"use strict";
/**
 * UK Future AI Legislation — Horizon-Scan Scaffold Pack
 *
 * Regulation: No standalone UK AI Act as of May 2026. This pack is a
 *             constitution scaffold that tracks DSIT bills + sectoral
 *             statutes in flight so customers can pre-position controls
 *             before enactment. Updated quarterly via horizon-scan.
 *
 * Jurisdiction: GB (United Kingdom)
 *
 * In-flight monitored instruments (review quarterly; update version on
 * material change):
 *   - DSIT AI Safety Bill (draft, post-Bletchley follow-on)
 *   - DSIT AI Regulation Roadmap implementation phases (post-2024 cycle)
 *   - Online Safety Act 2023 AI-generated-content amendments (Ofcom code)
 *   - Data Protection and Digital Information Bill carryover (post-General
 *     Election 2024) — DPDI / Data Use and Access Bill 2024-25
 *   - Sectoral AI statutes: FCA AI consumer-duty guidance follow-on;
 *     MHRA AI-as-medical-device regulation reform (UKCA path);
 *     CMA Strategic Market Status designations involving AI foundation models
 *
 * Pack posture: **MONITOR-only**. Validators fail at HIGH or MEDIUM, never
 * CRITICAL — the customer's existing AI controls under uk-ai-framework
 * (DSIT 2023 principles) are the operative requirement today. This pack
 * surfaces forward-looking obligations and scaffolds audit-chain entries
 * so when a statute is enacted the activation switch is a status change
 * (`MONITOR` → `ACTIVE`) rather than a from-scratch implementation.
 *
 * Pairs with:
 *   - uk-ai-framework (DSIT 2023 principles — operative today)
 *   - uk-equality-act-ai-bias (Equality Act 2010 + ICO-EHRC AI bias guidance)
 *   - uk-online-safety-act (Ofcom AI-content code carryover)
 *
 * @connexum/ai-governance  TIER 10-UK Wave 4 pack 16/16
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.UK_FUTURE_AI_LEGISLATION_PACK = exports.UK_FUTURE_AI_LEGISLATION_CATEGORY_CLASSIFIERS = void 0;
exports.UK_FUTURE_AI_LEGISLATION_CATEGORY_CLASSIFIERS = {
    HORIZON_SCAN_EVIDENCE: {
        references: ['DSIT AI Regulation Roadmap (2024); quarterly UK AI legislation horizon-scan'],
        classifier: (input) => {
            if (/\b(?:uk\s+ai\s+(?:bill|act)|dsit\s+ai\s+bill|ai\s+safety\s+bill|ai\s+regulation\s+roadmap)\b/i.test(input))
                return true;
            if (/\b(?:dpdi\s+bill|data\s+use\s+and\s+access\s+bill|ai\s+consumer\s+duty)\b/i.test(input))
                return true;
            if (/\b(?:strategic\s+market\s+status|sms\s+designation|foundation\s+model\s+designation)\b/i.test(input))
                return true;
            return false;
        },
    },
    DRAFT_STATUTE_CITATION: {
        references: ['Draft UK AI statute or regulatory consultation citation'],
        classifier: (input) => {
            if (/\b(?:draft\s+bill|first\s+reading|second\s+reading|royal\s+assent|consultation\s+response|hl\s+bill|hc\s+bill)\b/i.test(input))
                return true;
            if (/\b(?:cm\s+\d{3,5}|cp\s+\d{3,5})\b/i.test(input))
                return true; // Command Papers
            return false;
        },
    },
    SECTORAL_AI_STATUTE_REFERENCE: {
        references: ['Sectoral AI statute (FCA AI consumer duty, MHRA AIaMD, CMA SMS, Ofcom AI code)'],
        classifier: (input) => {
            if (/\b(?:fca\s+ai\s+(?:guidance|duty)|mhra\s+ai\s+regulation|cma\s+ai\s+(?:rules|designation)|ofcom\s+ai\s+code)\b/i.test(input))
                return true;
            if (/\b(?:ai.?as.?medical.?device|aimd|saimd|model\s+designation)\b/i.test(input))
                return true;
            return false;
        },
    },
};
exports.UK_FUTURE_AI_LEGISLATION_PACK = {
    categoryClassifiers: exports.UK_FUTURE_AI_LEGISLATION_CATEGORY_CLASSIFIERS,
    id: 'uk-future-ai-legislation',
    aliases: ['uk-ai-horizon', 'uk-future-ai'],
    name: 'UK Future AI Legislation Horizon-Scan',
    version: '1.0.0',
    contentHash: 'aa9df828695f410d57e3ce2ad56d26f0d79a86143d478cd292c56c5cd9466ce5',
    description: 'Constitution scaffold for upcoming UK AI legislation (DSIT AI Safety Bill, DPDI / Data Use and Access Bill carryover, sectoral statutes: FCA AI consumer duty, MHRA AI-as-medical-device, CMA SMS designations involving foundation models, Ofcom AI code). MONITOR-tier — does not block actions; flags horizon-scan evidence and draft-statute citations so an organisation can pre-position controls before enactment. Quarterly review cadence. When a specific instrument receives Royal Assent the pack version bumps and the relevant validators graduate from MONITOR-only to CRITICAL via a sibling ACTIVE pack.',
    authority: 'DSIT (Department for Science, Innovation and Technology) + sectoral regulators (FCA / MHRA / CMA / Ofcom / ICO) + Parliament (Bills in flight)',
    industries: ['technology', 'financial-services', 'healthcare', 'media', 'public-sector', 'retail', 'energy', 'transport'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Horizon-scan governance scaffold — flag actions that touch the surfaces draft UK AI legislation is expected to regulate (high-risk AI, foundation-model deployments, sectoral AI-as-product use cases).',
            reference: 'DSIT AI Regulation Roadmap (2024); future UK AI statute scaffold per TIER 10-UK Wave 4',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit trail for horizon-scan evidence (draft-bill citations, consultation responses, sectoral guidance updates). When statute is enacted the trail proves pre-enactment compliance posture.',
            reference: 'PACE 1984 s.78 admissibility carryover; ICO accountability documentation; pre-enactment evidence retention',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Quarterly horizon-scan attestation — operator confirms the pack version reflects the latest tracked instruments. Attestation cadence locks in update discipline.',
