/**
 * EU AI Act Compliance Framework
 *
 * Maps security findings to EU AI Act requirements (Regulation 2024/1689).
 * The EU AI Act establishes harmonized rules for AI systems within the EU,
 * with risk-based categorization and specific requirements for high-risk systems.
 *
 * @see https://eur-lex.europa.eu/eli/reg/2024/1689
 * @module compliance/frameworks/eu-ai-act
 */
/**
 * EU AI Act Controls
 *
 * Based on EU AI Act (Regulation 2024/1689) requirements.
 * Controls are organized by Article with focus on high-risk AI requirements.
 */
export const EU_AI_ACT_CONTROLS = [
    // ============================================================================
    // Chapter II: Prohibited AI Practices (Articles 5)
    // ============================================================================
    {
        id: "EUAIAct-5.1.a",
        framework: "EU-AI-ACT",
        category: "Prohibited Practices",
        title: "Subliminal Manipulation",
        description: "Prohibition on AI systems that deploy subliminal techniques or purposefully manipulative/deceptive techniques to materially distort behavior in a way that causes significant harm.",
        keywords: [
            "manipulation",
            "subliminal",
            "deception",
            "harmful influence",
        ],
        findingCategories: [
            "prompt-injection",
            "insecure-output",
        ],
        severityThreshold: "critical",
    },
    {
        id: "EUAIAct-5.1.b",
        framework: "EU-AI-ACT",
        category: "Prohibited Practices",
        title: "Exploitation of Vulnerabilities",
        description: "Prohibition on AI systems that exploit vulnerabilities of persons due to age, disability, or social/economic situation to materially distort behavior causing significant harm.",
        keywords: [
            "exploitation",
            "vulnerable persons",
            "harmful targeting",
        ],
        findingCategories: [
            "excessive-agency",
            "insecure-output",
        ],
        severityThreshold: "critical",
    },
    {
        id: "EUAIAct-5.1.c",
        framework: "EU-AI-ACT",
        category: "Prohibited Practices",
        title: "Social Scoring",
        description: "Prohibition on AI systems for social scoring by public authorities leading to detrimental treatment that is unjustified or disproportionate.",
        keywords: [
            "social scoring",
            "citizen evaluation",
            "behavior scoring",
        ],
        findingCategories: [],
        severityThreshold: "critical",
    },
    // ============================================================================
    // Chapter III Section 2: Requirements for High-Risk AI (Articles 8-15)
    // ============================================================================
    {
        id: "EUAIAct-9",
        framework: "EU-AI-ACT",
        category: "Risk Management",
        title: "Risk Management System",
        description: "High-risk AI systems shall have a risk management system established, implemented, documented and maintained. The system shall be a continuous iterative process throughout the AI system's lifecycle.",
        keywords: [
            "risk management",
            "lifecycle",
            "continuous process",
            "risk identification",
        ],
        findingCategories: [
            "security-misconfiguration",
            "excessive-agency",
            "overscoped-permission",
        ],
        severityThreshold: "high",
    },
    {
        id: "EUAIAct-9.2.a",
        framework: "EU-AI-ACT",
        category: "Risk Management",
        title: "Risk Identification and Analysis",
        description: "Identification and analysis of known and reasonably foreseeable risks that the high-risk AI system can pose to health, safety, or fundamental rights.",
        keywords: [
            "risk identification",
            "risk analysis",
            "foreseeable risks",
        ],
        findingCategories: [
            "prompt-injection",
            "insecure-plugin",
            "exfil-path",
        ],
        severityThreshold: "high",
    },
    {
        id: "EUAIAct-9.2.b",
        framework: "EU-AI-ACT",
        category: "Risk Management",
        title: "Risk Estimation and Evaluation",
        description: "Estimation and evaluation of risks that may emerge during use in accordance with intended purpose and reasonably foreseeable misuse.",
        keywords: [
            "risk estimation",
            "misuse",
