@ansvar/eu-regulations-mcp 0.1.0 → 0.2.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (156) hide show
  1. package/LICENSE +190 -21
  2. package/README.md +159 -26
  3. package/data/seed/aifmd.json +432 -0
  4. package/data/seed/applicability/ai-act.json +87 -0
  5. package/data/seed/applicability/aifmd.json +74 -0
  6. package/data/seed/applicability/cbam.json +74 -0
  7. package/data/seed/applicability/cer.json +74 -0
  8. package/data/seed/applicability/cra.json +77 -0
  9. package/data/seed/applicability/csddd.json +74 -0
  10. package/data/seed/applicability/csrd.json +74 -0
  11. package/data/seed/applicability/cyber_solidarity.json +74 -0
  12. package/data/seed/applicability/cybersecurity-act.json +69 -0
  13. package/data/seed/applicability/data-act.json +71 -0
  14. package/data/seed/applicability/dga.json +74 -0
  15. package/data/seed/applicability/dma.json +77 -0
  16. package/data/seed/applicability/dsa.json +71 -0
  17. package/data/seed/applicability/eecc.json +74 -0
  18. package/data/seed/applicability/ehds.json +74 -0
  19. package/data/seed/applicability/eidas2.json +86 -0
  20. package/data/seed/applicability/eprivacy.json +74 -0
  21. package/data/seed/applicability/eu_taxonomy.json +74 -0
  22. package/data/seed/applicability/eucc.json +74 -0
  23. package/data/seed/applicability/eudr.json +74 -0
  24. package/data/seed/applicability/gpsr.json +74 -0
  25. package/data/seed/applicability/ivdr.json +74 -0
  26. package/data/seed/applicability/led.json +74 -0
  27. package/data/seed/applicability/machinery.json +74 -0
  28. package/data/seed/applicability/mdr.json +74 -0
  29. package/data/seed/applicability/mica.json +74 -0
  30. package/data/seed/applicability/mifid2.json +74 -0
  31. package/data/seed/applicability/mifir.json +74 -0
  32. package/data/seed/applicability/pld.json +74 -0
  33. package/data/seed/applicability/psd2.json +74 -0
  34. package/data/seed/applicability/red.json +74 -0
  35. package/data/seed/applicability/sfdr.json +74 -0
  36. package/data/seed/applicability/un-r155.json +68 -0
  37. package/data/seed/applicability/un-r156.json +68 -0
  38. package/data/seed/cbam.json +397 -0
  39. package/data/seed/cer.json +233 -0
  40. package/data/seed/csddd.json +205 -0
  41. package/data/seed/csrd.json +50 -0
  42. package/data/seed/cyber_solidarity.json +252 -0
  43. package/data/seed/data-act.json +517 -0
  44. package/data/seed/dga.json +342 -0
  45. package/data/seed/dma.json +499 -0
  46. package/data/seed/dsa.json +686 -0
  47. package/data/seed/eecc.json +981 -0
  48. package/data/seed/ehds.json +638 -0
  49. package/data/seed/eidas2.json +590 -0
  50. package/data/seed/eprivacy.json +115 -0
  51. package/data/seed/eu_taxonomy.json +285 -0
  52. package/data/seed/eucc.json +386 -0
  53. package/data/seed/eudr.json +401 -0
  54. package/data/seed/gpsr.json +462 -0
  55. package/data/seed/ivdr.json +1036 -0
  56. package/data/seed/led.json +480 -0
  57. package/data/seed/machinery.json +513 -0
  58. package/data/seed/mappings/iso27001-ai-act.json +114 -0
  59. package/data/seed/mappings/iso27001-aifmd.json +50 -0
  60. package/data/seed/mappings/iso27001-cbam.json +26 -0
  61. package/data/seed/mappings/iso27001-cer.json +74 -0
  62. package/data/seed/mappings/iso27001-cra.json +130 -0
