@complior/engine 0.9.0

package/src/data/finding-explanations.json

@@ -0,0 +1,453 @@
+{
+  "$schema": "finding-explanations-schema",
+  "$comment": "US-S05-07: Static mapping check_id → explanation (article, penalty, deadline, business_impact)",
+
+  "passport-presence": {
+    "article": "Art. 26(4)",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Agent Passport is the core identity document for your AI system. Without it, you cannot demonstrate compliance to regulators, and deployers cannot verify the system's risk classification or intended use."
+  },
+  "passport-completeness": {
+    "article": "Art. 26(4)",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "An incomplete passport means gaps in your compliance record. Regulators require full documentation of AI system capabilities, limitations, and risk management measures."
+  },
+  "ai-disclosure": {
+    "article": "Art. 50(1)",
+    "penalty": "€7.5M or 1.5% of annual global turnover",
+    "deadline": "2025-08-02",
+    "business_impact": "Users must be informed they are interacting with AI. Failure to disclose AI involvement erodes trust and violates transparency obligations that are already enforceable."
+  },
+  "content-marking": {
+    "article": "Art. 50(2)",
+    "penalty": "€7.5M or 1.5% of annual global turnover",
+    "deadline": "2025-08-02",
+    "business_impact": "AI-generated content must be machine-detectable. Without marking (C2PA, watermarks, metadata), downstream systems cannot verify content provenance."
+  },
+  "interaction-logging": {
+    "article": "Art. 12",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Structured logging of AI interactions is required for audit trails, incident investigation, and demonstrating human oversight. Without logs, you cannot prove compliant operation."
+  },
+  "ai-literacy": {
+    "article": "Art. 4",
+    "penalty": "€7.5M or 1.5% of annual global turnover",
+    "deadline": "2025-02-02",
+    "business_impact": "All personnel working with AI must have sufficient AI literacy. Undocumented training programs expose your organization to liability if operators misuse AI systems."
+  },
+  "gpai-transparency": {
+    "article": "Art. 53",
+    "penalty": "€7.5M or 1.5% of annual global turnover",
+    "deadline": "2025-08-02",
+    "business_impact": "General-purpose AI models require model cards documenting capabilities, limitations, and training data. This enables downstream providers to assess risks."
+  },
+  "compliance-metadata": {
+    "article": "Art. 11",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Machine-readable compliance metadata enables automated verification. Without it, integration partners and regulators cannot programmatically assess your compliance status."
+  },
+  "documentation": {
+    "article": "Art. 11",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Technical documentation is a foundational requirement. It must be maintained throughout the AI system lifecycle and made available to competent authorities upon request."
+  },
+
+  "l2-ai-literacy": {
+    "article": "Art. 4",
+    "penalty": "€7.5M or 1.5% of annual global turnover",
+    "deadline": "2025-02-02",
+    "business_impact": "Your AI literacy document exists but lacks required sections. Incomplete training documentation fails the minimum standard for demonstrating organizational AI competence."
+  },
+  "l2-art5-screening": {
+    "article": "Art. 5",
+    "penalty": "€35M or 7% of annual global turnover",
+    "deadline": "2025-02-02",
+    "business_impact": "Art. 5 prohibited practices screening is the highest-penalty obligation. Your screening document must demonstrate systematic assessment of all 8 prohibited categories."
+  },
+  "l2-tech-documentation": {
+    "article": "Art. 11",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Technical documentation must include system architecture, data sources, training methodology, and performance metrics. Incomplete docs block conformity assessment."
+  },
+  "l2-monitoring-policy": {
+    "article": "Art. 26",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Monitoring policy must define scope, frequency, metrics, and escalation procedures. Without it, you cannot demonstrate ongoing post-market surveillance."
+  },
+  "l2-worker-notification": {
+    "article": "Art. 26(7)",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Workers and their representatives must be notified before AI deployment affects them. Missing notification is a direct violation of worker protection obligations."
