/**
 * EU AI Act Compliance Pack
 *
 * Regulation (EU) 2024/1689 -- the EU Artificial Intelligence Act.
 * First comprehensive horizontal AI law globally. Risk-based approach
 * with tiered obligations: prohibited / high-risk / limited /
 * minimal risk, plus GPAI (general purpose AI) and systemic-risk
 * GPAI layers.
 *
 * Key dates in force:
 *   - 2 Feb 2025: Art. 5 prohibited practices + AI literacy
 *     obligations active across all operators.
 *   - **2 Aug 2025**: GPAI obligations (Art. 53 all GPAI; Art. 55
 *     systemic-risk) in force. AI Office GPAI Code of Practice
 *     finalised. Providers placing GPAI models on the EU market after
 *     this date must meet technical documentation, downstream-provider
 *     info, copyright policy, and training-data summary obligations.
 *     Systemic-risk providers must additionally evaluate, mitigate,
 *     test adversarially, and report serious incidents.
 *   - 2 Aug 2026: High-risk Annex III system obligations in force
 *     (employment, credit, education, law enforcement, essential
 *     services, biometrics, critical infrastructure, migration /
 *     asylum / justice).
 *   - 2 Aug 2027: High-risk Annex I sectoral high-risk obligations
 *     in force (product safety regime).
 *
 * Current state (2026):
 *   - Pax1 already enforces GPAI provider checks (Art. 53 / Art. 55)
 *     against the merged provider policy.
 *   - Systemic-risk GPAI providers additionally gated on adversarial
 *     testing evidence and serious-incident reporting configuration.
 *   - EU AI Act pairs with GDPR (personal data) and Colorado AI Act /
 *     state AI laws (US jurisdictions) when operating cross-border.
 *
 * @connexum/ai-governance
 */
/**
 * EU AI Act category classifiers.
 * Regulation (EU) 2024/1689 -- risk-based AI law with prohibited practices (Art. 5),
 * high-risk systems (Annex III/I), GPAI (Art. 53/55), and biometric special rules.
 * PII and SPECIAL_CATEGORY derive from GDPR scope embedded within EU AI Act Art. 10.
 */
export const EUAIACT_CATEGORY_CLASSIFIERS = {
    PII: {
        references: ['EU AI Act Art. 10 -- data governance; personal data as defined in GDPR Art. 4(1)'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            if (/\b(?:personal\s+(?:data|information)|natural\s+person\s+(?:data|information)|GDPR\s+personal\s+data)\b/i.test(input))
                return true;
            return false;
        },
    },
    PHI: {
        references: ['EU AI Act Annex III §5 -- high-risk health/life insurance AI; health data processing'],
        classifier: (input) => {
            if (/\bMRN[:\s#]*\d{6,12}\b/i.test(input))
                return true;
            if (/\b(?:patient\s+(?:data|record|id)|clinical\s+(?:data|trial|record)|health\s+(?:data|record|information))\b/i.test(input))
                return true;
            if (/\b(?:medical\s+(?:diagnosis|condition|record)|prescription|lab\s+result)\b/i.test(input))
                return true;
            return false;
        },
    },
    SPECIAL_CATEGORY: {
        references: ['EU AI Act Art. 10 -- GDPR Art. 9 special categories used in AI training data; heightened protection'],
        classifier: (input) => {
            // Health
            if (/\b(?:HIV|AIDS|cancer|diabetes|mental\s+(?:health|illness|disorder)|depression|epilepsy|MS\b|multiple\s+sclerosis)\b/i.test(input))
                return true;
            // Biometric
            if (/\b(?:biometric\s+data|facial\s+recognition|fingerprint\s+(?:data|scan|record)|voice\s+recognition)\b/i.test(input))
                return true;
            // Racial/ethnic
            if (/\b(?:racial\s+origin|ethnic\s+origin|race\s+and\s+ethnicity)\b/i.test(input))
                return true;
            // Political
            if (/\b(?:political\s+opinions?|political\s+views?)\b/i.test(input))
                return true;
            // Religious/philosophical
            if (/\b(?:religious\s+beliefs?|philosophical\s+beliefs?|religious\s+(?:affiliation|practices?))\b/i.test(input))
                return true;
            // Sexual orientation
            if (/\b(?:sexual\s+orientation|gender\s+identity)\b/i.test(input))
                return true;
            // Genetic
            if (/\b(?:genetic\s+data|genetic\s+information|DNA\s+(?:data|profile|sequence))\b/i.test(input))
                return true;
            // Criminal
            if (/\b(?:criminal\s+convictions?|criminal\s+offences?|criminal\s+record|spent\s+conviction)\b/i.test(input))
                return true;
            return false;
        },
    },
    BIOMETRIC_IDENTIFIER: {