  63. package/data/seed/mappings/iso27001-csddd.json +50 -0
  64. package/data/seed/mappings/iso27001-csrd.json +26 -0
  65. package/data/seed/mappings/iso27001-cyber_solidarity.json +82 -0
  66. package/data/seed/mappings/iso27001-cybersecurity-act.json +90 -0
  67. package/data/seed/mappings/iso27001-data-act.json +66 -0
  68. package/data/seed/mappings/iso27001-dga.json +50 -0
  69. package/data/seed/mappings/iso27001-dma.json +50 -0
  70. package/data/seed/mappings/iso27001-dsa.json +58 -0
  71. package/data/seed/mappings/iso27001-eecc.json +74 -0
  72. package/data/seed/mappings/iso27001-ehds.json +90 -0
  73. package/data/seed/mappings/iso27001-eidas2.json +106 -0
  74. package/data/seed/mappings/iso27001-eprivacy.json +66 -0
  75. package/data/seed/mappings/iso27001-eu_taxonomy.json +34 -0
  76. package/data/seed/mappings/iso27001-eucc.json +66 -0
  77. package/data/seed/mappings/iso27001-eudr.json +34 -0
  78. package/data/seed/mappings/iso27001-gpsr.json +42 -0
  79. package/data/seed/mappings/iso27001-ivdr.json +66 -0
  80. package/data/seed/mappings/iso27001-led.json +74 -0
  81. package/data/seed/mappings/iso27001-machinery.json +50 -0
  82. package/data/seed/mappings/iso27001-mdr.json +82 -0
  83. package/data/seed/mappings/iso27001-mica.json +66 -0
  84. package/data/seed/mappings/iso27001-mifid2.json +66 -0
  85. package/data/seed/mappings/iso27001-mifir.json +42 -0
  86. package/data/seed/mappings/iso27001-pld.json +26 -0
  87. package/data/seed/mappings/iso27001-psd2.json +82 -0
  88. package/data/seed/mappings/iso27001-red.json +42 -0
  89. package/data/seed/mappings/iso27001-sfdr.json +50 -0
  90. package/data/seed/mappings/iso27001-un-r155.json +130 -0
  91. package/data/seed/mappings/iso27001-un-r156.json +106 -0
  92. package/data/seed/mappings/nist-csf-ai-act.json +138 -0
  93. package/data/seed/mappings/nist-csf-aifmd.json +58 -0
  94. package/data/seed/mappings/nist-csf-cbam.json +42 -0
  95. package/data/seed/mappings/nist-csf-cer.json +90 -0
  96. package/data/seed/mappings/nist-csf-cra.json +130 -0
  97. package/data/seed/mappings/nist-csf-csddd.json +50 -0
  98. package/data/seed/mappings/nist-csf-csrd.json +34 -0
  99. package/data/seed/mappings/nist-csf-cyber_solidarity.json +90 -0
  100. package/data/seed/mappings/nist-csf-cybersecurity-act.json +90 -0
  101. package/data/seed/mappings/nist-csf-data-act.json +50 -0
  102. package/data/seed/mappings/nist-csf-dga.json +58 -0
  103. package/data/seed/mappings/nist-csf-dma.json +42 -0
  104. package/data/seed/mappings/nist-csf-dora.json +210 -0
  105. package/data/seed/mappings/nist-csf-dsa.json +82 -0
  106. package/data/seed/mappings/nist-csf-eecc.json +90 -0
  107. package/data/seed/mappings/nist-csf-ehds.json +98 -0
  108. package/data/seed/mappings/nist-csf-eidas2.json +114 -0
  109. package/data/seed/mappings/nist-csf-eprivacy.json +58 -0
  110. package/data/seed/mappings/nist-csf-eu_taxonomy.json +34 -0
  111. package/data/seed/mappings/nist-csf-eucc.json +66 -0
  112. package/data/seed/mappings/nist-csf-eudr.json +58 -0
  113. package/data/seed/mappings/nist-csf-gdpr.json +178 -0
  114. package/data/seed/mappings/nist-csf-gpsr.json +58 -0
  115. package/data/seed/mappings/nist-csf-ivdr.json +66 -0
  116. package/data/seed/mappings/nist-csf-led.json +74 -0
  117. package/data/seed/mappings/nist-csf-machinery.json +58 -0
