@connexum/ai-governance 1.0.0-beta.11

package/dist/esm/packs/au-online-safety.js

@@ -0,0 +1,297 @@
+/**
+ * AU Online Safety Act 2021
+ *
+ * Primary statute: Online Safety Act 2021 (Cth) (OSA), effective 23 January 2022.
+ *
+ * Key instruments:
+ *   - Basic Online Safety Expectations (BOSE) Determination 2022 (s.48)
+ *   - Online Safety (Relevant Electronic Services) Determination
+ *   - Online Safety (Designated Internet Services) Determination
+ *   - eSafety Commissioner enforcement guidelines
+ *
+ * Covered services: Social media services, relevant electronic services (private
+ * messaging, online gaming, email, dating), and designated internet services
+ * (hosting, search, content aggregation) with AU end-users. AI systems operating
+ * as or within these services: AI chat, AI moderation, AI recommendation engines,
+ * AI-generated content platforms, AI companions/virtual agents.
+ *
+ * Key AI obligations:
+ *   - Part 4 (Cyberbullying): 48-hour removal obligation after notice targeting AU child.
+ *   - Part 5 (Adult Cyber Abuse): 48-hour removal after eSafety notice.
+ *   - Part 6 (NCII + Deepfake): 2024 amendments extend to AI-generated deepfake
+ *     intimate images; removal on notice.
+ *   - Part 9 (Class 1 CSAM): Absolute prohibition; proactive detection required.
+ *     AI generation systems need active safeguards against Class 1 production.
+ *   - BOSE s.8-10: Age assurance/verification and safety by design for minors.
+ *   - BOSE s.11-12: Transparency reporting on eSafety request.
+ *
+ * [CITATION TO VERIFY]: NCII deepfake commencement date (2024 amendments) — verify
+ * exact commencement date and current eSafety guidance on technical age-assurance
+ * requirements. Physical e-commerce platforms with incidental messaging — verify
+ * scope exclusion under current determinations.
+ *
+ * Cross-pack interactions:
+ *   - au-online-safety + au-privacy-act: Moderation records contain PI; APP 11
+ *     applies. eSafety investigation powers (s.173-183) may override APP 6
+ *     secondary-use restrictions for investigations.
+ *   - au-online-safety + coppa: AU platforms with US under-13 users: OSA minor
+ *     protections for AU; COPPA for US under-13. Both regimes run simultaneously.
+ *   - au-online-safety + euaiact: GPAI providers with systemic-risk classification
+ *     face EU AI Act Art. 53/55 obligations complementary to BOSE. AU 48-hour
+ *     removal more operationally demanding than EU AI Act transparency obligations.
+ *
+ * Authority: eSafety Commissioner (Australia)
+ * Sovereignty: Australian Federal
+ *
+ * @connexum/ai-governance
+ */
+export const AU_ONLINE_SAFETY_CATEGORY_CLASSIFIERS = {
+    OSA_CSAM: {
+        references: ['OSA 2021 Part 9 — Class 1 material (CSAM) absolute prohibition + proactive detection'],
+        classifier: (input) => {
+            // Content indicating CSAM classification or risk
+            if (/\b(?:class[_\-\s]?1\s+material|csam|child\s+(?:sexual\s+abuse\s+material|exploitation\s+material|sex(?:ual)?\s+content)|child\s+(?:pornography|abuse\s+image))/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    OSA_CLASS2_MATERIAL: {
+        references: ['OSA 2021 Part 9 — Class 2 material: pro-terror, NCII, abusive targeted content'],
+        classifier: (input) => {
+            if (/\b(?:class[_\-\s]?2\s+material|pro[_\-\s]?terror(?:ism)?\s+content|osa\s+class\s*2|violent\s+extremist\s+content.*online\s+safety)/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    OSA_CYBERBULLYING_CHILD: {
+        references: ['OSA 2021 Part 4 — cyberbullying targeting AU child; 48-hour removal'],
