/**
 * Singapore PDPC Model AI Governance Framework + AI Verify Compliance Pack
 *
 * Regulation: PDPC Model AI Governance Framework (2nd Edition, 2020)
 *             + AI Verify (open-source AI governance testing toolkit, IMDA, 2022)
 *             + Companion Guides to the Model AI Governance Framework (2022)
 *
 * Jurisdiction: SG (Singapore)
 * Regulators: IMDA (Infocomm Media Development Authority)
 *             + PDPC (Personal Data Protection Commission)
 *
 * Alias: EN-09
 *
 * Status:
 *   Voluntary framework, but referenced in PDPA enforcement actions and
 *   increasingly expected in MAS-regulated financial services and government
 *   procurement. AI Verify is the auditable testing artifact produced under
 *   this framework. Singapore MAS also references the Model AI Governance
 *   Framework in its Fairness, Ethics, Accountability and Transparency
 *   (FEAT) principles.
 *
 * Key obligations:
 *   1. Internal AI governance structure: board-level AI accountability,
 *      designated AI risk owner, AI ethics committee or equivalent.
 *   2. AI risk classification: apply PDPC Decision Matrix to classify each
 *      AI deployment by probability of harm and severity of impact.
 *   3. Human involvement level determination: each AI deployment classified
 *      as one of four levels:
 *        - Human-in-the-loop (HITL): human decision-making for every output
 *        - Human-over-the-loop (HOTL): human monitoring with override ability
 *        - Human-out-of-the-loop: AI autonomous but human-initiated
 *        - Human-controlled: fully automated within pre-defined parameters
 *   4. Explainability tier mapping: results must be explainable at a level
 *      appropriate to the risk classification and human-involvement level.
 *   5. Fairness testing: AI Verify toolkit conformance, covering performance
 *      metrics (accuracy, precision, recall, F1), fairness metrics (demographic
 *      parity, equalised odds, etc.), and robustness testing.
 *   6. Stakeholder communication: disclosure to affected individuals and
 *      relevant stakeholders about AI use, decisions, and limitations.
 *
 * AI Verify:
 *   AI Verify is an AI governance testing toolkit developed by IMDA.
 *   It produces a test report covering 9 AI ethics principles across
 *   25 testable properties. The AI Verify test report is the auditable
 *   artifact referenced by enterprise customers and regulators.
 *
 * Interaction with PDPA:
 *   The Model AI Governance Framework sits above the PDPA. Where AI
 *   decisions involve personal data, PDPA obligations (consent, purpose
 *   limitation, data protection) also apply. Both packs may be active
 *   simultaneously; PDPA governs data handling; this pack governs AI
 *   governance structure and fairness testing.
 *
 * @connexum/ai-governance
 */
export const SG_MODEL_AI_GOV_CATEGORY_CLASSIFIERS = {
    AI_DECISION_RECORD: {
        references: ['PDPC Model AI Governance Framework 2nd Ed. Part 3 -- human-centric AI; Decision Matrix'],
        classifier: (input) => {
            if (/\b(?:ai\s+decision|algorithmic\s+decision|automated\s+decision\s+singapore|model\s+decision\s+record|ai\s+outcome\s+record)\b/i.test(input))
                return true;
            if (/\b(?:ai\s+classification\s+output|risk\s+classification\s+ai|pdpc\s+decision\s+matrix|ai\s+risk\s+tier)\b/i.test(input))
                return true;
            if (/\b(?:ai\s+recommendation\s+record|consequential\s+ai\s+output|automated\s+recommendation)\b/i.test(input))
                return true;
            return false;
        },
    },
    AI_EXPLAINABILITY_ARTIFACT: {
        references: ['PDPC Model AI Governance Framework 2nd Ed. Section 2.4 -- explainability; AI Verify explainability tests'],
        classifier: (input) => {
            if (/\b(?:ai\s+explainability|model\s+explanation|ai\s+rationale|feature\s+importance|shap\s+value|lime\s+explanation)\b/i.test(input))
                return true;
            if (/\b(?:xai\s+report|explainable\s+ai\s+artifact|model\s+interpretability\s+report|ai\s+transparency\s+report)\b/i.test(input))
                return true;
            if (/\b(?:ai\s+verify\s+explainability|imda\s+explainability|accountability\s+artifact)\b/i.test(input))