+  },
+  "l2-fria": {
+    "article": "Art. 27",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Fundamental Rights Impact Assessment is mandatory for high-risk AI in public sector and certain private uses. It must analyze impacts on health, safety, and fundamental rights."
+  },
+  "l2-declaration-conformity": {
+    "article": "Art. 47",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "The EU Declaration of Conformity is a legally binding statement. Without it, your AI system cannot be placed on the EU market or put into service."
+  },
+  "l2-incident-report": {
+    "article": "Art. 73",
+    "penalty": "€7.5M or 1.5% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Incident reporting is required for serious incidents. A template must exist before incidents occur to ensure timely reporting within the mandatory timeframe."
+  },
+
+  "l3-missing-bias-testing": {
+    "article": "Art. 10",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Bias testing tools are absent from your dependencies. Without them, you cannot demonstrate that your AI system has been tested for discriminatory outcomes across protected characteristics."
+  },
+  "l3-log-retention": {
+    "article": "Art. 12",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Log retention configuration is missing. AI system logs must be retained for a period appropriate to the system's risk level and purpose, typically 6-12 months minimum."
+  },
+  "l3-env-config": {
+    "article": "Art. 12",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Environment configuration lacks compliance-relevant settings. Proper configuration ensures logging, monitoring, and safety features are consistently enabled across deployments."
+  },
+  "l3-ci-compliance": {
+    "article": "Art. 9",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "CI/CD pipeline lacks compliance checks. Automated compliance gates prevent non-compliant code from reaching production, reducing risk of regulatory violations."
+  },
+  "l3-banned-package": {
+    "article": "Art. 15(4)",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "A banned or high-risk dependency was detected. Using packages with known security vulnerabilities or prohibited licenses undermines your system's cybersecurity and legal standing."
+  },
+
+  "l4-bare-llm": {
+    "article": "Art. 50(1)",
+    "penalty": "€7.5M or 1.5% of annual global turnover",
+    "deadline": "2025-08-02",
+    "business_impact": "Bare LLM API calls detected. Consider @complior/sdk for runtime compliance enforcement (disclosure, logging, content marking). This is informational — bare calls are not a violation; compliance is enforced via separate disclosure, logging, and oversight checks."
+  },
+  "l4-disclosure": {
+    "article": "Art. 50(1)",
+    "penalty": "€7.5M or 1.5% of annual global turnover",
+    "deadline": "2025-08-02",
+    "business_impact": "AI disclosure patterns found — this is positive. Ensure disclosure components are visible in all user-facing interfaces where AI is involved."
+  },
+  "l4-human-oversight": {
+    "article": "Art. 14",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Human oversight mechanisms enable operators to monitor, intervene, and override AI decisions. Without them, you cannot meet the human-in-the-loop requirement for high-risk systems."
+  },
+  "l4-kill-switch": {
+    "article": "Art. 14",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "A kill switch or feature flag allows immediate shutdown of AI functionality. This is essential for incident response and required for human oversight of high-risk systems."
+  },
+  "l4-content-marking": {
+    "article": "Art. 50(2)",
+    "penalty": "€7.5M or 1.5% of annual global turnover",
+    "deadline": "2025-08-02",
+    "business_impact": "Content marking code patterns detected. Verify that AI-generated content is marked in a machine-readable format (C2PA, IPTC, custom metadata) across all output channels."
+  },
+  "l4-logging": {
+    "article": "Art. 12",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Structured logging patterns are present in your codebase. Ensure logs capture: input/output hashes, model version, latency, token usage, and compliance check results."
+  },
+  "l4-data-governance": {
+    "article": "Art. 10",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Data governance patterns control data quality, lineage, and consent. Without them, you cannot demonstrate that training and input data meet EU AI Act standards."
+  },
+  "l4-record-keeping": {
+    "article": "Art. 12",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Record-keeping enables traceability throughout the AI system lifecycle. Audit trails must capture compliance events, configuration changes, and incident responses."
+  },
+  "l4-accuracy-robustness": {
+    "article": "Art. 15",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Accuracy and robustness validation ensures your AI system performs reliably. Without testing, you cannot demonstrate the system meets performance benchmarks required by Art. 15."