+        classifier: (input) => {
+            if (/\b(?:cyberbullying.*(?:child|minor|under[_\-\s]?18|au\s+child)|targeting.*(?:child|minor).*(?:online|digital|cyber)|online\s+(?:bullying|abuse|harassment).*(?:child|minor|au\s+child))/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    OSA_NCII: {
+        references: ['OSA 2021 Part 6 — NCII; 2024 amendments extend to AI deepfake intimate images [CITATION TO VERIFY commencement]'],
+        classifier: (input) => {
+            if (/\b(?:ncii|non[_\-\s]?consensual\s+intimate\s+image|deepfake\s+(?:intimate|nude|sexual)|revenge\s+porn|intimate\s+image.*without\s+consent)/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    OSA_ESAFETY_NOTICE: {
+        references: ['OSA 2021 s.194-201 — formal eSafety compliance notice; BOSE compliance notice'],
+        classifier: (input) => {
+            if (/\b(?:esafety\s+(?:notice|commissioner\s+notice|compliance\s+notice|information\s+request)|formal\s+notice.*(?:esafety|online\s+safety\s+act))/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    OSA_BOSE_GAP: {
+        references: ['OSA 2021 s.48 BOSE Determination 2022 — 22 basic online safety expectations'],
+        classifier: (input) => {
+            if (/\b(?:bose\s+(?:gap|compliance|expectation|coverage)|basic\s+online\s+safety\s+expectation|bose\s+2022.*(?:gap|missing|not\s+met))/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    OSA_MINOR_USER: {
+        references: ['OSA 2021 BOSE s.8-10 — children\'s safety; age assurance [CITATION TO VERIFY technical requirements]'],
+        classifier: (input) => {
+            if (/\b(?:minor\s+(?:user|account|profile)|under[_\-\s]?18\s+user|child\s+(?:user|account)|age\s+(?:gate|assurance|verification).*(?:minor|child|under[_\-\s]?18))/i.test(input))
+                return true;
+            return false;
+        },
+    },
+};
+export const AU_ONLINE_SAFETY_PACK = {
+    categoryClassifiers: AU_ONLINE_SAFETY_CATEGORY_CLASSIFIERS,
+    /**
+     * P3.5: Content-keyed categories (CSAM, Class 2, NCII, cyberbullying) are
+     * subject-keyed by content target or by content ID to maintain eSafety
+     * investigation audit trail. Minor user is subject-keyed. BOSE gap is
+     * system-level (non-subject-keyed).
+     *
+     * [CITATION TO VERIFY]: NCII deepfake commencement date; eSafety technical
+     * age-assurance standard; scope of designated internet services determination.
+     */
+    subjectKeyedCategories: [
+        'OSA_CSAM',
+        'OSA_CLASS2_MATERIAL',
+        'OSA_CYBERBULLYING_CHILD',
+        'OSA_NCII',
+        'OSA_MINOR_USER',
+    ],
+    id: 'au-online-safety',
+    name: 'AU Online Safety Act 2021',
+    version: '1.0.0',
+    description: 'Online Safety Act 2021 compliance for AI systems deployed on or as social media, messaging, gaming, or content hosting services with AU users. Enforces absolute CSAM block (Part 9), NCII and deepfake intimate image block (Part 6, 2024 amendments [CITATION TO VERIFY commencement]), 48-hour cyberbullying removal (Part 4), minor user protection controls (BOSE s.8-10), eSafety notice routing, and BOSE coverage documentation.',
+    authority: 'eSafety Commissioner (Australia)',
+    industries: [
+        'social-media', 'saas', 'consumer-apps', 'gaming',
+        'edtech', 'media', 'messaging', 'ai-platforms',
+    ],
+    requiredModules: [
+        {
+            name: 'governance-runtime',
+            required: true,
+            reason: 'CSAM absolute block; NCII/deepfake block; 48-hour removal protocol; eSafety notice routing; minor user enhanced controls',