                return true;
            return false;
        },
    },
    AI_FAIRNESS_TEST_RESULT: {
        references: ['AI Verify Testing Toolkit -- fairness metrics; PDPC Model AI Governance Framework Section 2.4 -- fairness'],
        classifier: (input) => {
            if (/\b(?:ai\s+fairness\s+test|demographic\s+parity|equalised\s+odds|equalized\s+odds|disparate\s+impact\s+ratio\s+ai)\b/i.test(input))
                return true;
            if (/\b(?:ai\s+verify\s+test\s+report|ai\s+verify\s+fairness|imda\s+fairness\s+test|fairness\s+metric\s+report)\b/i.test(input))
                return true;
            if (/\b(?:bias\s+test\s+result\s+ai|model\s+bias\s+report|ai\s+bias\s+audit\s+singapore)\b/i.test(input))
                return true;
            return false;
        },
    },
    HUMAN_OVERSIGHT_RECORD: {
        references: ['PDPC Model AI Governance Framework 2nd Ed. Section 2.3 -- human involvement; 4-level framework'],
        classifier: (input) => {
            if (/\b(?:human.in.the.loop|human.over.the.loop|hitl\s+record|hotl\s+record|human\s+oversight\s+log)\b/i.test(input))
                return true;
            if (/\b(?:human\s+override\s+record|ai\s+human\s+review\s+log|human\s+involvement\s+level\s+singapore)\b/i.test(input))
                return true;
            if (/\b(?:human\s+controlled\s+ai\s+record|human\s+out\s+of\s+loop\s+record|oversight\s+intervention\s+log)\b/i.test(input))
                return true;
            return false;
        },
    },
    AI_STAKEHOLDER_COMMUNICATION: {
        references: ['PDPC Model AI Governance Framework 2nd Ed. Section 2.5 -- stakeholder communication; Companion Guide'],
        classifier: (input) => {
            if (/\b(?:ai\s+disclosure\s+singapore|stakeholder\s+ai\s+communication|ai\s+use\s+notice\s+singapore|pdpc\s+ai\s+notice)\b/i.test(input))
                return true;
            if (/\b(?:ai\s+limitation\s+disclosure|ai\s+impact\s+communication|singapore\s+ai\s+transparency\s+notice)\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['PDPA s.2 -- personal data; PDPC Model AI Governance Framework -- personal data in AI systems'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            // Singapore NRIC / FIN pattern
            if (/\b[STFGM]\d{7}[A-Z]\b/.test(input))
                return true;
            if (/\b(?:nric|fin|singapore\s+national\s+id|personal\s+data\s+sg)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['PDPA s.24 -- protection obligation; PDPC AI Governance security requirements'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const SG_MODEL_AI_GOV_PACK = {
    categoryClassifiers: SG_MODEL_AI_GOV_CATEGORY_CLASSIFIERS,
    id: 'sg-model-ai-gov',
    aliases: ['EN-09'],
    name: 'Singapore PDPC Model AI Governance Framework + AI Verify',
    version: '1.0.0',
    contentHash: '137fc0e6479ec97aa6f79caa622807db6c17303ad8809c7757f87d7c789d06e3',
    description: 'Singapore PDPC Model AI Governance Framework (2nd Edition, 2020) + AI Verify (IMDA open-source AI governance testing toolkit, 2022) + Companion Guides (2022). Voluntary framework increasingly referenced in PDPA enforcement, MAS FEAT, and government procurement. Key obligations: internal AI governance structure; PDPC Decision Matrix risk classification; four-level human involvement determination (human-in-the-loop, human-over-the-loop, human-out-of-the-loop, human-controlled); explainability tier mapping; AI Verify fairness testing (9 ethics principles, 25 testable properties); stakeholder communication disclosure. AI Verify test report is the auditable artifact. Pairs with PDPA for personal data handling obligations.',
    authority: 'IMDA (Infocomm Media Development Authority) + PDPC (Personal Data Protection Commission)',
    industries: ['technology', 'financial-services', 'healthcare', 'government', 'hr-employment', 'retail', 'logistics', 'education'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Internal AI governance structure enforcement; PDPC Decision Matrix risk classification gate; human involvement level determination and enforcement for each AI deployment',
