@complior/engine 0.9.0

package/data/regulations/eu-ai-act/timeline.json

@@ -0,0 +1,160 @@
+{
+  "timeline": {
+    "regulation_id": "eu-ai-act",
+    "key_dates": [
+      {
+        "date": "2024-06-13",
+        "event": "EU AI Act adopted by European Parliament and Council",
+        "impact_on_product": "Begin processing regulation content. Start building compliance framework.",
+        "status": "passed"
+      },
+      {
+        "date": "2024-07-12",
+        "event": "Published in Official Journal of the European Union",
+        "impact_on_product": "Official text available. Finalize regulatory parsing.",
+        "status": "passed"
+      },
+      {
+        "date": "2024-08-01",
+        "event": "Entry into force (20 days after publication)",
+        "impact_on_product": "Regulation is law. Countdown timers start for all phases.",
+        "status": "passed"
+      },
+      {
+        "date": "2025-02-02",
+        "event": "Phase 1: Prohibited practices (Art. 5) and AI literacy (Art. 4) apply",
+        "impact_on_product": "Prohibited practices screening and AI literacy modules must be live. Article 5 checklist and training templates must be available.",
+        "status": "passed"
+      },
+      {
+        "date": "2025-02-02",
+        "event": "Commission published Guidelines on Prohibited AI Practices and AI System Definition",
+        "impact_on_product": "Update prohibited practices screening logic and definition matching based on official guidelines.",
+        "status": "passed"
+      },
+      {
+        "date": "2025-08-02",
+        "event": "Phase 2: GPAI rules apply. Governance bodies operational. Penalty regime in force.",
+        "impact_on_product": "GPAI compliance modules must be live. Annex XI/XII documentation templates available. Code of Practice integration. Penalty calculator active.",
+        "status": "passed"
+      },
+      {
+        "date": "2025-08-02",
+        "event": "GPAI Code of Practice finalized and published",
+        "impact_on_product": "Integrate Code of Practice requirements into GPAI provider workflow. Update technical documentation templates.",
+        "status": "passed"
+      },
+      {
+        "date": "2025-08-02",
+        "event": "Member States designate national competent authorities. Penalty rules notified.",
+        "impact_on_product": "Build authority directory per Member State. Enable jurisdiction-specific penalty calculations. Map enforcement contacts.",
+        "status": "passed"
+      },
+      {
+        "date": "2025-12-17",
+        "event": "Commission published first draft Code of Practice on marking/labeling AI-generated content",
+        "impact_on_product": "Update content marking SDK requirements per Code of Practice. Integrate C2PA and marking standards referenced.",
+        "status": "passed"
+      },
+      {
+        "date": "2026-02-02",
+        "event": "Expected: Commission guidelines on high-risk AI classification (detailed examples for Annex III categories)",
+        "impact_on_product": "Update risk classification questionnaire with official examples and edge cases. Refine classification logic.",
+        "status": "upcoming"
+      },
+      {
+        "date": "2026-08-02",
+        "event": "Phase 3: MAJORITY OF PROVISIONS APPLY. High-risk AI (Annex III) rules. Transparency (Art. 50). Deployer obligations (Art. 26). FRIA (Art. 27). Registration (Art. 49). Sandboxes (Art. 57). Post-market monitoring (Art. 72). Incident reporting (Art. 73).",
+        "impact_on_product": "CRITICAL DEADLINE. All deployer and provider modules for high-risk AI must be fully operational. FRIA templates, monitoring dashboards, incident reporting workflows, EU database registration guidance, transparency compliance (disclosure + content marking) all live. This is the main enforcement date.",
+        "status": "upcoming"
+      },
+      {
+        "date": "2026-08-02",
+        "event": "GPAI administrative fines (Art. 101) become enforceable by AI Office",
+        "impact_on_product": "Update penalty information for GPAI providers. Ensure GPAI compliance scoring reflects enforcement risk.",
+        "status": "upcoming"
+      },
+      {
+        "date": "2027-08-02",
+        "event": "Phase 4: Full enforcement. Annex II high-risk (product safety AI). Legacy GPAI compliance deadline.",
+        "impact_on_product": "All remaining modules operational. Product safety AI compliance workflows. Full cross-regulation scoring. Legacy GPAI provider remediation tracking.",
+        "status": "upcoming"
+      },
+      {
+        "date": "2027-12-31",
+        "event": "Expected: Harmonised standards for AI published by European standardisation organisations (CEN/CENELEC)",
