"use strict";
/**
 * UK Pro-Innovation AI Framework Compliance Pack
 *
 * Regulation: UK Department for Science, Innovation and Technology (DSIT)
 *             "A pro-innovation approach to AI regulation" White Paper (March 2023)
 *             AI Regulation Roadmap (February 2024)
 *             Cross-Government Response (February 2024)
 *             Sectoral Regulator Guidance (CMA, ICO, FCA, MHRA, Ofcom, HSE, OFSTED)
 *             AI Safety Institute Guidance (frontier models)
 *
 * Jurisdiction: GB (United Kingdom)
 * Regulator: Cross-cutting; existing UK regulators (CMA, ICO, FCA, MHRA, OFSTED,
 *             Ofcom, HSE) apply 5 cross-sectoral principles within their own remits.
 *             AI Safety Institute (AISI) coordinates frontier AI assessment.
 *
 * Status note: UK has chosen a non-statutory, principles-based approach.
 *   Pack reflects the 5 cross-sectoral principles + sectoral regulator guidance.
 *   May require updates as statute is enacted.
 *
 * Key obligations (5 cross-sectoral principles -- all sectors):
 *   1. Safety, security and robustness
 *   2. Appropriate transparency and explainability
 *   3. Fairness
 *   4. Accountability and governance
 *   5. Contestability and redress
 *
 * Retention:
 *   Per sectoral regulator (varies); minimum 6 years for FCA-overlapping AI systems.
 *
 * Incident:
 *   Per sectoral regulator's notification rules;
 *   AISI notification for frontier AI.
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.UK_AI_FRAMEWORK_PACK = exports.UK_AI_FRAMEWORK_CATEGORY_CLASSIFIERS = void 0;
exports.UK_AI_FRAMEWORK_CATEGORY_CLASSIFIERS = {
    AI_SYSTEM_RECORD: {
        references: ['DSIT AI White Paper (2023) -- principle 4: accountability and governance; DSIT AI Regulation Roadmap (2024)'],
        classifier: (input) => {
            if (/\b(?:uk\s+ai\s+system|dsit\s+ai|pro.innovation\s+ai|uk\s+ai\s+framework|cross.sectoral\s+ai\s+principle)\b/i.test(input))
                return true;
            if (/\b(?:ai\s+system\s+record\s+uk|ai\s+governance\s+uk|ai\s+deployment\s+uk\s+principle|uk\s+ai\s+white\s+paper)\b/i.test(input))
                return true;
            if (/\b(?:aisi\s+assessment|ai\s+safety\s+institute\s+uk|frontier\s+model\s+uk)\b/i.test(input))
                return true;
            return false;
        },
    },
    SECTOR_REGULATOR_CORRESPONDENCE: {
        references: ['DSIT AI White Paper -- sectoral regulator guidance; CMA AI Principles; ICO Guidance on AI; FCA AI; MHRA AI; Ofcom AI; HSE AI'],
        classifier: (input) => {
            if (/\b(?:cma\s+ai|ico\s+ai\s+guidance|fca\s+ai|mhra\s+ai|ofcom\s+ai|hse\s+ai\s+guidance|ofsted\s+ai)\b/i.test(input))
                return true;
            if (/\b(?:sectoral\s+regulator\s+ai|sector\s+regulator\s+correspondence|uk\s+regulator\s+ai\s+guidance)\b/i.test(input))
                return true;
            if (/\b(?:competition\s+markets\s+authority\s+ai|financial\s+conduct\s+authority\s+ai\s+guidance|medicines\s+healthcare\s+ai)\b/i.test(input))
                return true;
            return false;
        },
    },
    AI_IMPACT_ASSESSMENT: {
        references: ['DSIT AI White Paper -- principle 1: safety, security and robustness; principle 3: fairness; ICO AI impact assessment guidance'],
        classifier: (input) => {
            if (/\b(?:ai\s+impact\s+assessment\s+uk|dsit\s+impact\s+assessment|uk\s+ai\s+risk\s+assessment|sector\s+ai\s+risk)\b/i.test(input))
                return true;
            if (/\b(?:algorithmic\s+impact\s+assessment\s+uk|ai\s+safety\s+assessment\s+uk|ai\s+fairness\s+assessment\s+uk)\b/i.test(input))
