"use strict";
/**
 * EU AI Act per-framework narrative prompt context.
 *
 * Declares section headings, evidence-linkage requirements, and required
 * control mappings for EU AI Act compliance narratives.
 *
 * References:
 *   Regulation (EU) 2024/1689 -- EU Artificial Intelligence Act
 *   Annex IV -- Technical documentation for high-risk AI systems
 *   Annex VII -- Conformity assessment based on quality management system
 *   ISO/IEC 42001:2023 -- AI Management System (referenced by EU AI Act)
 *
 * Spec: P4-AIR-02 AC 4-6
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.EU_AI_ACT_PROMPT_SPEC = void 0;
exports.EU_AI_ACT_PROMPT_SPEC = {
    frameworkId: 'eu-ai-act',
    frameworkName: 'EU AI Act',
    version: 'Regulation (EU) 2024/1689 (entered into force 2024-08-01)',
    sections: [
        {
            sectionId: 'euaiact-art9-risk-management',
            heading: 'Article 9 Risk Management System',
            regulatoryRef: 'EU AI Act Article 9',
            requiredEventTypes: ['governance:verdict', 'action:denied'],
            controlMappings: [
                'Art. 9(1) -- Continuous iterative risk management process',
                'Art. 9(2) -- Risk identification, analysis, and evaluation',
                'Art. 9(3) -- Adoption of risk management measures',
                'Art. 9(4) -- Residual risk acceptability assessment',
                'Art. 9(7) -- Testing against pre-defined metrics before market placement',
            ],
            citationRequirement: 'required',
            promptGuidance: 'Document the AI risk management system operating during the review period. ' +
                'Cite governance verdict events as evidence of continuous risk identification and control. ' +
                'Cite deny-decision events as evidence of risk mitigation measures being actively applied. ' +
                'Quantify: total AI agent actions governed, risk-triggered denials, and any residual ' +
                'risk events escalated for human review. This section maps to the Art. 9 iterative ' +
                'risk management requirement.',
        },
        {
            sectionId: 'euaiact-art10-data-governance',
            heading: 'Article 10 Data and Data Governance',
            regulatoryRef: 'EU AI Act Article 10',
            requiredEventTypes: ['governance:verdict'],
            controlMappings: [
                'Art. 10(2) -- Data governance practices for training, validation, testing data',
                'Art. 10(3) -- Relevant data preparation practices (labelling, cleaning)',
                'Art. 10(5) -- Special category data processing with appropriate safeguards',
            ],
            citationRequirement: 'optional',
            promptGuidance: 'Describe data governance controls applied to AI agent training and inference data. ' +
                'Document controls that prevent agents from accessing or processing prohibited data ' +
                'categories without appropriate safeguards. Reference governance verdicts that ' +
                'enforced data access restrictions. Note any data lineage controls captured in ' +
                'the audit chain.',
        },
        {
            sectionId: 'euaiact-art12-logging',
            heading: 'Article 12 Record-Keeping and Logging',
            regulatoryRef: 'EU AI Act Article 12',
            requiredEventTypes: ['agent:registered', 'governance:verdict'],
            controlMappings: [
                'Art. 12(1) -- Automatic logging of events throughout operational lifetime',
                'Art. 12(2) -- Logging capabilities commensurate with intended purpose',
                'Art. 12(3) -- Traceability throughout AI system lifecycle',
                'Annex IV (3) -- Technical documentation: description of monitoring measures',
            ],
            citationRequirement: 'required',
            promptGuidance: 'Demonstrate compliance with Article 12 logging requirements. ' +
                'Describe the audit chain architecture (hash-linked chain, tamper detection, ' +
                'event type coverage). Cite agent registration and governance verdict events as ' +
                'evidence that automatic logging fired for all regulated AI operations. ' +
                'Quantify log completeness: events captured vs actions taken ratio. ' +
                'Document log retention period against the Article 12 traceability obligation.',
        },
        {
            sectionId: 'euaiact-art14-human-oversight',
            heading: 'Article 14 Human Oversight',
            regulatoryRef: 'EU AI Act Article 14',
            requiredEventTypes: ['approval:decided'],
            controlMappings: [
                'Art. 14(1) -- Design enables effective oversight by natural persons',
                'Art. 14(2) -- Oversight measures for use-phase identification of risks',
                'Art. 14(3)(a) -- Ability to fully understand AI system capacities and limitations',
                'Art. 14(3)(b) -- Awareness of automation bias risk',
                'Art. 14(3)(e) -- Ability to decide not to use or override AI system output',
                'Art. 14(4) -- Deployment oversight by operator',
            ],
            citationRequirement: 'required',
            promptGuidance: 'Provide evidence of human oversight effectiveness under Article 14. ' +
                'Cite approval-decision events showing human review of AI agent actions prior to ' +
                'consequential execution. Quantify: total approval requests, approvals, rejections, ' +
                'and any override events. Document the average human response latency to demonstrate ' +
                'meaningful (non-rubber-stamp) oversight. Note any cases where humans intervened to ' +
                'override AI decisions as evidence of Art. 14(3)(e) capability.',
        },
        {
            sectionId: 'euaiact-art17-quality-management',
            heading: 'Article 17 Quality Management System',
            regulatoryRef: 'EU AI Act Article 17',
            requiredEventTypes: ['agent:registered', 'governance:verdict'],
            controlMappings: [
                'Art. 17(1)(a) -- Regulatory compliance strategy',
                'Art. 17(1)(b) -- Techniques for design control and design verification',
                'Art. 17(1)(d) -- Examination, testing and validation before deployment',
                'Art. 17(1)(e) -- Technical specifications including standards',
                'Art. 17(1)(f) -- Data management including data acquisition',
                'Art. 17(1)(h) -- Incident reporting and monitoring post-deployment',
                'Annex VII -- Quality management system conformity assessment',
            ],
            citationRequirement: 'optional',
            promptGuidance: 'Document quality management system controls relevant to Article 17. ' +
                'Describe the agent registration process (pre-deployment verification), governance ' +
                'verdict coverage (ongoing quality monitoring), and incident handling posture. ' +
                'Reference any compliance pack version changes during the audit window as evidence ' +
                'of continuous quality management. Note systematic rather than ad-hoc enforcement ' +
                'as evidence of the documented QMS requirement.',
        },
    ],
};
//# sourceMappingURL=euaiact.js.map