+        "impact_on_product": "Integrate harmonised standards references into conformity assessment workflows. Update technical requirements against formal standards.",
+        "status": "upcoming"
+      },
+      {
+        "date": "2028-08-02",
+        "event": "Commission evaluation of AI Office functioning (Art. 112)",
+        "impact_on_product": "Monitor for potential structural changes in enforcement landscape.",
+        "status": "upcoming"
+      },
+      {
+        "date": "2029-08-02",
+        "event": "Commission evaluation of impact/effectiveness of voluntary codes of conduct (Art. 112)",
+        "impact_on_product": "Monitor for potential shift from voluntary to mandatory for minimal-risk AI.",
+        "status": "upcoming"
+      },
+      {
+        "date": "2030-08-02",
+        "event": "Commission review of entire AI Act — potential amendments to scope, classification, governance",
+        "impact_on_product": "Major review cycle. Prepare for potential framework changes. Monitor legislative proposals.",
+        "status": "upcoming"
+      },
+      {
+        "date": "2030-12-31",
+        "event": "Large-scale IT systems in AFSJ (Annex X) compliance deadline",
+        "impact_on_product": "Final compliance deadline for legacy systems in justice/security domain.",
+        "status": "upcoming"
+      }
+    ],
+    "expected_amendments": [
+      "Digital Omnibus Package (proposed 2025): Commission proposed simplification amendments including adjusting high-risk timeline to link application to availability of harmonised standards. May extend some deadlines by up to 16 months.",
+      "Potential amendment to Annex III: Commission can expand or modify the high-risk use case list through delegated acts (Art. 7). Monitor for new high-risk categories.",
+      "GPAI systemic risk threshold: The 10^25 FLOPs threshold may be revised as compute capabilities evolve (Art. 51(3)).",
+      "Content marking standards: Technical standards for AI content marking are still being developed. Expect updates to implementation requirements."
+    ],
+    "codes_of_practice": [
+      {
+        "title": "General-Purpose AI Code of Practice",
+        "status": "finalized_august_2025",
+        "description": "Voluntary guidelines for GPAI model providers covering transparency, documentation, copyright compliance, and safety testing.",
+        "url": "https://digital-strategy.ec.europa.eu/en/policies/ai-pact"
+      },
+      {
+        "title": "Code of Practice on Marking and Labelling AI-Generated Content",
+        "status": "first_draft_december_2025",
+        "description": "Guidelines for machine-readable marking of AI-generated content (images, audio, video, text). Covers C2PA, watermarking, and metadata standards.",
+        "url": "https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai"
+      },
+      {
+        "title": "Harmonised Standards for AI (CEN/CENELEC)",
+        "status": "in_development",
+        "description": "Formal European harmonised standards for AI systems. When published, compliance with these standards provides presumption of conformity with AI Act requirements.",
+        "expected_date": "2027"
+      }
+    ],
+    "monitoring_sources": [
+      "https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai — European Commission AI policy page (primary)",
+      "https://ai-act-service-desk.ec.europa.eu/ — Official EU AI Act Service Desk",
+      "https://artificialintelligenceact.eu/ — Comprehensive AI Act reference (Future of Life Institute)",
+      "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R1689 — Official text on EUR-Lex",
+      "https://www.europarl.europa.eu/topics/en/article/20230601STO93804/eu-ai-act-first-regulation-on-artificial-intelligence — European Parliament AI Act overview",
+      "https://ec.europa.eu/commission/presscorner/home/en — European Commission press releases",
+      "EU AI Office announcements — monitor for enforcement actions, guidelines, and delegated acts"
+    ],
+    "review_frequency": "monthly — critical regulatory implementation period through August 2027. Switch to quarterly after full enforcement."
+  },
+  "version": {
+    "framework_version": "3.0-production",
+    "processed_date": "2026-02-17",
+    "source_regulation_version": "Regulation (EU) 2024/1689 as published in OJ L 2024/1689",
+    "processing_prompt_version": "12-stage-v2",
+    "last_regulatory_update_checked": "2025-12-17 (Code of Practice on content marking draft)",
+    "next_review_due": "2026-03-01",
+    "notes": "Production-grade framework with granular obligation decomposition, full what_not_to_do coverage, expanded deployer obligations, and comprehensive tech specs for scanner."
+  }
+}

