"use strict";
/**
 * AU AI Ethics Framework + Voluntary AI Safety Standard (2024)
 *
 * X1-DISAGGREGATION REVIEW (2026-04-24): ACCEPTABLE AS ONE PACK.
 *   Both instruments are voluntary, both issued by DISR (Department of
 *   Industry, Science and Resources), both covering the same domain (AU
 *   voluntary AI governance). The 2024 Voluntary AI Safety Standard is
 *   the operative evolution of the 2019 AI Ethics Framework -- DISR
 *   explicitly framed the 2024 Standard as the current operative guidance
 *   while the 2019 Framework remains the foundational document. They are
 *   complementary, not competing, and are consistently cited together by
 *   ASIC, APRA, and OAIC as a unified voluntary governance signal. Single
 *   issuing authority (DISR). Single voluntary compliance standard. No
 *   split required.
 *
 * Primary instruments:
 *   - Australia's AI Ethics Framework (DISR, 2019): 8 core AI Ethics Principles
 *     (voluntary for private sector, expected for government).
 *   - Voluntary AI Safety Standard (DISR, September 2024): 10 voluntary guardrails
 *     aligned with proposed mandatory guardrails.
 *
 * Status as at April 2026: Both voluntary. Voluntary AI Safety Standard (Sep 2024)
 * is current operative guidance pending mandatory legislation. Voluntary Standard
 * cited by ASIC, APRA, and OAIC as relevant standard for reasonable conduct.
 *
 * 8 AI Ethics Principles (2019):
 *   Wellbeing; Human-centred values; Fairness; Privacy and security;
 *   Reliability and safety; Transparency and explainability; Contestability;
 *   Accountability.
 *
 * 10 Voluntary Guardrails (Sep 2024):
 *   G1 Accountability; G2 Governance Framework; G3 Stakeholder Engagement;
 *   G4 Human Oversight; G5 Testing; G6 Documentation/Provenance;
 *   G7 Inform of AI Use; G8 Review/Redress/Appeal; G9 Privacy Protection;
 *   G10 Security.
 *
 * Most pack categories produce WARN actions (voluntary framework). Exception:
 * AU_AI_UNDISCLOSED_USE is BLOCK — G7 non-deception principle treats undisclosed
 * AI use in decisions affecting individuals as a deception, warranting hard refusal.
 * Enforcement risk arises where entity holds itself out as compliant but is not,
 * or where regulators use non-adherence as evidence of inadequate risk management
 * under sector-specific laws.
 *
 * Cross-pack interactions:
 *   - au-aiethics-framework + au-mandatory-ai-guardrails: Voluntary is legislative-
 *     evolution precursor. Run both; voluntary covers current operative standard;
 *     mandatory covers anticipated requirements. When legislation enacted, mandatory
 *     pack becomes primary.
 *   - au-aiethics-framework + nist-ai-rmf: NIST RMF 4 functions (Govern/Map/
 *     Measure/Manage) substantially align with Voluntary Standard's 10 guardrails.
 *     Cross-jurisdictional AU-US AI governance coverage.
 *   - au-aiethics-framework + iso42001: ISO/IEC 42001 closely maps to Voluntary
 *     Standard. ISO 42001 certification gives substantial Voluntary Standard
 *     compliance. Run alongside iso42001 for AU-specific context.
 *
 * Authority: Department of Industry, Science and Resources (DISR)
 * Sovereignty: Australian Federal (voluntary)
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.AU_AIETHICS_PACK = exports.AU_AIETHICS_CATEGORY_CLASSIFIERS = void 0;
exports.AU_AIETHICS_CATEGORY_CLASSIFIERS = {
    AU_AI_ACCOUNTABILITY_GAP: {
        references: ['AU Voluntary AI Safety Standard G1 — accountability: designated responsible person'],
        classifier: (input) => {
            if (/\b(?:no\s+(?:accountable\s+person|responsible\s+(?:person|owner)|ai\s+accountability)|accountability\s+(?:gap|missing|undefined).*ai|ai.*without\s+(?:designated|identified)\s+(?:accountable|responsible)\s+(?:person|owner))/i.test(input))
                return true;
            return false;
        },
    },
    AU_AI_UNDISCLOSED_USE: {
        references: ['AU Voluntary AI Safety Standard G7 — inform humans of AI use; non-deception'],
        classifier: (input) => {
            if (/\bAI\b.*\bundisclosed\s+use\b/i.test(input))
                return true;
            if (/\bundisclosed\s+(?:use|decision|recommendation)\b.*\bAI\b/i.test(input))
                return true;
            // F-NEW-VERA-PACK-C3-03 fix: Option B — two-predicate check.
