"use strict";
/**
 * Utah Artificial Intelligence Policy Act Compliance Pack
 *
 * Regulation: Utah AI Policy Act (SB 149, 2024)
 *             Utah Code §13-72-101 et seq. (Artificial Intelligence Policy Act)
 *
 * Jurisdiction: US-UT (Utah)
 * Regulator: Utah Division of Consumer Protection + Office of Artificial Intelligence Policy
 *             (established by the Act -- Utah Code §63C-27)
 *
 * Effective date: 1 May 2024
 *
 * Scope:
 *   Applies to persons (natural or legal) that use generative AI in interactions
 *   with consumers, and to regulated occupations where AI is used to provide
 *   professional services.
 *
 * Key obligations:
 *   1. Generative AI disclosure when asked (consumer interactions):
 *      If a consumer asks whether they are interacting with a human or an AI,
 *      the deployer MUST disclose that the consumer is interacting with generative AI.
 *   2. Generative AI disclosure mandatory (regulated occupations):
 *      Professionals in regulated occupations (medical, legal, mental health,
 *      financial, etc.) MUST affirmatively disclose AI use BEFORE providing
 *      AI-assisted professional services -- do not wait to be asked.
 *   3. Liability attribution: using AI does not relieve a company of its
 *      legal duties, professional obligations, or liability under existing law.
 *   4. Office of AI Policy Learning Lab: entities may apply for regulatory
 *      sandbox participation; pack tracks Learning Lab participation records
 *      and coordination evidence.
 *
 * Regulated occupation list (affirmative disclosure required):
 *   Medical and health care providers; attorneys and legal professionals;
 *   mental health professionals; financial advisors; accountants; engineers;
 *   architects; real estate professionals; any other state-licensed occupation.
 *   Pack must classify deployment by occupation type to determine disclosure tier.
 *
 * Retention:
 *   AI interaction records per general Utah business records retention.
 *   AI Learning Lab participation records per agreement with Office of AI Policy.
 *
 * Incident:
 *   Consumer harm from undisclosed AI: Utah Division of Consumer Protection
 *   complaint and enforcement action.
 *   Regulated occupation breach: professional licensing board referral.
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.UTAH_AI_POLICY_PACK = exports.UTAH_AI_POLICY_CATEGORY_CLASSIFIERS = void 0;
exports.UTAH_AI_POLICY_CATEGORY_CLASSIFIERS = {
    GENERATIVE_AI_OUTPUT_DISCLOSURE: {
        references: ['Utah Code §13-72-201 -- disclosure when asked; §13-72-202 -- affirmative disclosure for regulated occupations'],
        classifier: (input) => {
            if (/\b(?:generative\s+ai\s+disclosure\s+utah|utah\s+ai\s+disclosure|sb\s*149\s+disclosure|utah\s+ai\s+policy\s+act\s+disclosure)\b/i.test(input))
                return true;
            if (/\b(?:ai\s+disclosure\s+utah\s+consumer|utah\s+§13.72\s+disclosure|utah\s+ai\s+interaction\s+disclosure|utah\s+gen\s+ai\s+output)\b/i.test(input))
                return true;
            return false;
        },
    },
    AI_CONSUMER_INTERACTION_RECORD: {
        references: ['Utah Code §13-72-201 -- consumer interaction disclosure obligation; Utah Code §63C-27 -- Office of AI Policy coordination'],
        classifier: (input) => {
            if (/\b(?:utah\s+ai\s+consumer\s+interaction|utah\s+ai\s+chatbot\s+disclosure|utah\s+consumer\s+ai\s+record|utah\s+ai\s+policy\s+consumer)\b/i.test(input))
                return true;
            if (/\b(?:sb149\s+consumer\s+interaction|utah\s+artificial\s+intelligence\s+consumer|utah\s+ai\s+user\s+interaction\s+log)\b/i.test(input))
                return true;
            return false;
        },
    },
    REGULATED_OCCUPATION_AI_USE: {
        references: ['Utah Code §13-72-202 -- affirmative disclosure for regulated occupations; Utah Division of Consumer Protection enforcement'],
        classifier: (input) => {
            if (/\b(?:regulated\s+occupation\s+ai\s+utah|utah\s+professional\s+ai\s+disclosure|utah\s+licensed\s+professional\s+ai)\b/i.test(input))
                return true;
            if (/\b(?:utah\s+medical\s+ai|utah\s+legal\s+ai\s+disclosure|utah\s+mental\s+health\s+ai|utah\s+financial\s+advisor\s+ai|utah\s+attorney\s+ai\s+disclosure)\b/i.test(input))
                return true;
            if (/\b(?:utah\s+regulated\s+occupation\s+ai|utah\s+regulated\s+profession\s+ai|utah\s+ai\s+professional\s+services|sb149\s+regulated\s+occupation|utah\s+licensed\s+occupation\s+ai)\b/i.test(input))
                return true;
            return false;
        },
    },
    AI_LEARNING_LAB_RECORD: {
        references: ['Utah Code §63C-27 -- Office of Artificial Intelligence Policy; Learning Lab regulatory sandbox provisions'],
        classifier: (input) => {
            if (/\b(?:utah\s+ai\s+learning\s+lab|utah\s+office\s+of\s+ai\s+policy|utah\s+ai\s+sandbox|sb149\s+learning\s+lab)\b/i.test(input))
