@ansvar/eu-regulations-mcp 0.1.0 → 0.2.1

package/data/seed/applicability/ai-act.json

@@ -0,0 +1,87 @@
+[
+  {
+    "regulation": "AI_ACT",
+    "sector": "financial",
+    "subsector": "bank",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "6",
+    "notes": "AI systems for creditworthiness assessment and credit scoring are high-risk (Annex III)"
+  },
+  {
+    "regulation": "AI_ACT",
+    "sector": "financial",
+    "subsector": "insurance",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "6",
+    "notes": "AI systems for risk assessment and pricing in life/health insurance are high-risk (Annex III)"
+  },
+  {
+    "regulation": "AI_ACT",
+    "sector": "healthcare",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "6",
+    "notes": "AI medical devices and diagnostic systems are high-risk (Annex III); AI in healthcare management covered"
+  },
+  {
+    "regulation": "AI_ACT",
+    "sector": "public_administration",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "6",
+    "notes": "AI for access to public services, benefits, emergency services is high-risk (Annex III)"
+  },
+  {
+    "regulation": "AI_ACT",
+    "sector": "transport",
+    "subsector": "automotive_oem",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "6",
+    "notes": "AI safety components in vehicles are high-risk as per product safety legislation (Annex I)"
+  },
+  {
+    "regulation": "AI_ACT",
+    "sector": "transport",
+    "subsector": "aviation",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "6",
+    "notes": "AI in aviation safety management is high-risk (Annex I references aviation regulations)"
+  },
+  {
+    "regulation": "AI_ACT",
+    "sector": "digital_infrastructure",
+    "subsector": "vlop",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "6",
+    "notes": "AI recommender systems on VLOPs have transparency requirements; high-risk if used for content moderation"
+  },
+  {
+    "regulation": "AI_ACT",
+    "sector": "energy",
+    "applies": true,
+    "confidence": "likely",
+    "basis_article": "6",
+    "notes": "AI in critical infrastructure management may be high-risk; grid management AI covered"
+  },
+  {
+    "regulation": "AI_ACT",
+    "sector": "manufacturing",
+    "applies": true,
+    "confidence": "likely",
+    "basis_article": "6",
+    "notes": "AI safety components in machinery are high-risk (Annex I); general manufacturing AI may be limited risk"
+  },
+  {
+    "regulation": "AI_ACT",
+    "sector": "other",
+    "applies": true,
+    "confidence": "likely",
+    "basis_article": "50",
+    "notes": "All AI systems interacting with humans have transparency obligations (Art 50); emotion recognition and biometric categorization restricted"
+  }
+]

package/data/seed/applicability/aifmd.json

@@ -0,0 +1,74 @@
+[
+  {
+    "regulation": "AIFMD",
+    "sector": "financial",
+    "subsector": "fund_managers",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "AIFMD regulates managers of alternative investment funds"
+  },
+  {
+    "regulation": "AIFMD",
+    "sector": "financial",
+    "subsector": "hedge_funds",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "Hedge fund managers are within scope"
+  },
+  {
+    "regulation": "AIFMD",
+    "sector": "financial",
+    "subsector": "private_equity",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "Private equity fund managers are within scope"
+  },
+  {
+    "regulation": "AIFMD",
+    "sector": "financial",
+    "subsector": "real_estate_funds",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "Real estate fund managers are within scope"
+  },
+  {
+    "regulation": "AIFMD",
+    "sector": "financial",
+    "subsector": "depositaries",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "21",
+    "notes": "Depositaries of AIFs have specific obligations"
+  },
+  {
+    "regulation": "AIFMD",
+    "sector": "healthcare",
+    "subsector": null,
+    "applies": false,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "Healthcare sector not in scope"
+  },
+  {
+    "regulation": "AIFMD",
+    "sector": "energy",
+    "subsector": null,
+    "applies": false,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "Energy sector not in scope"
+  },
+  {
+    "regulation": "AIFMD",
+    "sector": "other",
+    "subsector": null,
+    "applies": false,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "AIFMD specifically targets alternative investment fund managers"
+  }
+]

