"use strict";
/**
 * EU MDR + IVDR Compliance Pack
 *
 * EU Medical Device Regulation (MDR) 2017/745 and In Vitro Diagnostic
 * Regulation (IVDR) 2017/746 -- the joint EU medical device regulatory
 * framework governing placing medical devices and IVDs on the EU market.
 *
 * Regulatory authority:
 *   - MDR Regulation (EU) 2017/745: applicable from 26 May 2021
 *     (Class I May 2021; Class IIa/IIb/III per transition timeline).
 *     Replaces Medical Device Directive (MDD) 93/42/EEC and Active
 *     Implantable Medical Device Directive (AIMDD) 90/385/EEC.
 *   - IVDR Regulation (EU) 2017/746: applicable from 26 May 2022
 *     for Class D; Class C (May 2025); Class B (May 2026); Class A
 *     sterile (May 2026). Replaces IVD Directive 98/79/EC.
 *   - Both regulations share the same Notified Body / EUDAMED /
 *     UDI infrastructure and conformity assessment framework.
 *   - National competent authorities: BfArM (Germany), ANSM (France),
 *     MHRA (UK -- now separate post-Brexit), etc.
 *   - MDCG (Medical Device Coordination Group): joint guidance body
 *     for MDR/IVDR implementation.
 *
 * Key distinctions from FDA SaMD (fda-samd.ts):
 *   - EU: classification by MDR/IVDR classes (I, IIa, IIb, III / A, B, C, D)
 *     vs FDA: IMDRF SaMD categories (Category I-IV)
 *   - EU: Notified Body conformity assessment + CE marking
 *     vs FDA: 510(k) / De Novo / PMA clearance or approval
 *   - EU: EUDAMED registration database
 *     vs FDA: FDA GUDID / 510(k) database
 *   - EU: MDR/IVDR clinical evaluation + PMCF (Post-Market Clinical Follow-Up)
 *     vs FDA: PCCP (Predetermined Change Control Plan) + real-world evidence
 *   - UK post-Brexit: MHRA UKCA marking (not CE marking) required for
 *     Great Britain market; Northern Ireland follows EU rules (CE marking).
 *
 * AI/Software as Medical Device (SaMD) under MDR/IVDR:
 *   - MDCG 2019-16 (rev.1): guidance on qualification and classification
 *     of software under MDR/IVDR. Software driving or influencing clinical
 *     decisions may qualify as a medical device.
 *   - MDCG 2022-2: guidance on medical device standalone software and AI.
 *   - Learning algorithms: AI/ML models that continuously learn may
 *     require re-qualification if the change is significant.
 *   - Cybersecurity: MDCG 2019-16 and ENISA guidance on medical device
 *     cybersecurity apply to AI SaMD under MDR/IVDR.
 *
 * Current state (2026):
 *   - MDR fully applicable; EUDAMED fully operational.
 *   - IVDR Class C transition deadline May 2025 passed; Class B and
 *     A sterile transition May 2026 approaching.
 *   - Notified Body capacity constraint remains a practical concern
 *     for conformity assessment timelines.
 *   - MDCG 2024 AI guidance updates expected on adaptive algorithms.
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.EU_MDR_IVDR_PACK = exports.EU_MDR_IVDR_CATEGORY_CLASSIFIERS = void 0;
/**
 * EU MDR + IVDR category classifiers.
 * Covers medical device classification data, IVD classification data,
 * clinical evaluation records, post-market surveillance data,
 * and vigilance reporting.
 */
exports.EU_MDR_IVDR_CATEGORY_CLASSIFIERS = {
    MEDICAL_DEVICE_CLASSIFICATION: {
        references: ['MDR 2017/745 Annex VIII -- classification rules; MDCG 2019-16 software qualification'],
        classifier: (input) => {
            if (/\b(?:Class\s+(?:I|IIa|IIb|III)\s+(?:medical\s+device|device)|MDR\s+Class|device\s+classification)\b/i.test(input))
                return true;
            if (/\b(?:CE\s+mark(?:ing)?|CE\s+certificate|conformity\s+assessment|Notified\s+Body)\b/i.test(input))
                return true;
            if (/\b(?:EUDAMED|UDI|unique\s+device\s+identifier|SRN|single\s+registration\s+number)\b/i.test(input))
                return true;
            return false;
        },
    },
    IVD_CLASSIFICATION: {
        references: ['IVDR 2017/746 Annex VIII -- classification rules; Classes A, B, C, D'],
        classifier: (input) => {
            if (/\b(?:Class\s+[ABCD]\s+(?:IVD|in\s+vitro)|IVDR\s+Class|IVD\s+classification)\b/i.test(input))
                return true;
            // Unambiguous IVD identifiers -- no anchor needed.
