/**
 * Illinois AI Video Interview Act (AIVIA) Compliance Pack
 *
 * Regulation: Illinois Artificial Intelligence Video Interview Act,
 *             820 ILCS 42/1 et seq. (effective January 1, 2020).
 *
 * Jurisdiction: US-IL (Illinois, United States)
 * Regulator: Illinois Department of Labor (IDOL)
 *
 * Alias: EM-01 (Employment AI -- first in employment series)
 *
 * CURRENT STATUS: IN-FORCE STATUTE (since January 1, 2020).
 * Highest urgency employment AI pack -- already enforceable.
 *
 * Scope:
 *   Applies to any employer that uses AI to analyse video interviews of
 *   applicants for positions based in Illinois. "AI analysis" means any
 *   automated or mechanical analysis of an applicant's video interview to
 *   assess qualifications using features such as speech patterns, facial
 *   expressions, or similar characteristics.
 *
 * Key obligations:
 *   1. Notice: Employer must notify applicant before interview that AI
 *      may be used to analyze video and assess qualifications.
 *   2. Consent: Employer must obtain consent before AI analysis begins.
 *   3. Disclosure: Employer must explain the general types of
 *      characteristics the AI uses to evaluate applicants upon request.
 *   4. Video retention: Interview recordings must be destroyed within
 *      30 days after the applicant requests deletion, or within 30 days
 *      of the employer's decision not to proceed with the applicant --
 *      whichever is earlier. Default: retain no longer than necessary.
 *   5. Third parties: Employers that share videos with third-party AI
 *      vendors must obtain consent and ensure vendors destroy recordings
 *      within the 30-day window.
 *   6. Annual reporting: Employers using AI to analyze video interviews
 *      must report the race and ethnicity of applicants interviewed and
 *      those who proceeded to subsequent rounds to the Illinois
 *      Department of Labor annually (for disparate impact analysis).
 *
 * Enforcement:
 *   - IDOL may investigate complaints.
 *   - Civil penalties for violations (per-violation fines).
 *   - Applicants have a private right of action.
 *
 * @connexum/ai-governance
 */
/**
 * Illinois AIVIA category classifiers.
 */
export const ILLINOIS_AIVIA_CATEGORY_CLASSIFIERS = {
    VIDEO_INTERVIEW_RECORDING: {
        references: ['820 ILCS 42/10 -- definitions: AI analysis of video interview'],
        classifier: (input) => {
            if (/\b(?:video\s+interview|recorded\s+interview|async(?:hronous)?\s+interview|one.way\s+video|interview\s+recording)\b/i.test(input))
                return true;
            if (/\b(?:video\s+(?:file|clip|upload)|interview\s+(?:video|footage|recording))\b/i.test(input))
                return true;
            return false;
        },
    },
    AI_ANALYSIS_OF_CANDIDATE: {
        references: ['820 ILCS 42/10 -- AI analysis: automated analysis using speech patterns, facial expressions, characteristics'],
        classifier: (input) => {
            if (/\b(?:AI\s+analysis|automated\s+scoring|algorithmic\s+assessment|facial\s+expression\s+analysis|speech\s+pattern\s+analysis)\b/i.test(input))
                return true;
            if (/\b(?:candidate\s+(?:score|rating|rank|assessment|evaluation)\s+by\s+AI|AI.(?:generated|driven|scored)\s+(?:score|rating))\b/i.test(input))
                return true;
            if (/\b(?:emotion\s+recognition|sentiment\s+detection\s+interview|personality\s+AI\s+hiring)\b/i.test(input))
                return true;
            return false;
        },
    },
    CANDIDATE_CONSENT_RECORD: {
        references: ['820 ILCS 42/15(a)(1) -- notification; 820 ILCS 42/15(a)(2) -- consent requirement'],
        classifier: (input) => {
            if (/\b(?:candidate\s+consent|applicant\s+consent|consent\s+to\s+AI\s+analysis|interview\s+consent\s+form)\b/i.test(input))
                return true;
            if (/\b(?:consent\s+(?:record|log|signature|acknowledgement)\s+(?:video|interview|AI))\b/i.test(input))
                return true;
            return false;
        },
    },
    VIDEO_DELETION_RECORD: {
        references: ['820 ILCS 42/25 -- destruction of video: 30 days after request or decision; third-party deletion obligation'],