  118. package/data/seed/mappings/nist-csf-mdr.json +66 -0
  119. package/data/seed/mappings/nist-csf-mica.json +98 -0
  120. package/data/seed/mappings/nist-csf-mifid2.json +74 -0
  121. package/data/seed/mappings/nist-csf-mifir.json +50 -0
  122. package/data/seed/mappings/nist-csf-nis2.json +194 -0
  123. package/data/seed/mappings/nist-csf-pld.json +34 -0
  124. package/data/seed/mappings/nist-csf-psd2.json +98 -0
  125. package/data/seed/mappings/nist-csf-red.json +58 -0
  126. package/data/seed/mappings/nist-csf-sfdr.json +42 -0
  127. package/data/seed/mappings/nist-csf-un-r155.json +130 -0
  128. package/data/seed/mappings/nist-csf-un-r156.json +98 -0
  129. package/data/seed/mdr.json +1066 -0
  130. package/data/seed/mica.json +1003 -0
  131. package/data/seed/mifid2.json +906 -0
  132. package/data/seed/mifir.json +512 -0
  133. package/data/seed/pld.json +244 -0
  134. package/data/seed/psd2.json +827 -0
  135. package/data/seed/red.json +452 -0
  136. package/data/seed/sfdr.json +228 -0
  137. package/data/seed/un-r155.json +166 -0
  138. package/data/seed/un-r156.json +150 -0
  139. package/dist/http-server.d.ts +9 -0
  140. package/dist/http-server.d.ts.map +1 -0
  141. package/dist/http-server.js +342 -0
  142. package/dist/http-server.js.map +1 -0
  143. package/dist/index.js +4 -4
  144. package/dist/index.js.map +1 -1
  145. package/dist/tools/map.d.ts +1 -1
  146. package/dist/tools/map.d.ts.map +1 -1
  147. package/dist/tools/map.js +3 -3
  148. package/dist/tools/map.js.map +1 -1
  149. package/package.json +8 -3
  150. package/scripts/build-db.ts +20 -8
  151. package/scripts/check-updates.ts +141 -39
  152. package/scripts/ingest-eurlex.ts +9 -1
  153. package/scripts/ingest-unece.ts +368 -0
  154. package/src/http-server.ts +380 -0
  155. package/src/index.ts +4 -4
  156. package/src/tools/map.ts +4 -4
@@ -0,0 +1,74 @@
1
+ [
2
+ {
3
+ "regulation": "MIFIR",
4
+ "sector": "financial",
5
+ "subsector": "investment_firms",
6
+ "applies": true,
7
+ "confidence": "definite",
8
+ "basis_article": "1",
9
+ "notes": "MiFIR establishes uniform requirements for trading and transparency"
10
+ },
11
+ {
12
+ "regulation": "MIFIR",
13
+ "sector": "financial",
14
+ "subsector": "trading_venues",
15
+ "applies": true,
16
+ "confidence": "definite",
17
+ "basis_article": "1",
18
+ "notes": "Trading venues must comply with pre and post-trade transparency"
19
+ },
20
+ {
21
+ "regulation": "MIFIR",
22
+ "sector": "financial",
23
+ "subsector": "banks",
24
+ "applies": true,
25
+ "confidence": "definite",
26
+ "basis_article": "1",
27
+ "notes": "Credit institutions providing investment services must comply"
28
+ },
29
+ {
30
+ "regulation": "MIFIR",
31
+ "sector": "financial",
32
+ "subsector": "ccps",
33
+ "applies": true,
34
+ "confidence": "definite",
35
+ "basis_article": "1",
36
+ "notes": "CCPs and persons with proprietary rights to benchmarks are in scope"
37
+ },
38
+ {
39
+ "regulation": "MIFIR",
40
+ "sector": "digital_infrastructure",
41
+ "subsector": null,
42
+ "applies": false,
43
+ "confidence": "definite",
44
+ "basis_article": "1",
45
+ "notes": "Digital infrastructure not directly in scope"
46
+ },
47
+ {
48
+ "regulation": "MIFIR",
49
+ "sector": "healthcare",
50
+ "subsector": null,
51
+ "applies": false,