        references: ['EU AI Act Art. 3(34) + Art. 5 -- prohibited biometric categorisation; real-time remote biometric ID'],
        classifier: (input) => {
            if (/\bBiometric\s+ID\b/i.test(input))
                return true;
            if (/\b(?:biometric\s+identifier|real.?time\s+(?:remote\s+)?biometric|biometric\s+categorisation|remote\s+biometric\s+identification)\b/i.test(input))
                return true;
            if (/\b(?:retinal\s+scan|iris\s+recognition|gait\s+recognition|emotion\s+recognition|facial\s+(?:geometry|template))\b/i.test(input))
                return true;
            if (/\b(?:voice\s+print|speaker\s+recognition|fingerprint\s+template|palm\s+(?:print|vein))\b/i.test(input))
                return true;
            if (/\bfingerprint\s+hash\b/i.test(input))
                return true;
            return false;
        },
    },
};
export const EUAIACT_PACK = {
    categoryClassifiers: EUAIACT_CATEGORY_CLASSIFIERS,
    /** P3.5: PII, special-category data, and biometric identifiers are subject-keyed per EU AI Act Art. 9/10. */
    subjectKeyedCategories: ['PII', 'SPECIAL_CATEGORY', 'BIOMETRIC_IDENTIFIER'],
    /**
     * EU AI Act Article 9 special-category data types. Statutory; not configurable.
     * These categories apply regardless of which compliance packs are loaded.
     * Pack-derived BLOCK categories are merged with this set at runtime in euai-routes.ts.
     */
    statutoryCategories: [
        'BIOMETRIC', 'GENETIC', 'CRIMINAL', 'POLITICAL', 'RELIGIOUS', 'SEXUAL', 'ETHNIC',
        'PII', 'PAN',
    ],
    id: 'eu-ai-act',
    name: 'EU AI Act',
    version: '1.0.0',
    description: 'EU Artificial Intelligence Act (Regulation (EU) 2024/1689) compliance with phased enforcement: Art. 5 prohibited practices (Feb 2025), GPAI obligations (Aug 2025 with AI Office Code of Practice), Annex III high-risk (Aug 2026), Annex I sectoral (Aug 2027).',
    authority: 'European Commission / AI Office + Member State market surveillance authorities',
    industries: ['all-eu', 'healthcare', 'legal', 'finance', 'hr', 'education', 'law-enforcement', 'biometrics', 'critical-infrastructure', 'migration', 'ai-foundation-model-provider'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Risk management system; prohibited practice gating; high-risk classification',
            reference: 'Art. 5, Art. 6, Art. 9 -- Prohibited Practices + Risk Management',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Technical documentation + automatic logging of AI system operation',
            reference: 'Art. 11 -- Technical Documentation; Art. 12 -- Record-Keeping',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Post-market monitoring; performance degradation; drift detection',
            reference: 'Art. 72 -- Post-Market Monitoring',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Data and data governance; training / validation / testing datasets',
            reference: 'Art. 10 -- Data and Data Governance',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Serious incident reporting; 15-day clock trigger',
            reference: 'Art. 73 -- Reporting of Serious Incidents',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Human oversight enablement; decision-context continuity',
            reference: 'Art. 14 -- Human Oversight',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Human-in-the-loop / human-on-the-loop for consequential decisions',
            reference: 'Art. 14 -- Human Oversight levels',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'User-facing disclosure of AI interaction; deepfake labelling',
            reference: 'Art. 13, Art. 50 -- Transparency Obligations',
        },
        {
            name: 'bias-monitor',
            required: true,
            reason: 'Fundamental-rights impact assessment; demographic bias evaluation',
            reference: 'Art. 27 -- FRIA; Art. 10 -- data bias mitigation',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'GPAI model supply chain; downstream provider obligations',
            reference: 'Art. 53, Art. 55 -- GPAI Obligations',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Conformity assessment + EU database registration + declaration of conformity',
            reference: 'Art. 43, Art. 49, Art. 60 -- Conformity Assessment + Registration',
        },
    ],
    moduleConfig: {
        'anomaly-detector': {
            thresholdMultiplier: 1.5,
            postMarketMonitoringRequired: true,
        },
        'governance-runtime': {
            riskClassificationRequired: true,
            prohibitedPracticeCheckRequired: true,