            reference: 'TIER 10-UK Wave 4 quarterly horizon-scan policy; DSIT AI Regulation Roadmap quarterly cycle',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Detect HORIZON_SCAN_EVIDENCE / DRAFT_STATUTE_CITATION / SECTORAL_AI_STATUTE_REFERENCE in audit content. Categorise for differential retention as draft statutes mature.',
            reference: 'UK GDPR Art. 4(1); ICO accountability documentation; horizon-scan content categorisation',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Emit a UK_AI_HORIZON_SCAN event when an operator records a quarterly attestation, or when a draft-bill citation is detected in audit content. Enables downstream subscribers (compliance dashboards, sectoral-regulator notification workflows) to react when a tracked instrument advances.',
            reference: 'TIER 10-UK Wave 4 horizon-scan event emission; DSIT AI Regulation Roadmap quarterly cadence',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            horizonScanScaffoldActive: true,
            flagDraftStatuteAdjacentActions: true,
            monitorModeOnly: true,
        },
        'audit-integrity': {
            horizonScanEvidenceTrailRequired: true,
            retentionYearsForPreEnactmentEvidence: 6,
        },
        'attestation-manager': {
            quarterlyHorizonScanAttestationRequired: true,
            operatorAcknowledgementRequired: true,
        },
        'data-classifier': {
            horizonScanCategoriesActive: true,
        },
        'event-bus': {
            emitHorizonScanEventOnAttestation: true,
            emitHorizonScanEventOnDraftBillCitation: true,
        },
    },
    providerPolicy: {
        blockedProviders: [], // MONITOR-tier: don't block providers pre-enactment
        requiredCapabilities: ['DATA-RESIDENCY-UK-OR-EU'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: ['HORIZON_SCAN_EVIDENCE', 'DRAFT_STATUTE_CITATION', 'SECTORAL_AI_STATUTE_REFERENCE'],
        categoryActions: {
            HORIZON_SCAN_EVIDENCE: 'LOG',
            DRAFT_STATUTE_CITATION: 'WARN',
            SECTORAL_AI_STATUTE_REFERENCE: 'WARN',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'INTERNAL',
    },
    retentionPolicy: {
        // Pre-enactment evidence retained 6 years to align with FCA SYSC + Limitation
        // Act 1980. When a tracked instrument is enacted the sibling ACTIVE pack
        // governs retention going forward; the horizon-scan trail proves
        // pre-enactment compliance posture during the transition window.
        auditLogRetentionDays: 2190, // 6 years
        sessionRetentionDays: 2190,
        incidentRetentionDays: 2190,
        reference: 'Limitation Act 1980 6-year claims period; FCA SYSC 9.1.1R; ICO accountability documentation; pre-enactment evidence retention',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['gb', 'eu'],
    },
    incidentPolicy: {
        // No statute-mandated notification deadline pre-enactment. Use 72-hour
        // baseline so operators rehearse the cadence; activation in the sibling
        // ACTIVE pack will tighten as enactment lands.
        notificationDeadlineHours: 72,
        reference: 'Pre-enactment rehearsal cadence; UK GDPR Art. 33 72-hour baseline; future UK AI statute scaffold',
        requiredRecipients: ['chief-ai-officer', 'data-protection-officer', 'compliance-officer'],
        formalNotificationRequired: false,
    },
    validators: [
        {
            id: 'uk-future-ai-horizon-scan-current',
            description: 'Quarterly horizon-scan attestation present and within the last 90 days. Confirms operator is tracking DSIT bills + sectoral statutes.',
            reference: 'TIER 10-UK Wave 4 quarterly cadence; DSIT AI Regulation Roadmap update cycle',
            check: 'attestation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'uk-future-ai-draft-bill-tracker',
            description: 'Audit-chain entries reference tracked draft instruments (AI Safety Bill / DPDI / Data Use and Access Bill / sectoral statutes). Surfaces evidence that the organisation is monitoring legislative progress.',
            reference: 'TIER 10-UK Wave 4 scaffold; DSIT AI Regulation Roadmap; in-flight Bills tracker',
            check: 'audit_trail_exists',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'uk-future-ai-sectoral-mapping',
            description: 'Sectoral AI statute mapping documented — at minimum the operator has identified which sectoral regulator(s) will govern its AI deployments post-enactment (FCA / MHRA / CMA / Ofcom / ICO).',
            reference: 'DSIT cross-sectoral framework; sectoral regulator AI guidance carryover',
            check: 'subservice_registry_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'uk-future-ai-data-classifier',
            description: 'Data classifier active for HORIZON_SCAN_EVIDENCE, DRAFT_STATUTE_CITATION, and SECTORAL_AI_STATUTE_REFERENCE categories so horizon-scan content is queryable in the audit chain.',
            reference: 'Horizon-scan content categorisation; data-classifier integration',
            check: 'data_classifier_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'uk-future-ai-audit-encryption',
            description: 'Pre-enactment evidence encrypted at rest and in transit; protects horizon-scan content and operator attestations.',
            reference: 'UK GDPR Art. 32(1)(a); NCSC AI security guidance',
            check: 'encryption_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=uk-future-ai-legislation.js.map