+            reference: 'OSA 2021 Part 4 (48h); Part 6 (NCII); Part 9 (CSAM); BOSE s.8-10 (minors)',
+        },
+        {
+            name: 'audit-integrity',
+            required: true,
+            reason: 'Content moderation records 3 years; eSafety notice records 7 years; CSAM detection/referral records 7 years',
+            reference: 'OSA 2021; law enforcement retention requirements for CSAM records',
+        },
+        {
+            name: 'data-classifier',
+            required: true,
+            reason: 'Detect CSAM, Class 2 material, NCII/deepfake, cyberbullying targeting children, minor users, eSafety notices',
+            reference: 'OSA 2021 Part 4, 5, 6, 9; BOSE 2022',
+        },
+        {
+            name: 'approval-queue',
+            required: true,
+            reason: 'eSafety notice legal and senior management review; minor user enhanced-restriction approval',
+            reference: 'OSA 2021 s.194-201 (compliance notice); BOSE s.8-10',
+        },
+        {
+            name: 'event-bus',
+            required: true,
+            reason: 'CSAM detection referral stream; 48-hour removal timer events; eSafety notice events; minor user context events',
+            reference: 'OSA 2021 Part 4 (48h); Part 9 (CSAM prompt referral)',
+        },
+    ],
+    moduleConfig: {
+        'data-classifier': {
+            enabledCategories: [
+                'OSA_CSAM',
+                'OSA_CLASS2_MATERIAL',
+                'OSA_CYBERBULLYING_CHILD',
+                'OSA_NCII',
+                'OSA_ESAFETY_NOTICE',
+                'OSA_BOSE_GAP',
+                'OSA_MINOR_USER',
+            ],
+            csamBlockEnabled: true,
+            nciiBlockEnabled: true,
+            contentRemoval48hActive: true,
+            esafetyNoticeRoutingEnabled: true,
+            minorUserProtectionsEnabled: true,
+            boseCoverageDocumented: true,
+            moderationLoggingActive: true,
+        },
+        'governance-runtime': {
+            csamBlockEnabled: true,
+            nciiBlockEnabled: true,
+            contentRemoval48hActive: true,
+            esafetyNoticeRoutingEnabled: true,
+            minorUserProtectionsEnabled: true,
+            boseCoverageDocumented: true,
+            moderationLoggingActive: true,
+        },
+        'approval-queue': {
+            esafetyNoticeApprovalRequired: true,
+            minorUserRestrictionApprovalRequired: true,
+        },
+    },
+    providerPolicy: {
+        blockedProviders: [],
+        requiredCapabilities: [
+            'CSAM-PROACTIVE-DETECTION',
+            'NCII-DEEPFAKE-SAFEGUARDS',
+            'ESAFETY-NOTICE-COOPERATION',
+            'MINOR-AGE-ASSURANCE',
+        ],
+        blockReasons: {},
+    },
+    dataPolicy: {
+        scanCategories: [
+            'OSA_CSAM',
+            'OSA_CLASS2_MATERIAL',
+            'OSA_CYBERBULLYING_CHILD',
+            'OSA_NCII',
+            'OSA_ESAFETY_NOTICE',
+            'OSA_BOSE_GAP',
+            'OSA_MINOR_USER',
+        ],
+        categoryActions: {
+            OSA_CSAM: 'BLOCK',
+            OSA_CLASS2_MATERIAL: 'BLOCK',
+            OSA_CYBERBULLYING_CHILD: 'BLOCK',
+            OSA_NCII: 'BLOCK',
+            OSA_ESAFETY_NOTICE: 'REQUIRE_APPROVAL',
+            OSA_BOSE_GAP: 'WARN',
+            OSA_MINOR_USER: 'REQUIRE_APPROVAL',
+        },
+        encryptionRequired: true,
+        encryptionStandard: 'AES-256',
+        minimumClassification: 'CONFIDENTIAL',
+    },
+    retentionPolicy: {
+        sovereignty: ['AU'],
+        auditLogRetentionDays: 2555, // 7 years (eSafety notice records, CSAM detection records)