            reference: 'PDPC Model AI Governance Framework 2nd Ed. Section 2.1 -- internal governance; Section 2.3 -- operations management and human oversight; PDPC Decision Matrix',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Classify AI decision records, explainability artifacts, fairness test results, human oversight records, and stakeholder communications for appropriate handling and retention',
            reference: 'PDPC Model AI Governance Framework Section 2.4 -- data management; PDPA s.2 -- personal data classification; AI Verify test data classification',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit log of AI decisions, human oversight interventions, AI Verify test results, and stakeholder communications; required for IMDA/PDPC review and enterprise customer audit',
            reference: 'PDPC Model AI Governance Framework Section 2.6 -- stakeholder management and documentation; AI Verify report generation; PDPA s.11 -- accountability obligation',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Access control for AI decision records, fairness test results, and explainability artifacts; ensures only authorised personnel access AI governance documentation',
            reference: 'PDPA s.24 -- protection obligation; PDPC Model AI Governance Framework Section 2.1 -- governance structure; AI Verify test report access control',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'Personal data in AI systems encrypted at rest and in transit per PDPA protection obligation; AI Verify test data encrypted during processing',
            reference: 'PDPA s.24 -- protection obligation; PDPC Advisory Guidelines -- encryption as a reasonable security arrangement; AI Verify security requirements',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Human-in-the-loop gate for high-risk AI decisions per PDPC Decision Matrix; human override workflow for HOTL deployments; AI Verify test pass evidence sign-off',
            reference: 'PDPC Model AI Governance Framework Section 2.3 -- human oversight levels; PDPC Decision Matrix -- high probability/severity AI decisions require HITL; AI Verify conformance sign-off',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'AI Verify test pass evidence retention (5 years); AI governance structure documentation; PDPC Decision Matrix classification records; annual AI risk review documentation',
            reference: 'AI Verify Framework -- 5-year test artifact retention; PDPC Model AI Governance Framework Section 2.6 -- documentation; PDPC accountability obligation',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'AI failure event root cause analysis workflow; bias detection breach triggers AI Verify re-test; AI Verify non-conformance escalation; PDPA breach notification events',
            reference: 'PDPC Model AI Governance Framework Section 2.4 -- incident response; AI Verify non-conformance remediation; PDPA s.26D -- mandatory data breach notification (effective 2022)',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Third-party AI vendor governance accountability; AI Verify conformance from vendors; PDPA data intermediary obligations for AI system suppliers',
            reference: 'PDPC Model AI Governance Framework Section 2.2 -- responsible AI use across the organisation; PDPA s.4 -- data intermediary obligations; AI Verify third-party conformance',
        },
        {
            name: 'bias-monitor',
            required: true,
            reason: 'AI fairness monitoring per AI Verify fairness metric suite; demographic parity, equalised odds, disparate impact monitoring; continuous post-deployment bias detection',
            reference: 'AI Verify Testing Toolkit -- fairness test suite (demographic parity, equalised odds, disparate impact ratio); PDPC Model AI Governance Framework Section 2.4 -- fairness; MAS FEAT principles',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Stakeholder communication of AI use, decisions, and limitations; explainability disclosure at appropriate tier per PDPC risk classification; AI Verify report summary disclosure',
            reference: 'PDPC Model AI Governance Framework Section 2.5 -- stakeholder communication; Companion Guide -- disclosure to affected individuals; AI Verify public report option',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            aiRiskFrameworkRequired: true,