        classifier: (input) => {
            if (/\b(?:video\s+deletion|interview\s+(?:deletion|destruction|purge)|30.day\s+deletion|AIVIA\s+deletion)\b/i.test(input))
                return true;
            if (/\b(?:delete\s+(?:video|recording|interview)\s+(?:request|30\s*days?)|video\s+purge\s+record)\b/i.test(input))
                return true;
            return false;
        },
    },
    DEMOGRAPHIC_REPORTING_DATA: {
        references: ['820 ILCS 42/30 -- annual racial and ethnic demographic reporting to Illinois Department of Labor'],
        classifier: (input) => {
            if (/\b(?:race|ethnicity|racial|ethnic)\s+(?:data|breakdown|composition|distribution)\s+(?:applicant|interview|hiring)\b/i.test(input))
                return true;
            if (/\b(?:AIVIA\s+(?:report|demographic)|annual\s+hiring\s+report\s+Illinois|IDOL\s+AI\s+report)\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['820 ILCS 42/5 -- legislative findings; applicant personal data in hiring context'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            if (/\b(?:applicant|candidate)\s+(?:name|email|phone|address)/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['820 ILCS 42 -- system security for video interview data'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const ILLINOIS_AIVIA_PACK = {
    categoryClassifiers: ILLINOIS_AIVIA_CATEGORY_CLASSIFIERS,
    id: 'illinois-aivia',
    aliases: ['EM-01'],
    name: 'Illinois AI Video Interview Act (AIVIA)',
    version: '1.0.0',
    description: 'Illinois Artificial Intelligence Video Interview Act (820 ILCS 42 et seq.), effective January 1, 2020 -- the first US in-force statute regulating AI use in employment video interviews. Requires: pre-interview notice to applicants; written or electronic consent before AI analysis; disclosure of AI characteristics used upon request; 30-day video deletion window after candidate request or employer decision; annual race/ethnicity demographic reporting to the Illinois Department of Labor for disparate impact analysis. CURRENT IN-FORCE STATUTE -- highest urgency employment AI pack. Enforced by IDOL; private right of action for applicants.',
    authority: 'Illinois Department of Labor (IDOL)',
    industries: ['hr-employment', 'recruiting', 'staffing', 'technology', 'enterprise-hr', 'ats-vendors'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Enforce pre-interview notice delivery and consent collection gate before any AI analysis of video interview data; block AI analysis without prior consent',
            reference: '820 ILCS 42/15(a)(1) -- notification before AI use; 820 ILCS 42/15(a)(2) -- consent required before AI analysis begins',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Classify video interview recordings, AI analysis outputs, candidate consent records, and video deletion records for appropriate handling and retention enforcement',
            reference: '820 ILCS 42/10 -- definitions of AI analysis and video interview; 820 ILCS 42/25 -- destruction obligations',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident log of consent collection, AI analysis events, video deletion actions, and annual demographic report submissions; required for IDOL investigation defence',
            reference: '820 ILCS 42/15 -- consent and notice obligations; 820 ILCS 42/25 -- destruction of recordings; 820 ILCS 42/30 -- annual reporting',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Access control for video interview recordings and AI analysis outputs; candidate data access limited to authorised recruiting personnel',
            reference: '820 ILCS 42 -- implicit security obligations for biometric and sensitive candidate data',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Human-in-the-loop gate for AI analysis decisions; AI analysis BLOCKED unless consent flag confirmed; video deletion request escalation workflow',
            reference: '820 ILCS 42/15(a)(2) -- consent as prerequisite for AI analysis; 820 ILCS 42/25 -- deletion on request within 30 days',
        },
        {
            name: 'event-bus',
            required: true,
            reason: '30-day deletion clock management: triggered on candidate deletion request or employer no-proceed decision; annual IDOL demographic report deadline tracking',
