Method

1. Research design

The ledger uses qualitative document analysis: the systematic review and interpretation of printed and electronic documents to produce empirical knowledge about a subject ^[1]. Here the documents are Indonesia's legal instruments, the official statements made about them, and the reporting and analysis that describe them.

The design is longitudinal. Each instrument and each public promise is followed over time, every observation is dated, and sources are re-opened to check whether anything has changed. The analysis works in three layers that are kept visibly separate on every entry:

1. Descriptive layer. What happened, when, who said it, and in which instrument. This is the summary and the source list.
2. Coded layer. A fixed codebook applied to every entry: instrument status, evidence level and the four-question Safety lens.
3. Evaluative layer. The comparison with EU law and frontier AI safety practice, and the author's own view, labelled "My take".

Unit of analysis. The primary unit is the entry: one dated governance event tied to exactly one instrument. The secondary unit is the deadline: a public, dated promise by a named official, recorded in the Promise vs Reality ledger.

Research mode. Desk research only. The ledger has not conducted interviews or filed information requests. Every piece of evidence is published and linkable, so any reader can retrace each step.

2. Research questions

1. RQ1. Which instruments govern artificial intelligence in Indonesia, and what is the legal force of each?
2. RQ2. What have officials publicly promised about those instruments, and did the promised act happen by the stated date?
3. RQ3. Do the instruments address seven safety questions: incident reporting, unacceptable uses, general-purpose models, enforcement, who receives incident reports, cross-border incidents and frontier AI?
4. RQ4. How does each instrument compare with EU law and with the safety frameworks published by frontier AI developers?
5. RQ5. When an AI incident crosses a border, who receives the notice, and does that body exist? Analysis 01 takes this question up (Nobody to Call).

3. Scope and case selection

Jurisdiction. Indonesia only, until the ledger holds twelve Indonesian entries. Other ASEAN member states follow after that.

Inclusion criteria. An event is recorded when it does at least one of the following:

• creates, amends, signs, delays or withdraws an instrument that governs AI;
• sets or restates a public deadline for such an instrument;
• changes a data protection rule that shapes AI governance, such as breach reporting or the supervisory authority.

Exclusion criteria.

• commentary or opinion that reports no new governance event;
• corporate product announcements without a regulatory element;
• claims that cannot be tied to a linkable source;
• conduct of private individuals.

Time frame. From the Ministerial Circular Letter on AI ethics of 19 December 2023^[12], the first AI-specific instrument in force, to the present. Deadlines are recorded from January 2025, the earliest public deadline the ledger has found.

4. Data collection

Sources are discovered through four streams. Each stream has a defined role in the evidence chain.

Search strategy. Searches run in Bahasa Indonesia first, using the terms officials actually use:kecerdasan artifisial, Perpres AI, rancangan, peta jalan, etika AI, tanda tangan Presiden, pelindungan data pribadi. English searches follow, mainly to find foreign coverage and law firm analysis.

Capture. For every source the ledger records the title, outlet, language and URL in the entry's data file, and keeps the source in its original language.

Access to information. The Public Information Disclosure Law gives everyone the right to request public information from public bodies through their information officers (PPID) ^[6]. The ledger has not yet used this route. When it does, each request and its outcome will be logged.

5. Source hierarchy and evidence levels

Every entry carries one evidence level. It describes the strongest source the author has actually read for that entry, not the strongest source that exists.

Evidence: Legal textLegal text

Tier 1. The author has read the signed or published text of the instrument itself, from the issuing agency or an official legal database. This is the only level that can support a claim about what the law says.

Evidence: Official statementOfficial statement

Tier 2. A minister, ministry official or government body said it on the record, through an official channel or as reported by a named outlet with the speaker named. It shows what the government says it intends, not what the law says.

Evidence: Press reportPress report

Tier 3. Journalism or secondary analysis, such as a law firm summary, without the primary text. Treated as provisional until the primary text is read.

• Upgrade rule. A level is raised only after the author has read the stronger source. It is never raised on the strength of someone else's reading.
• Copy rule. Aggregating databases such as BPK's state that their documents come from the issuing agencies and should be checked against them ^[5]. Where copies differ, the issuing agency's copy prevails.
• Not evidence. Screenshots, anonymous claims and unattributed social media posts are not admitted as evidence at any level.