package/data/regulations/jurisdictions/at.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "AT",
+  "country_name": "Austria",
+  "msa_name": "RTR - Rundfunk und Telekom Regulierungs-GmbH",
+  "msa_url": "https://www.rtr.at",
+  "msa_contact": "rtr@rtr.at",
+  "local_requirements": [
+    "National AI strategy alignment required",
+    "German-language documentation mandatory for public-facing AI systems",
+    "Austrian DPA (DSB) notification required for high-risk AI processing personal data"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "German",
+  "notes": "RTR designated as MSA under national AI Act implementation"
+}

package/data/regulations/jurisdictions/be.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "BE",
+  "country_name": "Belgium",
+  "msa_name": "Federal Public Service Economy - AI Authority",
+  "msa_url": "https://economie.fgov.be",
+  "msa_contact": "info.eco@economie.fgov.be",
+  "local_requirements": [
+    "Bilingual documentation required (French and Dutch) for federal AI systems",
+    "National DPA (APD/GBA) notification required for high-risk AI",
+    "Belgian Knowledge Centre for Data & Society alignment recommended"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "French/Dutch/German",
+  "notes": "Federal structure requires coordination between regional and federal authorities"
+}

package/data/regulations/jurisdictions/bg.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "BG",
+  "country_name": "Bulgaria",
+  "msa_name": "Commission for Consumer Protection",
+  "msa_url": "https://www.kzp.bg",
+  "msa_contact": "info@kzp.bg",
+  "local_requirements": [
+    "Bulgarian-language user-facing documentation required",
+    "National DPA (CPDP) notification for AI systems processing personal data",
+    "Alignment with Bulgarian Digital Transformation Strategy"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "Bulgarian",
+  "notes": "Consumer protection authority acts as primary MSA"
+}

package/data/regulations/jurisdictions/cy.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "CY",
+  "country_name": "Cyprus",
+  "msa_name": "Department of Electronic Communications (DEC)",
+  "msa_url": "https://www.mcw.gov.cy/dec",
+  "msa_contact": "dec@mcw.gov.cy",
+  "local_requirements": [
+    "Greek-language documentation required for public sector AI",
+    "National DPA notification for AI processing personal data",
+    "Alignment with Cyprus Digital Strategy 2025-2030"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "Greek",
+  "notes": "Small market; DEC handles AI oversight alongside telecommunications"
+}

package/data/regulations/jurisdictions/cz.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "CZ",
+  "country_name": "Czech Republic",
+  "msa_name": "Czech Trade Inspection Authority (CTIA)",
+  "msa_url": "https://www.coi.cz",
+  "msa_contact": "info@coi.cz",
+  "local_requirements": [
+    "Czech-language user documentation mandatory",
+    "National DPA (UOOU) notification required for high-risk AI",
+    "Alignment with Czech National AI Strategy"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "Czech",
+  "notes": "CTIA handles market surveillance for AI products alongside consumer goods"
+}

package/data/regulations/jurisdictions/de.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "DE",
+  "country_name": "Germany",
+  "msa_name": "Bundesnetzagentur (Federal Network Agency)",
+  "msa_url": "https://www.bundesnetzagentur.de",
+  "msa_contact": "info@bnetza.de",
+  "local_requirements": [
+    "German-language documentation mandatory for all AI systems in German market",
+    "National DPA (BfDI) notification required for high-risk AI systems",
+    "Sector-specific requirements for AI in critical infrastructure (BSI alignment)"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "German",
+  "notes": "Bundesnetzagentur designated as primary MSA; federal state DPAs also have oversight roles"
+}

package/data/regulations/jurisdictions/dk.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "DK",
+  "country_name": "Denmark",
+  "msa_name": "Danish Business Authority (Erhvervsstyrelsen)",
+  "msa_url": "https://www.erst.dk",
+  "msa_contact": "erst@erst.dk",
+  "local_requirements": [
+    "Danish-language documentation for consumer-facing AI systems",
+    "National DPA (Datatilsynet) notification for high-risk AI",
+    "Alignment with Danish National Strategy for Artificial Intelligence"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "Danish",
+  "notes": "Denmark has a proactive AI ethics framework alongside EU AI Act compliance"
+}