                return true;
            return false;
        },
    },
    PRINCIPLE_CONFORMANCE_EVIDENCE: {
        references: ['DSIT AI White Paper (2023) -- 5 cross-sectoral principles; cross-government response (Feb 2024)'],
        classifier: (input) => {
            if (/\b(?:principle\s+conformance|uk\s+ai\s+principle|cross.sectoral\s+principle\s+evidence|dsit\s+principle)\b/i.test(input))
                return true;
            if (/\b(?:safety\s+robustness\s+ai\s+uk|transparency\s+ai\s+uk|fairness\s+ai\s+uk|accountability\s+ai\s+uk|contestability\s+ai\s+uk)\b/i.test(input))
                return true;
            if (/\b(?:principle\s+1\s+safety|principle\s+2\s+transparency|principle\s+3\s+fairness|principle\s+4\s+accountability|principle\s+5\s+contestability)\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['UK GDPR Art. 4(1) -- personal data; ICO AI and data protection guidance'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b[A-CEGHJ-PR-TW-Z]{2}\s?\d{2}\s?\d{2}\s?\d{2}\s?[A-D]\b/i.test(input))
                return true;
            if (/\b(?:national\s+insurance\s+number|nino|uk\s+passport\s+number|driving\s+licence\s+number)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['UK GDPR Art. 32 -- security; DSIT AI White Paper -- principle 1: safety security robustness'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
exports.UK_AI_FRAMEWORK_PACK = {
    categoryClassifiers: exports.UK_AI_FRAMEWORK_CATEGORY_CLASSIFIERS,
    id: 'uk-ai-framework',
    aliases: [],
    name: 'UK Pro-Innovation AI Framework (DSIT 2023)',
    version: '1.0.0',
    description: 'UK Department for Science, Innovation and Technology (DSIT) pro-innovation approach to AI regulation (White Paper March 2023, Roadmap Feb 2024). Encodes the 5 cross-sectoral AI principles (safety/security/robustness; transparency/explainability; fairness; accountability/governance; contestability/redress) applied across sectors by existing UK regulators (CMA, ICO, FCA, MHRA, Ofcom, HSE, OFSTED). Includes AI Safety Institute (AISI) coordination obligations for frontier AI. Non-statutory principles-based framework; may require updates as UK statute is enacted.',
    authority: 'DSIT (Department for Science, Innovation and Technology) + CMA / ICO / FCA / MHRA / Ofcom / HSE / OFSTED + AI Safety Institute',
    industries: ['technology', 'financial-services', 'healthcare', 'media', 'energy', 'transport', 'retail', 'manufacturing', 'public-sector'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Enforce Principle 4 (accountability and governance): AI system-level governance controls, accountability mapping, and deployment gate. Principle 1 (safety/security/robustness) requires governance gate for high-risk AI contexts.',
            reference: 'DSIT AI White Paper (2023) -- Principle 4: Accountability and Governance; Principle 1: Safety, Security and Robustness; Sectoral Regulator Guidance (ICO, FCA)',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Enforce Principle 2 (appropriate transparency and explainability): AI-generated outputs must include disclosure that AI was used; explanations of AI decisions must be available to affected persons on request.',
            reference: 'DSIT AI White Paper (2023) -- Principle 2: Appropriate Transparency and Explainability; ICO Guidance on Explaining Decisions Made with AI; Ofcom transparency guidance',
        },
        {
            name: 'bias-monitor',
            required: true,
            reason: 'Enforce Principle 3 (fairness): monitor AI outputs for disparate treatment across protected characteristics; detect discriminatory outcomes across demographic groups.',
