/**
 * FDA 21 CFR Part 56 (IRB Regulations) Compliance Pack
 *
 * 21 CFR Part 56 -- Institutional Review Boards.
 * FDA authority (not OHRP) for IRBs reviewing FDA-regulated research
 * under the Federal Food, Drug, and Cosmetic Act and the Public Health
 * Service Act. Parallel framework to 45 CFR 46 (Common Rule) but
 * distinct legal authority, distinct enforcement body, and distinct
 * regulatory scope.
 *
 * Scope: Any clinical investigation regulated by FDA under:
 *   - 21 CFR Part 50  (protection of human subjects -- informed consent)
 *   - 21 CFR Part 312 (IND -- drugs / biologics)
 *   - 21 CFR Part 812 (IDE -- devices)
 *   - 21 CFR Part 820 (QMSR -- SaMD quality management)
 *
 * Key subparts:
 *   Subpart A -- General provisions (purpose, applicability, definitions)
 *   Subpart B -- Organization and personnel (56.107 composition requirements)
 *   Subpart C -- IRB functions and operations (56.108-56.110)
 *   Subpart D -- Records and reports (56.115)
 *   Subpart E -- Administrative actions (56.120-56.124)
 *
 * Distinction from Common Rule (45 CFR 46):
 *   - Authority: FDA (FD&C Act / PHS Act) vs HHS/OHRP (45 CFR 46)
 *   - Scope: FDA-regulated clinical investigations vs federally-funded research
 *   - Enforcement: FDA Office of Good Clinical Practice (OGCP) vs OHRP
 *   - Reporting: FDA district offices + OGCP vs OHRP
 *   - Both packs may be active simultaneously for dual-covered research
 *     (e.g., NIH-funded IND study). In that case, more restrictive control
 *     applies per each dimension.
 *
 * Out of scope here:
 *   - 21 CFR Part 50 (informed consent) -- separate future pack
 *   - 21 CFR Part 11 (electronic records) -- see part11.ts pack
 *   - 21 CFR Part 820 (QMSR) -- see fda-samd.ts pack
 *
 * Key obligations for AI systems:
 *   - AI tools used in FDA-regulated clinical investigations must be
 *     documented in the IRB-approved protocol.
 *   - IRB review is required for any change in protocol affecting AI
 *     tools used in data collection or analysis.
 *   - Prompt reporting of unanticipated problems involving risk to
 *     subjects must include any AI-generated outputs contributing to
 *     the problem.
 *   - IRB records including AI tool documentation must be retained
 *     >= 3 years after clinical investigation completion (56.115(b)).
 *
 * @connexum/ai-governance
 */
/**
 * FDA 21 CFR 56 IRB category classifiers.
 * Clinical investigation data and IRB-specific markers are
 * high-sensitivity; BLOCK on identifiable subject data.
 */
export const US_FDA_21CFR56_CATEGORY_CLASSIFIERS = {
    IRB_CLINICAL_SUBJECT_ID: {
        references: ['21 CFR 56.111(a)(7) -- equitable subject selection; subject identification in IRB records'],
        classifier: (input) => {
            // Subject/participant identifiers in clinical investigation context
            if (/\b(?:clinical.?subject|investigational.?subject|study.?subject)[_\-\s]?(?:id|number|#)\s*[=:]\s*\w+/i.test(input))
                return true;
            if (/\b(?:CSUBJ|CINV|CIS)-?\d{3,12}\b/i.test(input))
                return true;
            if (/\bIRB_CLINICAL_SUBJECT_ID\b/i.test(input))
                return true;
            return false;
        },
    },
    FDA_IRB_PROTOCOL_DATA: {
        references: ['21 CFR 56.108 -- IRB review of research; 21 CFR 56.115 -- IRB records'],
        classifier: (input) => {
            if (/\b(?:fda.?irb|irb.?fda|21.cfr.?56|cfr.?56|21cfr56|ind.?irb|ide.?irb|irb.?ind|irb.?ide)\b/i.test(input))
                return true;
            if (/\b(?:irb.?protocol|irb.?approval|irb.?number|fda.?protocol.?id)\b/i.test(input))
                return true;
            if (/\bFDA_IRB_PROTOCOL_DATA\b/i.test(input))
                return true;
            return false;
        },
    },
    CLINICAL_INVESTIGATION_DATA: {
        references: ['21 CFR 56.102(c) -- clinical investigation definition; 21 CFR 312 IND; 21 CFR 812 IDE'],
        classifier: (input) => {
            if (/\b(?:clinical.?investigation|investigational.?drug|IND.?application|IDE.?application|IND.?number|IDE.?number)\b/i.test(input))
                return true;
            if (/\b(?:investigational.?device|investigational.?biologic|phase.?(?:I|II|III|IV).?trial|first.?in.?human)\b/i.test(input))
                return true;
            if (/\bCLINICAL_INVESTIGATION_DATA\b/i.test(input))
                return true;
            return false;
        },
    },
    SERIOUS_ADVERSE_EVENT: {
        references: ['21 CFR 56.108(b) -- prompt reporting of unanticipated problems; 21 CFR 312.32 IND safety reports'],
        classifier: (input) => {
