"use strict";
/**
 * California AB 2930 Automated Decision Tool Act Compliance Pack
 *
 * Regulation: California AB 2930 -- Automated Decision Tools (ADT) Act,
 *             proposed legislation amending California Civil Code.
 *
 * Jurisdiction: US-CA (California, United States)
 * Regulators: California Civil Rights Department (CRD) +
 *             California Privacy Protection Agency (CPPA)
 *
 * Alias: EM-03 (Employment AI -- third in employment series)
 *
 * STATUS NOTICE (as of April 2026):
 *   AB 2930 is California's proposed automated decision tool act. This pack
 *   reflects the most recent published version of the bill. The legislation
 *   has been subject to amendments; specific timelines, thresholds, and
 *   enforcement mechanisms may change as the bill progresses through the
 *   California Legislature or upon signature into law. Pack requires updates
 *   when the final statute is enacted. Monitor CRD and CPPA guidance closely.
 *
 * Scope (as proposed):
 *   Applies to any "developer" or "deployer" of an "automated decision tool"
 *   (ADT) used to make or inform "consequential decisions" affecting California
 *   residents. Consequential decisions include: employment, credit, housing,
 *   education, healthcare, insurance, and legal decisions.
 *
 * Key obligations (as proposed):
 *   1. Pre-deployment impact assessment: Developers and deployers must conduct
 *      an impact assessment before using an ADT for consequential decisions.
 *   2. Ongoing annual impact assessment: Required annually for the life of ADT.
 *   3. Notice: Must notify affected individuals before a consequential decision
 *      is made using an ADT.
 *   4. Right to human review: Individuals may request human review of
 *      consequential decisions made by ADTs.
 *   5. Demographic impact analysis: Must assess ADT for disparate impact on
 *      protected classes annually.
 *   6. Vendor / developer disclosure: Deployers must disclose ADT use to
 *      individuals; developers must disclose ADT capabilities to deployers.
 *   7. CRD report: Significant discriminatory impact triggers reporting to
 *      the California Civil Rights Department.
 *
 * Retention:
 *   Impact assessments: life of ADT use + 4 years after.
 *   Candidate/affected-individual records: per CA general data retention.
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.CALIFORNIA_AB2930_PACK = exports.CALIFORNIA_AB2930_CATEGORY_CLASSIFIERS = void 0;
/**
 * California AB 2930 category classifiers.
 */
exports.CALIFORNIA_AB2930_CATEGORY_CLASSIFIERS = {
    AUTOMATED_DECISION_TOOL_OUTPUT: {
        references: ['CA AB 2930 -- automated decision tool (ADT) definition; consequential decision scope'],
        classifier: (input) => {
            if (/\b(?:automated\s+decision(?:\s+tool)?|ADT|algorithmic\s+decision|AI\s+(?:decision|recommendation|scoring|ranking))\b/i.test(input))
                return true;
            if (/\b(?:AI.(?:generated|driven|assisted)\s+(?:decision|score|rating|assessment|determination))\b/i.test(input))
                return true;
            if (/\b(?:machine\s+learning\s+(?:output|prediction|score)|model\s+(?:output|prediction|recommendation)\s+(?:consequential|employment|hiring|credit|housing))\b/i.test(input))
                return true;
            return false;
        },
    },
    CONSEQUENTIAL_DECISION_RECORD: {
        references: ['CA AB 2930 -- consequential decision definition: employment, credit, housing, education, healthcare, insurance, legal'],
        classifier: (input) => {
            // California marker required: this pack must NOT fire on Colorado AI Act or ISO 42001
            // language that also uses "consequential decision" (F-NEW-CRIT-23).