package/data/seed/applicability/cbam.json

@@ -0,0 +1,74 @@
+[
+  {
+    "regulation": "CBAM",
+    "sector": "manufacturing",
+    "subsector": "steel",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "Steel importers must comply with CBAM reporting and certificates"
+  },
+  {
+    "regulation": "CBAM",
+    "sector": "manufacturing",
+    "subsector": "aluminium",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "Aluminium importers must comply with CBAM"
+  },
+  {
+    "regulation": "CBAM",
+    "sector": "manufacturing",
+    "subsector": "cement",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "Cement importers must comply with CBAM"
+  },
+  {
+    "regulation": "CBAM",
+    "sector": "manufacturing",
+    "subsector": "fertilizers",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "Fertilizer importers must comply with CBAM"
+  },
+  {
+    "regulation": "CBAM",
+    "sector": "energy",
+    "subsector": "electricity",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "Electricity importers must comply with CBAM"
+  },
+  {
+    "regulation": "CBAM",
+    "sector": "energy",
+    "subsector": "hydrogen",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "Hydrogen importers must comply with CBAM"
+  },
+  {
+    "regulation": "CBAM",
+    "sector": "financial",
+    "subsector": null,
+    "applies": false,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "Financial sector not in scope"
+  },
+  {
+    "regulation": "CBAM",
+    "sector": "other",
+    "subsector": "customs_declarants",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "4",
+    "notes": "Customs declarants of CBAM goods must register"
+  }
+]

package/data/seed/applicability/cer.json

@@ -0,0 +1,74 @@
+[
+  {
+    "regulation": "CER",
+    "sector": "energy",
+    "subsector": null,
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "CER applies to critical entities in energy sector"
+  },
+  {
+    "regulation": "CER",
+    "sector": "transport",
+    "subsector": null,
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "CER applies to critical entities in transport sector"
+  },
+  {
+    "regulation": "CER",
+    "sector": "financial",
+    "subsector": null,
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "CER applies to critical entities in banking and financial market infrastructure"
+  },
+  {
+    "regulation": "CER",
+    "sector": "healthcare",
+    "subsector": null,
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "CER applies to critical entities in health sector"
+  },
+  {
+    "regulation": "CER",
+    "sector": "digital_infrastructure",
+    "subsector": null,
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "CER applies to critical digital infrastructure operators"
+  },
+  {
+    "regulation": "CER",
+    "sector": "public_administration",
+    "subsector": null,
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "Central government public administration entities may be in scope"
+  },
+  {
+    "regulation": "CER",
+    "sector": "manufacturing",
+    "subsector": "food",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "Food production, processing and distribution entities may be critical"
+  },
+  {
+    "regulation": "CER",
+    "sector": "other",
+    "subsector": "space",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "Space sector operators may be designated as critical entities"
+  }
+]

package/data/seed/applicability/cra.json

@@ -0,0 +1,77 @@
+[
+  {
+    "regulation": "CRA",
+    "sector": "manufacturing",
+    "subsector": "iot_devices",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "2",
+    "notes": "IoT devices with network connectivity are products with digital elements; must meet essential cybersecurity requirements"
+  },
+  {
+    "regulation": "CRA",
+    "sector": "manufacturing",
+    "subsector": "consumer_electronics",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "2",
+    "notes": "Smart home devices, wearables, connected appliances are in scope"
+  },
+  {
+    "regulation": "CRA",
+    "sector": "manufacturing",
+    "subsector": "industrial_equipment",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "2",
+    "notes": "Industrial control systems, PLCs with digital elements are in scope; may be Important Products Class I/II"
+  },
+  {
+    "regulation": "CRA",
+    "sector": "digital_infrastructure",
+    "subsector": "software_vendor",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "2",
+    "notes": "Commercial software products are in scope; open-source non-commercial may be exempt (Art 2(8))"
+  },
+  {
+    "regulation": "CRA",
+    "sector": "transport",
+    "subsector": "automotive_supplier",
+    "applies": true,
+    "confidence": "likely",
+    "basis_article": "2",
+    "notes": "Aftermarket ECUs and connected vehicle components in scope; OEM components may be covered by R155/R156"
+  },
+  {
+    "regulation": "CRA",
+    "sector": "healthcare",
+    "applies": true,
+    "confidence": "likely",
+    "basis_article": "2",
+    "notes": "Connected medical devices in scope unless covered by MDR; health IoT devices covered"
+  },
+  {
+    "regulation": "CRA",
+    "sector": "energy",
+    "applies": true,
+    "confidence": "likely",
+    "basis_article": "2",
+    "notes": "Smart meters, grid equipment with digital elements in scope; may be Important Products"
+  },
+  {
+    "regulation": "CRA",
+    "sector": "financial",
+    "applies": false,
+    "confidence": "likely",
+    "notes": "Financial services themselves not in scope; but connected devices/software used by financial sector covered"
+  },
+  {
+    "regulation": "CRA",
+    "sector": "public_administration",
+    "applies": false,
+    "confidence": "likely",
+    "notes": "CRA applies to product manufacturers/importers, not end-users; public sector is a user, not producer"
+  }
+]

