levels, a Google News sitemap, an RSS feed per jurisdiction and a newsletter archive.
• Answer-first record pages: a short answer, a key-facts table and questions and answers on every policy page.
• Incident pages with brand-safety rules, harm domains and the policy angle of each incident.
• A templates library: 18 XLSX and DOCX templates generated from the records, versioned, previewed and free to download (/templates).
• Country hubs, regional hubs and comparison pairs (/ai-regulation-*, /compare/*).
• A deadline engine that works out which dates apply, with .ics and PDF exports (/deadlines/which-date-applies).
• Watches with email and webhook channels, recorded consent, one-click unsubscribe, a watches API and an obligations register export in XLSX, CSV, JSON and PDF.
• An AI economic transition tracker and a displacement policy index (/ai-economic-transition).
• A quarterly State of AI Regulation report, embeddable widgets, a page per reviewer and localised hubs in Spanish, Indonesian and Brazilian Portuguese.
• An admin review queue that acts on a selection for every record kind (policies, jurisdictions, controls, change log entries, transition measures): verify, publish or unpublish the ticked rows or everything a filter matches, with one attestation. Submissions, subscribers and tools take bulk actions too.
• A request ID on every response, shown on the error page and written with every log line, so a reported error can be found.
• Eight more AI governance templates, 26 in all: AI Model Card, AI Data Governance Register, AI Audit Evidence Tracker, AI Literacy and Training Plan, AI Post-Market Monitoring Plan, AI Contract Clause Library, AI Red-Team and Evaluation Test Plan, and AI Governance Board Reporting Pack.
• Template downloads are requested with a work email: name, company, work address (consumer and throwaway mailboxes refused), terms consent and Cloudflare Turnstile. The files arrive as links signed for seven days; requests are listed and exported in the admin.
• An interactive world map of AI regulation (amCharts 5) on /jurisdictions and the State of AI Regulation report, loaded only where it appears.
• A Deployment check workflow that reports which shipped features the live site is serving, and a Release workflow that runs from a version tag or from the Actions tab.

Changed

• Verified records are signed by Bhaskar Bhatt, the accountable reviewer, rather than the editorial desk. Records still pending review are unchanged.
• The Colorado kit is rebuilt on SB 26-189; four September 2026 California changes are recorded (SB 813 and AB 1405, the companion-chatbot package, SB 1050, the AI oversight executive order), pending review.
• The EU AI Act record follows Regulation (EU) 2026/1744: high-risk duties apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I products. Colorado's SB 24-205 is marked repealed and SB 26-189 has its own record. Both are pending review against the official texts.

Fixed

• Reviewer pages answered 500 on PostgreSQL because they queried a column obligations do not have.
• Confirmation prompts on destructive admin actions never ran under the Content-Security-Policy; they do now.
• Verification decisions for controls, change log entries and transition measures are written back to data/, not only those for policies and jurisdictions.
• A redesigned social preview card was never redrawn or re-fetched for an unchanged record; the design version is now part of each card's cache key and URL.
• Successive versions of a template shared one change-log title because the version fell outside the 60-character title budget; the version now leads the title.