            const hasCaliforniaMarker = /\b(?:California|CA\s+resident|AB\s*[-]?2930|California\s+Civil\s+Code|Cal\s+Civ\s+Code|1798\.\d+|Department\s+of\s+Civil\s+Rights|CA\s+AG|CPPA|CCPA|automated\s+decision\s+tool\b|ADT\s+Act)\b/i.test(input);
            if (!hasCaliforniaMarker)
                return false;
            if (/\b(?:consequential\s+decision|hiring\s+(?:decision|outcome)|credit\s+(?:decision|denial|approval)|loan\s+(?:decision|denial|approval))\b/i.test(input))
                return true;
            if (/\b(?:housing\s+(?:decision|denial|approval)|eviction\s+(?:decision|determination)|enrollment\s+(?:decision|denial))\b/i.test(input))
                return true;
            if (/\b(?:insurance\s+(?:decision|denial|premium\s+determination)|parole\s+decision|sentencing\s+recommendation)\b/i.test(input))
                return true;
            if (/\b(?:adverse\s+employment\s+action|termination\s+(?:by\s+AI|AI.assisted|algorithmic))\b/i.test(input))
                return true;
            return false;
        },
    },
    IMPACT_ASSESSMENT_RECORD: {
        references: ['CA AB 2930 -- pre-deployment and annual impact assessment requirement'],
        classifier: (input) => {
            // California marker required: this pack must NOT fire on ISO 42001 "impact assessment"
            // language that lacks any California-specific context (F-NEW-CRIT-23).
            const hasCaliforniaMarker = /\b(?:California|CA\s+resident|AB\s*[-]?2930|California\s+Civil\s+Code|Cal\s+Civ\s+Code|1798\.\d+|Department\s+of\s+Civil\s+Rights|CA\s+AG|CPPA|CCPA|automated\s+decision\s+tool\b|ADT\s+Act)\b/i.test(input);
            // AB 2930 assessment phrase is unambiguous on its own; all other "impact assessment"
            // phrases require the California marker to avoid cross-jurisdiction misattribution.
            if (/\b(?:AB\s*2930\s+assessment)\b/i.test(input))
                return true;
            if (!hasCaliforniaMarker)
                return false;
            if (/\b(?:impact\s+assessment|algorithmic\s+impact\s+assessment|AIA|bias\s+assessment|disparate\s+impact\s+analysis)\b/i.test(input))
                return true;
            if (/\b(?:pre.deployment\s+(?:assessment|review|audit)|annual\s+(?:ADT|AI)\s+(?:assessment|audit|review))\b/i.test(input))
                return true;
            return false;
        },
    },
    CANDIDATE_AFFECTED_BY_ADT: {
        references: ['CA AB 2930 -- individual notice and human review right for consequential decisions'],
        classifier: (input) => {
            if (/\b(?:ADT\s+(?:notice|notification)|automated\s+decision\s+(?:notice|disclosure|notification))\b/i.test(input))
                return true;
            if (/\b(?:right\s+to\s+(?:human\s+review|appeal\s+AI|contest\s+AI\s+decision)|human\s+review\s+request\s+(?:ADT|automated))\b/i.test(input))
                return true;
            if (/\b(?:AB\s*2930\s+(?:notice|disclosure|right)|California\s+ADT\s+disclosure)\b/i.test(input))
                return true;
            return false;
        },
    },
    DEMOGRAPHIC_IMPACT_DATA: {
        references: ['CA AB 2930 -- annual demographic impact analysis requirement; CRD reporting trigger'],
        classifier: (input) => {
            if (/\b(?:demographic\s+(?:impact|analysis|breakdown|disparity)|disparate\s+impact\s+(?:AI|ADT|algorithmic)|protected\s+class\s+(?:analysis|impact|disparity))\b/i.test(input))
                return true;
            if (/\b(?:CRD\s+(?:report|notification)|California\s+Civil\s+Rights\s+(?:Department|report)\s+AI|AB\s*2930\s+CRD)\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['CA AB 2930 -- affected individual personal data in ADT context; CCPA alignment'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            if (/\b(?:applicant|candidate|individual|consumer)\s+(?:name|email|phone|address)/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['CA AB 2930 -- security obligations for ADT data and impact assessment records'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
exports.CALIFORNIA_AB2930_PACK = {
    categoryClassifiers: exports.CALIFORNIA_AB2930_CATEGORY_CLASSIFIERS,
    /**
     * F-NEW-VERA-PACK-C4-01b: subjectKeyedCategories added per Vera recommendation.
     * ADT consequential decisions and affected-candidate records are inherently
     * subject-keyed; PII is included as it identifies affected individuals.