            if (/\b(?:serious.?adverse.?event|SAE|unexpected.?adverse|unexpected.?risk|unanticipated.?problem|UPIRTSO)\b/i.test(input))
                return true;
            if (/\b(?:life.?threatening.?adverse|fatal.?adverse|death.?in.?study|hospitalization.?adverse)\b/i.test(input))
                return true;
            if (/\bSERIOUS_ADVERSE_EVENT\b/i.test(input))
                return true;
            return false;
        },
    },
    IRB_NONCOMPLIANCE: {
        references: ['21 CFR 56.108(b)(5) -- reporting of continuing noncompliance; 21 CFR 56.108(b)(6) -- suspension/termination'],
        classifier: (input) => {
            if (/\b(?:serious.?noncompliance|continuing.?noncompliance|protocol.?deviation.?report|irb.?suspension|irb.?termination)\b/i.test(input))
                return true;
            if (/\bIRB_NONCOMPLIANCE\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['21 CFR 11 -- electronic records; clinical investigation data access controls'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const US_FDA_21CFR56_PACK = {
    categoryClassifiers: US_FDA_21CFR56_CATEGORY_CLASSIFIERS,
    /** P3.5: Clinical investigation subject IDs and adverse event records are inherently subject-keyed. */
    subjectKeyedCategories: ['IRB_CLINICAL_SUBJECT_ID', 'SERIOUS_ADVERSE_EVENT'],
    id: 'us-fda-21cfr56',
    name: 'FDA 21 CFR Part 56 (IRB Regulations)',
    version: '1.0.0',
    description: 'FDA 21 CFR Part 56 IRB Regulations for FDA-regulated clinical investigations (drugs, biologics, devices). Covers IRB composition (56.107), quorum (56.108(c)), conflict of interest (56.107(e)), continuing review (56.109(f)), expedited review criteria (56.110), records retention (56.115(b) -- 3 years), meeting minutes (56.115(a)(2)), and prompt reporting of unanticipated problems (56.108(b)). Distinct from 45 CFR 46 (Common Rule): FDA authority, OGCP enforcement, clinical investigation scope. Both packs may be active simultaneously for dual-covered research.',
    authority: 'US Food and Drug Administration (FDA) -- Office of Good Clinical Practice (OGCP)',
    industries: [
        'healthcare',
        'life-sciences',
        'pharmaceuticals',
        'medical-devices',
        'clinical-research',
        'biotech',
        'biologics',
    ],
    requiredModules: [
        {
            name: 'attestation-manager',
            required: true,
            reason: 'IRB composition attestations (56.107); member qualification records; affiliiation declarations; conflict-of-interest acknowledgments; continuing-review approval on file; expedited-review eligibility documentation',
            reference: '21 CFR 56.107 (IRB membership); 21 CFR 56.109(f) (continuing review); 21 CFR 56.110 (expedited review)',
        },
        {
            name: 'audit-chain',
            required: true,
            reason: 'Tamper-evident chain for IRB meeting minutes (56.115(a)(2)); protocol approval records; vote tallies; basis for required modifications. FDA may inspect these records at any time (56.115(c)).',
            reference: '21 CFR 56.115(a)(2) (minutes with attendance, votes, basis); 21 CFR 56.115(c) (FDA inspection authority)',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Hash-chain integrity verification for IRB records; tamper detection for approval records and meeting minutes required under 21 CFR 56.115',
            reference: '21 CFR 56.115 (IRB records); FDA inspection authority (56.115(c))',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'IRB protocol review gate before AI-assisted research commences; expedited vs full-board routing; continuing-review renewal queue; conflict-of-interest recusal enforcement',
            reference: '21 CFR 56.108(a) (protocol review before commencement); 21 CFR 56.107(e) (COI recusal); 21 CFR 56.109(f) (continuing review)',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Unanticipated problem reporting stream (56.108(b)); prompt reporting clock for SAEs involving risk to subjects; suspension/termination notification events; continuing noncompliance escalation',
            reference: '21 CFR 56.108(b) (prompt reporting to FDA and sponsor); 21 CFR 56.108(b)(5) (continuing noncompliance); 21 CFR 56.108(b)(6) (suspension/termination)',
        },
        {
            name: 'governance-runtime',
            required: true,
            reason: 'IRB approval gate enforcement; quorum tracking; conflict-of-interest recusal enforcement; protocol scope verification; continuing-review interval enforcement',