52
+ "confidence": "definite",
53
+ "basis_article": "1",
54
+ "notes": "Healthcare sector not in scope"
55
+ },
56
+ {
57
+ "regulation": "MIFIR",
58
+ "sector": "energy",
59
+ "subsector": null,
60
+ "applies": false,
61
+ "confidence": "likely",
62
+ "basis_article": "1",
63
+ "notes": "Energy sector generally not in scope unless trading financial instruments"
64
+ },
65
+ {
66
+ "regulation": "MIFIR",
67
+ "sector": "other",
68
+ "subsector": "third_country_firms",
69
+ "applies": true,
70
+ "confidence": "definite",
71
+ "basis_article": "1",
72
+ "notes": "Third-country firms providing services in EU must comply"
73
+ }
74
+ ]
@@ -0,0 +1,74 @@
1
+ [
2
+ {
3
+ "regulation": "PLD",
4
+ "sector": "manufacturing",
5
+ "subsector": null,
6
+ "applies": true,
7
+ "confidence": "definite",
8
+ "basis_article": "1",
9
+ "notes": "Product Liability Directive applies to manufacturers of defective products"
10
+ },
11
+ {
12
+ "regulation": "PLD",
13
+ "sector": "digital_infrastructure",
14
+ "subsector": "software",
15
+ "applies": true,
16
+ "confidence": "definite",
17
+ "basis_article": "2",
18
+ "notes": "Software and AI systems are covered as products under new PLD"
19
+ },
20
+ {
21
+ "regulation": "PLD",
22
+ "sector": "healthcare",
23
+ "subsector": null,
24
+ "applies": true,
25
+ "confidence": "definite",
26
+ "basis_article": "1",
27
+ "notes": "Medical products causing harm are covered"
28
+ },
29
+ {
30
+ "regulation": "PLD",
31
+ "sector": "other",
32
+ "subsector": "importers",
33
+ "applies": true,
34
+ "confidence": "definite",
35
+ "basis_article": "3",
36
+ "notes": "Importers can be liable as if they were manufacturers"
37
+ },
38
+ {
39
+ "regulation": "PLD",
40
+ "sector": "other",
41
+ "subsector": "online_platforms",
42
+ "applies": true,
43
+ "confidence": "likely",
44
+ "basis_article": "3",
45
+ "notes": "Online platforms may be liable in certain circumstances"
46
+ },
47
+ {
48
+ "regulation": "PLD",
49
+ "sector": "financial",
50
+ "subsector": null,
51
+ "applies": false,
52
+ "confidence": "definite",
53
+ "basis_article": "1",
54
+ "notes": "Financial services are not products under PLD"
55
+ },
56
+ {
57
+ "regulation": "PLD",
58
+ "sector": "energy",
59
+ "subsector": null,
60
+ "applies": true,
61
+ "confidence": "likely",
62
+ "basis_article": "1",
63
+ "notes": "Energy products causing defects may be covered"
64
+ },
65
+ {
66
+ "regulation": "PLD",
67
+ "sector": "transport",
68
+ "subsector": null,
69
+ "applies": true,
70
+ "confidence": "definite",
71
+ "basis_article": "1",
72
+ "notes": "Defective vehicles and transport equipment covered"
73
+ }
74
+ ]
@@ -0,0 +1,74 @@
1
+ [
2
+ {
3
+ "regulation": "PSD2",
4
+ "sector": "financial",
5
+ "subsector": "payment_services",
6
+ "applies": true,
7
+ "confidence": "definite",
8
+ "basis_article": "1",
9
+ "notes": "PSD2 regulates payment service providers in the EU"
10
+ },
11
+ {
12
+ "regulation": "PSD2",
13
+ "sector": "financial",
14
+ "subsector": "banks",
15
+ "applies": true,
16
+ "confidence": "definite",
17
+ "basis_article": "1",
18
+ "notes": "Credit institutions providing payment services must comply"
19
+ },
20
+ {
21
+ "regulation": "PSD2",
22
+ "sector": "financial",
23
+ "subsector": "fintechs",
24
+ "applies": true,
25
+ "confidence": "definite",
26