+        sessionRetentionDays: 1095, // 3 years (moderation records, BOSE compliance docs)
+        incidentRetentionDays: 2555,
+        reference: 'OSA 2021: content moderation records 3y; eSafety notice records 7y; CSAM detection/referral records 7y (law enforcement)',
+    },
+    incidentPolicy: {
+        notificationDeadlineHours: 48, // Part 4/5/6: 48-hour removal obligation on notice
+        reference: 'OSA 2021 s.67 (Part 4/5 cyberbullying/adult abuse 48h); Part 6 (NCII removal on notice); Part 9 (CSAM immediate)',
+        requiredRecipients: ['esafety-commissioner', 'afp'],
+        formalNotificationRequired: true,
+    },
+    validators: [
+        {
+            id: 'au-online-safety-csam-block',
+            description: 'CSAM generation and hosting absolutely blocked; proactive detection active',
+            reference: 'OSA 2021 Part 9',
+            check: 'au_online_safety_csam_block_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'au-online-safety-ncii-block',
+            description: 'NCII and AI-generated deepfake intimate images blocked [CITATION TO VERIFY: 2024 amendment commencement]',
+            reference: 'OSA 2021 Part 6 (2024 amendments)',
+            check: 'au_online_safety_ncii_block_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'au-online-safety-48h-removal',
+            description: 'Cyberbullying targeting AU children and Class 2 material removal protocol active within 48 hours',
+            reference: 'OSA 2021 s.67',
+            check: 'au_online_safety_48h_removal_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'au-online-safety-esafety-notice',
+            description: 'Formal eSafety notice triggers REQUIRE_APPROVAL with legal and senior management routing',
+            reference: 'OSA 2021 s.194-201',
+            check: 'au_online_safety_esafety_notice_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'au-online-safety-minor-protections',
+            description: 'Minor user context activates enhanced safety controls and age-appropriate restrictions',
+            reference: 'OSA 2021 BOSE s.8-10',
+            check: 'au_online_safety_minor_protections_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'au-online-safety-bose-coverage',
+            description: 'BOSE compliance documented for all 22 basic online safety expectations',
+            reference: 'OSA 2021 BOSE Determination 2022',
+            check: 'au_online_safety_bose_coverage_active',
+            failSeverity: 'MEDIUM',
+        },
+        {
+            id: 'au-online-safety-moderation-logging',
+            description: 'All content moderation events logged with content classification and outcome',
+            reference: 'OSA 2021 eSafety enforcement guidance',
+            check: 'au_online_safety_moderation_logging_active',
+            failSeverity: 'MEDIUM',
+        },
+    ],
+};
+//# sourceMappingURL=au-online-safety.js.map

package/dist/esm/packs/au-online-safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"au-online-safety.js","sourceRoot":"","sources":["../../../src/packs/au-online-safety.