            "intended purpose",
        ],
        findingCategories: [
            "excessive-agency",
            "prompt-injection",
        ],
        severityThreshold: "high",
    },
    {
        id: "EUAIAct-9.4",
        framework: "EU-AI-ACT",
        category: "Risk Management",
        title: "Testing for Risk Management",
        description: "Testing shall be performed to identify the most appropriate and targeted risk management measures. Testing shall ensure AI systems perform consistently and meet requirements.",
        keywords: [
            "testing",
            "risk measures",
            "performance testing",
        ],
        findingCategories: [
            "prompt-injection",
            "model-denial-of-service",
        ],
        severityThreshold: "high",
    },
    {
        id: "EUAIAct-10",
        framework: "EU-AI-ACT",
        category: "Data Governance",
        title: "Data and Data Governance",
        description: "Training, validation and testing data sets shall be subject to appropriate data governance and management practices. This includes examination of biases, gaps, and data quality.",
        keywords: [
            "data governance",
            "training data",
            "bias",
            "data quality",
        ],
        findingCategories: [
            "training-data-poisoning",
            "integrity-failure",
        ],
        severityThreshold: "high",
    },
    {
        id: "EUAIAct-10.2.f",
        framework: "EU-AI-ACT",
        category: "Data Governance",
        title: "Data Bias Examination",
        description: "Examination in view of possible biases that are likely to affect the health and safety of persons, have a negative impact on fundamental rights, or lead to discrimination.",
        keywords: [
            "bias detection",
            "discrimination",
            "fairness",
        ],
        findingCategories: [
            "training-data-poisoning",
        ],
        severityThreshold: "high",
    },
    {
        id: "EUAIAct-11",
        framework: "EU-AI-ACT",
        category: "Technical Documentation",
        title: "Technical Documentation",
        description: "Technical documentation shall be drawn up before the system is placed on market and kept up to date. Documentation must enable assessment of compliance.",
        keywords: [
            "documentation",
            "technical documentation",
            "compliance assessment",
        ],
        findingCategories: [
            "manifest-drift",
            "tool-drift",
        ],
        severityThreshold: "medium",
    },
    {
        id: "EUAIAct-12",
        framework: "EU-AI-ACT",
        category: "Record-Keeping",
        title: "Record-Keeping",
        description: "High-risk AI systems shall technically allow for automatic recording of events (logs) throughout the system's lifetime. Logging capabilities shall enable monitoring of operation.",
        keywords: [
            "logging",
            "audit trail",
            "event recording",
            "monitoring",
        ],
        findingCategories: [
            "logging-failure",
            "unsigned-change",
        ],
        severityThreshold: "high",
    },
    {
        id: "EUAIAct-12.2",
        framework: "EU-AI-ACT",
        category: "Record-Keeping",
        title: "Traceability of Logs",
        description: "Logging shall enable traceability of AI system functioning throughout its lifecycle. Logs must be sufficient for post-market monitoring.",
        keywords: [
            "traceability",
            "audit logs",
            "post-market monitoring",
        ],
        findingCategories: [
            "logging-failure",
        ],
        severityThreshold: "high",
    },
    {
        id: "EUAIAct-13",
        framework: "EU-AI-ACT",
        category: "Transparency",
        title: "Transparency and Provision of Information",
        description: "High-risk AI systems shall be designed to enable deployers to interpret outputs and use them appropriately. Users shall be informed of system capabilities and limitations.",
        keywords: [
            "transparency",
            "interpretability",
            "user information",
            "explainability",
        ],
        findingCategories: [
            "overreliance",
            "sensitive-disclosure",
        ],
        severityThreshold: "medium",
    },
    {
        id: "EUAIAct-13.3.b.ii",
        framework: "EU-AI-ACT",
        category: "Transparency",