6. Verification protocol

Every claim goes through the same steps before it is published.

1. Provenance. Trace the claim to its earliest publication by a named outlet or official channel. Reposts and aggregators are replaced with the original.
2. Primacy. Look for the primary text in the official legal databases before relying on any summary of it.
3. Attribution. Tie every statement to a named person and their role, or to a named body. An unnamed "source at the ministry" is not recorded as an official statement.
4. Temporal integrity. Keep three dates apart: when something was said, when it was published, and when the ledger last checked it. Deadlines use the date said.
5. Corroboration. Every additional independent report the author reads is added as a source. A claim that rests on one report is shown with that report's evidence level.
6. Quotation integrity. Quotes stay in the original language, stay under 15 words, appear at most once per source, and carry an English line. The validator enforces all four rules. Statute text on Analysis pages is the only exemption from the length rule. A separate check reads each source and looks for the quote's exact words (npm run check-quotes). Quotes checked on 27 October 2026: 13 of 13 found in their sources.
7. Digital content. Posts, images and screenshots are assessed against the Berkeley Protocol on Digital Open Source Investigations, which looks at where content came from, its technical properties and what it shows^[7]. Content that cannot be authenticated is shown only as an unverified lead, with personal data redacted, and never as evidence.
8. Re-verification. The "last checked" date changes only when the sources were actually re-opened. A link checker flags sources that stop responding.

These steps follow two professional standards. The SPJ Code of Ethics asks journalists to verify information before publishing it and to use original sources whenever possible ^[8]. The IFCN Code of Principles asks for transparency of sources, methodology and corrections ^[9]. Monsoon Ledger is not an IFCN signatory. It uses the code as a benchmark.

7. Coding scheme

7.1 The Safety lens

The same seven questions are asked of every entry. The first four have been coded since the start. The last three were added in October 2026 (lens v2). The codes and decision rules are fixed, and the full table is on the Safety lens page.

Unclear is not No. Unclear means public sources do not yet answer the question. A draft whose text has not been published is usually Unclear on most questions. Coding uses only the sources listed on the entry, at the evidence level shown.

Definitions. Yes: a cited source states it. No: a cited source states the opposite, or the full text has been read and it is absent. Absence in a press summary is not No. Unclear: the default. Every coded value carries a sentence, in both languages, naming the source that supports it, and the day the lens was last checked. The validator rejects a coded value without that sentence, and a No taken from a press report.

7.2 Instrument status

• Announced: publicly said to be coming, with no draft text seen.
• Draft: a draft exists or is described by officials, but it is not signed.
• Signed: signed and promulgated, but not yet in effect.
• In force: legally in effect.
• Withdrawn: officially abandoned or revoked.

7.3 Promise vs Reality outcomes

Outcomes are no longer coded by hand. They are computed from each promise's claim type, deadline and outcome date, as set out in section 8.

8. Coding promises

The Promise vs Reality ledger follows the promise format published on the Promise format page. Its rules are summarised here.

8.1 What counts as a promise

A public, on-the-record statement by a named official or government body that commits the government to an act about AI rules, such as signing, issuing or launching an instrument or forming a body, reported by a named outlet or an official channel. Hopes without an act ("Indonesia wants to lead in AI"), statements by companies and unnamed sources are not promises. Each promise is one row in data/deadlines.yml, coded at the evidence level of its source.

8.2 Three claim types

• Dated: the promise has a deadline that can pass, for example "a binding rule within three months".
• Conditional: it depends on an event and gives no date, for example "the task force starts once the President signs". It is never counted as missed.
• Status claim: a claim about progress with no deadline, for example "only the President's signature is left". It is never counted as missed.

8.3 Deriving the deadline

The deadline is the last day the promise could still be kept, derived from the words in the source:

1. When the wording allows more than one date, the latest plausible reading is used, so that every "missed" can be defended.
2. A named period ends on its last day: "in June 2025" is 30 June 2025, "in the first half of 2026" is 30 June 2026, "in 2026" is 31 December 2026, "this month" is the last day of the month in which it was said.
3. "Within N months" counts calendar months from the day it was said, clamped to the end of a shorter month: one month from 31 January is 28 or 29 February.
4. The deadline day counts in Western Indonesian Time (WIB). The promise is still open on that day.
5. No wording about time means no deadline: the promise is conditional or a status claim.