            reference: '820 ILCS 42/25 -- destruction within 30 days of request or no-proceed decision; 820 ILCS 42/30 -- annual demographic report to IDOL',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Third-party AI vendor contractual obligations: vendors must also destroy recordings within 30 days; employer retains responsibility for vendor compliance',
            reference: '820 ILCS 42/20 -- third-party destruction obligation; employer responsibility for vendor compliance with AIVIA',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Consent record continuity; video deletion request state tracking across sessions; annual demographic report accumulation',
            reference: '820 ILCS 42/15 -- consent records; 820 ILCS 42/25 -- 30-day deletion clock state; 820 ILCS 42/30 -- annual report data accumulation',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Annual demographic report documentation to IDOL; consent record archival; video deletion confirmation records',
            reference: '820 ILCS 42/30 -- annual race/ethnicity reporting to Illinois Department of Labor; 820 ILCS 42/25 -- destruction records',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Pre-interview notice delivery to applicants; AI characteristics disclosure on request; consent form presentation before AI analysis',
            reference: '820 ILCS 42/15(a)(1) -- notification obligation; 820 ILCS 42/15(a)(3) -- disclosure of characteristics used by AI on request',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            preInterviewNoticeRequired: true,
            aiAnalysisBlockedWithoutConsent: true,
            aiVideoAnalysisDisclosureRequired: true,
        },
        'data-classifier': {
            enabledCategories: ['VIDEO_INTERVIEW_RECORDING', 'AI_ANALYSIS_OF_CANDIDATE', 'CANDIDATE_CONSENT_RECORD', 'VIDEO_DELETION_RECORD', 'DEMOGRAPHIC_REPORTING_DATA', 'PII', 'CREDENTIALS'],
            aiAnalysisWithoutConsentAction: 'BLOCK',
            videoInterviewRecordingAction: 'WARN',
            credentialsAction: 'BLOCK',
        },
        'approval-queue': {
            aiAnalysisConsentGateRequired: true,
            videoDeletionRequestEscalationRequired: true,
        },
        'event-bus': {
            videoDeletion30DayClockActive: true,
            annualIdolDemographicReportDeadlineTracked: true,
        },
        'supply-chain': {
            thirdPartyAiVendorDeletionObligationRequired: true,
            vendorDeletionConfirmationRequired: true,
        },
        'attestation-manager': {
            annualDemographicReportToIdolRequired: true,
            consentRecordArchivalRequired: true,
            videoDeletionConfirmationRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['DATA-RESIDENCY-US', 'CANDIDATE-CONSENT-GATE', 'VIDEO-DELETION-SUPPORT'],
        blockReasons: {
            deepseek: 'PRC National Intelligence Law creates candidate biometric data custody risk incompatible with Illinois AIVIA §820 ILCS 42/20 employer responsibility for vendor destruction obligations.',
            baidu: 'PRC jurisdiction incompatible with employer obligation to ensure third-party vendors destroy video recordings within 30 days per 820 ILCS 42/20.',
            alibaba: 'PRC jurisdiction incompatible with employer obligation to ensure third-party vendors destroy video recordings within 30 days per 820 ILCS 42/20.',
        },
    },
    dataPolicy: {
        scanCategories: ['VIDEO_INTERVIEW_RECORDING', 'AI_ANALYSIS_OF_CANDIDATE', 'CANDIDATE_CONSENT_RECORD', 'VIDEO_DELETION_RECORD', 'DEMOGRAPHIC_REPORTING_DATA', 'PII', 'CREDENTIALS'],
        categoryActions: {
            VIDEO_INTERVIEW_RECORDING: 'WARN',
            AI_ANALYSIS_OF_CANDIDATE: 'WARN',
            CANDIDATE_CONSENT_RECORD: 'WARN',
            VIDEO_DELETION_RECORD: 'WARN',
            DEMOGRAPHIC_REPORTING_DATA: 'WARN',
            PII: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        // Video recordings: no longer than necessary; 30 days after deletion request or no-proceed decision.
        // Consent records and annual demographic reports: retain for duration of employment record + applicable limitation period.