Security

• An account became owner if its email matched ADMIN_EMAILS, verified or not. Anyone who registered an owner address that had no account yet, or changed their own profile email to one, could enrol their own authenticator and hold every capability. Ownership now requires a verified address.
• A session holding only an admin's password, stopped at the second-factor challenge, could still change the account's email or password or delete it, and so free an owner address to re-register. The profile and password routes now sit behind the second factor for admins; POST /confirm-password is throttled.
• Suspending an account, resetting its second factor, or changing or resetting its password now ends its other sessions and remember-me cookies. They had been checked only at the next password sign-in.
• A billing webhook that failed while being applied was acknowledged as a duplicate on the provider's retry and never applied, so a cancellation hit by a deadlock left Pro access in place. A retry of a failed event is now applied.
• The subscribe form sends at most three confirmation emails per address per day, whatever the source IP. It could be used to mail any unconfirmed address thousands of times a day.
• /og/site/{slug}.png drew and stored a fresh image for any made-up slug, so a loop of GETs filled the disk. Only default exists now.
• Public CSV exports of third-party data (AI incidents, risks, open data) escape cells a spreadsheet would run as formulas.
• Array query parameters (page[]=, q[]=, jurisdictions[][]=) no longer cause a 500 on the API, the risk browser or the applicability check, and a non-numeric page no longer creates a cache entry per variant.
• The AIID and MIT sync commands fail on an HTTP error instead of saving the error page as a workbook.
• A proxy the app trusts could have its visitor's X-Forwarded-Host, -Port and -Prefix rewrite every URL the app generated, including pagination links cached in public API responses. Only X-Forwarded-For and -Proto are trusted now.
• An admin cannot rename themselves on the profile page: the reviewer roster matches display names, so a rename could sign verifications as someone else.
• Confirming a subscription or unsubscribing takes a button press. Opening the link no longer changes anything, so mail scanners that follow every URL cannot do it for the reader.
• Security headers (CSP, nosniff, frame options) are sent on every response, including the API and 404 pages; X-Powered-By is removed.
• Full-table exports, llms-full.txt and social cards are rate-limited. Jobs cannot overlap, whichever of the scheduler, /cron/* or the admin started them. The past_due grace period no longer restarts with each webhook. Future-dated records are not reachable by slug. Third-party report links are http(s) only. Flowbite is pinned by Subresource Integrity. The XLSX reader bounds column references.
• Production defaults to secure, encrypted session cookies. The Docker image keeps public/ read-only for the runtime user, sets expose_php=Off, has a health check, and builds assets on Node 22 (Node 20 is end of life).
• GitHub Actions are pinned to commit SHAs, and the one workflow input is validated before use.

Added

• .github/workflows/security.yml: secret scanning of the full history (Gitleaks), SAST (Semgrep), dependency audits (composer, npm, Trivy), IaC (Trivy, Checkov) and a container image scan on every pull request; ZAP DAST and an active API scan weekly. Dependabot for composer, npm, Actions and Docker. See docs/reference/security-scanning.md and the assessment in docs/reference/vapt-2026-09-24.md.
• data/LICENSE (CC BY 4.0) and GOVERNANCE.md. The API list responses and the CSV and NDJSON exports state the data licence. NOTICE lists the data and third-party dataset licences, and no longer names libraries the project stopped using.

Changed

• composer lint is enforced in CI; the codebase was formatted once with Pint.
• Contributor docs: fork-first setup, policy:import after seeding, schema limits for new records, a worked data-only pull request, and composer test no longer times out. A policy record must cite at least one source.
• The verification badge says what it is: a factual check against the official source, not a legal review.
• Repository layout: the three point-in-time audit and implementation reports moved from the repository root to docs/reports/, so the root holds only the documents a newcomer reads (README, contributing, governance, security, code of conduct, changelog and the operations notes). References in the debt register and inside the reports follow.
• README: status badges for CI, the gate check, data validation and security; the quick start and the command table moved to the top, where someone cloning the repository looks first; a repository map naming what lives in each directory; security reporting given its own section.
• The operating company is named once on the About page, in NOTICE and in the structured data, rather than in the footer of every page, in the About FAQ and in the header of every email. The site footer keeps the maintainer, which is who a reader with a correction needs.
• The address on the automated external-data pull requests is the project's maintainer address rather than a personal mailbox, matching CONTACT_EMAIL and /.well-known/security.txt.
• docs/reference/compliance-map.md cited CLAUDE.md, a local editor-tooling file that is git-ignored and so is not in the repository. It now cites the public documents that carry the same rule (engineering-standard.md, change-gates.md, CONTRIBUTING.md).
• docs/reference/change-gates.md put "Accepted debt" between gate ...