                return true;
            if (/\b(?:utah\s+regulatory\s+sandbox\s+ai|office\s+of\s+artificial\s+intelligence\s+policy\s+utah|utah\s+ai\s+policy\s+lab)\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['Utah Consumer Privacy Act (UCPA) -- personal data; general Utah privacy obligations for AI interaction data'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            if (/\b(?:ssn|social\s+security|driver.s\s+license\s+number|utah\s+id\s+number)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['Utah security breach notification law (Utah Code §13-44) -- data security obligations'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
exports.UTAH_AI_POLICY_PACK = {
    categoryClassifiers: exports.UTAH_AI_POLICY_CATEGORY_CLASSIFIERS,
    id: 'utah-ai-policy',
    aliases: [],
    name: 'Utah AI Policy Act (SB 149, 2024)',
    version: '1.0.0',
    contentHash: '2fa07e825f838eb2995fbfdebf43dabe7c7e5374d5b37a66a72f4dd237a8e811',
    description: 'Utah Artificial Intelligence Policy Act (SB 149, 2024 -- Utah Code §13-72). Requires: (1) disclosure when asked -- any generative AI consumer interaction must disclose AI nature if consumer asks; (2) affirmative disclosure for regulated occupations -- medical, legal, mental health, financial, and other licensed professionals must proactively disclose AI use before providing AI-assisted services (do not wait to be asked); (3) liability attribution -- AI use does not relieve firms of existing legal duties; (4) Office of AI Policy Learning Lab participation tracking (regulatory sandbox). Effective 1 May 2024. Enforced by Utah Division of Consumer Protection + professional licensing boards.',
    authority: 'Utah Division of Consumer Protection + Utah Office of Artificial Intelligence Policy (Utah Code §63C-27)',
    industries: ['healthcare', 'legal', 'financial-services', 'mental-health', 'technology', 'real-estate', 'insurance'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Enforce occupation-type classification gate: classify AI deployment by regulated occupation to determine disclosure tier (ask-only vs. affirmative); liability attribution tracking ensuring AI use does not waive existing legal duties.',
            reference: 'Utah Code §13-72-201 -- disclosure when asked; §13-72-202 -- affirmative disclosure for regulated occupations; §13-72-301 -- liability attribution',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Inject generative AI disclosure into consumer interactions: (1) when-asked disclosure response for general consumer interactions; (2) affirmative disclosure before regulated occupation professional services using AI.',
            reference: 'Utah Code §13-72-201 -- generative AI disclosure when asked; §13-72-202 -- affirmative disclosure for regulated professions prior to AI-assisted service delivery',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Classify AI consumer interaction records, regulated occupation AI use records, and Learning Lab participation records; detect PII in AI-generated outputs for compliance logging.',
            reference: 'Utah Code §13-72 -- AI interaction record classification; UCPA -- personal data in AI interaction contexts; Office of AI Policy Learning Lab record classification',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit trail for AI disclosure events, regulated occupation deployment records, and Learning Lab participation agreements; required for Division of Consumer Protection enforcement defense and licensing board review.',
            reference: 'Utah Code §13-72 -- accountability for disclosure compliance; Utah Division of Consumer Protection enforcement documentation; professional licensing board audit requirements',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Regulated occupation deployment classification register; Learning Lab participation agreement documentation; disclosure compliance attestation; liability attribution policy documentation.',
            reference: 'Utah Code §13-72-202 -- regulated occupation classification documentation; §63C-27 -- Learning Lab participation records; §13-72-301 -- liability attribution evidence',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'AI consumer interaction records persisted for Division of Consumer Protection enforcement defense; regulated occupation AI use logs persisted for licensing board review; Learning Lab participation records per agreement.',
            reference: 'Utah Code §13-72 -- AI interaction record retention; Division of Consumer Protection enforcement investigation support; professional licensing board record requirements',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Human review gate before AI deployment in regulated occupations: ensure affirmative disclosure mechanism is in place and occupation classification is correct before go-live; Learning Lab application review workflow.',