        // Using 365 days as conservative default for audit logs; video deletion is managed by 30-day clock.
        auditLogRetentionDays: 365, // 1 year for consent and analysis logs
        sessionRetentionDays: 30, // Video recordings: 30-day maximum after triggering event
        incidentRetentionDays: 1825, // 5 years for complaint/incident records
        reference: '820 ILCS 42/25 -- destruction of video within 30 days of request or no-proceed decision; 820 ILCS 42/30 -- annual report records; Illinois 5-year civil statute of limitations for employment claims (735 ILCS 5/13-205)',
        forceDelete: true, // Videos MUST be deleted after 30-day trigger
        requiresLegalHoldSupport: true,
        sovereignty: ['us-il', 'us'],
    },
    incidentPolicy: {
        // IDOL complaint investigation is not time-bound by a statutory breach notification deadline.
        // Using 720 hours (30 days) as the primary incident reporting clock consistent with video deletion obligation.
        notificationDeadlineHours: 720, // 30 days (aligns with video deletion and IDOL complaint response)
        reference: '820 ILCS 42/25 -- 30-day video destruction obligation (also serves as incident-response anchor); IDOL complaint investigation procedures; 820 ILCS 42/35 -- enforcement provisions',
        requiredRecipients: ['chief-compliance-officer', 'hr-legal-counsel', 'idol-complaint-response-unit'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'aivia-pre-interview-notice',
            description: 'Pre-interview notice delivered to applicant before AI video analysis begins; disclosure of AI analysis characteristics available on request',
            reference: '820 ILCS 42/15(a)(1) -- notification before AI use; 820 ILCS 42/15(a)(3) -- characteristics disclosure on request',
            check: 'transparency_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'aivia-consent-gate',
            description: 'Candidate consent collected and confirmed before AI analysis of video interview; AI analysis BLOCKED without consent flag',
            reference: '820 ILCS 42/15(a)(2) -- consent required before AI analysis; consent must be in writing or electronic',
            check: 'gdpr_lawful_basis_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'aivia-video-deletion-30day',
            description: '30-day video deletion clock active; triggered on candidate deletion request or employer no-proceed decision; third-party vendors notified for deletion',
            reference: '820 ILCS 42/25 -- destruction within 30 days of request or no-proceed decision; 820 ILCS 42/20 -- third-party destruction obligation',
            check: 'event_clock_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'aivia-consent-record-audit',
            description: 'Tamper-evident audit log of consent collection, AI analysis events, and video deletion confirmations',
            reference: '820 ILCS 42/15 -- consent obligations; 820 ILCS 42/25 -- destruction records; IDOL investigation defence requirements',
            check: 'audit_trail_exists',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'aivia-annual-demographic-report',
            description: 'Annual race/ethnicity demographic report compiled and submitted to Illinois Department of Labor',
            reference: '820 ILCS 42/30 -- annual reporting of applicant race and ethnicity to IDOL for disparate impact analysis',
            check: 'finra_annual_certification_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'aivia-data-classifier',
            description: 'Video interview recordings, AI analysis outputs, and consent records classified and subject to 30-day deletion enforcement',
            reference: '820 ILCS 42/10 -- definitions; 820 ILCS 42/25 -- destruction obligations',
            check: 'data_classifier_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'aivia-third-party-vendor-compliance',
            description: 'Third-party AI video analysis vendors contractually obligated to destroy recordings within 30-day window',
            reference: '820 ILCS 42/20 -- employer responsibility for third-party vendor destruction',
            check: 'subservice_registry_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'aivia-access-control',
            description: 'Video interview recordings and AI analysis data access limited to authorised personnel',
            reference: '820 ILCS 42 -- implicit security obligation for sensitive candidate biometric data',
            check: 'rbac_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'aivia-encryption',
            description: 'Video interview recordings and AI analysis outputs encrypted at rest and in transit',
            reference: '820 ILCS 42 -- security obligations for candidate personal data in AI employment screening',
            check: 'encryption_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'aivia-human-review-gate',
            description: 'Human review gate active for AI analysis hiring decisions; applicants not solely evaluated by AI',
            reference: '820 ILCS 42/15 -- employer obligations; AIVIA does not prohibit AI use but requires oversight and consent',
            check: 'gdpr_article22_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=illinois-aivia.js.map