            reference: 'DSIT AI White Paper (2023) -- Principle 3: Fairness; Equality Act 2010 intersection; CMA AI and Competition guidance on fairness in AI markets',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Enforce Principle 5 (contestability and redress): human review gate before consequential AI decisions affecting individuals; contestability workflow for affected persons; AI Safety Institute engagement workflow for frontier models.',
            reference: 'DSIT AI White Paper (2023) -- Principle 5: Contestability and Redress; ICO AI and Data Protection -- right to human review; MHRA AI guidance on clinical contestability',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit trail for AI system decisions and principle-conformance evidence; required for sectoral regulator review and AI Safety Institute assessment.',
            reference: 'DSIT AI White Paper (2023) -- Principle 4: Accountability and Governance; ICO accountability principle; FCA SYSC record-keeping requirements for AI systems',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Principle-conformance documentation: impact assessments, sector-regulator correspondence records, AISI frontier model coordination records. Retention per sectoral regulator requirements.',
            reference: 'DSIT AI White Paper (2023) -- Principle 4 governance documentation; Sectoral Regulator Guidance cross-reference; ICO accountability documentation',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Classify AI system records, sector-regulator correspondence, impact assessments, and principle-conformance evidence; detect PII and credentials in AI training data and outputs.',
            reference: 'UK GDPR Art. 4(1) -- personal data (applies alongside DSIT AI framework); ICO AI and Data Protection guidance; DSIT Principle 3 fairness requires data classification for bias detection',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'AI safety incident detection and sectoral regulator notification workflow; AISI notification for frontier AI incidents; Principle 1 safety event escalation.',
            reference: 'DSIT AI White Paper (2023) -- Principle 1: Safety, Security and Robustness; AISI Frontier AI Safety Commitments (Nov 2023); Sectoral regulator notification requirements',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Sector-regulator mapping and third-party AI vendor accountability; sectoral regulator correspondence tracking across CMA / ICO / FCA / MHRA / Ofcom / HSE / OFSTED.',
            reference: 'DSIT AI White Paper (2023) -- Principle 4: Accountability and Governance (supply chain); Sectoral Regulator Guidance on AI vendor obligations; CMA AI Foundation Models guidance (2024)',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'Protection of AI system records, personal data in training/inference contexts, and principle-conformance evidence at rest and in transit.',
            reference: 'UK GDPR Art. 32(1)(a) -- encryption; DSIT AI White Paper -- Principle 1: Safety, Security and Robustness; ICO AI and Data Protection security guidance',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Sectoral retention requirements; minimum 6-year retention for FCA-overlapping AI systems; storage limitation enforcement per UK GDPR Art. 5(1)(e) and Principle 4 governance documentation requirements.',
            reference: 'UK GDPR Art. 5(1)(e) -- storage limitation; FCA SYSC record-keeping 6-year minimum; DSIT AI White Paper Principle 4 governance documentation',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            principle4AccountabilityRequired: true,