            if (/\b(?:in\s+vitro\s+diagnostic|companion\s+diagnostic|CDx)\b/i.test(input))
                return true;
            // Bare "IVD" must appear alongside a device or regulatory context to avoid
            // false positives from other packs using the acronym in different senses.
            if (/\bIVD\b/.test(input) && /\b(?:Class|IVDR|device|diagnostic|reagent|assay|kit)\b/i.test(input))
                return true;
            // F-NEW-VERA-PACK-C4-03: "performance evaluation" and "performance data" require
            // an IVD-context anchor to prevent cross-firing when ISO 23894, NIST AI RMF, or
            // SG Model AI Gov packs generate "performance evaluation" records for general AI.
            if (/\b(?:IVD|in\s+vitro|diagnostic)\s+performance\s+(?:evaluation|study|data)\b/i.test(input))
                return true;
            if (/\bperformance\s+(?:evaluation|data)\b/i.test(input) &&
                /\b(?:IVD|in\s+vitro|IVDR|companion\s+diagnostic|CDx|reagent|assay)\b/i.test(input))
                return true;
            // F-NEW-VERA-PACK-C4-03: standalone \bPER\b removed -- too broad; overlaps with
            // Performance Evaluation Report context but also fires on unrelated "per" abbreviations.
            return false;
        },
    },
    CLINICAL_EVALUATION_DATA: {
        references: ['MDR Annex XIV -- clinical evaluation; IVDR Annex XIII -- performance evaluation'],
        classifier: (input) => {
            if (/\b(?:clinical\s+evaluation|clinical\s+investigation|CER|clinical\s+evidence|PMCF)\b/i.test(input))
                return true;
            // F-NEW-VERA-PACK-C4-03: standalone \bPER\b removed (same cross-fire risk as IVD branch).
            // "performance evaluation" here refers to MDR Annex XIV / IVDR Annex XIII context;
            // "clinical evaluation" in the preceding line provides sufficient MDR anchor for CER.
            // "performance evaluation" alone still risks false positives from AI governance packs.
            if (/\b(?:performance\s+evaluation\s+(?:report|plan)|performance\s+study|performance\s+evaluation)\b/i.test(input) &&
                /\b(?:MDR|IVDR|IVD|Annex\s+XIV|Annex\s+XIII|clinical\s+evidence|notified\s+body|CE\s+mark|EUDAMED)\b/i.test(input))
                return true;
            if (/\bperformance\s+data\b/i.test(input))
                return true; // still useful in MDR context; less risk than PER
            if (/\b(?:clinical\s+trial|IDE|investigational\s+device|clinical\s+investigation\s+plan)\b/i.test(input))
                return true;
            return false;
        },
    },
    POST_MARKET_SURVEILLANCE: {
        references: ['MDR Art. 83-86 -- post-market surveillance; IVDR Art. 78-81'],
        classifier: (input) => {
            if (/\b(?:post.?market\s+surveillance|PMS\s+plan|post.?market\s+clinical\s+follow.?up|PMCF|PSUR|periodic\s+safety\s+update)\b/i.test(input))
                return true;
            if (/\b(?:serious\s+incident|field\s+safety\s+corrective\s+action|FSCA|vigilance\s+report|trend\s+report)\b/i.test(input))
                return true;
            return false;
        },
    },
    PHI: {
        references: ['MDR/IVDR -- patient data in clinical evaluation; GDPR Art. 9(1) -- health data as special category'],
        classifier: (input) => {
            if (/\b(?:patient|subject\s+id|MRN|medical\s+record\s+number)\b/i.test(input))
                return true;
            if (/\b(?:DOB|date\s+of\s+birth|diagnosis|clinical\s+finding|pathology)\b/i.test(input))
                return true;
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true; // SSN / patient identifiers
            return false;
        },
    },
    CREDENTIALS: {
        references: ['EUDAMED access credentials; Notified Body secure access'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
exports.EU_MDR_IVDR_PACK = {
    categoryClassifiers: exports.EU_MDR_IVDR_CATEGORY_CLASSIFIERS,
    id: 'eu-mdr-ivdr',
    aliases: ['HC-05'],
    name: 'EU MDR + IVDR (Medical Device Regulations)',
    version: '1.0.0',
    description: 'EU Medical Device Regulation (MDR, 2017/745) and In Vitro Diagnostic Regulation (IVDR, 2017/746) compliance for AI systems (SaMD) placed on the EU market. Covers MDR Class I-III and IVDR Class A-D classification, CE marking via Notified Body conformity assessment, EUDAMED registration, UDI management, clinical and performance evaluation, post-market surveillance (PMS), and vigilance reporting. Distinct from FDA SaMD pack: EU classification rules, CE vs FDA clearance, EUDAMED vs FDA GUDID, PMCF vs PCCP.',