package/data/seed/applicability/csddd.json

@@ -0,0 +1,74 @@
+[
+  {
+    "regulation": "CSDDD",
+    "sector": "manufacturing",
+    "subsector": null,
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "2",
+    "notes": "Large manufacturing companies must conduct human rights and environmental due diligence"
+  },
+  {
+    "regulation": "CSDDD",
+    "sector": "financial",
+    "subsector": null,
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "2",
+    "notes": "Large financial undertakings are in scope"
+  },
+  {
+    "regulation": "CSDDD",
+    "sector": "energy",
+    "subsector": null,
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "2",
+    "notes": "Large energy companies must conduct value chain due diligence"
+  },
+  {
+    "regulation": "CSDDD",
+    "sector": "transport",
+    "subsector": null,
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "2",
+    "notes": "Large transport companies must conduct value chain due diligence"
+  },
+  {
+    "regulation": "CSDDD",
+    "sector": "healthcare",
+    "subsector": null,
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "2",
+    "notes": "Large healthcare companies must conduct value chain due diligence"
+  },
+  {
+    "regulation": "CSDDD",
+    "sector": "digital_infrastructure",
+    "subsector": null,
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "2",
+    "notes": "Large digital companies must conduct value chain due diligence"
+  },
+  {
+    "regulation": "CSDDD",
+    "sector": "other",
+    "subsector": "third_country_companies",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "2",
+    "notes": "Third-country companies with significant EU turnover are in scope"
+  },
+  {
+    "regulation": "CSDDD",
+    "sector": "public_administration",
+    "subsector": null,
+    "applies": false,
+    "confidence": "definite",
+    "basis_article": "2",
+    "notes": "Public bodies not in scope"
+  }
+]

package/data/seed/applicability/csrd.json

@@ -0,0 +1,74 @@
+[
+  {
+    "regulation": "CSRD",
+    "sector": "financial",
+    "subsector": null,
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "Large financial undertakings must report under CSRD"
+  },
+  {
+    "regulation": "CSRD",
+    "sector": "manufacturing",
+    "subsector": null,
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "Large manufacturing companies must provide sustainability reports"
+  },
+  {
+    "regulation": "CSRD",
+    "sector": "energy",
+    "subsector": null,
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "Large energy companies must provide sustainability reports"
+  },
+  {
+    "regulation": "CSRD",
+    "sector": "transport",
+    "subsector": null,
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "Large transport companies must provide sustainability reports"
+  },
+  {
+    "regulation": "CSRD",
+    "sector": "healthcare",
+    "subsector": null,
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "Large healthcare companies must provide sustainability reports"
+  },
+  {
+    "regulation": "CSRD",
+    "sector": "digital_infrastructure",
+    "subsector": null,
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "Large digital companies must provide sustainability reports"
+  },
+  {
+    "regulation": "CSRD",
+    "sector": "public_administration",
+    "subsector": null,
+    "applies": false,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "Public bodies generally not in scope"
+  },
+  {
+    "regulation": "CSRD",
+    "sector": "other",
+    "subsector": "listed_smes",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "Listed SMEs (except micro) must report with simplified standards"
+  }
+]