package/data/regulations/jurisdictions/ee.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "EE",
+  "country_name": "Estonia",
+  "msa_name": "Consumer Protection and Technical Regulatory Authority (TTJA)",
+  "msa_url": "https://www.ttja.ee",
+  "msa_contact": "info@ttja.ee",
+  "local_requirements": [
+    "Estonian-language documentation for public sector AI deployments",
+    "National DPA (AKI) notification for AI processing personal data",
+    "e-Estonia digital infrastructure compliance for government AI systems"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "Estonian",
+  "notes": "Estonia is a leader in digital governance and AI adoption in public services"
+}

package/data/regulations/jurisdictions/es.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "ES",
+  "country_name": "Spain",
+  "msa_name": "Agencia Espanola de Supervision de la Inteligencia Artificial (AESIA)",
+  "msa_url": "https://www.aesia.gob.es",
+  "msa_contact": "contacto@aesia.gob.es",
+  "local_requirements": [
+    "Spanish-language documentation mandatory for all AI systems in Spanish market",
+    "AEPD notification required for high-risk AI processing personal data",
+    "National AI regulatory sandbox participation available for testing"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "Spanish",
+  "notes": "Spain was the first EU member state to create a dedicated AI supervisory agency (AESIA)"
+}

package/data/regulations/jurisdictions/fi.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "FI",
+  "country_name": "Finland",
+  "msa_name": "Transport and Communications Agency (Traficom)",
+  "msa_url": "https://www.traficom.fi",
+  "msa_contact": "kirjaamo@traficom.fi",
+  "local_requirements": [
+    "Finnish and Swedish language documentation for public AI systems",
+    "National DPA (Tietosuojavaltuutettu) notification for high-risk AI",
+    "Alignment with Finland AuroraAI programme for ethical AI"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "Finnish/Swedish",
+  "notes": "Traficom oversees digital safety including AI systems"
+}

package/data/regulations/jurisdictions/fr.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "FR",
+  "country_name": "France",
+  "msa_name": "CNIL + Direction generale des entreprises (DGE)",
+  "msa_url": "https://www.cnil.fr",
+  "msa_contact": "contact@cnil.fr",
+  "local_requirements": [
+    "French-language documentation mandatory for all consumer AI systems",
+    "CNIL AI impact assessment required for systems processing personal data",
+    "Sector-specific requirements for public sector AI (Etalab guidelines)"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "French",
+  "notes": "France has dual oversight: CNIL for data protection aspects, DGE for market surveillance"
+}

package/data/regulations/jurisdictions/gr.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "GR",
+  "country_name": "Greece",
+  "msa_name": "National Telecommunications and Post Commission (EETT)",
+  "msa_url": "https://www.eett.gr",
+  "msa_contact": "info@eett.gr",
+  "local_requirements": [
+    "Greek-language documentation required for consumer-facing AI systems",
+    "National DPA (HDPA) notification for AI processing personal data",
+    "Alignment with Greek National AI Strategy (Hellenic AI Society)"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "Greek",
+  "notes": "EETT handles digital market oversight including AI systems"
+}

package/data/regulations/jurisdictions/hr.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "HR",
+  "country_name": "Croatia",
+  "msa_name": "Croatian Regulatory Authority for Network Industries (HAKOM)",
+  "msa_url": "https://www.hakom.hr",
+  "msa_contact": "info@hakom.hr",
+  "local_requirements": [
+    "Croatian-language documentation mandatory for consumer-facing AI",
+    "National DPA (AZOP) notification required for high-risk AI",
+    "Sector-specific requirements for public administration AI systems"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "Croatian",
+  "notes": "HAKOM designated as primary MSA for AI systems in Croatia"
+}

package/data/regulations/jurisdictions/hu.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "HU",
+  "country_name": "Hungary",
+  "msa_name": "National Media and Infocommunications Authority (NMHH)",
+  "msa_url": "https://www.nmhh.hu",
+  "msa_contact": "info@nmhh.hu",
+  "local_requirements": [
+    "Hungarian-language documentation mandatory for consumer AI systems",
+    "National DPA (NAIH) notification required for high-risk AI",
+    "Alignment with Hungarian Artificial Intelligence Strategy"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "Hungarian",
+  "notes": "NMHH oversees digital communications and AI market surveillance"
+}