+ "basis_article": "1",
27
+ "notes": "Payment institutions and electronic money institutions are in scope"
28
+ },
29
+ {
30
+ "regulation": "PSD2",
31
+ "sector": "digital_infrastructure",
32
+ "subsector": "payment_gateways",
33
+ "applies": true,
34
+ "confidence": "definite",
35
+ "basis_article": "1",
36
+ "notes": "Technical service providers supporting payment services may be in scope"
37
+ },
38
+ {
39
+ "regulation": "PSD2",
40
+ "sector": "other",
41
+ "subsector": "account_information",
42
+ "applies": true,
43
+ "confidence": "definite",
44
+ "basis_article": "1",
45
+ "notes": "Account information service providers (AISPs) are regulated"
46
+ },
47
+ {
48
+ "regulation": "PSD2",
49
+ "sector": "other",
50
+ "subsector": "payment_initiation",
51
+ "applies": true,
52
+ "confidence": "definite",
53
+ "basis_article": "1",
54
+ "notes": "Payment initiation service providers (PISPs) are regulated"
55
+ },
56
+ {
57
+ "regulation": "PSD2",
58
+ "sector": "healthcare",
59
+ "subsector": null,
60
+ "applies": false,
61
+ "confidence": "definite",
62
+ "basis_article": "1",
63
+ "notes": "Healthcare sector not in scope"
64
+ },
65
+ {
66
+ "regulation": "PSD2",
67
+ "sector": "energy",
68
+ "subsector": null,
69
+ "applies": false,
70
+ "confidence": "definite",
71
+ "basis_article": "1",
72
+ "notes": "Energy sector not in scope"
73
+ }
74
+ ]
@@ -0,0 +1,74 @@
1
+ [
2
+ {
3
+ "regulation": "RED",
4
+ "sector": "manufacturing",
5
+ "subsector": "electronics",
6
+ "applies": true,
7
+ "confidence": "definite",
8
+ "basis_article": "1",
9
+ "notes": "RED applies to manufacturers of radio equipment placed on EU market"
10
+ },
11
+ {
12
+ "regulation": "RED",
13
+ "sector": "manufacturing",
14
+ "subsector": "telecommunications",
15
+ "applies": true,
16
+ "confidence": "definite",
17
+ "basis_article": "1",
18
+ "notes": "Telecom equipment manufacturers must comply"
19
+ },
20
+ {
21
+ "regulation": "RED",
22
+ "sector": "manufacturing",
23
+ "subsector": "iot_devices",
24
+ "applies": true,
25
+ "confidence": "definite",
26
+ "basis_article": "1",
27
+ "notes": "IoT and connected devices using radio spectrum are covered"
28
+ },
29
+ {
30
+ "regulation": "RED",
31
+ "sector": "digital_infrastructure",
32
+ "subsector": null,
33
+ "applies": true,
34
+ "confidence": "likely",
35
+ "basis_article": "1",
36
+ "notes": "Radio infrastructure equipment manufacturers are in scope"
37
+ },
38
+ {
39
+ "regulation": "RED",
40
+ "sector": "other",
41
+ "subsector": "importers",
42
+ "applies": true,
43
+ "confidence": "definite",
44
+ "basis_article": "12",
45
+ "notes": "Importers must verify CE marking and conformity"
46
+ },
47
+ {
48
+ "regulation": "RED",
49
+ "sector": "other",
50
+ "subsector": "distributors",
51
+ "applies": true,
52
+ "confidence": "definite",
53
+ "basis_article": "13",
54
+ "notes": "Distributors must verify compliance before making available"
55
+ },
56
+ {
57
+ "regulation": "RED",
58
+ "sector": "financial",
59
+ "subsector": null,
60
+ "applies": false,
61
+ "confidence": "definite",
62
+ "basis_article": "1",
63
+ "notes": "Financial sector not in scope"
64
+ },
65
+ {
66
+ "regulation": "RED",
67
+ "sector": "healthcare",
68
+ "subsector": null,
69
+ "applies": true,
70
+ "confidence": "likely",
71
+ "basis_article": "1",
72