package/data/seed/applicability/cyber_solidarity.json

@@ -0,0 +1,74 @@
+[
+  {
+    "regulation": "CYBER_SOLIDARITY",
+    "sector": "digital_infrastructure",
+    "subsector": null,
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "1",
+    "notes": "Cyber Solidarity Act strengthens EU cyber threat detection and incident response"
+  },
+  {
+    "regulation": "CYBER_SOLIDARITY",
+    "sector": "public_administration",
+    "subsector": null,
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "3",
+    "notes": "National Cyber Hubs and competent authorities are central to the Act"
+  },
+  {
+    "regulation": "CYBER_SOLIDARITY",
+    "sector": "financial",
+    "subsector": null,
+    "applies": true,
+    "confidence": "likely",
+    "basis_article": "1",
+    "notes": "Critical sectors including finance benefit from EU Cybersecurity Reserve"
+  },
+  {
+    "regulation": "CYBER_SOLIDARITY",
+    "sector": "healthcare",
+    "subsector": null,
+    "applies": true,
+    "confidence": "likely",
+    "basis_article": "1",
+    "notes": "Healthcare is a critical sector covered by cyber solidarity measures"
+  },
+  {
+    "regulation": "CYBER_SOLIDARITY",
+    "sector": "energy",
+    "subsector": null,
+    "applies": true,
+    "confidence": "likely",
+    "basis_article": "1",
+    "notes": "Energy is a critical sector covered by cyber solidarity measures"
+  },
+  {
+    "regulation": "CYBER_SOLIDARITY",
+    "sector": "transport",
+    "subsector": null,
+    "applies": true,
+    "confidence": "likely",
+    "basis_article": "1",
+    "notes": "Transport is a critical sector covered by cyber solidarity measures"
+  },
+  {
+    "regulation": "CYBER_SOLIDARITY",
+    "sector": "manufacturing",
+    "subsector": null,
+    "applies": false,
+    "confidence": "likely",
+    "basis_article": "1",
+    "notes": "General manufacturing not directly targeted, but may benefit from incident response"
+  },
+  {
+    "regulation": "CYBER_SOLIDARITY",
+    "sector": "other",
+    "subsector": "cybersecurity_providers",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "12",
+    "notes": "Managed security service providers can join EU Cybersecurity Reserve"
+  }
+]

package/data/seed/applicability/cybersecurity-act.json

@@ -0,0 +1,69 @@
+[
+  {
+    "regulation": "CYBERSECURITY_ACT",
+    "sector": "digital_infrastructure",
+    "subsector": "cloud_provider",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "46",
+    "notes": "Cloud services eligible for EU cybersecurity certification under EUCS scheme (in development)"
+  },
+  {
+    "regulation": "CYBERSECURITY_ACT",
+    "sector": "digital_infrastructure",
+    "subsector": "software_vendor",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "46",
+    "notes": "ICT products and services can obtain EU cybersecurity certification; schemes cover various product categories"
+  },
+  {
+    "regulation": "CYBERSECURITY_ACT",
+    "sector": "manufacturing",
+    "subsector": "iot_devices",
+    "applies": true,
+    "confidence": "definite",
+    "basis_article": "46",
+    "notes": "IoT devices eligible for certification under EUCC (Common Criteria based) or future schemes"
+  },
+  {
+    "regulation": "CYBERSECURITY_ACT",
+    "sector": "public_administration",
+    "applies": true,
+    "confidence": "likely",
+    "basis_article": "48",
+    "notes": "Public sector may require certified products/services; Art 48 allows Member States to mandate certification"
+  },
+  {
+    "regulation": "CYBERSECURITY_ACT",
+    "sector": "financial",
+    "applies": true,
+    "confidence": "likely",
+    "basis_article": "46",
+    "notes": "Financial entities may use certified products to demonstrate compliance with DORA requirements"
+  },
+  {
+    "regulation": "CYBERSECURITY_ACT",
+    "sector": "energy",
+    "applies": true,
+    "confidence": "likely",
+    "basis_article": "46",
+    "notes": "Critical infrastructure operators may require certified products under NIS2 implementation"
+  },
+  {
+    "regulation": "CYBERSECURITY_ACT",
+    "sector": "healthcare",
+    "applies": true,
+    "confidence": "likely",
+    "basis_article": "46",
+    "notes": "Healthcare IT products can be certified; may align with MDR cybersecurity requirements"
+  },
+  {
+    "regulation": "CYBERSECURITY_ACT",
+    "sector": "transport",
+    "applies": true,
+    "confidence": "likely",
+    "basis_article": "46",
+    "notes": "Transport sector IT systems eligible for certification; may support UN R155 compliance"
+  }
+]