Each dated row records its derivation as a rule, such as end 2025-06, together with the wording behind it. The validator recomputes every deadline from its rule and refuses the data if they disagree. The derivations in the ledger today:

8.4 Computing the outcome

The outcome is never set by hand. For a dated promise it is met if it was kept on or before the deadline, missed if the deadline has passed without it being kept (or it was kept late), and open otherwise. Conditional promises are met once kept and otherwise have no deadline. Status claims never have one. One module, scripts/promises.mjs, does this for the validator, every page, the feeds and the share cards, so a count can never differ between two places. Headline counts are taken among dated promises only. As of 5 November 2026: 4 of 5 dated promises missed, 1 open and 0 met; 1 conditional promise and 1 status claim set no deadline.

8.5 Disputes and corrections

Anyone who reads a source differently can open an issue with the wording. The derivation is checked again against the source. If it changes, the rule, the deadline and the basis are updated together, the change is logged with its date in the changelog, and the earlier reading stays in the public git history. When two readings remain possible, the later deadline is kept.

8.6 A single coder

Every promise is coded by one person, the author. There is no second coder and no inter-coder reliability measure. To make up for that, every derivation is published with the wording it rests on, and the validator checks each deadline against its rule, so any reader can retrace and contest every reading.

9. Preserving evidence

News pages move, change and disappear. Following the attention the Berkeley Protocol gives to preserving digital open source information ^[7], every source behind a promise, an instrument or an entry gets a copy in the Internet Archive.

• How. After each scheduled scan, scripts/archive.mjs looks for an existing snapshot of each unarchived source and, if there is none, requests one, a few per run with a pause between requests.
• Where it shows. The copy and its date are recorded next to the source in the data, and every page that shows the source links the copy beside it. The original link remains the citation.
• Missing copies. The validator warns about every source still without a copy. A missing copy never blocks publication and is never hidden.
• Limits. Some sites refuse archiving, and a snapshot shows the page as the archive saw it, which can differ from what a reader saw behind a paywall or after a live update. If the original changes or disappears, the copy is the record of what was said.

10. Assessing legal force

Whether an instrument binds anyone is decided by Indonesia's law on lawmaking. Article 7(1) of Law 12 of 2011 sets the hierarchy: the 1945 Constitution, decrees of the People's Consultative Assembly, laws and government regulations in lieu of law, government regulations (PP), presidential regulations (Perpres), provincial regulations and district or city regulations ^[10]. Under Article 8, regulations issued by ministers and other bodies are recognised and binding only when a higher regulation orders them or when they are made within the issuer's authority^[11].

A circular letter (surat edaran) sits outside both lists. It is administrative guidance. That is why the AI ethics circular of 2023, which describes itself as ethical guidance ^[12], is coded Not binding even though it is in force. A presidential regulation is coded binding, because it will have legal force once it is signed, while its status stays Draft until then. The full assessment for each instrument is on the Instruments page.

11. Comparative frame

The EU is the reference point because it has the most complete binding AI law in force, the AI Act^[13], and because the author lives under it. The comparison is a reference point, not a claim that Indonesia should copy Europe. Legal rules work differently in different legal and political systems.

Other reference points. The Council of Europe Framework Convention on AI is the first binding international treaty on AI, and the EU ratified it in May 2026 ^[19]. The OECD AI Principles^[20] and the UNESCO Recommendation on the Ethics of AI ^[21] are soft law. The ASEAN guides of 2024 and 2025 are regional and non-binding ^{[22, 23]}.

Frontier AI safety practice. At the AI Seoul Summit in 2024, frontier AI developers committed to publish safety frameworks that set thresholds for severe risk ^[24]. Anthropic's Responsible Scaling Policy is one such framework ^[25], and the UK AI Security Institute has reviewed emerging practice across them^[26]. The Safety lens asks whether Indonesian instruments reach the risks these frameworks are built for, such as capable general-purpose models, which often involve no personal data at all.