    authority: 'National competent authorities (e.g., BfArM, ANSM) + Notified Bodies + European Commission + MDCG',
    industries: ['medical-device', 'ivd', 'digital-health', 'health-it', 'pharma', 'biotech', 'radiology', 'diagnostics', 'surgical-robotics', 'wearable-health'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Software qualification assessment (MDCG 2019-16); MDR/IVDR class determination gate; change control for AI/ML model updates (significant change re-qualification)',
            reference: 'MDR Art. 2(1) -- medical device definition; MDCG 2019-16 -- software qualification and classification; MDCG 2022-2 -- AI/ML SaMD',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Medical device classification data; IVD classification detection; clinical evaluation data; post-market surveillance data; PHI in clinical records',
            reference: 'MDR Annex VIII -- classification rules; IVDR Annex VIII -- IVD classification; MDR Art. 10(2) -- quality management system data requirements',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Technical documentation integrity per MDR Annex II/III; clinical evaluation report (CER) tamper-evident records; quality management system (QMS) audit trail; 10-year post-market documentation retention',
            reference: 'MDR Art. 10(8) -- technical documentation; MDR Annex II/III -- technical documentation content; MDR Art. 83 -- PMS data integrity',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'CE certificate tracking; Notified Body conformity assessment records; EUDAMED registration status; QMS EN ISO 13485:2016 certification; authorised representative on file',
            reference: 'MDR Art. 10(11) -- CE certificate; MDR Art. 13 -- authorised representative; MDR Art. 31 -- EUDAMED registration; ISO 13485:2016 QMS',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Serious incident investigation gate; field safety corrective action (FSCA) authorisation; significant change qualification re-assessment approval; PMCF study protocol approval',
            reference: 'MDR Art. 87 -- serious incident reporting gate; MDR Art. 88 -- trend reporting; MDR Annex XIV -- PMCF protocol; MDCG 2022-2 -- AI/ML change management',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Vigilance event detection and notification clock: serious incidents 15 days; trends 90 days; serious public health threats 2 days; FSCA reporting to competent authorities',
            reference: 'MDR Art. 87 -- serious incident notification (15 calendar days); MDR Art. 87(2) -- life-threatening events (< 2 calendar days); MDR Art. 88 -- trend reporting (90 days)',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Post-market surveillance (PMS) trend analysis; serious incident signal detection; AI/ML model performance drift monitoring per PMCF; EUDAMED data reconciliation',
            reference: 'MDR Art. 83-86 -- post-market surveillance; MDR Art. 88 -- trend reporting obligation; MDCG 2022-2 -- continuous learning AI performance monitoring',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Third-party component and software supplier oversight per QMS; subcontractor control per ISO 13485; Notified Body TPRM integration',
            reference: 'MDR Art. 10(9)(b) -- supplier control; ISO 13485 Clause 7.4 -- purchasing; MDR Annex IX -- technical documentation on supply chain',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'Patient data and clinical evaluation records encrypted at rest and in transit; EUDAMED secure access; cybersecurity per MDCG 2019-16 and ENISA medical device guidance',
            reference: 'MDCG 2019-16 Annex 1 -- cybersecurity for medical devices; MDR Art. 5(5) -- cybersecurity requirements; ENISA medical device cybersecurity guidance',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Clinical investigation state persistence; PMCF study lifecycle tracking; post-market surveillance data collection continuity; EUDAMED interaction session management',
            reference: 'MDR Annex XIV -- PMCF plan and report requirements; MDR Art. 83 -- PMS system data continuity',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'SaMD intended purpose disclosure per MDR Art. 2; patient/user information per MDR Annex I; AI/ML transparency in clinical decision support context',
            reference: 'MDR Art. 2(12) -- intended purpose; MDR Annex I General Safety and Performance Requirements (GSPR) -- information for safety; MDCG 2022-2 -- AI transparency for users',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            imdrfCategoryTrackingRequired: true,
            softwareQualificationAssessmentRequired: true,
            significantChangeRequalificationRequired: true,