            principle1SafetyGateRequired: true,
            sectorRegulatorMappingRequired: true,
            aisiCoordinationForFrontierModels: true,
        },
        'transparency-injector': {
            principle2TransparencyRequired: true,
            aiUseDisclosureRequired: true,
            explainabilityOnRequestRequired: true,
        },
        'bias-monitor': {
            principle3FairnessMonitoringRequired: true,
            equalityActProtectedCharacteristicsRequired: true,
            disparateTreatmentDetectionRequired: true,
        },
        'approval-queue': {
            principle5ContestabilityRequired: true,
            humanReviewForConsequentialDecisionsRequired: true,
            aisiEngagementWorkflowRequired: true,
        },
        'attestation-manager': {
            principleConformanceDocumentationRequired: true,
            aiImpactAssessmentRequired: true,
            sectorRegulatorCorrespondenceRequired: true,
            aisiCoordinationEvidenceRequired: true,
            retentionYearsForFcaOverlap: 6,
        },
        'event-bus': {
            aiSafetyIncidentDetectionRequired: true,
            aisiNotificationForFrontierModels: true,
        },
        'supply-chain': {
            sectorRegulatorMappingRequired: true,
            aiVendorAccountabilityRequired: true,
        },
        'session-persistence': {
            storageLimitationEnforced: true,
            retentionYearsMinimum: 6,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['DATA-RESIDENCY-UK-OR-EU', 'PROCESSOR-CONTRACT', 'AISI-SAFETY-COMMITMENTS'],
        blockReasons: {
            deepseek: 'PRC National Intelligence Law incompatible with UK GDPR Art. 46 transfer requirements and DSIT AI framework Principle 1 (safety/security/robustness) for UK AI deployments.',
            baidu: 'PRC jurisdiction. No UK adequacy decision. Transfer of UK personal data to PRC violates UK GDPR Art. 44. Incompatible with Principle 4 accountability requirements.',
            alibaba: 'PRC jurisdiction. No UK adequacy decision. Transfer of UK personal data to PRC violates UK GDPR Art. 44. Incompatible with DSIT AI framework Principle 1 and Principle 4.',
        },
    },
    dataPolicy: {
        scanCategories: ['AI_SYSTEM_RECORD', 'SECTOR_REGULATOR_CORRESPONDENCE', 'AI_IMPACT_ASSESSMENT', 'PRINCIPLE_CONFORMANCE_EVIDENCE', 'PII', 'CREDENTIALS'],
        categoryActions: {
            AI_SYSTEM_RECORD: 'WARN',
            SECTOR_REGULATOR_CORRESPONDENCE: 'WARN',
            AI_IMPACT_ASSESSMENT: 'WARN',
            PRINCIPLE_CONFORMANCE_EVIDENCE: 'WARN',
            PII: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        // Per sectoral regulator. FCA-overlapping AI systems: 6 years.
        // ICO accountability documentation: minimum 3 years recommended.
        // Using 6-year general standard (aligns with Limitation Act 1980 and FCA SYSC 9).
        auditLogRetentionDays: 2190, // 6 years
        sessionRetentionDays: 2190,
        incidentRetentionDays: 2190,
        reference: 'DSIT AI White Paper -- Principle 4: Accountability and Governance documentation; FCA SYSC 9.1.1R -- 6-year retention for FCA-overlapping AI systems; Limitation Act 1980 -- 6-year claims period',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['gb', 'eu'],
    },
    incidentPolicy: {
        // Per sectoral regulator notification rules. AISI notification for frontier AI.
        // Using 72 hours as baseline (consistent with UK GDPR Art. 33 and NIS2 harmonisation).