        title: "Known Limitations",
        description: "Instructions for use shall include known or foreseeable circumstances that may lead to risks to health, safety, or fundamental rights, including misuse.",
        keywords: [
            "limitations",
            "known risks",
            "misuse prevention",
        ],
        findingCategories: [
            "prompt-injection",
            "excessive-agency",
        ],
        severityThreshold: "medium",
    },
    {
        id: "EUAIAct-14",
        framework: "EU-AI-ACT",
        category: "Human Oversight",
        title: "Human Oversight",
        description: "High-risk AI systems shall be designed to be effectively overseen by natural persons during use. Human oversight shall prevent or minimize risks to health, safety, or fundamental rights.",
        keywords: [
            "human oversight",
            "human control",
            "intervention",
            "override",
        ],
        findingCategories: [
            "excessive-agency",
            "overreliance",
            "consensus-manipulation",
        ],
        severityThreshold: "high",
    },
    {
        id: "EUAIAct-14.4.a",
        framework: "EU-AI-ACT",
        category: "Human Oversight",
        title: "Understand AI Capabilities",
        description: "Human oversight shall enable the individuals to fully understand the capacities and limitations of the high-risk AI system and duly monitor its operation.",
        keywords: [
            "understanding",
            "capabilities",
            "monitoring",
        ],
        findingCategories: [
            "overreliance",
        ],
        severityThreshold: "medium",
    },
    {
        id: "EUAIAct-14.4.d",
        framework: "EU-AI-ACT",
        category: "Human Oversight",
        title: "Decide Not to Use AI Output",
        description: "Human oversight shall enable the individuals to decide not to use the AI system output or to override, disregard, or reverse it.",
        keywords: [
            "override",
            "human decision",
            "reversal",
        ],
        findingCategories: [
            "excessive-agency",
        ],
        severityThreshold: "high",
    },
    {
        id: "EUAIAct-14.4.e",
        framework: "EU-AI-ACT",
        category: "Human Oversight",
        title: "Interrupt AI Operation",
        description: "Human oversight shall enable the individuals to interrupt the operation of the high-risk AI system through a 'stop' button or similar procedure.",
        keywords: [
            "stop button",
            "interrupt",
            "emergency stop",
        ],
        findingCategories: [
            "excessive-agency",
        ],
        severityThreshold: "high",
    },
    {
        id: "EUAIAct-15",
        framework: "EU-AI-ACT",
        category: "Accuracy, Robustness, Cybersecurity",
        title: "Accuracy, Robustness, and Cybersecurity",
        description: "High-risk AI systems shall achieve an appropriate level of accuracy, robustness, and cybersecurity, and perform consistently throughout their lifecycle.",
        keywords: [
            "accuracy",
            "robustness",
            "cybersecurity",
            "consistency",
        ],
        findingCategories: [
            "prompt-injection",
            "model-denial-of-service",
            "supply-chain-vuln",
        ],
        severityThreshold: "high",
    },
    {
        id: "EUAIAct-15.4",
        framework: "EU-AI-ACT",
        category: "Accuracy, Robustness, Cybersecurity",
        title: "Resilience Against Manipulation",
        description: "High-risk AI systems shall be resilient against attempts by unauthorized third parties to alter their use, outputs, or performance by exploiting system vulnerabilities.",
        keywords: [
            "resilience",
            "manipulation prevention",
            "adversarial attacks",
        ],
        findingCategories: [
            "prompt-injection",
            "training-data-poisoning",
            "model-theft",
        ],
        severityThreshold: "critical",
    },
    {
        id: "EUAIAct-15.5",
        framework: "EU-AI-ACT",
        category: "Accuracy, Robustness, Cybersecurity",
        title: "Adversarial Attack Resilience",
        description: "Technical solutions to address AI specific vulnerabilities shall include measures to prevent, detect, respond to, resolve, and control attacks trying to manipulate training datasets or models.",
        keywords: [
            "adversarial attacks",