12. Validity and limitations

• Single coder. One person codes every entry, so inter-coder reliability cannot be measured. The mitigation is a published codebook, coding tied to listed sources, and open corrections.
• Desk research only. No interviews or information requests yet. The ledger sees what is published, not what is decided behind closed doors.
• Unpublished drafts. Neither AI presidential regulation has a published draft text. The draft texts were not published as of 26 October 2026: neither appeared on the ministry's official list of draft regulations. Claims about their content rest on official statements and are graded as such.
• Analysis and incidents. The analysis papers argue from the ledger's sources, and the frontier incident reference lists public reports only. Neither is complete, neither is counted in the ledger, and both can change as investigations report. The quote check reads sources as they are on the day it runs, so a page that changes later can turn a found quote into one that needs checking again.
• Selection bias. Events that the media does not report are less likely to be found. Monitoring official channels directly reduces this, but does not remove it.
• Translation. Every English rendering is an interpretation. Original quotes and links stay on the page so readers can check.
• Link decay. News pages move or disappear. The link checker finds broken links, and entries record outlet and title so a source can still be found.
• Recency. Each entry is accurate as of its last checked date, which is shown on the entry.

13. Reproducibility and data management

• Open data. Every entry, instrument and deadline is a plain YAML file in the public repository, under CC BY 4.0. The code is under MIT.
• Schema. Entries are validated against a JSON Schema (draft 2020-12). A validator adds checks the schema cannot express: each id matches its file name and date, each instrument exists, dates are real, no source appears twice, quotes follow the four rules, every promise follows the published format and its deadline follows from its rule, and no text anywhere contains an em dash or en dash.
• Continuous integration. Every push runs the validator and a full site build. The build refuses to publish data that fails validation.
• Audit trail. The full history of every change is public in git, so anyone can see what changed, when and why.
• Automated monitoring. A scanner checks the watched sources twice a week and lists unreviewed leads on the Radar. The Technical system page documents the pipeline in full.

14. Research ethics

• Public officials, not private people. The ledger records what officials and public bodies say and do in their public roles. It does not identify private individuals.
• Redaction. Where unverified social media content is shown for context, faces and account names are redacted and the image is re-encoded to strip metadata.
• Proportionate quotation. Quotes are short and attributed, so the original reporting keeps its value and its audience.
• Independence. Monsoon Ledger is an independent project. It is not legal advice.

15. Use of AI

I research the sources, write and edit every entry and every My take myself, and use Claude to help draft, translate and build the site. Translated text is reviewed by me, and the original source is always linked so you can check it.

16. Corrections

Anyone can report an error on GitHub with a source. Errors are fixed in the open, as public commits, and every correction is logged with its date in the changelog. See About for who writes this.

17. Frontier incident reference

The frontier incident reference lists public reports of frontier AI models or agents acting on, or being used against, systems outside the developer's control. It gives context to RQ5 and to Analysis 01. It is never counted in the ledger's figures.

• Inclusion. An incident is listed when the developer, the affected party or an independent investigator has described it publicly, and the activity reached systems the developer does not control.
• Exclusions. Activity that stayed inside the developer's own systems, such as a test environment escape with no contact with a third party. Claims without a primary disclosure or a named investigator. Incidents not yet reviewed.
• Dates. Only as a cited source gives them. A date no source gives stays empty, with a note in the data. The day counts (access to notice, awareness to notice, notice to public) are computed by scripts/frontier.mjs and never typed. Analysis 01 reads its day counts from the same code, and the build fails if they disagree.
• Limits. The list is small and not complete. Investigations are ongoing and details can change. Most rows rest on the developer's or the affected party's own account. The reference does not claim that any Indonesian system was affected.

18. Glossary

UU (Undang-Undang)

A law passed by the House of Representatives and the President.

PP (Peraturan Pemerintah)

A government regulation that implements a law.

Perpres (Peraturan Presiden)

A presidential regulation. Both planned AI rules take this form.

SE (Surat Edaran)

A circular letter. Administrative guidance, outside the hierarchy of legislation.

Rancangan

A draft. An instrument that has not been signed.

Komdigi

Kementerian Komunikasi dan Digital, the Ministry of Communication and Digital Affairs, formerly Kominfo.

JDIH

Jaringan Dokumentasi dan Informasi Hukum, the government's legal documentation network.

PPID

Pejabat Pengelola Informasi dan Dokumentasi, the officer who handles public information requests in each public body.

Pendengung (buzzer)

An account or person paid or organised to amplify a message online.