            reference: '21 CFR 56.108(c) (majority quorum with nonscientific member); 21 CFR 56.107(e) (COI recusal); 21 CFR 56.109(f) (annual continuing review)',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'IRB approval status persistence across AI sessions; quorum membership state for meeting tracking; continuing-review interval tracking; SAE clock state',
            reference: '21 CFR 56.109(f) (continuing review not less than once per year); 21 CFR 56.108(b) (prompt SAE reporting)',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'AI vendor DUA and data handling agreement for clinical investigation data; ZERO-RETENTION and ZERO-TRAINING-ON-INPUTS provider enforcement for identifiable subject data; vendor oversight per FDA supplier controls',
            reference: '21 CFR 56.111(a)(7) (equitable selection); FDA sponsor oversight obligations; 21 CFR 312 sponsor responsibilities',
        },
    ],
    moduleConfig: {
        'attestation-manager': {
            irbRosterCompositionAttestationRequired: true,
            memberQualificationRecordsRequired: true,
            affiliationDeclarationRequired: true,
            conflictOfInterestAcknowledgmentRequired: true,
            continuingReviewApprovalOnFileRequired: true,
            expeditedReviewEligibilityDocumentationRequired: true,
            /** Minimum roster size per 56.107(a) */
            minimumIrbMemberCount: 5,
        },
        'audit-chain': {
            irbMeetingMinutesIntegrityRequired: true,
            voteTallyTamperDetectionRequired: true,
            protocolApprovalChainRequired: true,
        },
        'approval-queue': {
            irbProtocolReviewGateRequired: true,
            expeditedVsFullBoardRoutingRequired: true,
            continuingReviewRenewalQueueEnabled: true,
            conflictOfInterestRecusalEnforced: true,
        },
        'event-bus': {
            unanticipatedProblemReportingActive: true,
            suspensionTerminationNotificationActive: true,
            continuingNoncomplianceEscalationActive: true,
            /** Prompt reporting clock for SAEs -- 24 hours for serious adverse events (56.108(b)) */
            saePromptReportingDeadlineHours: 24,
        },
        'governance-runtime': {
            irbApprovalGateRequired: true,
            /** Quorum: majority present including at least one nonscientific member (56.108(c)) */
            irbQuorumMajorityRequired: true,
            irbQuorumNonscientificMemberRequired: true,
            conflictOfInterestRecusalActive: true,
            /** Continuing review: not less than once per year (56.109(f)) */
            continuingReviewMaxIntervalDays: 365,
            protocolScopeVerificationEnabled: true,
        },
        'supply-chain': {
            clinicalInvestigationDataDuaRequired: true,
            vendorZeroRetentionRequired: true,
            vendorZeroTrainingOnInputsRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: [
            'ZERO-RETENTION',
            'ZERO-TRAINING-ON-INPUTS',
            'DATA-RESIDENCY-US',
            'FDA-CLINICAL-INVESTIGATION-READY',
        ],
        blockReasons: {
            deepseek: 'PRC jurisdiction; cannot meet ZERO-RETENTION or FDA clinical investigation data protection requirements.',
            baidu: 'PRC jurisdiction; clinical investigation subject data protection risk.',
            alibaba: 'PRC jurisdiction; clinical investigation subject data protection risk.',
        },
    },
    dataPolicy: {
        scanCategories: [
            'IRB_CLINICAL_SUBJECT_ID',
            'FDA_IRB_PROTOCOL_DATA',
            'CLINICAL_INVESTIGATION_DATA',
            'SERIOUS_ADVERSE_EVENT',
            'IRB_NONCOMPLIANCE',
            'CREDENTIALS',
        ],
        categoryActions: {
            IRB_CLINICAL_SUBJECT_ID: 'BLOCK',
            FDA_IRB_PROTOCOL_DATA: 'REQUIRE_APPROVAL',
            CLINICAL_INVESTIGATION_DATA: 'LOG',
            SERIOUS_ADVERSE_EVENT: 'BLOCK',
            IRB_NONCOMPLIANCE: 'BLOCK',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        sovereignty: ['US'],
        // 21 CFR 56.115(b): IRB records retained >= 3 years after completion
        // of the clinical investigation. 1095 = 3 * 365.
        auditLogRetentionDays: 1095,
        sessionRetentionDays: 1095,
        incidentRetentionDays: 1095,
        reference: '21 CFR 56.115(b): IRB records (including minutes, protocols, consent documents, correspondence) retained >= 3 years after completion of the clinical investigation or until FDA has reviewed and approved a marketing application for the drug/device, whichever is longer.',
    },
    incidentPolicy: {
        // 21 CFR 56.108(b): IRB shall ensure prompt reporting to FDA and sponsor.