package/data/regulations/jurisdictions/ie.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "IE",
+  "country_name": "Ireland",
+  "msa_name": "Commission for Communications Regulation (ComReg)",
+  "msa_url": "https://www.comreg.ie",
+  "msa_contact": "info@comreg.ie",
+  "local_requirements": [
+    "English-language documentation accepted; Irish also recognized",
+    "National DPC notification required for high-risk AI processing personal data",
+    "Enterprise Ireland AI governance framework alignment recommended"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "English/Irish",
+  "notes": "Ireland hosts many multinational tech HQs; DPC has significant cross-border AI oversight role"
+}

package/data/regulations/jurisdictions/is.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "IS",
+  "country_name": "Iceland",
+  "msa_name": "Post and Telecom Administration (PFS)",
+  "msa_url": "https://www.pfs.is",
+  "msa_contact": "pfs@pfs.is",
+  "local_requirements": [
+    "Icelandic-language documentation for public-facing AI systems",
+    "National DPA (Persónuvernd) notification for AI processing personal data",
+    "EEA agreement obligations for AI Act transposition"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "Icelandic",
+  "notes": "EEA member; AI Act applies through EEA Agreement incorporation"
+}

package/data/regulations/jurisdictions/it.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "IT",
+  "country_name": "Italy",
+  "msa_name": "Agenzia per l'Italia Digitale (AgID)",
+  "msa_url": "https://www.agid.gov.it",
+  "msa_contact": "protocollo@pec.agid.gov.it",
+  "local_requirements": [
+    "Italian-language documentation mandatory for all AI systems in Italian market",
+    "Garante per la protezione dei dati personali notification for high-risk AI",
+    "Sector-specific requirements for public administration AI (Piano Triennale)"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "Italian",
+  "notes": "AgID coordinates AI governance for public sector; Garante handles data protection aspects"
+}

package/data/regulations/jurisdictions/li.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "LI",
+  "country_name": "Liechtenstein",
+  "msa_name": "Office for Communications (AK)",
+  "msa_url": "https://www.llv.li/inhalt/118804/amtsstellen/amt-fur-kommunikation",
+  "msa_contact": "info.ak@llv.li",
+  "local_requirements": [
+    "German-language documentation accepted",
+    "National DPA (DSS) notification for AI processing personal data",
+    "EEA agreement obligations for AI Act transposition"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "German",
+  "notes": "EEA member; AI Act applies through EEA Agreement; strong fintech sector"
+}

package/data/regulations/jurisdictions/lt.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "LT",
+  "country_name": "Lithuania",
+  "msa_name": "State Consumer Rights Protection Authority (VVTAT)",
+  "msa_url": "https://www.vvtat.lt",
+  "msa_contact": "vvtat@vvtat.lt",
+  "local_requirements": [
+    "Lithuanian-language documentation for consumer-facing AI systems",
+    "National DPA (VDAI) notification for high-risk AI",
+    "Alignment with Lithuanian AI Strategy and Innovation Agency guidelines"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "Lithuanian",
+  "notes": "VVTAT manages consumer protection including AI product safety"
+}

package/data/regulations/jurisdictions/lu.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "LU",
+  "country_name": "Luxembourg",
+  "msa_name": "Institut Luxembourgeois de Regulation (ILR)",
+  "msa_url": "https://www.ilr.lu",
+  "msa_contact": "info@ilr.lu",
+  "local_requirements": [
+    "French, German, or Luxembourgish documentation accepted",
+    "National DPA (CNPD) notification for AI processing personal data",
+    "Alignment with Luxembourg Digital Innovation Hub requirements"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "French/German/Luxembourgish",
+  "notes": "ILR regulates digital markets including AI; strong fintech and AI ecosystem"
+}

package/data/regulations/jurisdictions/lv.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "LV",
+  "country_name": "Latvia",
+  "msa_name": "Consumer Rights Protection Centre (PTAC)",
+  "msa_url": "https://www.ptac.gov.lv",
+  "msa_contact": "ptac@ptac.gov.lv",
+  "local_requirements": [
+    "Latvian-language documentation required for consumer-facing AI",
+    "National DPA (DVI) notification for AI processing personal data",
+    "Alignment with Latvian AI Strategy and Digital Transformation Guidelines"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "Latvian",
+  "notes": "PTAC handles consumer protection aspects of AI market surveillance"
+}