+ "notes": "Medical radio devices may be covered (also see MDR)"
73
+ }
74
+ ]
@@ -0,0 +1,74 @@
1
+ [
2
+ {
3
+ "regulation": "SFDR",
4
+ "sector": "financial",
5
+ "subsector": "asset_managers",
6
+ "applies": true,
7
+ "confidence": "definite",
8
+ "basis_article": "1",
9
+ "notes": "SFDR applies to financial market participants including asset managers"
10
+ },
11
+ {
12
+ "regulation": "SFDR",
13
+ "sector": "financial",
14
+ "subsector": "insurance",
15
+ "applies": true,
16
+ "confidence": "definite",
17
+ "basis_article": "2",
18
+ "notes": "Insurance undertakings making IBIPs available are in scope"
19
+ },
20
+ {
21
+ "regulation": "SFDR",
22
+ "sector": "financial",
23
+ "subsector": "pension_funds",
24
+ "applies": true,
25
+ "confidence": "definite",
26
+ "basis_article": "2",
27
+ "notes": "IORPs (pension funds) are in scope"
28
+ },
29
+ {
30
+ "regulation": "SFDR",
31
+ "sector": "financial",
32
+ "subsector": "investment_advisers",
33
+ "applies": true,
34
+ "confidence": "definite",
35
+ "basis_article": "2",
36
+ "notes": "Financial advisers must make sustainability-related disclosures"
37
+ },
38
+ {
39
+ "regulation": "SFDR",
40
+ "sector": "financial",
41
+ "subsector": "banks",
42
+ "applies": true,
43
+ "confidence": "definite",
44
+ "basis_article": "2",
45
+ "notes": "Credit institutions providing portfolio management are in scope"
46
+ },
47
+ {
48
+ "regulation": "SFDR",
49
+ "sector": "healthcare",
50
+ "subsector": null,
51
+ "applies": false,
52
+ "confidence": "definite",
53
+ "basis_article": "1",
54
+ "notes": "Healthcare sector not directly in scope"
55
+ },
56
+ {
57
+ "regulation": "SFDR",
58
+ "sector": "energy",
59
+ "subsector": null,
60
+ "applies": false,
61
+ "confidence": "definite",
62
+ "basis_article": "1",
63
+ "notes": "Energy sector not directly in scope (but may be investees)"
64
+ },
65
+ {
66
+ "regulation": "SFDR",
67
+ "sector": "other",
68
+ "subsector": null,
69
+ "applies": false,
70
+ "confidence": "definite",
71
+ "basis_article": "1",
72
+ "notes": "SFDR specifically targets financial sector"
73
+ }
74
+ ]
@@ -0,0 +1,68 @@
1
+ [
2
+ {
3
+ "regulation": "UN_R155",
4
+ "sector": "transport",
5
+ "subsector": "automotive_oem",
6
+ "applies": true,
7
+ "confidence": "definite",
8
+ "basis_article": "1",
9
+ "notes": "Applies to vehicle manufacturers (OEMs) for type approval of vehicles in categories M, N, O, and L with electronic control units"
10
+ },
11
+ {
12
+ "regulation": "UN_R155",
13
+ "sector": "transport",
14
+ "subsector": "automotive_supplier",
15
+ "applies": true,
16
+ "confidence": "likely",
17
+ "basis_article": "7",
18
+ "notes": "Tier 1/2 suppliers must support OEM CSMS requirements; OEMs responsible for supply chain cybersecurity"
19
+ },
20
+ {
21
+ "regulation": "UN_R155",
22
+ "sector": "transport",
23
+ "subsector": "fleet_operator",
24
+ "applies": false,
25
+ "confidence": "definite",
26
+ "basis_article": "1",
27
+ "notes": "R155 applies to type approval, not vehicle operation; fleet operators are end users"
28
+ },
29
+ {
30
+ "regulation": "UN_R155",
31
+ "sector": "manufacturing",
32
+ "subsector": "automotive_components",
33
+ "applies": true,
34
+ "confidence": "likely",
35
+ "basis_article": "7",
36
+ "notes": "Component manufacturers (ECUs, sensors, connectivity modules) indirectly affected through OEM requirements"