     */
    subjectKeyedCategories: ['CONSEQUENTIAL_DECISION_RECORD', 'CANDIDATE_AFFECTED_BY_ADT', 'PII'],
    id: 'california-ab2930',
    aliases: ['EM-03'],
    name: "California AB 2930 Automated Decision Tool Act",
    version: '1.0.0',
    contentHash: 'eefe88c9f7eea174cc595f85abfaead7682498f6e93b2d80e6606bd795b927d1',
    description: "California AB 2930 Automated Decision Tool (ADT) Act compliance for AI systems making or informing consequential decisions affecting California residents (employment, credit, housing, education, healthcare, insurance, legal). STATUS NOTE: AB 2930 is California's proposed automated decision tool act. This pack reflects the most recent published version of the bill and may require updates as the final statute is enacted. Key obligations: pre-deployment and annual impact assessments; individual notice before consequential ADT decisions; right to human review; annual demographic impact analysis; discriminatory-impact reporting to the California Civil Rights Department (CRD) and California Privacy Protection Agency (CPPA). Impact assessments retained for life of ADT use + 4 years.",
    authority: 'California Civil Rights Department (CRD) + California Privacy Protection Agency (CPPA)',
    industries: ['hr-employment', 'fintech', 'banking', 'insurance', 'healthcare', 'education', 'housing', 'legal', 'technology', 'recruiting'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Enforce ADT use constraints for consequential decisions; pre-deployment impact assessment gate before ADT goes live; individual notice delivery before consequential decision',
            reference: 'CA AB 2930 -- pre-deployment impact assessment requirement; notice obligation before consequential decision; developer and deployer obligations',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Classify ADT outputs, consequential decision records, impact assessment records, and demographic impact data for appropriate handling and retention',
            reference: 'CA AB 2930 -- ADT output classification; consequential decision record keeping; impact assessment documentation',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident records of impact assessments, ADT consequential decisions, individual notices, human review requests, and CRD reports; 4-year post-ADT retention',
            reference: 'CA AB 2930 -- impact assessment records (life of ADT + 4 years); consequential decision audit trail; CRD investigation defence',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Access control for ADT outputs, impact assessment records, and individual consequential decision data',
            reference: 'CA AB 2930 -- security obligations for ADT data; CPPA alignment with CCPA access control standards',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Human-in-the-loop gate for consequential ADT decisions; individual right-to-human-review workflow; pre-deployment impact assessment sign-off',
            reference: 'CA AB 2930 -- right to human review of consequential ADT decisions; pre-deployment assessment authorisation',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Annual impact assessment deadline tracking; discriminatory impact threshold breach triggers CRD report; individual complaint 30-day response clock',
            reference: 'CA AB 2930 -- annual impact assessment obligation; CRD report trigger on discriminatory impact threshold; 30-day complaint response',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'ADT developer-to-deployer disclosure obligations; third-party ADT vendor contractual controls; developer disclosure of ADT capabilities and limitations',
            reference: 'CA AB 2930 -- developer obligations to deployers; deployer obligations to individuals; vendor disclosure requirements',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Impact assessment record continuity for life of ADT + 4-year post-ADT period; human review request state tracking',
            reference: 'CA AB 2930 -- impact assessment retention (life of ADT + 4 years); affected-individual record continuity',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Pre-deployment and annual impact assessment documentation; demographic impact analysis records; CRD report attestation',
            reference: 'CA AB 2930 -- impact assessment documentation; annual demographic analysis; CRD reporting records',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Individual notice before consequential ADT decision; ADT use disclosure; explanation of ADT characteristics; human review right disclosure',