+  },
+  "l4-cybersecurity": {
+    "article": "Art. 15(4)",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Cybersecurity measures (rate limiting, input sanitization, access control) protect against adversarial attacks and data manipulation. Essential for system resilience."
+  },
+  "l4-deployer-monitoring": {
+    "article": "Art. 26(5)",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Deployer monitoring patterns track model drift, performance degradation, and anomalies. Required for post-market surveillance and incident detection."
+  },
+  "l4-gpai-transparency": {
+    "article": "Art. 53",
+    "penalty": "€7.5M or 1.5% of annual global turnover",
+    "deadline": "2025-08-02",
+    "business_impact": "GPAI transparency code patterns document model capabilities. Ensure model cards, training data documentation, and capability descriptions are complete and accessible."
+  },
+  "l4-conformity-assessment": {
+    "article": "Art. 43",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Conformity assessment patterns support the formal evaluation process. High-risk AI systems must undergo conformity assessment before market placement."
+  },
+  "l4-security-risk": {
+    "article": "Art. 15(4)",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Unsafe code patterns (eval, pickle, command injection) create exploitable vulnerabilities. These undermine your system's cybersecurity posture required by Art. 15(4)."
+  },
+
+  "behavioral-constraints": {
+    "article": "Art. 9 / Art. 14",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Behavioral constraints define how your AI agent escalates decisions and handles PII. High-risk agents without structured escalation rules lack the human oversight required by Art. 14. Missing data boundaries indicate gaps in the risk management system required by Art. 9."
+  },
+
+  "cross-doc-code-mismatch": {
+    "article": "Art. 11",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Your documentation claims capabilities that are not implemented in code (or vice versa). Regulators will verify documentation against actual system behavior — mismatches indicate governance failures."
+  },
+  "cross-sdk-no-disclosure": {
+    "article": "Art. 50(1)",
+    "penalty": "€7.5M or 1.5% of annual global turnover",
+    "deadline": "2025-08-02",
+    "business_impact": "AI SDK is used in your project but no disclosure is shown to users. This is a direct Art. 50(1) violation — users interacting with your AI must be explicitly informed."
+  },
+  "cross-logging-no-retention": {
+    "article": "Art. 12",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Logging exists but without retention policy. Logs without defined retention can be deleted prematurely (losing audit trail) or retained too long (GDPR violation)."
+  },
+  "cross-kill-switch-no-test": {
+    "article": "Art. 14",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Kill switch exists but has no tests. An untested kill switch may fail during an incident, leaving you unable to shut down a malfunctioning AI system when it matters most."
+  },
+
+  "undeclared-permission": {
+    "article": "Art. 26(4)",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Tool permissions used in code but not declared in Agent Passport. Undeclared permissions indicate governance gaps — regulators require full transparency about AI agent capabilities."
+  },
+  "unused-declared-permission": {
+    "article": "Art. 26(4)",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Passport declares tool permissions not found in code. Stale declarations reduce trust in passport accuracy and may indicate outdated documentation."
+  },
+  "cross-permission-passport-mismatch": {
+    "article": "Art. 26(4)",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Undeclared permissions combined with unwrapped LLM calls indicate a compounding governance failure. The AI system operates outside its declared boundaries without compliance safeguards."
+  },
+
+  "industry-hr": {
+    "article": "Art. 6(2), Annex III §6(a)",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "HR/recruitment AI is classified as high-risk under Annex III. Systems used for recruitment, CV screening, or employee evaluation require FRIA, conformity assessment, and enhanced human oversight."
+  },
+  "industry-finance": {
+    "article": "Art. 6(2), Annex III §5(b)",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Financial AI for credit scoring, insurance, or fraud detection is high-risk under Annex III. Access to essential services like credit and insurance is a fundamental right requiring strict compliance."