            "data poisoning",
            "model manipulation",
        ],
        findingCategories: [
            "prompt-injection",
            "training-data-poisoning",
            "insecure-plugin",
        ],
        severityThreshold: "critical",
    },
    // ============================================================================
    // Chapter V: General Purpose AI Models (Articles 51-56)
    // ============================================================================
    {
        id: "EUAIAct-53.1.a",
        framework: "EU-AI-ACT",
        category: "GPAI Obligations",
        title: "GPAI Technical Documentation",
        description: "Providers of general-purpose AI models shall draw up and keep up-to-date technical documentation of the model, including training and testing process.",
        keywords: [
            "gpai",
            "general purpose ai",
            "technical documentation",
        ],
        findingCategories: [
            "manifest-drift",
        ],
        severityThreshold: "medium",
    },
    {
        id: "EUAIAct-53.1.b",
        framework: "EU-AI-ACT",
        category: "GPAI Obligations",
        title: "GPAI Provider Information",
        description: "Providers of general-purpose AI models shall draw up, keep up-to-date, and make available information and documentation to providers of AI systems that intend to integrate the model.",
        keywords: [
            "integration documentation",
            "downstream providers",
            "model documentation",
        ],
        findingCategories: [
            "sensitive-disclosure",
        ],
        severityThreshold: "medium",
    },
    {
        id: "EUAIAct-53.1.c",
        framework: "EU-AI-ACT",
        category: "GPAI Obligations",
        title: "Copyright Compliance Policy",
        description: "Providers of general-purpose AI models shall put in place a policy to comply with Union copyright law, including mechanisms to identify and comply with reservations of rights.",
        keywords: [
            "copyright",
            "intellectual property",
            "training data rights",
        ],
        findingCategories: [],
        severityThreshold: "low",
    },
    {
        id: "EUAIAct-55.1",
        framework: "EU-AI-ACT",
        category: "GPAI Systemic Risk",
        title: "Systemic Risk GPAI Model Evaluation",
        description: "Providers of general-purpose AI models with systemic risk shall perform model evaluations, including adversarial testing to identify and mitigate systemic risks.",
        keywords: [
            "systemic risk",
            "model evaluation",
            "adversarial testing",
        ],
        findingCategories: [
            "prompt-injection",
            "model-denial-of-service",
            "model-theft",
        ],
        severityThreshold: "critical",
    },
    {
        id: "EUAIAct-55.1.b",
        framework: "EU-AI-ACT",
        category: "GPAI Systemic Risk",
        title: "Systemic Risk Mitigation",
        description: "Providers of GPAI models with systemic risk shall assess and mitigate possible systemic risks at Union level, including their sources.",
        keywords: [
            "systemic risk mitigation",
            "risk assessment",
            "risk sources",
        ],
        findingCategories: [
            "excessive-agency",
            "exfil-path",
        ],
        severityThreshold: "critical",
    },
    {
        id: "EUAIAct-55.1.c",
        framework: "EU-AI-ACT",
        category: "GPAI Systemic Risk",
        title: "Incident Tracking and Reporting",
        description: "Providers of GPAI models with systemic risk shall track, document, and report relevant information about serious incidents and possible corrective measures.",
        keywords: [
            "incident tracking",
            "serious incidents",
            "corrective measures",
        ],
        findingCategories: [
            "logging-failure",
        ],
        severityThreshold: "high",
    },
    {
        id: "EUAIAct-55.1.d",
        framework: "EU-AI-ACT",
        category: "GPAI Systemic Risk",
        title: "Cybersecurity Protection",
        description: "Providers of GPAI models with systemic risk shall ensure an adequate level of cybersecurity protection for the model and physical infrastructure.",
        keywords: [
            "cybersecurity",
            "model protection",
            "infrastructure security",
        ],
        findingCategories: [
