"use strict";
/**
 * EU AI Act Annex IV Technical Documentation Template
 *
 * Annex IV of Regulation (EU) 2024/1689 (AI Act) mandates technical
 * documentation for high-risk AI systems under Article 11. Deployers of
 * high-risk AI systems must maintain documentation demonstrating conformity.
 *
 * Art. 50 disclosure is non-optional for every AI-generated section:
 * the rendered report carries a visible AI-authorship declaration
 * because the report itself is partially AI-generated (ironic, but required).
 *
 * Regulatory references:
 *   Regulation (EU) 2024/1689, Article 11 -- Technical documentation
 *   Regulation (EU) 2024/1689, Annex IV -- Technical documentation content
 *   Regulation (EU) 2024/1689, Article 50 -- Transparency obligations for AI systems
 *   Regulation (EU) 2024/1689, Article 13 -- Transparency and provision of information
 *   Regulation (EU) 2024/1689, Article 14 -- Human oversight
 *   Regulation (EU) 2024/1689, Article 17 -- Quality management system
 *   Recital 49 -- Deployer obligations for high-risk AI systems
 *
 * Required audit event types:
 *   agent:registered -- AI system registration in the governance registry
 *   policy:snapshot  -- policy version captured in the tamper-evident chain
 *   governance:verdict -- runtime governance decisions
 *
 * Spec: P4-AIR-02 item 4
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.EU_AI_ACT_ANNEX_IV_TEMPLATE = exports.ART50_DISCLOSURE = void 0;
/**
 * Art. 50 disclosure block appended to every AI-generated section.
 * This is non-optional per the spec and must survive into the rendered
 * artefact even if the operator attempts to suppress it.
 */
exports.ART50_DISCLOSURE = `
[AI-GENERATED SECTION -- EU AI Act Art. 50 Disclosure]
This section was generated by an AI system. The generating model, prompt
template hash, and audit-chain provenance reference are recorded in the
report provenance block at the beginning of this document. Human review of
AI-generated sections is required before submission to a conformity assessment
body or notified body.
`.trim();
const CITATION_INSTRUCTION = `
MANDATORY CITATION RULES: Every factual claim MUST immediately reference the
audit-chain event ID in square brackets, e.g. [EVT-abc123]. You may ONLY cite
event IDs from the AVAILABLE EVENTS list. If evidence is absent, write
"Evidence not available in the audit window; deployer must supplement with
direct technical documentation per Annex IV." Never invent event IDs.

Additionally, append the following disclosure at the end of every section you
generate:
${exports.ART50_DISCLOSURE}
`.trim();
exports.EU_AI_ACT_ANNEX_IV_TEMPLATE = {
    templateId: 'tpl-eu-ai-act-annex-iv-v1',
    name: 'EU AI Act Annex IV Technical Documentation',
    framework: 'eu-ai-act',
    requiredAuditEventTypes: [
        'agent:registered',
        'policy:snapshot',
        'governance:verdict',
    ],
    artefactFormat: 'pdf',
    legalReviewRequired: true,
    sections: [
        {
            id: 'euai-annex-iv-1-general-description',
            title: 'Annex IV §1: General Description of the AI System',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting Annex IV §1 (General Description) for EU AI Act technical
documentation under Article 11 and Annex IV of Regulation (EU) 2024/1689.

Annex IV §1 requires:
  (a) Intended purpose, including the persons, groups, or categories of persons
      on whom the AI system is intended to be used
  (b) The category of high-risk AI system per Annex III
  (c) Version of the AI system
  (d) Interaction with hardware or software not part of the AI system itself

Using ONLY the audit-chain events provided, describe:
1. The AI agent(s) registered in the governance system during the reporting
   period -- cite each agent:registered event with its timestamp, agent name,
   and declared purpose.
2. The operational category and intended use case for each registered agent.
3. Interactions with external LLM providers as evidenced by governance verdicts.
4. Changes in the AI system population during the period (new registrations,
   decommissions).

${CITATION_INSTRUCTION}

Write 3-5 formal paragraphs suitable for submission to a conformity assessment body.
`.trim(),
        },
        {
            id: 'euai-annex-iv-2-development-process',
            title: 'Annex IV §2: Development Process Description',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting Annex IV §2 (Development Process) for EU AI Act technical
documentation.

Annex IV §2 requires documentation of:
  (a) Development methods and design choices including mathematical methods
  (b) System architecture and computational resources
  (c) Data governance and examination procedures
  (d) Pre-determined changes to the system

Using ONLY the audit-chain events provided, describe:
1. Policy versioning evidence: policy:snapshot events that demonstrate a
   version-controlled governance policy was in place.
2. How governance policies are structured, versioned, and applied to AI agents.
3. Evidence that policy changes followed a documented change process with
   human review (cite approval events).
4. The governance runtime architecture as evidenced by the types of enforcement
   events present in the chain.