+  },
+  "industry-healthcare": {
+    "article": "Art. 6(2), Annex III §5(a)",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Healthcare AI for diagnosis, treatment, or patient monitoring is high-risk under Annex III. Medical AI directly impacts health and safety, requiring the highest level of compliance rigor."
+  },
+  "industry-education": {
+    "article": "Art. 6(2), Annex III §6(b)",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Education AI for admissions, grading, or student assessment is high-risk under Annex III. AI determining access to education affects fundamental rights and life opportunities."
+  },
+
+  "fria": {
+    "article": "Art. 27",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Fundamental Rights Impact Assessment is mandatory for deployers of high-risk AI in public services and certain private-sector uses. Without a FRIA, deployment may be unlawful."
+  },
+  "art5-screening": {
+    "article": "Art. 5",
+    "penalty": "€35M or 7% of annual global turnover",
+    "deadline": "2025-02-02",
+    "business_impact": "Prohibited practices carry the highest penalty tier. You must demonstrate systematic screening against all 8 Art. 5 categories before deploying any AI system in the EU."
+  },
+  "technical-documentation": {
+    "article": "Art. 11",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Technical documentation covering system design, data, and performance is required before market placement. Without it, conformity assessment cannot proceed."
+  },
+  "incident-report": {
+    "article": "Art. 73",
+    "penalty": "€7.5M or 1.5% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "An incident report template must exist before incidents occur. Timely reporting of serious incidents to authorities is mandatory — delays compound liability."
+  },
+  "declaration-of-conformity": {
+    "article": "Art. 47",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "The EU Declaration of Conformity is a legally binding prerequisite for placing an AI system on the EU market. Missing it blocks market access entirely."
+  },
+  "monitoring-policy": {
+    "article": "Art. 26",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Post-market monitoring policy is required to detect and respond to risks after deployment. Without it, you cannot demonstrate ongoing surveillance obligations."
+  },
+  "worker-notification": {
+    "article": "Art. 26(7)",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Workers and their representatives must be informed before AI is deployed in the workplace. Missing notification is a direct worker protection violation."
+  },
+  "risk-management": {
+    "article": "Art. 9",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "A risk management system must be established, maintained, and documented throughout the AI lifecycle. It is the foundation for all high-risk AI compliance."
+  },
+  "data-governance": {
+    "article": "Art. 10",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Data governance measures must ensure training data quality, relevance, and representativeness. Without a policy, bias and data quality issues go unmanaged."
+  },
+  "qms": {
+    "article": "Art. 17",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "A quality management system ensures systematic compliance across the AI lifecycle. Without QMS documentation, you cannot demonstrate organizational compliance maturity."
+  },
+  "instructions-for-use": {
+    "article": "Art. 13",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Instructions for use must accompany every high-risk AI system, enabling deployers to understand capabilities, limitations, and required human oversight measures."
+  },
+
+  "l2-risk-management": {
+    "article": "Art. 9",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Your risk management document exists but lacks required structure. It must cover risk identification, estimation, evaluation, and mitigation across the full AI lifecycle."
+  },
+  "l2-data-governance": {
+    "article": "Art. 10",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Your data governance document exists but is structurally incomplete. It must detail data collection, labeling, quality checks, and bias mitigation procedures."
+  },
+  "l2-qms": {
+    "article": "Art. 17",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Your QMS document exists but missing key sections. A complete QMS must cover design, development, testing, and post-market processes with defined responsibilities."
+  },
+  "l2-instructions-for-use": {
+    "article": "Art. 13",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Your instructions for use document exists but is structurally incomplete. Deployers rely on these instructions to operate the AI system safely and compliantly."
+  },
+
+  "gpai-systemic-risk": {
+    "article": "Art. 55",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2025-08-02",
+    "business_impact": "GPAI models with systemic risk require additional obligations: adversarial testing, incident reporting to the AI Office, and cybersecurity protections beyond standard GPAI requirements."
+  },
+  "industry-legal": {
+    "article": "Art. 6(2), Annex III",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "AI used in legal interpretation or judicial assistance is high-risk under Annex III. Legal AI affecting access to justice requires enhanced oversight, transparency, and conformity assessment."