            reference: 'Utah Code §13-72-202 -- pre-deployment disclosure configuration for regulated occupations; §63C-27 -- Learning Lab application review; Utah Division of Consumer Protection authorization workflows',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Consumer harm event detection: trigger Division of Consumer Protection complaint workflow for undisclosed AI interactions; licensing board referral event for regulated occupation disclosure failures.',
            reference: 'Utah Code §13-72 -- consumer harm from undisclosed AI: Division of Consumer Protection enforcement; professional licensing board complaint triggering events',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'AI consumer interaction records and regulated occupation AI use records containing PII encrypted at rest and in transit per Utah security breach notification law (Utah Code §13-44).',
            reference: 'Utah Code §13-44 -- security breach notification (personal data security obligation); general Utah data security requirements for consumer interaction records',
        },
        {
            name: 'bias-monitor',
            required: true,
            reason: 'Monitor AI outputs in regulated occupation contexts for disparate treatment or biased recommendations that could constitute professional liability; fairness monitoring in high-stakes AI-assisted professional services.',
            reference: 'Utah Code §13-72-301 -- liability attribution: existing professional duties apply to AI-assisted services; regulated occupation professional conduct standards apply to AI outputs',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            regulatedOccupationClassificationRequired: true,
            liabilityAttributionTrackingRequired: true,
            aiDisclosureTierDetermination: true,
        },
        'transparency-injector': {
            generativeAiDisclosureWhenAskedRequired: true,
            regulatedOccupationAffirmativeDisclosureRequired: true,
            aiUseClientDisclosureRequired: true,
        },
        'attestation-manager': {
            regulatedOccupationRegisterRequired: true,
            learningLabParticipationRecordsRequired: true,
            disclosureComplianceAttestationRequired: true,
        },
        'event-bus': {
            consumerHarmEventDetectionRequired: true,
            licensingBoardReferralWorkflowRequired: true,
            divisionOfConsumerProtectionEscalationRequired: true,
        },
        'session-persistence': {
            aiInteractionRecordRetentionRequired: true,
            regulatedOccupationAiUseLogRequired: true,
            storageLimitationEnforced: true,
        },
        'approval-queue': {
            regulatedOccupationDeploymentReviewRequired: true,
            disclosureMechanismVerificationRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['DATA-RESIDENCY-US', 'PROCESSOR-CONTRACT', 'GENERATIVE-AI-DISCLOSURE-SUPPORT'],
        blockReasons: {
            deepseek: 'PRC National Intelligence Law creates risk for Utah consumer interaction data; Utah AI Policy Act liability attribution obligations incompatible with PRC government access obligations.',
            baidu: 'PRC jurisdiction. Transfer of Utah consumer AI interaction data to PRC creates significant compliance risk under Utah AI Policy Act and Utah Consumer Privacy Act.',
            alibaba: 'PRC jurisdiction. Transfer of Utah consumer AI interaction records and regulated occupation AI use data to PRC creates compliance risk for Utah AI Policy Act liability obligations.',
        },
    },
    dataPolicy: {
        scanCategories: ['GENERATIVE_AI_OUTPUT_DISCLOSURE', 'AI_CONSUMER_INTERACTION_RECORD', 'REGULATED_OCCUPATION_AI_USE', 'AI_LEARNING_LAB_RECORD', 'PII', 'CREDENTIALS'],
        categoryActions: {
            GENERATIVE_AI_OUTPUT_DISCLOSURE: 'WARN',
            AI_CONSUMER_INTERACTION_RECORD: 'WARN',
            REGULATED_OCCUPATION_AI_USE: 'WARN',
            AI_LEARNING_LAB_RECORD: 'WARN',
            PII: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'INTERNAL',
    },
    retentionPolicy: {
        // AI interaction records: per general Utah business retention (no specific statute period).
        // Learning Lab: per agreement with Office of AI Policy.
        // Using 3 years as reasonable consumer rights and enforcement defense period.
        auditLogRetentionDays: 1095, // 3 years
        sessionRetentionDays: 1095,
        incidentRetentionDays: 1095,
        reference: 'Utah Code §13-72 -- AI interaction record retention (no specific period; general Utah business records standard); Utah Code §63C-27 -- Learning Lab participation records per agreement; Utah Code §13-44 -- security breach incident records',
        forceDelete: false,
        requiresLegalHoldSupport: false,
        sovereignty: ['us'],
    },
    incidentPolicy: {
        // Consumer harm from undisclosed AI: Division of Consumer Protection complaint.
