Method

How this is built, and what it does not claim.

The short answer

The seven legal-force levels

This taxonomy is the product. Most AI governance summaries put a statute, a supervisory expectation and a voluntary framework in the same bullet list, which is how a compliance team ends up treating a consultation draft as a deadline and a binding notice as a suggestion.

Binding

Binding law. It applies to everyone in scope, whether or not anyone points at it.

Binding, sectoral

Binding, but only for a defined population: one regulated sector, or the federal government and the vendors it buys from.

Supervisory expectation

Not law. It is what your supervisor examines you against, which is not the same as optional.

Consultation

Proposed, not final. Read it, plan for it, and do not treat it as settled.

Guidance

Voluntary guidance. Best practice, not obligation, until a contract or a regulator cites it.

Standard

A voluntary standard. It becomes an obligation the moment a contract or a regulator cites it.

Emerging

Not in force yet. Expected, and not something you can be held to today.

Two mapping notes worth stating plainly. In the United States chart, executive orders and OMB memoranda are labelled binding, sectoral: they bind the federal government and, through procurement, the vendors it buys from, and they do not bind a private company that sells nothing to Washington. In both charts, a framework labelled voluntary can still become an obligation the moment a contract, a regulator or a state statute cites it, which is exactly what happened to the NIST AI Risk Management Framework.

What counts as a source

• Official domains only. The agency's own publication, the Federal Register, the statute book. Never a law firm summary, never a news write-up, never another tracker.
• Every node carries a URL and a date. If a fact could not be traced to a primary source, the node was deleted rather than guessed. An unjustified legal-force label is worse than a missing entry.
• Quotes are short and marked. Where a phrase does the work, it is quoted verbatim with its section, and nothing on this site reproduces a document in bulk.
• Absence is reported. Where an agency was directed to publish something and has not, the entry says so and names the deadline that passed. That is a fact about the stack, not a gap in the dataset.

Where our reading replaces theirs

Of 924 relations on this map, 244 are GAGE analysis rather than a connection the source documents state. Those are drawn as dashed amber edges on every graph, flagged on every crosswalk cell, and labelled on every relation row. Cross jurisdiction links, for example the line from the NIST AI Risk Management Framework to Singapore's Model AI Governance Framework, are always ours: no agency published that mapping, and pretending otherwise would be the easiest and worst shortcut in this tool.

Scope, and what lives elsewhere

The United States chart covers the federal layer. State AI law is deliberately not restated here: it lives in the 50-State AI Law Atlas, on its own verification cycle, so no state fact can sit in two datasets and drift apart. The EU AI Act has its own provision by provision explorer, and the regime level comparison of Europe, the United States and China lives in the Global AI Governance Arena.

Re-verification

Both datasets get a monthly pass. The watchlist is written into the build scripts: a consultation going final, a guidance document withdrawn, a new executive order, an agency publishing something it was directed to publish. Every node shows the date it was last checked, so a stale entry is visible rather than invisible.

Source registry

Every official URL behind this map, with the date it was last checked. A handful of government hosts block automated requests; those are marked and were checked by hand.