            reference: 'CA AB 2930 -- notice obligation before consequential decision; disclosure of ADT use; right-to-human-review explanation',
        },
        {
            name: 'bias-monitor',
            required: true,
            reason: 'Ongoing demographic impact analysis; discriminatory impact detection for protected classes; annual bias monitoring report generation',
            reference: 'CA AB 2930 -- annual demographic impact analysis; discriminatory impact threshold monitoring; CRD report trigger detection',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            preDeploymentImpactAssessmentRequired: true,
            adtNoticeBeforeConsequentialDecisionRequired: true,
            adtConsequentialDecisionScopeEnforced: true,
            developerDeployerDisclosureRequired: true,
        },
        'data-classifier': {
            enabledCategories: ['AUTOMATED_DECISION_TOOL_OUTPUT', 'CONSEQUENTIAL_DECISION_RECORD', 'IMPACT_ASSESSMENT_RECORD', 'CANDIDATE_AFFECTED_BY_ADT', 'DEMOGRAPHIC_IMPACT_DATA', 'PII', 'CREDENTIALS'],
            adtOutputAction: 'WARN',
            credentialsAction: 'BLOCK',
        },
        'approval-queue': {
            humanReviewRightEnforced: true,
            preDeploymentAssessmentSignOffRequired: true,
            consequentialDecisionHumanGateRequired: true,
        },
        'event-bus': {
            annualImpactAssessmentDeadlineTracked: true,
            discriminatoryImpactCrdReportTriggerActive: true,
            individualComplaint30DayResponseClockActive: true,
        },
        'supply-chain': {
            adtDeveloperDisclosureRequired: true,
            thirdPartyAdtVendorContractRequired: true,
        },
        'attestation-manager': {
            preDeploymentImpactAssessmentDocumented: true,
            annualImpactAssessmentDocumented: true,
            demographicAnalysisRecordRequired: true,
            crdReportRecordRequired: true,
        },
        'bias-monitor': {
            annualDemographicImpactAnalysisRequired: true,
            discriminatoryImpactThresholdAlertActive: true,
            protectedClassMonitoringEnabled: true,
        },
        'session-persistence': {
            impactAssessmentRetentionLifePlusYears: 4,
            humanReviewRequestStateTracked: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['DATA-RESIDENCY-US', 'BIAS-MONITORING', 'IMPACT-ASSESSMENT-SUPPORT', 'HUMAN-REVIEW-GATE'],
        blockReasons: {
            deepseek: 'PRC National Intelligence Law creates consequential decision data custody risk incompatible with California AB 2930 impact assessment transparency and CRD/CPPA examination requirements.',
            baidu: 'PRC jurisdiction incompatible with CPPA and CRD supervisory expectations for ADT impact assessment records and California consumer data residency standards.',
            alibaba: 'PRC jurisdiction incompatible with CPPA and CRD supervisory expectations for ADT impact assessment records and California consumer data residency standards.',
        },
    },
    dataPolicy: {
        scanCategories: ['AUTOMATED_DECISION_TOOL_OUTPUT', 'CONSEQUENTIAL_DECISION_RECORD', 'IMPACT_ASSESSMENT_RECORD', 'CANDIDATE_AFFECTED_BY_ADT', 'DEMOGRAPHIC_IMPACT_DATA', 'PII', 'CREDENTIALS'],
        categoryActions: {
            AUTOMATED_DECISION_TOOL_OUTPUT: 'WARN',
            CONSEQUENTIAL_DECISION_RECORD: 'WARN',
            IMPACT_ASSESSMENT_RECORD: 'WARN',
            CANDIDATE_AFFECTED_BY_ADT: 'WARN',
            DEMOGRAPHIC_IMPACT_DATA: 'WARN',
            PII: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        // Impact assessments: life of ADT use + 4 years after ADT retirement.
        // Affected-individual records: per CA general retention (typically 3-4 years for employment/consumer).
        // Using 1825 days (5 years) as a baseline covering the 4-year post-ADT window plus operational buffer.
        auditLogRetentionDays: 1825, // 5 years (4-year post-ADT + 1-year operational buffer)
        sessionRetentionDays: 1460, // 4 years for affected-individual records
        incidentRetentionDays: 1825, // 5 years for CRD complaint records
        reference: 'CA AB 2930 -- impact assessments retained for life of ADT + 4 years after ADT retirement; affected-individual records per CA general retention; CRD complaint statute of limitations (4 years -- Cal. Civ. Proc. §338); CCPA consumer record standards',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['us-ca', 'us'],
    },
    incidentPolicy: {
        // Discriminatory impact threshold breach triggers CRD report.
        // Individual complaint response: 30 days.