        // No statutory incident deadline in the Act; using 72 hours as operational standard.
        notificationDeadlineHours: 72,
        reference: 'Utah Code §13-72 -- consumer harm from undisclosed AI interaction; Utah Division of Consumer Protection complaint procedures; regulated occupation breach: professional licensing board referral; Utah Code §13-44 -- data breach notification obligations',
        requiredRecipients: ['utah-division-consumer-protection', 'professional-licensing-board', 'chief-compliance-officer', 'chief-ai-officer'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'utah-ai-disclosure-when-asked',
            description: 'Utah AI Policy Act disclosure when asked: generative AI consumer interactions configured to disclose AI nature immediately when any consumer asks whether they are interacting with a human or AI',
            reference: 'Utah Code §13-72-201 -- disclosure obligation when consumer asks about AI interaction nature; effective 1 May 2024',
            check: 'transparency_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'utah-ai-regulated-occupation-affirmative-disclosure',
            description: 'Regulated occupation affirmative disclosure gate active: AI deployments in medical, legal, mental health, financial, and other licensed professional contexts configured for pre-service affirmative disclosure before AI-assisted delivery',
            reference: 'Utah Code §13-72-202 -- affirmative disclosure required before AI-assisted professional service delivery in regulated occupations; does not wait for consumer to ask',
            check: 'governance_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'utah-ai-occupation-classification',
            description: 'Regulated occupation classification register maintained: each AI deployment classified by occupation type to determine correct disclosure tier (ask-only vs. affirmative)',
            reference: 'Utah Code §13-72-202 -- regulated occupation list; §13-72-201 -- general consumer interaction disclosure; occupation classification determines disclosure obligation',
            check: 'attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'utah-ai-consumer-interaction-audit',
            description: 'AI consumer interaction records maintained with disclosure event timestamps; audit trail supports Division of Consumer Protection enforcement defense',
            reference: 'Utah Code §13-72 -- accountability for AI disclosure compliance; Utah Division of Consumer Protection enforcement investigation support',
            check: 'audit_trail_exists',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'utah-ai-liability-attribution',
            description: 'Liability attribution policy active: existing legal duties, professional obligations, and liability standards apply to AI-assisted services; AI use does not waive or reduce firm liability',
            reference: 'Utah Code §13-72-301 -- liability attribution: AI use does not relieve person of obligations under existing law; professional conduct standards apply',
            check: 'approval_queue_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'utah-ai-data-classifier',
            description: 'AI consumer interaction records, regulated occupation AI use data, and Learning Lab participation records classified and logged for compliance monitoring',
            reference: 'Utah Code §13-72 -- AI interaction data classification; Office of AI Policy Learning Lab record requirements (§63C-27)',
            check: 'data_classifier_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'utah-ai-consumer-harm-monitoring',
            description: 'Consumer harm monitoring active: undisclosed AI interaction detection triggers Division of Consumer Protection complaint workflow; regulated occupation disclosure failure triggers licensing board referral',
            reference: 'Utah Code §13-72 -- enforcement by Division of Consumer Protection; professional licensing board referral for regulated occupation disclosure failures',
            check: 'monitoring_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'utah-ai-learning-lab-coordination',
            description: 'Office of AI Policy Learning Lab participation records maintained per agreement terms; Learning Lab coordination evidence available for regulatory sandbox compliance review',
            reference: 'Utah Code §63C-27 -- Office of Artificial Intelligence Policy; Learning Lab regulatory sandbox; participation agreement record-keeping requirements',
            check: 'subservice_registry_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'utah-ai-encryption',
            description: 'Utah consumer AI interaction records and regulated occupation AI use logs containing PII encrypted at rest and in transit per Utah security breach notification law',
            reference: 'Utah Code §13-44 -- data security obligations; Utah AI Policy Act -- data security for AI interaction records',
            check: 'encryption_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'utah-ai-bias-monitor',
            description: 'AI output fairness monitoring active in regulated occupation contexts: disparate treatment detection for professional services; bias monitor supports liability attribution compliance',
            reference: 'Utah Code §13-72-301 -- existing professional conduct standards apply to AI-assisted services; anti-discrimination obligations applicable to AI-assisted professional services in Utah',
            check: 'bias_monitor_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=utah-ai-policy.js.map