            ceMarkingStatusRequired: true,
            euMdrIvdrClassRequired: true,
        },
        'data-classifier': {
            enabledCategories: ['MEDICAL_DEVICE_CLASSIFICATION', 'IVD_CLASSIFICATION', 'CLINICAL_EVALUATION_DATA', 'POST_MARKET_SURVEILLANCE', 'PHI', 'CREDENTIALS'],
            phiAction: 'BLOCK',
            clinicalDataAction: 'WARN',
        },
        'audit-integrity': {
            technicalDocumentationRetentionYears: 10, // MDR Art. 10(8) -- 10 years; 15 for implantables
            implantableDeviceRetentionYears: 15,
            clinicalInvestigationRetentionYears: 25,
            appendOnlyRequired: true,
            tamperEvidentRequired: true,
        },
        'attestation-manager': {
            ceCertificateTrackingRequired: true,
            notifiedBodyConformityAssessmentRequired: true,
            eudamedRegistrationRequired: true,
            iso13485CertificationRequired: true,
            authorisedRepresentativeRequired: true,
            postMarketSurveillancePlanRequired: true,
        },
        'approval-queue': {
            seriousIncidentInvestigationGateRequired: true,
            fieldSafetyCorrectiveActionApprovalRequired: true,
            pmcfProtocolApprovalRequired: true,
            significantChangeApprovalRequired: true,
        },
        'event-bus': {
            seriousIncidentNotificationDays: 15,
            lifeThreateningEventNotificationDays: 2,
            seriousPublicHealthThreatNotificationDays: 2,
            trendReportingDays: 90,
            fscraNationalCompetentAuthorityNotificationRequired: true,
        },
        'anomaly-detector': {
            postMarketSurveillanceTrendAnalysisRequired: true,
            seriousIncidentSignalDetectionRequired: true,
            aiModelPerformanceDriftMonitoringRequired: true,
            realWorldPerformanceMonitoringRequired: true,
        },
        'supply-chain': {
            supplierControlRequired: true,
            thirdPartyComponentAuditRequired: true,
            notifiedBodyTprmIntegrationRequired: true,
        },
        'encryption-layer': {
            algorithm: 'aes-256-gcm',
            encryptionRequiredForClinicalData: true,
            cybersecurityByDesignRequired: true,
        },
        'transparency-injector': {
            intendedPurposeDisclosureRequired: true,
            indicationForUseDisclosureRequired: true,
            aiTransparencyForClinicalUsersRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['CLINICAL-DATA-RESIDENCY-EU', 'GDPR-PROCESSOR-CONTRACT', 'ISO-13485-COMPATIBLE'],
        blockReasons: {
            deepseek: 'PRC National Intelligence Law creates clinical data disclosure risk incompatible with MDR/IVDR technical documentation confidentiality and GDPR/GDPR requirements for patient data.',
            baidu: 'PRC jurisdiction. No EU adequacy decision. Patient data and clinical evaluation records cannot be transferred to PRC under GDPR Art. 44 or MDR/IVDR data integrity requirements.',
            alibaba: 'PRC jurisdiction. No EU adequacy decision. Patient data and clinical evaluation records cannot be transferred to PRC under GDPR Art. 44 or MDR/IVDR data integrity requirements.',
        },
    },
    dataPolicy: {
        scanCategories: ['MEDICAL_DEVICE_CLASSIFICATION', 'IVD_CLASSIFICATION', 'CLINICAL_EVALUATION_DATA', 'POST_MARKET_SURVEILLANCE', 'PHI', 'CREDENTIALS'],
        categoryActions: {
            MEDICAL_DEVICE_CLASSIFICATION: 'WARN',
            IVD_CLASSIFICATION: 'WARN',
            CLINICAL_EVALUATION_DATA: 'WARN',
            POST_MARKET_SURVEILLANCE: 'WARN',
            PHI: 'BLOCK',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        // MDR Art. 10(8): technical documentation retained 10 years post last device on market
        // MDR Art. 10(8): implantable devices -- 15 years
        // MDR Annex XV -- clinical investigations: 25 years
        auditLogRetentionDays: 5475, // 15 years (implantable device maximum)
        sessionRetentionDays: 3650, // 10 years (standard MDR technical documentation)
        incidentRetentionDays: 5475,
        reference: 'MDR Art. 10(8) -- technical documentation: 10 years post last device on market; 15 years for implantable devices; MDR Annex XV -- clinical investigation records: 25 years; IVDR same framework',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['eu'],
    },
    incidentPolicy: {
        // MDR Art. 87: serious incidents -- 15 calendar days
        // MDR Art. 87(2): life-threatening / death -- 2 calendar days (< 10 days in practice)
        // MDR Art. 87: serious public health threat -- immediately / 2 days