+  },
+  "industry-biometrics": {
+    "article": "Art. 6(2), Annex III",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Biometric AI (identification, categorization, emotion recognition) is high-risk under Annex III. Some biometric uses are outright prohibited under Art. 5."
+  },
+  "industry-critical-infra": {
+    "article": "Art. 6(2), Annex III",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "AI in critical infrastructure (energy, transport, water, digital) is high-risk under Annex III. Failures can directly endanger public safety and essential services."
+  },
+  "industry-migration": {
+    "article": "Art. 6(2), Annex III",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "AI used in migration, asylum, or border control is high-risk under Annex III. These systems directly affect fundamental rights and require the highest compliance standards."
+  },
+  "cross-banned-with-wrapper": {
+    "article": "Art. 5",
+    "penalty": "€35M or 7% of annual global turnover",
+    "deadline": "2025-02-02",
+    "business_impact": "A prohibited package is present but wrapped with compliance controls. While controls mitigate risk, the underlying package may still constitute a prohibited practice violation."
+  },
+  "cross-passport-code-mismatch": {
+    "article": "Art. 26(4)",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Agent Passport declarations do not match actual code behavior. Passport accuracy is essential for deployer obligations — mismatches indicate governance failures."
+  },
+  "l4-nhi-secret": {
+    "article": "Art. 15(4)",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Hardcoded secrets or credentials found in source code. Exposed credentials undermine the cybersecurity measures required by Art. 15(4) and create exploitable attack vectors."
+  },
+  "l3-dep-vuln": {
+    "article": "Art. 15(4)",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Dependencies with known vulnerabilities compromise your system's cybersecurity posture. Art. 15(4) requires resilience against unauthorized access and data manipulation."
+  },
+  "l3-dep-license": {
+    "article": "Art. 11",
+    "penalty": "€15M or 3% of annual global turnover",
+    "deadline": "2026-08-02",
+    "business_impact": "Dependency license incompatibilities may prevent lawful distribution of your AI system. Technical documentation must account for all third-party component licensing."
+  }
+}

package/src/data/industry-patterns.ts

@@ -0,0 +1,161 @@
+export type IndustryId = 'hr' | 'finance' | 'healthcare' | 'education' | 'legal' | 'biometrics' | 'critical-infra' | 'migration';
+
+export interface IndustryPattern {
+  readonly id: IndustryId;
+  readonly label: string;
+  readonly annexRef: string;
+  readonly articleRef: string;
+  readonly obligationId: string;
+  readonly patterns: readonly RegExp[];
+}
+
+export const INDUSTRY_PATTERNS: readonly IndustryPattern[] = [
+  {
+    id: 'hr',
+    label: 'HR / Employment',
+    annexRef: 'Annex III §6(a)',
+    articleRef: 'Art. 6(2)',
+    obligationId: 'eu-ai-act-OBL-006',
+    patterns: [
+      /resume[_.]parser/i,
+      /cv[_.]screen/i,
+      /candidate[_.]score/i,
+      /hiring[_.]decision/i,
+      /recruitment[_.]ai/i,
+      /employee[_.]monitoring/i,
+      /performance[_.]review/i,
+      /applicant[_.]tracking/i,
+    ],
+  },
+  {
+    id: 'finance',
+    label: 'Finance / Credit',
+    annexRef: 'Annex III §5(b)',