            pdpcDecisionMatrixClassificationRequired: true,
            humanInvolvementLevelDeterminationRequired: true,
            aimsContextDefined: true,
        },
        'data-classifier': {
            enabledCategories: ['AI_DECISION_RECORD', 'AI_EXPLAINABILITY_ARTIFACT', 'AI_FAIRNESS_TEST_RESULT', 'HUMAN_OVERSIGHT_RECORD', 'AI_STAKEHOLDER_COMMUNICATION', 'PII', 'CREDENTIALS'],
            aiDecisionRecordAction: 'WARN',
            aiExplainabilityArtifactAction: 'WARN',
            credentialsAction: 'BLOCK',
        },
        'approval-queue': {
            humanInvolvementLevelTracked: true,
            humanOversightLevelTracked: true,
            hiRiskAiDecisionHumanReviewRequired: true,
            aiVerifyConformanceSignOffRequired: true,
        },
        'attestation-manager': {
            aiVerifyTestPassEvidenceRequired: true,
            aiVerifyRetentionYears: 5,
            aiRiskRegisterRequired: true,
            pdpcDecisionMatrixDocumentationRequired: true,
            annualAiRiskReviewRequired: true,
        },
        'event-bus': {
            aiFailureRootCauseRequired: true,
            biasDetectionRetestRequired: true,
            riskCommunicationEventsActive: true,
        },
        'bias-monitor': {
            friaSupported: true,
            aiVerifyFairnessTestingRequired: true,
            demographicParityMonitoringRequired: true,
            equalisedOddsMonitoringRequired: true,
            responsibleAiObjectivesTracked: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['AI-VERIFY-COMPATIBLE', 'EXPLAINABILITY-CAPABLE', 'PDPA-COMPLIANT'],
        blockReasons: {
            deepseek: 'PRC National Intelligence Law creates AI governance accountability gaps incompatible with PDPC Model AI Governance Framework Section 2.1 governance structure requirements and PDPA cross-border transfer restrictions.',
            baidu: 'PRC jurisdiction. No Singapore-PRC adequacy framework. Cross-border transfer of personal data to PRC without adequate protection violates PDPA s.26 and PDPC advisory guidelines.',
            alibaba: 'PRC jurisdiction. PDPA cross-border transfer restrictions apply. No PRC-Singapore adequacy arrangement; binding corporate rules or contractual clauses required per PDPC guidelines.',
        },
    },
    dataPolicy: {
        scanCategories: ['AI_DECISION_RECORD', 'AI_EXPLAINABILITY_ARTIFACT', 'AI_FAIRNESS_TEST_RESULT', 'HUMAN_OVERSIGHT_RECORD', 'AI_STAKEHOLDER_COMMUNICATION', 'PII', 'CREDENTIALS'],
        categoryActions: {
            AI_DECISION_RECORD: 'WARN',
            AI_EXPLAINABILITY_ARTIFACT: 'WARN',
            AI_FAIRNESS_TEST_RESULT: 'WARN',
            HUMAN_OVERSIGHT_RECORD: 'WARN',
            AI_STAKEHOLDER_COMMUNICATION: 'WARN',
            PII: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        // AI Verify test artifacts: 5 years per AI Verify framework.
        // AI decision logs: retain as long as needed for purpose (PDPA) plus reasonable additional period.
        // General PDPA documentation: typically 5-7 years in Singapore commercial practice.
        auditLogRetentionDays: 1825, // 5 years for AI Verify test artifacts
        sessionRetentionDays: 1825, // 5 years for AI decision logs (conservative PDPA purpose-plus-period)
        incidentRetentionDays: 1825, // 5 years for AI failure incidents and bias detection breaches
        reference: 'AI Verify Framework -- 5-year test artifact retention standard; PDPA s.25 -- retain no longer than necessary for purpose; PDPC Advisory Guidelines on retention -- reasonable additional period; Singapore Limitation Act (Cap 163) -- 6-year claims limitation period',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['sg'], // Singapore data residency; PDPA cross-border transfer controls apply
    },
    incidentPolicy: {
        // AI failure event: PDPC Model AI Governance Framework -- root cause analysis + corrective action.
        // Bias detection breach: AI Verify re-test + remediation before continued operation.
        // PDPA data breach: mandatory notification to PDPC within 3 calendar days of assessment (s.26D).