        notificationDeadlineHours: 72,
        reference: 'DSIT AI White Paper -- Principle 1 safety incident response; AISI Frontier AI Safety Commitments (Nov 2023) -- notify AISI of significant safety incidents; UK GDPR Art. 33 -- 72-hour ICO notification (parallel data breach); Sectoral regulator notification requirements',
        requiredRecipients: ['sector-regulator-primary', 'chief-ai-officer', 'data-protection-officer', 'aisi-liaison'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'uk-ai-principle1-safety-gate',
            description: 'Principle 1 (safety, security and robustness) gate active: AI system safety assessment completed before deployment; high-risk AI contexts subject to governance gate',
            reference: 'DSIT AI White Paper (2023) -- Principle 1: Safety, Security and Robustness; Sectoral regulator guidance on AI safety (MHRA, HSE, OFSTED)',
            check: 'governance_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'uk-ai-principle2-transparency-gate',
            description: 'Principle 2 (appropriate transparency and explainability) gate active: AI-generated outputs disclosed; explanations available on request for consequential AI decisions',
            reference: 'DSIT AI White Paper (2023) -- Principle 2: Appropriate Transparency and Explainability; ICO Guidance on Explaining Decisions Made with AI',
            check: 'transparency_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'uk-ai-principle3-fairness-monitor',
            description: 'Principle 3 (fairness) monitoring active: AI outputs monitored for disparate treatment across Equality Act 2010 protected characteristics',
            reference: 'DSIT AI White Paper (2023) -- Principle 3: Fairness; Equality Act 2010; CMA AI Foundation Models guidance (2024) -- fairness obligations',
            check: 'bias_monitor_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'uk-ai-principle4-accountability-governance',
            description: 'Principle 4 (accountability and governance) documentation active: AI system records, principle-conformance evidence, and sector-regulator correspondence maintained',
            reference: 'DSIT AI White Paper (2023) -- Principle 4: Accountability and Governance; Cross-Government Response Feb 2024; ICO accountability documentation requirements',
            check: 'attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'uk-ai-principle5-contestability-redress',
            description: 'Principle 5 (contestability and redress) workflow active: human review gate for consequential AI decisions; redress pathway available to affected persons',
            reference: 'DSIT AI White Paper (2023) -- Principle 5: Contestability and Redress; ICO AI and Data Protection -- right to human review; MHRA contestability requirements',
            check: 'approval_queue_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'uk-ai-impact-assessment-current',
            description: 'AI impact assessment documented and current for deployed AI systems; assessments cover all 5 cross-sectoral principles',
            reference: 'DSIT AI White Paper (2023) -- Principle 4 governance documentation; ICO AI and Data Protection Impact Assessment guidance; DSIT AI Regulation Roadmap (2024)',
            check: 'impact_assessment_current',
            failSeverity: 'HIGH',
        },
        {
            id: 'uk-ai-audit-trail',
            description: 'Tamper-evident audit trail active for AI system decisions, principle-conformance records, and sector-regulator correspondence',
            reference: 'DSIT AI White Paper (2023) -- Principle 4: Accountability and Governance; ICO accountability principle (UK GDPR Art. 5(2)); FCA SYSC 9.1.1R -- record-keeping',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
        {
            id: 'uk-ai-sector-regulator-mapping',
            description: 'Sector-regulator mapping active: AI deployments cross-referenced against applicable UK sectoral regulator (CMA / ICO / FCA / MHRA / Ofcom / HSE / OFSTED) and their sector-specific AI guidance',
            reference: 'DSIT AI White Paper (2023) -- Sectoral Regulator Guidance; CMA AI Principles (Jan 2024); ICO AI and Data Protection; FCA AI guidance; MHRA AI framework',
            check: 'subservice_registry_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'uk-ai-data-classifier',
            description: 'Data classifier active for AI system records, personal data in AI contexts, and principle-conformance evidence; enables differential handling for sensitive data categories',
            reference: 'UK GDPR Art. 4(1) -- personal data; ICO AI and Data Protection -- data minimisation and purpose limitation for AI; DSIT Principle 3 fairness data classification',
            check: 'data_classifier_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'uk-ai-safety-incident-monitoring',
            description: 'AI safety incident monitoring active; sectoral regulator and AISI notification workflow configured for frontier AI safety events',
            reference: 'DSIT AI White Paper (2023) -- Principle 1: Safety; AISI Frontier AI Safety Commitments (Nov 2023) -- notify AISI of significant safety incidents; Sectoral regulator notification requirements',
            check: 'monitoring_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'uk-ai-encryption',
            description: 'UK AI framework data encrypted at rest and in transit; AI system records and personal data in AI contexts protected to UK GDPR Art. 32 standard',
            reference: 'UK GDPR Art. 32(1)(a) -- encryption; DSIT AI White Paper -- Principle 1: Safety, Security and Robustness; NCSC guidance on securing AI systems',
            check: 'encryption_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=uk-ai-framework.js.map