        // FDA guidance interprets "prompt" as 24 hours for serious adverse events
        // impacting subject safety; 5 business days for unanticipated problems
        // involving risk; 30 days for continuing noncompliance. Using 24h as the
        // strictest default to ensure serious subject-safety events are never delayed.
        notificationDeadlineHours: 24,
        reference: '21 CFR 56.108(b): Prompt reporting of unanticipated problems involving risk to subjects, serious or continuing noncompliance, and suspension/termination of IRB approval. FDA guidance: 24 hours for subject-safety SAEs; 5 business days for unanticipated problems; 30 days for continuing noncompliance.',
        requiredRecipients: [
            'fda-ogcp',
            'irb-chair',
            'clinical-investigator',
            'sponsor',
            'institution-official',
        ],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'fda-irb-roster-composition',
            description: 'IRB has >= 5 members with varying backgrounds: at least one scientific member, one nonscientific member, and one not affiliated with the institution',
            reference: '21 CFR 56.107(a): IRB must have at least 5 members with varying backgrounds including professional competence and diverse membership. 56.107(c): At least one member whose primary concerns are nonscientific. 56.107(d): At least one member not affiliated with institution.',
            check: 'fda_irb_roster_composition_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fda-irb-quorum',
            description: 'Majority quorum required for convened meetings, including at least one nonscientific member present',
            reference: '21 CFR 56.108(c): IRB shall conduct business at convened meetings at which a majority of the members are present, including at least one member whose primary concerns are nonscientific.',
            check: 'fda_irb_quorum_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fda-irb-conflict-of-interest',
            description: 'IRB members may not participate in review of research in which they have a conflicting interest, except to provide requested information',
            reference: '21 CFR 56.107(e): No IRB member may participate in the initial or continuing review of any research in which the member has a conflicting interest, except to provide information requested by the IRB.',
            check: 'fda_irb_conflict_of_interest_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fda-irb-continuing-review',
            description: 'Continuing review conducted at intervals appropriate to the degree of risk, but not less than once per year',
            reference: '21 CFR 56.109(f): An IRB shall conduct continuing review of research covered by these regulations at intervals appropriate to the degree of risk, but not less than once per year.',
            check: 'fda_irb_continuing_review_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fda-irb-expedited-review-criteria',
            description: 'Expedited review only for minimal-risk studies on the current FDA/HHS expedited review list',
            reference: '21 CFR 56.110: An IRB may use expedited review procedures to review minor changes to previously approved research, or to review research for which there is only minimal risk and the research is on the FDA expedited review list.',
            check: 'fda_irb_expedited_review_criteria_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'fda-irb-records-retention',
            description: 'IRB records retained >= 3 years after completion of clinical investigation per 56.115(b)',
            reference: '21 CFR 56.115(b): An institution shall retain the records required by this subpart for at least 3 years after completion of the research, and the records shall be accessible for inspection and copying by authorized representatives of FDA.',
            check: 'fda_irb_records_retention_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'fda-irb-meeting-minutes',
            description: 'Meeting minutes record attendance, votes by outcome (including abstentions), and basis for requiring changes to or disapproving research',
            reference: '21 CFR 56.115(a)(2): Documentation of IRB activities including copies of all research proposals reviewed, minutes of IRB meetings (including attendance, actions taken, votes by person and outcome, and basis for requiring modifications or disapproval).',
            check: 'fda_irb_meeting_minutes_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'fda-irb-prompt-reporting',
            description: 'IRB ensures prompt reporting to FDA and sponsor of unanticipated problems, serious noncompliance, and suspension/termination of approval',
            reference: '21 CFR 56.108(b): The IRB shall follow written procedures for ensuring prompt reporting to the IRB, appropriate institutional officials, and the FDA of any unanticipated problems involving risks to human subjects or others; any instance of serious or continuing noncompliance; and any suspension or termination of IRB approval.',
            check: 'fda_irb_prompt_reporting_active',
            failSeverity: 'CRITICAL',
        },
    ],
};
//# sourceMappingURL=us-fda-21cfr56.js.map