            // The original /\bno\s+disclosure\b/i was context-free and fired on NDAs,
            // financial agreements, and any document containing the phrase "no disclosure"
            // without any connection to AI use. Option B splits into two predicates:
            //   (1) the "no disclosure" phrase must be present, AND
            //   (2) an AI-context keyword must appear anywhere in the same input.
            // This allows the AI keyword to precede OR follow "no disclosure" in the
            // sentence (e.g. "AI system ... no disclosure to applicants"), whereas
            // Option A's inline look-forward would miss cases where AI appears first.
            if (/\bno\s+(?:ai\s+)?disclosure\b/i.test(input) &&
                /\b(?:ai|automated|algorithm|bot|llm|chatbot|model|machine\s+learning|ml)\b/i.test(input))
                return true;
            if (/\bDISR\b/i.test(input))
                return true;
            if (/\b(?:undisclosed\s+ai\s+(?:use|decision|recommendation)|ai\s+(?:decision|output|recommendation)\s+(?:without|not)\s+(?:disclosure|informing)|hidden\s+ai.*(?:individual|customer|applicant))\b/i.test(input))
                return true;
            return false;
        },
    },
    AU_AI_GOVERNANCE_GAP: {
        references: ['AU Voluntary AI Safety Standard G2 — governance framework; risk assessment + approval + oversight'],
        classifier: (input) => {
            if (/\b(?:ai\s+governance\s+(?:gap|missing|absent|incomplete)|no\s+ai\s+(?:governance\s+(?:policy|framework|document)|risk\s+assessment|board\s+oversight))/i.test(input))
                return true;
            return false;
        },
    },
    AU_AI_TESTING_GAP: {
        references: ['AU Voluntary AI Safety Standard G5 — pre-deployment testing; ongoing monitoring'],
        classifier: (input) => {
            if (/\b(?:ai\s+(?:not\s+tested|untested|testing\s+(?:gap|overdue|missing))|pre[_\-\s]?deployment\s+(?:testing\s+)?(?:not\s+done|skipped|absent).*ai|no\s+(?:testing|validation)\s+record.*ai)/i.test(input))
                return true;
            return false;
        },
    },
    AU_AI_APPEAL_MISSING: {
        references: ['AU Voluntary AI Safety Standard G8 — review/redress/appeal mechanism'],
        classifier: (input) => {
            if (/\b(?:no\s+(?:appeal|redress|review)\s+mechanism.*ai|ai\s+decision.*(?:no\s+appeal|cannot\s+(?:challenge|contest|review))|appeal\s+(?:mechanism\s+)?(?:missing|absent|unavailable).*ai)/i.test(input))
                return true;
            return false;
        },
    },
};
exports.AU_AIETHICS_PACK = {
    categoryClassifiers: exports.AU_AIETHICS_CATEGORY_CLASSIFIERS,
    /**
     * P3.5: AU_AI_UNDISCLOSED_USE is subject-keyed — each individual affected by an
     * undisclosed AI decision should carry a subject ID for G7 disclosure tracking.
     * All other categories are system/governance-level (non-subject-keyed).