            "supply-chain-vuln",
            "model-theft",
            "missing-sandbox",
        ],
        severityThreshold: "critical",
    },
    // ============================================================================
    // Chapter IX: Post-Market Monitoring (Articles 72-73)
    // ============================================================================
    {
        id: "EUAIAct-72",
        framework: "EU-AI-ACT",
        category: "Post-Market Monitoring",
        title: "Post-Market Monitoring System",
        description: "Providers shall establish and document a post-market monitoring system proportionate to the nature of the AI system. The system shall actively collect relevant data.",
        keywords: [
            "post-market monitoring",
            "data collection",
            "continuous monitoring",
        ],
        findingCategories: [
            "manifest-drift",
            "tool-drift",
            "unsigned-change",
        ],
        severityThreshold: "high",
    },
    {
        id: "EUAIAct-73",
        framework: "EU-AI-ACT",
        category: "Incident Reporting",
        title: "Reporting of Serious Incidents",
        description: "Providers of high-risk AI systems shall report any serious incident to market surveillance authorities without undue delay. Incidents include those posing risks to health, safety, or fundamental rights.",
        keywords: [
            "incident reporting",
            "serious incidents",
            "market surveillance",
        ],
        findingCategories: [
            "logging-failure",
        ],
        severityThreshold: "critical",
    },
];
/**
 * Get all EU AI Act controls
 */
export function getEUAIActControls() {
    return EU_AI_ACT_CONTROLS;
}
/**
 * Get EU AI Act control by ID
 */
export function getEUAIActControlById(id) {
    return EU_AI_ACT_CONTROLS.find((c) => c.id === id);
}
/**
 * Get EU AI Act controls by category
 */
export function getEUAIActControlsByCategory(category) {
    return EU_AI_ACT_CONTROLS.filter((c) => c.category === category);
}
/**
 * Get all EU AI Act categories
 */
export function getEUAIActCategories() {
    return [...new Set(EU_AI_ACT_CONTROLS.map((c) => c.category))];
}
/**
 * Determine AI system risk level based on findings
 */
export function determineRiskLevel(findingCategories) {
    const criticalCategories = [
        "prompt-injection",
        "training-data-poisoning",
        "model-theft",
        "exfil-path",
    ];
    const highCategories = [
        "excessive-agency",
        "insecure-plugin",
        "supply-chain-vuln",
        "missing-sandbox",
    ];
    const hasCritical = findingCategories.some((c) => criticalCategories.includes(c));
    const hasHigh = findingCategories.some((c) => highCategories.includes(c));
    if (hasCritical)
        return "High";
    if (hasHigh)
        return "High";
    if (findingCategories.length > 0)
        return "Limited";
    return "Minimal";
}
/**
 * Get applicable articles based on AI system type
 */
export function getApplicableArticles(isHighRisk, isGPAI, hasSystemicRisk) {
    const articles = ["EUAIAct-5.1.a", "EUAIAct-5.1.b", "EUAIAct-5.1.c"];
    if (isHighRisk) {
        articles.push("EUAIAct-9", "EUAIAct-9.2.a", "EUAIAct-9.2.b", "EUAIAct-9.4", "EUAIAct-10", "EUAIAct-10.2.f", "EUAIAct-11", "EUAIAct-12", "EUAIAct-12.2", "EUAIAct-13", "EUAIAct-13.3.b.ii", "EUAIAct-14", "EUAIAct-14.4.a", "EUAIAct-14.4.d", "EUAIAct-14.4.e", "EUAIAct-15", "EUAIAct-15.4", "EUAIAct-15.5", "EUAIAct-72", "EUAIAct-73");
    }
    if (isGPAI) {
        articles.push("EUAIAct-53.1.a", "EUAIAct-53.1.b", "EUAIAct-53.1.c");
    }
    if (hasSystemicRisk) {
        articles.push("EUAIAct-55.1", "EUAIAct-55.1.b", "EUAIAct-55.1.c", "EUAIAct-55.1.d");
    }
    return articles;
}
/**
 * Cross-mapping to OWASP LLM Top 10
 */
export const EU_AI_ACT_TO_OWASP_LLM_MAPPING = {
    "EUAIAct-15.4": ["LLM01", "LLM02"], // Resilience → Prompt Injection, Insecure Output
    "EUAIAct-15.5": ["LLM01", "LLM03"], // Adversarial → Prompt Injection, Data Poisoning
    "EUAIAct-10": ["LLM03"], // Data Governance → Training Data Poisoning
    "EUAIAct-9.4": ["LLM01", "LLM04"], // Testing → Prompt Injection, Model DoS
    "EUAIAct-14": ["LLM08", "LLM09"], // Human Oversight → Excessive Agency, Overreliance
    "EUAIAct-15": ["LLM05"], // Cybersecurity → Supply Chain
    "EUAIAct-12": ["LLM06"], // Record-Keeping → Sensitive Disclosure
    "EUAIAct-55.1.d": ["LLM10"], // GPAI Cybersecurity → Model Theft
};
//# sourceMappingURL=eu-ai-act.js.map