        notificationDeadlineHours: 72, // PDPA s.26D -- 3 calendar days = 72 hours for PDPA breach; AI failure events use same clock
        reference: 'PDPA s.26D -- mandatory data breach notification to PDPC within 3 calendar days; PDPC Model AI Governance Framework -- AI failure root cause and corrective action; AI Verify -- non-conformance remediation',
        requiredRecipients: ['pdpc-breach-portal', 'ai-risk-owner', 'chief-compliance-officer', 'data-protection-officer'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'sg-ai-gov-risk-framework',
            description: 'AI risk management framework active; PDPC Decision Matrix classification applied to each AI deployment; risk tiers documented',
            reference: 'PDPC Model AI Governance Framework 2nd Ed. Section 2.2 -- internal governance structure; PDPC Decision Matrix (probability of harm x severity); AI Verify risk classification',
            check: 'iso23894_framework_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'sg-ai-gov-human-oversight',
            description: 'Human involvement level determined for each AI deployment per 4-level framework (HITL / HOTL / Human-out-of-loop / Human-controlled); high-risk deployments require HITL gate',
            reference: 'PDPC Model AI Governance Framework Section 2.3 -- human involvement in AI-augmented decision-making; 4-level human involvement framework; PDPC Decision Matrix',
            check: 'iso23894_human_oversight_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'sg-ai-gov-ai-verify-conformance',
            description: 'AI Verify test pass evidence documented and retained for 5 years; 9 ethics principles and 25 testable properties covered; non-conformance triggers remediation workflow',
            reference: 'AI Verify Testing Toolkit -- IMDA 2022; AI Verify Framework -- 9 AI ethics principles; IMDA AI Verify test report as auditable artifact',
            check: 'attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'sg-ai-gov-fairness-testing',
            description: 'AI fairness testing active per AI Verify fairness metric suite; demographic parity, equalised odds, and disparate impact ratio monitored; bias detection triggers re-test',
            reference: 'AI Verify Testing Toolkit -- fairness tests (demographic parity, equalised odds, calibration); PDPC Model AI Governance Framework Section 2.4 -- fairness; MAS FEAT Fairness principle',
            check: 'bias_monitor_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'sg-ai-gov-data-classifier',
            description: 'AI decision records, explainability artifacts, fairness test results, and human oversight records classified for appropriate handling',
            reference: 'PDPC Model AI Governance Framework Section 2.4 -- data management; AI Verify data classification; PDPA s.24 -- protection obligation for personal data in AI systems',
            check: 'data_classifier_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'sg-ai-gov-explainability-tier',
            description: 'Explainability tier mapped to PDPC risk classification; AI decisions explainable at appropriate level; AI Verify explainability tests passed',
            reference: 'PDPC Model AI Governance Framework Section 2.4 -- explainability; AI Verify explainability test suite; Companion Guide -- explainability level by risk tier',
            check: 'iso23894_transparency_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'sg-ai-gov-risk-register',
            description: 'AI risk register maintained; PDPC Decision Matrix risk classification records stored; annual AI risk review documented',
            reference: 'PDPC Model AI Governance Framework Section 2.6 -- documentation; AI Verify risk register; PDPC accountability obligation; annual review requirement',
            check: 'iso23894_risk_register_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'sg-ai-gov-stakeholder-communication',
            description: 'Stakeholder communication of AI use, decisions, and limitations active; affected individuals notified per PDPC Model AI Governance Framework',
            reference: 'PDPC Model AI Governance Framework Section 2.5 -- stakeholder communication and disclosure; Companion Guide to Framework -- notification to affected individuals',
            check: 'transparency_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'sg-ai-gov-audit-trail',
            description: 'Tamper-evident audit trail of AI decisions, human oversight interventions, AI Verify test results, and AI failure incidents active',
            reference: 'PDPC Model AI Governance Framework Section 2.6 -- documentation and record-keeping; PDPA s.11 -- accountability; AI Verify audit log',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
        {
            id: 'sg-ai-gov-encryption',
            description: 'Personal data in AI systems encrypted at rest and in transit per PDPA protection obligation; AI Verify test data secured',
            reference: 'PDPA s.24 -- protection obligation; PDPC Advisory Guidelines -- encryption as reasonable security; AI Verify security requirements',
            check: 'encryption_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'sg-ai-gov-incident-response',
            description: 'AI failure event root cause analysis workflow active; bias detection breach triggers AI Verify re-test + remediation; PDPA breach notification clock active',
            reference: 'PDPC Model AI Governance Framework -- incident response; AI Verify non-conformance remediation; PDPA s.26D -- 3-calendar-day breach notification',
            check: 'monitoring_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'sg-ai-gov-supply-chain',
            description: 'Third-party AI vendor AI Verify conformance documented; PDPA data intermediary obligations enforced in AI supply chain',
            reference: 'PDPC Model AI Governance Framework Section 2.2 -- third-party AI use; PDPA s.4 -- data intermediary; AI Verify third-party conformance requirement',
            check: 'subservice_registry_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=sg-model-ai-gov.js.map