     */
    subjectKeyedCategories: [
        'AU_AI_UNDISCLOSED_USE',
    ],
    id: 'au-aiethics-framework',
    name: 'AU AI Ethics Framework + Voluntary AI Safety Standard (2024)',
    version: '1.0.0',
    description: 'Australia\'s AI Ethics Framework (DISR 2019, 8 principles) and Voluntary AI Safety Standard (DISR September 2024, 10 guardrails) compliance pack. Voluntary as at April 2026. All categories produce WARN actions. Cited by ASIC, APRA, and OAIC as relevant standard for reasonable conduct. Government procurement increasingly requires Framework compliance. Mandatory legislation anticipated 2025-2026 (see au-mandatory-ai-guardrails pack).',
    authority: 'Department of Industry, Science and Resources (DISR)',
    industries: [
        'all-au', 'government', 'healthcare', 'fintech',
        'edtech', 'legal', 'hr-tech', 'critical-infrastructure',
    ],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'G1 accountable person; G2 governance framework documented; G4 human override capability; G7 AI disclosure; G8 redress mechanism',
            reference: 'AU Voluntary AI Safety Standard G1, G2, G4, G7, G8',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'G6 model provenance documentation; G5 testing records 5 years; accountability records 5 years',
            reference: 'AU Voluntary AI Safety Standard G5, G6',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'G7 disclosure when AI used in contexts affecting individuals; G8 redress pathway accessible to affected parties',
            reference: 'AU Voluntary AI Safety Standard G7, G8',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Classify AU_AI_ACCOUNTABILITY_GAP, AU_AI_UNDISCLOSED_USE, AU_AI_GOVERNANCE_GAP, AU_AI_TESTING_GAP, AU_AI_APPEAL_MISSING categories; detect voluntary-standard violations in AI system outputs',
            reference: 'AU Voluntary AI Safety Standard G1, G2, G4, G5, G7, G8',
        },
        // F-NEW-VERA-PACK-C3-03 (bias-monitor decision): ADDED.
        // "Fairness" is one of the 8 enumerated AI Ethics Principles (2019 Framework).
        // Peer AI-framework packs that enumerate Fairness as a core principle all
        // require bias-monitor (uk-ai-framework, nist-ai-rmf, iso42001). Consistency
        // with catalog peers and the explicit Fairness principle warrants inclusion.
        // This is voluntary framework so the module is marked required=true to
        // surface the gap at activation time, consistent with peer pack design.
        {
            name: 'bias-monitor',
            required: true,
            reason: 'Enforce AI Ethics Principle 3 (Fairness): monitor AI outputs for disparate treatment and discriminatory outcomes; detect bias across demographic groups affected by AI decisions',
            reference: 'AU AI Ethics Framework Principle 3 — Fairness; AU Voluntary AI Safety Standard G3 (stakeholder engagement including affected communities)',
        },
    ],
    moduleConfig: {
        'data-classifier': {
            enabledCategories: [
                'AU_AI_ACCOUNTABILITY_GAP',
                'AU_AI_UNDISCLOSED_USE',
                'AU_AI_GOVERNANCE_GAP',
                'AU_AI_TESTING_GAP',
                'AU_AI_APPEAL_MISSING',
            ],
            accountablePersonDefined: true,
            aiDisclosureEnabled: true,
            governanceDocumentOnFile: true,
            lastTestWithin365Days: true,
            redressMechanismActive: true,
            provenanceDocumentationOnFile: true,
            humanOverrideCapabilityActive: true,
        },
        'governance-runtime': {
            accountablePersonDefined: true,
            aiDisclosureEnabled: true,
            governanceDocumentOnFile: true,
            lastTestWithin365Days: true,
            redressMechanismActive: true,
            provenanceDocumentationOnFile: true,
            humanOverrideCapabilityActive: true,
        },
        'transparency-injector': {
            aiDisclosureRequired: true,
            redressPathwayRequired: true,
        },
        // bias-monitor config added alongside requiredModules entry (C3-03 fix)
        'bias-monitor': {
            fairnessPrincipleMonitoringRequired: true,
            disparateTreatmentDetectionRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: [
            'PROVENANCE-DOCUMENTATION',
            'HUMAN-OVERRIDE-CAPABILITY',
            'AI-DISCLOSURE-CAPABILITY',
        ],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: [
            'AU_AI_ACCOUNTABILITY_GAP',
            'AU_AI_UNDISCLOSED_USE',
            'AU_AI_GOVERNANCE_GAP',
            'AU_AI_TESTING_GAP',
            'AU_AI_APPEAL_MISSING',
        ],
        categoryActions: {
            /**
             * AU_AI_ACCOUNTABILITY_GAP: No accountable person identified for an AI
             * system. REQUIRE_APPROVAL because G1 is the foundational guardrail -- an
             * AI system operating without a designated responsible person cannot satisfy
             * any other guardrail and exposes the operator to regulator criticism under
             * sector-specific laws (ASIC, APRA, OAIC). Requires human review before
             * proceeding. Per Thomas principle: "a governance framework with no
             * enforcement teeth is decorative."