        notificationDeadlineHours: 48, // 2 days for most serious incidents
        reference: 'MDR Art. 87(1)(b) -- serious incidents: 15 calendar days; Art. 87(2) -- death or life-threatening: 2 calendar days or less; Art. 87(1)(a) -- serious public health threat: immediately/2 days; IVDR Art. 82 same framework',
        requiredRecipients: ['national-competent-authority', 'notified-body', 'authorised-representative', 'eudamed-portal'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'eu-mdr-ivdr-qualification',
            description: 'EU MDR/IVDR software qualification assessment active; AI SaMD classification determined per MDCG 2019-16',
            reference: 'MDR Art. 2(1) -- medical device definition; MDCG 2019-16 -- software qualification and classification',
            check: 'eu_mdr_ivdr_qualification_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'eu-mdr-ivdr-ce-marking',
            description: 'CE certificate and Notified Body conformity assessment on file for MDR Class IIa/IIb/III and IVDR Class B/C/D devices',
            reference: 'MDR Art. 10(11) -- CE marking; MDR Annex IX -- Notified Body conformity assessment',
            check: 'attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'eu-mdr-ivdr-eudamed',
            description: 'EUDAMED registration active; UDI assigned and registered for all devices in scope',
            reference: 'MDR Art. 31 -- EUDAMED registration; MDR Art. 27 -- UDI system',
            check: 'eu_mdr_ivdr_eudamed_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'eu-mdr-ivdr-vigilance',
            description: 'Vigilance event detection and reporting wired: 2-day clock for life-threatening events, 15-day for serious incidents, 90-day trend reporting',
            reference: 'MDR Art. 87 -- serious incident notification; MDR Art. 88 -- trend reporting; IVDR Art. 82',
            check: 'incident_reporting',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'eu-mdr-ivdr-pms',
            description: 'Post-market surveillance (PMS) system active; PMCF/PMPF plan in place; trend analysis running',
            reference: 'MDR Art. 83-86 -- post-market surveillance obligations; MDR Annex XIV -- PMCF; IVDR Annex XIII -- PMPF',
            check: 'post_market_monitoring',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'eu-mdr-ivdr-technical-docs',
            description: 'Technical documentation retained with tamper-evident integrity for 10 years (15 for implantables)',
            reference: 'MDR Art. 10(8) -- technical documentation retention; MDR Annex II/III -- technical documentation',
            check: 'audit_trail_exists',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'eu-mdr-ivdr-change-management',
            description: 'Significant change qualification gate active; AI/ML model updates re-assessed for MDR/IVDR classification impact',
            reference: 'MDR Art. 10(14) -- significant change notification; MDCG 2022-2 -- AI/ML change management',
            check: 'change_management_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'eu-mdr-ivdr-clinical-evaluation',
            description: 'Clinical evaluation report (CER) or performance evaluation report (PER) current; PMCF data feeding back into CER',
            reference: 'MDR Annex XIV -- clinical evaluation; IVDR Annex XIII -- performance evaluation; MDR Art. 61 -- clinical evaluation',
            check: 'eu_mdr_ivdr_clinical_evaluation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'eu-mdr-ivdr-phi-protection',
            description: 'Patient data and PHI in clinical records blocked and encrypted; GDPR processor obligations met',
            reference: 'MDR/IVDR + GDPR Art. 9 -- health data as special category; MDR Art. 10 data protection requirements',
            check: 'data_classifier_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'eu-mdr-ivdr-cybersecurity',
            description: 'Medical device cybersecurity controls active per MDCG 2019-16 and ENISA guidance',
            reference: 'MDR Art. 5(5) -- cybersecurity; MDCG 2019-16 Annex 1 -- cybersecurity checklist; ENISA medical device cybersecurity',
            check: 'encryption_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'eu-mdr-ivdr-authorised-rep',
            description: 'EU authorised representative on file for non-EU manufacturers; QMS ISO 13485 certification active',
            reference: 'MDR Art. 11 -- authorised representative obligations; MDR Art. 10(9) -- QMS (ISO 13485)',
            check: 'subservice_registry_active',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=eu-mdr-ivdr.js.map