            highRiskControlsActive: true,
        },
        'approval-queue': {
            humanOversightLevelTracked: true, // HUMAN_IN_COMMAND / HUMAN_ON_THE_LOOP / HUMAN_IN_THE_LOOP
        },
        'transparency-injector': {
            userFacingDisclosureRequired: true,
            deepfakeLabellingRequired: true,
        },
        'bias-monitor': {
            friaSupported: true, // Fundamental Rights Impact Assessment
        },
        'supply-chain': {
            gpaiObligationsTracked: true,
            systemicRiskGpaiAdversarialTestingRequired: true,
        },
        'attestation-manager': {
            conformityAssessmentRequired: true,
            euDatabaseRegistrationRequired: true,
            declarationOfConformityRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: ['GPAI-ART-53', 'EU-AI-ACT-READY'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: ['PII', 'PHI', 'SPECIAL_CATEGORY', 'BIOMETRIC_IDENTIFIER'],
        categoryActions: {
            PII: 'WARN',
            PHI: 'WARN',
            SPECIAL_CATEGORY: 'WARN',
            BIOMETRIC_IDENTIFIER: 'BLOCK', // Art. 5 prohibited untargeted biometric scraping
        },
        encryptionRequired: false,
        minimumClassification: 'INTERNAL',
    },
    retentionPolicy: {
        sovereignty: ['EU'],
        auditLogRetentionDays: 3650, // 10 years for high-risk systems
        sessionRetentionDays: 365,
        incidentRetentionDays: 3650,
        reference: 'Art. 12(2) -- Logs retained for the period appropriate to the intended purpose; high-risk systems default 10 years',
    },
    incidentPolicy: {
        notificationDeadlineHours: 336, // 15 days standard (serious incident)
        reference: 'Art. 73 -- Serious incident reporting: 15 days (standard) / 10 days (interruption of critical infrastructure) / 2 days (widespread infringement or person serious harm)',
        requiredRecipients: ['market-surveillance-authority', 'notified-body', 'ai-office-for-gpai', 'affected-deployers'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'euai-risk-mgmt',
            description: 'Risk management system established and maintained',
            reference: 'Art. 9',
            check: 'governance_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'euai-logging',
            description: 'Automatic logging of AI system operations',
            reference: 'Art. 12',
            check: 'audit_trail_exists',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'euai-human-oversight',
            description: 'Human oversight mechanisms active',
            reference: 'Art. 14',
            check: 'human_oversight',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'euai-prohibited-practice',
            description: 'Art. 5 prohibited-practice detection active',
            reference: 'Art. 5',
            check: 'euai_prohibited_practice_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'euai-transparency',
            description: 'AI system disclosure to users (Art. 13, 50)',
            reference: 'Art. 13, Art. 50',
            check: 'transparency_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'euai-data-governance',
            description: 'Data quality and governance measures',
            reference: 'Art. 10',
            check: 'data_classifier_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'euai-post-market',
            description: 'Post-market monitoring system active',
            reference: 'Art. 72',
            check: 'post_market_monitoring',
            failSeverity: 'HIGH',
        },
        {
            id: 'euai-incident-report',
            description: 'Serious incident reporting configured (Art. 73)',
            reference: 'Art. 73',
            check: 'incident_reporting',
            failSeverity: 'HIGH',
        },
        {
            id: 'euai-gpai',
            description: 'GPAI obligations tracked (Art. 53 + Art. 55 for systemic risk)',
            reference: 'Art. 53, Art. 55',
            check: 'euai_gpai_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'euai-fria',
            description: 'Fundamental Rights Impact Assessment available for high-risk systems',
            reference: 'Art. 27',
            check: 'euai_fria_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'euai-conformity',
            description: 'Conformity assessment + EU database registration + declaration of conformity',
            reference: 'Art. 43, Art. 49, Art. 60',
            check: 'euai_conformity_active',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=euaiact.js.map