             */
            AU_AI_ACCOUNTABILITY_GAP: 'REQUIRE_APPROVAL',
            /**
             * AU_AI_UNDISCLOSED_USE: AI used in a decision affecting an individual
             * without disclosure. BLOCK because the non-deception principle (G7) is
             * an absolute obligation -- an AI system that hides its own involvement
             * from affected individuals is deceptive by definition. Voluntary framework
             * or not, regulators treat this as a material breach of conduct standards.
             * This is the only category that can produce a hard DENY verdict.
             */
            AU_AI_UNDISCLOSED_USE: 'BLOCK',
            /**
             * AU_AI_GOVERNANCE_GAP: No governance framework document on file.
             * REQUIRE_APPROVAL -- G2 compliance requires documented risk assessment
             * and board approval. Operate without it only with explicit human sign-off.
             */
            AU_AI_GOVERNANCE_GAP: 'REQUIRE_APPROVAL',
            /**
             * AU_AI_TESTING_GAP: AI system not tested within last 12 months.
             * WARN -- testing cadence is an operational control, not an absolute
             * prohibition. Warn and log so the gap is visible, but don't block.
             */
            AU_AI_TESTING_GAP: 'WARN',
            /**
             * AU_AI_APPEAL_MISSING: No human appeal or redress mechanism for
             * AI-driven decisions. WARN -- G8 requires redress, but the mechanism
             * may be in progress. Warn to surface the gap; escalate to
             * REQUIRE_APPROVAL once au-mandatory-ai-guardrails becomes operative.
             */
            AU_AI_APPEAL_MISSING: 'WARN',
        },
        encryptionRequired: false,
        encryptionStandard: 'AES-256',
        minimumClassification: 'INTERNAL',
    },
    retentionPolicy: {
        sovereignty: ['AU'],
        auditLogRetentionDays: 1825, // 5 years (governance framework docs, testing records, provenance)
        sessionRetentionDays: 1825,
        incidentRetentionDays: 1825,
        reference: 'AU Voluntary AI Safety Standard: governance framework 5y prior versions; testing records 5y; accountability records 5y',
    },
    incidentPolicy: {
        notificationDeadlineHours: 0, // No mandatory notification; voluntary framework
        reference: 'No mandatory notification. AI incidents engaging au-privacy-act, au-cps234, or au-soci-act trigger those notifications instead. G10 recommends prompt internal escalation.',
        requiredRecipients: [],
        formalNotificationRequired: false,
    },
    validators: [
        {
            id: 'au-aiethics-accountability-defined',
            description: 'Accountable human identified for AI system (G1)',
            reference: 'AU Voluntary AI Safety Standard G1',
            check: 'au_aiethics_accountability_defined_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'au-aiethics-ai-disclosure',
            description: 'AI disclosure presented before AI-driven decisions affecting individuals (G7)',
            reference: 'AU Voluntary AI Safety Standard G7',
            check: 'au_aiethics_ai_disclosure_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'au-aiethics-governance-doc',
            description: 'Governance framework document on file covering risk assessment, approval, oversight (G2)',
            reference: 'AU Voluntary AI Safety Standard G2',
            check: 'au_aiethics_governance_doc_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'au-aiethics-testing-current',
            description: 'AI system tested within last 12 months for accuracy, reliability, robustness, safety (G5)',
            reference: 'AU Voluntary AI Safety Standard G5',
            check: 'au_aiethics_testing_current_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'au-aiethics-redress-mechanism',
            description: 'Human appeal and redress mechanism documented and accessible (G8)',
            reference: 'AU Voluntary AI Safety Standard G8',
            check: 'au_aiethics_redress_mechanism_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'au-aiethics-provenance-docs',
            description: 'Model provenance documentation on file: training data, version history, change management (G6)',
            reference: 'AU Voluntary AI Safety Standard G6',
            check: 'au_aiethics_provenance_docs_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'au-aiethics-human-override',
            description: 'Human override and shutdown capability confirmed for high-risk AI (G4)',
            reference: 'AU Voluntary AI Safety Standard G4',
            check: 'au_aiethics_human_override_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=au-aiethics-framework.js.map