        // CRD formal complaint investigation timelines per FEHA/CRD procedures.
        notificationDeadlineHours: 720, // 30 days for individual complaint response and CRD report
        reference: 'CA AB 2930 -- discriminatory impact threshold breach triggers CRD report; 30-day complaint response obligation; CPPA enforcement procedures; CRD investigation authority under FEHA',
        requiredRecipients: ['california-civil-rights-department', 'cppa-regulatory-affairs', 'chief-compliance-officer', 'legal-counsel'],
        formalNotificationRequired: true,
    },
    // F-NEW-VERA-PACK-C4-01a: Validator check-key namespace design note.
    // Validators below use check keys from other regulation namespaces
    // (gdpr_dpia_active, finra_annual_certification_active, post_market_monitoring).
    // This is intentional and documented in check-registry.ts lines 2949-2951:
    // these are generic infrastructure checks that test module/config presence,
    // not GDPR- or FINRA-specific logic. Renaming to california_ab2930_* would
    // require adding duplicate check implementations with identical logic.
    // Design choice: generic infrastructure checks are reused across packs
    // to avoid redundant implementations. Documented here for auditability.
    validators: [
        {
            id: 'ca-ab2930-pre-deployment-assessment',
            description: 'Pre-deployment impact assessment completed and documented before ADT used for consequential decisions',
            reference: 'CA AB 2930 -- pre-deployment impact assessment requirement; assessment must precede consequential ADT deployment',
            check: 'gdpr_dpia_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ca-ab2930-individual-notice',
            description: 'Individual notice delivered before consequential decision made by or informed by ADT; disclosure of ADT use and characteristics',
            reference: 'CA AB 2930 -- notice obligation to affected individual before consequential ADT decision',
            check: 'transparency_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ca-ab2930-human-review-right',
            description: 'Right-to-human-review workflow active; individuals can request and receive human review of consequential ADT decisions',
            reference: 'CA AB 2930 -- right to human review of consequential decisions made by automated decision tools',
            check: 'gdpr_article22_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ca-ab2930-impact-assessment-retention',
            description: 'Impact assessment records retained for life of ADT + 4 years post-retirement; tamper-evident audit trail',
            reference: 'CA AB 2930 -- impact assessment retention requirement: life of ADT use + 4 years after ADT retirement',
            check: 'audit_trail_exists',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ca-ab2930-annual-impact-assessment',
            description: 'Annual impact assessment conducted; demographic impact analysis covering protected classes completed and documented',
            reference: 'CA AB 2930 -- ongoing annual impact assessment obligation for life of ADT deployment',
            check: 'finra_annual_certification_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ca-ab2930-demographic-impact-analysis',
            description: 'Annual demographic impact analysis active; discriminatory impact threshold monitoring wired for CRD report trigger',
            reference: 'CA AB 2930 -- annual demographic impact analysis; discriminatory impact on protected classes triggers CRD report',
            check: 'post_market_monitoring',
            failSeverity: 'HIGH',
        },
        {
            id: 'ca-ab2930-data-classifier',
            description: 'ADT outputs, consequential decision records, impact assessment records, and demographic impact data classified and handled appropriately',
            reference: 'CA AB 2930 -- ADT output and consequential decision record classification',
            check: 'data_classifier_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ca-ab2930-vendor-disclosure',
            description: 'ADT developer disclosure to deployers active; third-party ADT vendor contractual obligations enforced',
            reference: 'CA AB 2930 -- developer obligations to deployers; deployer disclosure to affected individuals',
            check: 'subservice_registry_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ca-ab2930-access-control',
            description: 'ADT output and impact assessment data access limited to authorised personnel; audit trail maintained',
            reference: 'CA AB 2930 -- security obligations for ADT data; CPPA alignment with CCPA access control standards',
            check: 'rbac_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ca-ab2930-encryption',
            description: 'ADT consequential decision records and impact assessments encrypted at rest and in transit',
            reference: 'CA AB 2930 -- security obligations for consequential decision data; CPPA security standards',
            check: 'encryption_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ca-ab2930-crd-report-trigger',
            description: 'CRD report trigger active for discriminatory impact threshold breaches; 30-day complaint response clock wired',
            reference: 'CA AB 2930 -- discriminatory impact triggers report to CRD; 30-day complaint response obligation',
            check: 'event_clock_active',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=california-ab2930.js.map