+    articleRef: 'Art. 6(2)',
+    obligationId: 'eu-ai-act-OBL-005',
+    patterns: [
+      /credit[_.]score/i,
+      /loan[_.]approval/i,
+      /insurance[_.]underwriting/i,
+      /fraud[_.]detection/i,
+      /aml[_.]check/i,
+      /kyc[_.]verification/i,
+      /creditworthiness/i,
+      /trading[_.]algo/i,
+    ],
+  },
+  {
+    id: 'healthcare',
+    label: 'Healthcare / Medical',
+    annexRef: 'Annex III §5(a)',
+    articleRef: 'Art. 6(2)',
+    obligationId: 'eu-ai-act-OBL-005',
+    patterns: [
+      /medical[_.]device/i,
+      /diagnosis[_.]ai/i,
+      /patient[_.]data/i,
+      /health[_.]record/i,
+      /clinical[_.]decision/i,
+      /drug[_.]discovery/i,
+      /patient[_.]monitoring/i,
+      /medical[_.]imaging/i,
+    ],
+  },
+  {
+    id: 'education',
+    label: 'Education / Academic',
+    annexRef: 'Annex III §3',
+    articleRef: 'Art. 6(2)',
+    obligationId: 'eu-ai-act-OBL-006',
+    patterns: [
+      /admission[_.]ai/i,
+      /grading[_.]system/i,
+      /student[_.]monitoring/i,
+      /learning[_.]analytics/i,
+      /exam[_.]proctoring/i,
+      /plagiarism[_.]detection/i,
+      /enrollment[_.]decision/i,
+    ],
+  },
+  {
+    id: 'legal',
+    label: 'Legal / Justice',
+    annexRef: 'Annex III §8(a)',
+    articleRef: 'Art. 6(2)',
+    obligationId: 'eu-ai-act-OBL-008',
+    patterns: [
+      /legal[_.]analysis/i,
+      /case[_.]prediction/i,
+      /contract[_.]review/i,
+      /sentencing[_.]assist/i,
+      /evidence[_.]analysis/i,
+      /judicial[_.]decision/i,
+      /legal[_.]research/i,
+      /dispute[_.]resolution/i,
+    ],
+  },
+  {
+    id: 'biometrics',
+    label: 'Biometrics / Identification',
+    annexRef: 'Annex III §1',
+    articleRef: 'Art. 6(2)',
+    obligationId: 'eu-ai-act-OBL-003',
+    patterns: [
+      /biometric[_.]identification/i,
+      /facial[_.]recognition/i,
+      /face[_.]detect/i,
+      /fingerprint[_.]match/i,
+      /iris[_.]scan/i,
+      /voice[_.]biometric/i,
+      /emotion[_.]recognition/i,
+      /gait[_.]analysis/i,
+      /remote[_.]biometric/i,
+    ],
+  },
+  {
+    id: 'critical-infra',
+    label: 'Critical Infrastructure',
+    annexRef: 'Annex III §2',
+    articleRef: 'Art. 6(2)',
+    obligationId: 'eu-ai-act-OBL-003',
+    patterns: [
+      /scada[_.]control/i,
+      /power[_.]grid/i,
+      /water[_.]treatment/i,
+      /traffic[_.]control/i,
+      /infrastructure[_.]monitor/i,
+      /smart[_.]grid/i,
+      /energy[_.]management/i,
+      /pipeline[_.]control/i,
+      /network[_.]routing.*critical/i,
+    ],
+  },
+  {
+    id: 'migration',
+    label: 'Migration / Border Control',
+    annexRef: 'Annex III §7',
+    articleRef: 'Art. 6(2)',
+    obligationId: 'eu-ai-act-OBL-008',
+    patterns: [
+      /border[_.]control/i,
+      /visa[_.]assessment/i,
+      /asylum[_.]application/i,
+      /immigration[_.]screening/i,
+      /travel[_.]document/i,
+      /migration[_.]risk/i,
+      /entry[_.]exit[_.]system/i,
+      /refugee[_.]screening/i,
+    ],
+  },
+];
+
+export const INDUSTRY_TEMPLATE_MAP: Record<IndustryId, string> = {
+  hr: 'hr-ai-policy.md',
+  finance: 'finance-ai-policy.md',
+  healthcare: 'healthcare-ai-policy.md',
+  education: 'education-ai-policy.md',
+  legal: 'legal-ai-policy.md',
+  biometrics: 'biometrics-ai-policy.md',
+  'critical-infra': 'critical-infra-ai-policy.md',
+  migration: 'migration-ai-policy.md',
+};