${CITATION_INSTRUCTION}

Write 3-5 formal paragraphs.
`.trim(),
        },
        {
            id: 'euai-annex-iv-3-monitoring-functioning',
            title: 'Annex IV §3: Monitoring, Functioning, and Controls (Art. 14)',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting Annex IV §3 (Monitoring and Controls) for EU AI Act technical
documentation, addressing Article 14 (Human Oversight) and Annex IV §3.

Article 14 requires high-risk AI systems to be designed to allow natural persons
to effectively oversee and intervene during the period of use, including the
ability to stop the system.

Using ONLY the audit-chain events provided, describe:
1. Human-in-the-loop controls: approval events where humans intervened in AI
   agent operations -- cite each with timestamp and outcome.
2. Circuit-breaker and suspension mechanisms: evidence that the system can be
   stopped by an authorised human.
3. Monitoring controls: anomaly detection events and how they triggered human
   review.
4. Metrics on human oversight engagement during the review period (approval
   rate, response times, escalation counts).

${CITATION_INSTRUCTION}

Write 3-5 formal paragraphs.
`.trim(),
        },
        {
            id: 'euai-annex-iv-4-risk-management',
            title: 'Annex IV §4: Risk Management System (Art. 9)',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting Annex IV §4 (Risk Management) for EU AI Act technical
documentation, addressing Article 9 of Regulation (EU) 2024/1689.

Article 9 requires providers of high-risk AI systems to establish and maintain
a risk management system throughout the lifecycle. The system must:
  (a) Identify and analyse known and reasonably foreseeable risks
  (b) Estimate and evaluate risks that may emerge from use
  (c) Evaluate risks based on post-market monitoring data

Using ONLY the audit-chain events provided, describe:
1. Known risks identified and governed by the compliance packs active during
   the period.
2. Risk events observed (governance verdicts, anomalies, policy violations)
   and their frequency and severity.
3. Residual risk assessment: which risk categories had zero events (indicating
   effective prevention) vs. which had recurring events (indicating residual risk).
4. Risk-mitigation effectiveness: compare enforcement events against denials
   to demonstrate active risk reduction.

${CITATION_INSTRUCTION}

Write 4-6 formal paragraphs.
`.trim(),
        },
        {
            id: 'euai-annex-iv-5-transparency-obligations',
            title: 'Annex IV §5 + Art. 50: Transparency Obligations',
            citationRequirement: 'optional',
            promptTemplate: `
You are drafting the Transparency Obligations section for EU AI Act technical
documentation under Article 50 and Annex IV §5.

Article 50(1): Providers of AI systems intended to interact with natural persons
shall ensure that natural persons are notified that they are interacting with
an AI system.

Article 50(4): Any person deploying an AI system that generates synthetic audio,
image, video, or text content shall label it as AI-generated.

Describe the transparency mechanisms implemented:
1. How users and oversight staff are notified of AI agent involvement in decisions.
2. AI-authorship labelling on generated content and reports (including this report).
3. How the audit chain's provenance records satisfy Art. 50 documentation
   requirements.
4. Any content-generation events in the chain where the AI-authorship label was
   applied.

This section may contain procedural statements not backed by audit-chain events
where the transparency mechanism is structural (e.g., UI labels).

${exports.ART50_DISCLOSURE}
`.trim(),
        },
        {
            id: 'euai-annex-iv-6-quality-management',
            title: 'Annex IV §6: Quality Management System (Art. 17)',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting Annex IV §6 (Quality Management) for EU AI Act technical
documentation under Article 17 of Regulation (EU) 2024/1689.

Article 17 requires providers to implement a quality management system covering:
  (a) Regulatory compliance strategy
  (b) Techniques, procedures, and actions for design, control, and verification
  (c) Examination, test, and validation procedures
  (d) Responsibilities and accountability structures

Using ONLY the audit-chain events provided, describe:
1. Evidence that governance policies were validated against regulatory compliance
   packs during the review period (policy:snapshot events with pack bindings).
2. Approval workflows that demonstrate accountability structures for AI governance
   decisions.
3. Test or validation events in the chain confirming that controls were
   operationally effective.
4. Accountability trail: which human roles approved which classes of AI agent
   actions during the period.

${CITATION_INSTRUCTION}

Write 3-5 formal paragraphs.
`.trim(),
        },
        {
            id: 'euai-annex-iv-7-post-market-monitoring',
            title: 'Annex IV §7: Post-Market Monitoring (Art. 72)',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting Annex IV §7 (Post-Market Monitoring) for EU AI Act technical
documentation under Article 72 of Regulation (EU) 2024/1689.

Article 72 requires providers to actively monitor performance of high-risk AI
systems after placing them on the market, including collecting data on serious
incidents.

Using ONLY the audit-chain events provided, describe:
1. Continuous monitoring activities during the reporting period -- anomaly
   detection events, performance drift signals, and monitoring gaps.
2. Any serious incidents detected and whether they were reported to relevant
   market surveillance authorities.
3. Corrective actions taken in response to post-market findings.
4. Evidence that the monitoring system operated effectively throughout the period.

${CITATION_INSTRUCTION}

Write 3-5 formal paragraphs.
`.trim(),
        },
    ],
};
//# sourceMappingURL=eu-ai-act-annex-iv.js.map