/**
 * ISO/IEC 42001:2023 Compliance Pack
 *
 * The first international management system standard specifically for
 * Artificial Intelligence. Certification-ready (vs NIST AI RMF which
 * is voluntary guidance). Published December 2023.
 *
 * Standards referenced:
 *   - ISO/IEC 42001:2023 (AIMS requirements -- Clauses 4-10 + Annexes
 *     A through D)
 *   - ISO/IEC 23894:2023 (AI risk management guidance)
 *   - ISO/IEC 38507:2022 (AI governance implications for top management)
 *   - ISO/IEC 5259 series (Data quality for analytics and ML)
 *   - ISO/IEC 25059:2023 (Quality model for AI systems)
 *
 * Structure (matches Annex SL high-level structure shared with ISO
 * 27001, 27701, 9001, etc.):
 *   - Clauses 4-10: AIMS requirements
 *   - Annex A: Reference controls
 *   - Annex B: AI data management implementation guidance
 *   - Annex C: AI system impact assessment
 *   - Annex D: AI use cases and domains
 *
 * Current state (2026):
 *   - First certification-bodies accredited; certification market is
 *     growing rapidly driven by EU AI Act + Colorado AI Act
 *     affirmative-defence recognition.
 *   - Pairs naturally with ISO 27001 (Annex SL shared structure) and
 *     NIST AI RMF (mapping available from NIST / ISO).
 *   - Colorado AI Act §6-1-1706 names ISO/IEC 42001 as a recognised
 *     framework for affirmative defence.
 *
 * @connexum/ai-governance
 */
/**
 * ISO 42001:2023 (AIMS) category classifiers.
 * ISO 42001 governs AI Management Systems process flows.
 * PII and CREDENTIALS are detected to satisfy A.6.1 (data governance) and
 * A.8.4 (information security for AI systems).
 */
export const ISO_42001_CATEGORY_CLASSIFIERS = {
    AI_IMPACT_ASSESSMENT_ISO: {
        references: [
            'ISO 42001:2023 Annex C -- AI System Impact Assessment',
            'ISO 42001:2023 Clause 6.1.4 -- AI risk treatment',
        ],
        classifier: (input) => {
            // ISO 42001 marker required: fires only when text is anchored to the standard
            // (F-NEW-CRIT-23). Prevents misattribution to California AB 2930 or Colorado AI Act
            // on generic "impact assessment" phrases.
            const hasISOMarker = /\b(?:ISO\s*[\/_]?IEC\s*42001|ISO\s*42001|AI\s+management\s+system|AIMS|Annex\s+[ABCD]|Clause\s+6\.1\.4|AI.MAS|AI\s+risk\s+register|AIMS\s+scope|ISO\s*42001\s+cert)\b/i.test(input);
            if (!hasISOMarker)
                return false;
            if (/\b(?:impact\s+assessment|AI\s+system\s+impact|risk\s+assessment|AI\s+risk\s+register)\b/i.test(input))
                return true;
            if (/\b(?:AI\s+objective|responsible\s+AI\s+objective|risk\s+treatment|control\s+objective)\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['ISO 42001:2023 A.6.1 -- data for development and enhancement of AI systems'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['ISO 42001:2023 A.8.4 -- information security for AI systems'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const ISO_42001_PACK = {
    categoryClassifiers: ISO_42001_CATEGORY_CLASSIFIERS,
    id: 'iso_42001',
    name: 'ISO/IEC 42001:2023 AI Management Systems',
    version: '1.0.0',
    description: 'ISO/IEC 42001:2023 AI Management System (AIMS) certification-ready compliance. Covers Clauses 4-10 (context, leadership, planning, support, operation, performance evaluation, improvement) + Annex A (reference controls) + Annex B (AI data management) + Annex C (AI impact assessment). Colorado AI Act §6-1-1706 affirmative defence.',
    authority: 'ISO/IEC JTC 1/SC 42 + accredited certification bodies',
    industries: ['technology', 'healthcare', 'finance', 'government', 'manufacturing', 'consulting', 'ai-foundation-model-provider', 'legal', 'critical-infrastructure'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'AIMS establishment + scope + context of organisation',
            reference: 'ISO 42001 Clause 4 -- Context of the Organization',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Documented information + internal audit evidence',
            reference: 'ISO 42001 Clauses 7.5, 9.2 -- Documented Information + Internal Audit',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Nonconformity detection + corrective action + AI incident streams',
            reference: 'ISO 42001 Clause 10 -- Improvement',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'AI data management throughout lifecycle',
            reference: 'ISO 42001 Annex B -- AI Data Management',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Leadership commitment; AI policy approvals; resource allocation',
            reference: 'ISO 42001 Clause 5 -- Leadership',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Monitoring + measurement + analysis of AI performance',
            reference: 'ISO 42001 Clause 9.1 -- Monitoring, Measurement, Analysis, Evaluation',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Third-party AI component management; AI system impact assessment',
            reference: 'ISO 42001 Annex C -- AI System Impact Assessment',
        },