package/data/regulations/jurisdictions/mt.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "MT",
+  "country_name": "Malta",
+  "msa_name": "Malta Communications Authority (MCA)",
+  "msa_url": "https://www.mca.org.mt",
+  "msa_contact": "info@mca.org.mt",
+  "local_requirements": [
+    "English or Maltese documentation accepted",
+    "Malta Digital Innovation Authority (MDIA) certification for innovative technology",
+    "National DPA (IDPC) notification for AI processing personal data"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "Maltese/English",
+  "notes": "Malta was among the first EU states to establish AI-specific governance (MDIA)"
+}

package/data/regulations/jurisdictions/nl.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "NL",
+  "country_name": "Netherlands",
+  "msa_name": "Autoriteit Consument & Markt (ACM)",
+  "msa_url": "https://www.acm.nl",
+  "msa_contact": "info@acm.nl",
+  "local_requirements": [
+    "Dutch-language documentation required for consumer-facing AI",
+    "Autoriteit Persoonsgegevens (AP) notification for high-risk AI processing personal data",
+    "Algorithm Register mandatory for government AI systems"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "Dutch",
+  "notes": "Netherlands has a public Algorithm Register and proactive algorithmic oversight"
+}

package/data/regulations/jurisdictions/no.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "NO",
+  "country_name": "Norway",
+  "msa_name": "Norwegian Communications Authority (Nkom)",
+  "msa_url": "https://www.nkom.no",
+  "msa_contact": "firmapost@nkom.no",
+  "local_requirements": [
+    "Norwegian-language documentation required for consumer-facing AI",
+    "National DPA (Datatilsynet) notification for high-risk AI",
+    "Alignment with Norwegian National Strategy for Artificial Intelligence"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "Norwegian",
+  "notes": "EEA member; AI Act applies through EEA Agreement; active AI ethics community"
+}

package/data/regulations/jurisdictions/pl.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "PL",
+  "country_name": "Poland",
+  "msa_name": "Office of Electronic Communications (UKE)",
+  "msa_url": "https://www.uke.gov.pl",
+  "msa_contact": "uke@uke.gov.pl",
+  "local_requirements": [
+    "Polish-language documentation mandatory for consumer AI systems",
+    "National DPA (UODO) notification required for high-risk AI",
+    "Alignment with Polish AI Development Policy"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "Polish",
+  "notes": "UKE oversees electronic communications and digital market surveillance"
+}

package/data/regulations/jurisdictions/pt.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "PT",
+  "country_name": "Portugal",
+  "msa_name": "ANACOM - Autoridade Nacional de Comunicacoes",
+  "msa_url": "https://www.anacom.pt",
+  "msa_contact": "info@anacom.pt",
+  "local_requirements": [
+    "Portuguese-language documentation required for consumer-facing AI",
+    "National DPA (CNPD) notification for AI processing personal data",
+    "Alignment with Portugal INCoDe.2030 digital competences strategy"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "Portuguese",
+  "notes": "ANACOM oversees communications and digital market including AI systems"
+}

package/data/regulations/jurisdictions/ro.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "RO",
+  "country_name": "Romania",
+  "msa_name": "National Authority for Management and Regulation in Communications (ANCOM)",
+  "msa_url": "https://www.ancom.ro",
+  "msa_contact": "ancom@ancom.ro",
+  "local_requirements": [
+    "Romanian-language documentation mandatory for consumer AI systems",
+    "National DPA (ANSPDCP) notification for high-risk AI processing personal data",
+    "Alignment with Romanian National Strategy on Artificial Intelligence"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "Romanian",
+  "notes": "ANCOM handles communications regulation and AI market surveillance"
+}

package/data/regulations/jurisdictions/se.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "SE",
+  "country_name": "Sweden",
+  "msa_name": "Post and Telecom Authority (PTS)",
+  "msa_url": "https://www.pts.se",
+  "msa_contact": "pts@pts.se",
+  "local_requirements": [
+    "Swedish-language documentation required for consumer AI systems",
+    "National DPA (IMY) notification for high-risk AI processing personal data",
+    "Alignment with Swedish National Approach to Artificial Intelligence"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "Swedish",
+  "notes": "PTS oversees telecommunications and digital services including AI market surveillance"
+}