37
+ },
38
+ {
39
+ "regulation": "UN_R155",
40
+ "sector": "digital_infrastructure",
41
+ "subsector": "telematics",
42
+ "applies": true,
43
+ "confidence": "possible",
44
+ "basis_article": "Annex 5",
45
+ "notes": "Telematics and connected services providers may be affected through backend server security requirements"
46
+ },
47
+ {
48
+ "regulation": "UN_R155",
49
+ "sector": "financial",
50
+ "applies": false,
51
+ "confidence": "definite",
52
+ "notes": "R155 is specific to vehicle type approval; financial services not in scope"
53
+ },
54
+ {
55
+ "regulation": "UN_R155",
56
+ "sector": "healthcare",
57
+ "applies": false,
58
+ "confidence": "definite",
59
+ "notes": "R155 is specific to vehicle type approval; healthcare not in scope"
60
+ },
61
+ {
62
+ "regulation": "UN_R155",
63
+ "sector": "energy",
64
+ "applies": false,
65
+ "confidence": "definite",
66
+ "notes": "R155 is specific to vehicle type approval; energy sector not in scope (though EV charging infrastructure has separate requirements)"
67
+ }
68
+ ]
@@ -0,0 +1,68 @@
1
+ [
2
+ {
3
+ "regulation": "UN_R156",
4
+ "sector": "transport",
5
+ "subsector": "automotive_oem",
6
+ "applies": true,
7
+ "confidence": "definite",
8
+ "basis_article": "1",
9
+ "notes": "Applies to vehicle manufacturers (OEMs) for type approval of vehicles that allow software updates (categories M, N, O, R, S, T)"
10
+ },
11
+ {
12
+ "regulation": "UN_R156",
13
+ "sector": "transport",
14
+ "subsector": "automotive_supplier",
15
+ "applies": true,
16
+ "confidence": "likely",
17
+ "basis_article": "7",
18
+ "notes": "Tier 1/2 suppliers providing software components must support OEM SUMS requirements"
19
+ },
20
+ {
21
+ "regulation": "UN_R156",
22
+ "sector": "transport",
23
+ "subsector": "fleet_operator",
24
+ "applies": false,
25
+ "confidence": "definite",
26
+ "basis_article": "1",
27
+ "notes": "R156 applies to type approval, not vehicle operation; fleet operators receive updates as end users"
28
+ },
29
+ {
30
+ "regulation": "UN_R156",
31
+ "sector": "manufacturing",
32
+ "subsector": "automotive_components",
33
+ "applies": true,
34
+ "confidence": "likely",
35
+ "basis_article": "7",
36
+ "notes": "ECU and software component manufacturers must provide RXSWIN and support OTA update mechanisms"
37
+ },
38
+ {
39
+ "regulation": "UN_R156",
40
+ "sector": "digital_infrastructure",
41
+ "subsector": "telematics",
42
+ "applies": true,
43
+ "confidence": "likely",
44
+ "basis_article": "7",
45
+ "notes": "OTA update infrastructure providers (backend servers, CDN) must meet security requirements for software distribution"
46
+ },
47
+ {
48
+ "regulation": "UN_R156",
49
+ "sector": "financial",
50
+ "applies": false,
51
+ "confidence": "definite",
52
+ "notes": "R156 is specific to vehicle software updates; financial services not in scope"
53
+ },
54
+ {
55
+ "regulation": "UN_R156",
56
+ "sector": "healthcare",
57
+ "applies": false,
58
+ "confidence": "definite",
59
+ "notes": "R156 is specific to vehicle software updates; healthcare not in scope"
60
+ },
61
+ {
62
+ "regulation": "UN_R156",
63
+ "sector": "energy",
64
+ "applies": false,
65
+ "confidence": "definite",
66
+ "notes": "R156 is specific to vehicle software updates; energy sector not in scope"
67
+ }
68
+ ]