        {
            name: 'bias-monitor',
            required: true,
            reason: 'Responsible AI objectives + fairness + impact assessment',
            reference: 'ISO 42001 Clause 6.2 + Annex C -- AI Objectives and Impact',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Communication to interested parties + AI disclosures',
            reference: 'ISO 42001 Clause 7.4 -- Communication',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'AIMS scope statement + management review + internal audit + Statement of Applicability for Annex A',
            reference: 'ISO 42001 Clauses 4.3, 9.2, 9.3 + Annex A',
        },
    ],
    moduleConfig: {
        'anomaly-detector': {
            thresholdMultiplier: 2.0,
            aimsPerformanceMonitoringActive: true,
        },
        'governance-runtime': {
            aimsContextDefined: true,
            scopeStatementRequired: true,
        },
        'approval-queue': {
            aiPolicyApprovalRequired: true,
            leadershipCommitmentRequired: true,
        },
        'attestation-manager': {
            aimsScopeStatementRequired: true,
            annexAStatementOfApplicabilityRequired: true,
            managementReviewRequired: true,
            internalAuditRequired: true,
            aiSystemImpactAssessmentRequired: true,
        },
        'data-classifier': {
            aiDataLifecycleManagementRequired: true, // Annex B
        },
        'bias-monitor': {
            responsibleAiObjectivesTracked: true,
        },
        'supply-chain': {
            thirdPartyAiComponentAssessmentRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: ['ISO-42001-ALIGNED'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: ['AI_IMPACT_ASSESSMENT_ISO', 'PII', 'CREDENTIALS'],
        categoryActions: {
            AI_IMPACT_ASSESSMENT_ISO: 'WARN',
            PII: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'INTERNAL',
    },
    retentionPolicy: {
        sovereignty: ['GLOBAL'],
        auditLogRetentionDays: 1095, // 3 years
        sessionRetentionDays: 365,
        incidentRetentionDays: 1095,
        reference: 'ISO 42001 Clause 7.5 -- Documented information retained as evidence of conformity (3 years typical audit cycle)',
    },
    incidentPolicy: {
        notificationDeadlineHours: 48,
        reference: 'ISO 42001 Clause 10.2 -- Nonconformity and corrective action; 48-hour escalation to AIMS top management',
        requiredRecipients: ['aims-manager', 'top-management', 'interested-parties', 'certification-body-if-material'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'iso42001-context',
            description: 'AIMS context and scope defined (Clause 4)',
            reference: 'ISO 42001 Clause 4',
            check: 'iso42001_context_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'iso42001-leadership',
            description: 'Leadership commitment + AI policy + roles (Clause 5)',
            reference: 'ISO 42001 Clause 5',
            check: 'iso42001_leadership_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'iso42001-risk',
            description: 'AI risk assessment + treatment (Clause 6.1 + Annex C)',
            reference: 'ISO 42001 Clause 6.1',
            check: 'risk_assessment_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'iso42001-objectives',
            description: 'AI objectives measurable, monitored, responsible (Clause 6.2)',
            reference: 'ISO 42001 Clause 6.2',
            check: 'iso42001_responsible_objectives_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iso42001-data',
            description: 'AI data management controls (Annex B)',
            reference: 'ISO 42001 Annex B',
            check: 'iso42001_data_lifecycle_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iso42001-monitoring',
            description: 'Performance monitoring, measurement, analysis, evaluation (Clause 9.1)',
            reference: 'ISO 42001 Clause 9.1',
            check: 'monitoring_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iso42001-internal-audit',
            description: 'Internal audit + management review (Clauses 9.2, 9.3)',
            reference: 'ISO 42001 Clauses 9.2, 9.3',
            check: 'iso42001_internal_audit_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iso42001-improvement',
            description: 'Nonconformity + corrective action + continual improvement (Clause 10)',
            reference: 'ISO 42001 Clause 10',
            check: 'incident_reporting',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'iso42001-impact',
            description: 'AI system impact assessment (Annex C)',
            reference: 'ISO 42001 Annex C',
            check: 'iso42001_impact_assessment_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iso42001-soa',
            description: 'Statement of Applicability for Annex A reference controls',
            reference: 'ISO 42001 Annex A',
            check: 'iso42001_soa_active',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=iso42001.js.map