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAKH,MAAM,CAAC,MAAM,qCAAqC,GAAwB;IACxE,QAAQ,EAAE;QACR,UAAU,EAAE,CAAC,sFAAsF,CAAC;QACpG,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,iDAAiD;YACjD,IAAI,iKAAiK,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/L,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,mBAAmB,EAAE;QACnB,UAAU,EAAE,CAAC,gFAAgF,CAAC;QAC9F,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,qIAAqI,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnK,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,uBAAuB,EAAE;QACvB,UAAU,EAAE,CAAC,qEAAqE,CAAC;QACnF,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,0LAA0L,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACxN,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,QAAQ,EAAE;QACR,UAAU,EAAE,CAAC,iHAAiH,CAAC;QAC/H,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,6IAA6I,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3K,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,kBAAkB,EAAE;QAClB,UAAU,EAAE,CAAC,+EAA+E,CAAC;QAC7F,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,gJAAgJ,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9K,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,YAAY,EAAE;QACZ,UAAU,EAAE,CAAC,6EAA6E,CAAC;QAC3F,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,oIAAoI,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClK,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,cAAc,EAAE;QACd,UAAU,EAAE,CAAC,sGAAsG,CAAC;QACpH,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,gKAAgK,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9L,OAAO,KAAK,CAAC;QACf,CAAC;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAG9B;IACF,mBAAmB,EAAE,qCAAqC;IAC1D;;;;;;;;OAQG;IACH,sBAAsB,EAAE;QACtB,UAAU;QACV,qBAAqB;QACrB,yBAAyB;QACzB,UAAU;QACV,gBAAgB;KACjB;IAED,EAAE,EAAE,kBAAkB;IACtB,IAAI,EAAE,2BAA2B;IACjC,OAAO,EAAE,OAAO;IAChB,WAAW,EACT,0aAA0a;IAC5a,SAAS,EAAE,kCAAkC;IAC7C,UAAU,EAAE;QACV,cAAc,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ;QACjD,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc;KAC/C;IAED,eAAe,EAAE;QACf;YACE,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,0HAA0H;YAClI,SAAS,EAAE,2EAA2E;SACvF;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,6GAA6G;YACrH,SAAS,EAAE,mEAAmE;SAC/E;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,8GAA8G;YACtH,SAAS,EAAE,qCAAqC;SACjD;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,6FAA6F;YACrG,SAAS,EAAE,qDAAqD;SACjE;QACD;YACE,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,gHAAgH;YACxH,SAAS,EAAE,sDAAsD;SAClE;KACF;IAED,YAAY,EAAE;QACZ,iBAAiB,EAAE;YACjB,iBAAiB,EAAE;gBACjB,UAAU;gBACV,qBAAqB;gBACrB,yBAAyB;gBACzB,UAAU;gBACV,oBAAoB;gBACpB,cAAc;gBACd,gBAAgB;aACjB;YACD,gBAAgB,EAAE,IAAI;YACtB,gBAAgB,EAAE,IAAI;YACtB,uBAAuB,EAAE,IAAI;YAC7B,2BAA2B,EAAE,IAAI;YACjC,2BAA2B,EAAE,IAAI;YACjC,sBAAsB,EAAE,IAAI;YAC5B,uBAAuB,EAAE,IAAI;SAC9B;QACD,oBAAoB,EAAE;YACpB,gBAAgB,EAAE,IAAI;YACtB,gBAAgB,EAAE,IAAI;YACtB,uBAAuB,EAAE,IAAI;YAC7B,2BAA2B,EAAE,IAAI;YACjC,2BAA2B,EAAE,IAAI;YACjC,sBAAsB,EAAE,IAAI;YAC5B,uBAAuB,EAAE,IAAI;SAC9B;QACD,gBAAgB,EAAE;YAChB,6BAA6B,EAAE,IAAI;YACnC,oCAAoC,EAAE,IAAI;SAC3C;KACF;IAED,cAAc,EAAE;QACd,gBAAgB,EAAE,EAAE;QACpB,oBAAoB,EAAE;YACpB,0BAA0B;YAC1B,0BAA0B;YAC1B,4BAA4B;YAC5B,qBAAqB;SACtB;QACD,YAAY,EAAE,EAAE;KACjB;IAED,UAAU,EAAE;QACV,cAAc,EAAE;YACd,UAAU;YACV,qBAAqB;YACrB,yBAAyB;YACzB,UAAU;YACV,oBAAoB;YACpB,cAAc;YACd,gBAAgB;SACjB;QACD,eAAe,EAAE;YACf,QAAQ,EAAE,OAAO;YACjB,mBAAmB,EAAE,OAAO;YAC5B,uBAAuB,EAAE,OAAO;YAChC,QAAQ,EAAE,OAAO;YACjB,kBAAkB,EAAE,kBAAkB;YACtC,YAAY,EAAE,MAAM;YACpB,cAAc,EAAE,kBAAkB;SACnC;QACD,kBAAkB,EAAE,IAAI;QACxB,kBAAkB,EAAE,SAAS;QAC7B,qBAAqB,EAAE,cAAc;KACtC;IAED,eAAe,EAAE;QACf,WAAW,EAAE,CAAC,IAAI,CAAC;QACnB,qBAAqB,EAAE,IAAI,EAAE,2DAA2D;QACxF,oBAAoB,EAAE,IAAI,EAAE,qDAAqD;QACjF,qBAAqB,EAAE,IAAI;QAC3B,SAAS,EAAE,0HAA0H;KACtI;IAED,cAAc,EAAE;QACd,yBAAyB,EAAE,EAAE,EAAE,mDAAmD;QAClF,SAAS,EAAE,kHAAkH;QAC7H,kBAAkB,EAAE,CAAC,sBAAsB,EAAE,KAAK,CAAC;QACnD,0BAA0B,EAAE,IAAI;KACjC;IAED,UAAU,EAAE;QACV;YACE,EAAE,EAAE,6BAA6B;YACjC,WAAW,EAAE,4EAA4E;YACzF,SAAS,EAAE,iBAAiB;YAC5B,KAAK,EAAE,oCAAoC;YAC3C,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,6BAA6B;YACjC,WAAW,EAAE,0GAA0G;YACvH,SAAS,EAAE,mCAAmC;YAC9C,KAAK,EAAE,oCAAoC;YAC3C,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,8BAA8B;YAClC,WAAW,EAAE,kGAAkG;YAC/G,SAAS,EAAE,eAAe;YAC1B,KAAK,EAAE,qCAAqC;YAC5C,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,iCAAiC;YACrC,WAAW,EAAE,0FAA0F;YACvG,SAAS,EAAE,oBAAoB;YAC/B,KAAK,EAAE,wCAAwC;YAC/C,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,oCAAoC;YACxC,WAAW,EAAE,wFAAwF;YACrG,SAAS,EAAE,sBAAsB;YACjC,KAAK,EAAE,2CAA2C;YAClD,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,gCAAgC;YACpC,WAAW,EAAE,wEAAwE;YACrF,SAAS,EAAE,kCAAkC;YAC7C,KAAK,EAAE,uCAAuC;YAC9C,YAAY,EAAE,QAAQ;SACvB;QACD;YACE,EAAE,EAAE,qCAAqC;YACzC,WAAW,EAAE,8EAA8E;YAC3F,SAAS,EAAE,uCAAuC;YAClD,KAAK,EAAE,4CAA4C;YACnD,YAAY,EAAE,QAAQ;SACvB;KACF;CACF,CAAC"}

package/dist/esm/packs/au-privacy-act.js

@@ -0,0 +1,361 @@
+/**
+ * AU Privacy Act 1988 — Australian Privacy Principles (APPs 1-13)
+ *
+ * Primary statutes:
+ *   - Privacy Act 1988 (Cth); Australian Privacy Principles (Schedule 1)
+ *   - Privacy Legislation Amendment (Enhancing Online Privacy and Other Measures)
+ *     Act 2021
+ *   - Privacy and Other Legislation Amendment Act 2024 (royal assent October 2024,
+ *     phased commencement 2026-2027)
+ *
+ * Entities covered: Australian Government agencies; private sector organisations
+ * with annual turnover exceeding AUD 3 million; health service providers
+ * regardless of size; operators of certain websites and online services with an
+ * Australian link; credit reporting bodies; tax file number recipients. 2024
+ * amendments expand coverage to small businesses that trade in personal
+ * information.
+ *
+ * Key AI obligations:
+ *   - APP 3: Collect only what is reasonably necessary (purpose limitation).
+ *   - APP 6: Secondary uses (AI analytics, training) require separate basis.
+ *   - APP 8: Overseas transfers require reasonable steps for comparable protection;
+ *     AU entity liable for offshore recipient breaches.
+ *   - APP 9: Government identifiers (TFN, Medicare) not adopted as internal IDs.
+ *   - APP 11: Security measures; destroy or de-identify when no longer needed.
+ *   - APP 12: Individual access within 30 days.
+ *   - NDB Scheme (Part IIIC): 30-day internal assessment from awareness;
+ *     OAIC + affected individuals notified on eligible breach.
+ *   - 2024 amendments: AUD 50M penalty for serious/repeated interference;
+ *     statutory tort for serious invasions of privacy.
+ *
+ * Cross-pack interactions:
+ *   - au-privacy-act + au-cdr: CDR Privacy Safeguards are lex specialis for
+ *     CDR data; APPs fill gaps. Dual OAIC + ACCC oversight.
+ *   - au-privacy-act + au-cps234: APRA entities must meet CPS 234 for APP 11.
+ *     CPS 234 is floor; APPs remain independently applicable.
+ *   - au-privacy-act + gdpr: Both apply where AU organisation targets EU data
+ *     subjects. GDPR Art. 6 lawful basis does not substitute for APP compliance;
+ *     dual obligations; stricter governs per category.
+ *   - au-privacy-act + hipaa: Where AU SaMD/clinical AI processes US patient data
+ *     on AU infrastructure, HIPAA covers US-side; Privacy Act APPs cover AU-side.
+ *
+ * Authority: Office of the Australian Information Commissioner (OAIC)
+ * Sovereignty: Australian Federal
+ *
+ * @connexum/ai-governance
+ */
+export const AU_PRIVACY_ACT_CATEGORY_CLASSIFIERS = {
+    AU_PI_INDIVIDUAL: {
+        references: ['Privacy Act 1988 (Cth) s.6 — definition of personal information'],
+        classifier: (input) => {
+            if (/\b(?:au[_\-\s]?individual|australian\s+(?:person|resident|citizen)|personal\s+information)/i.test(input))
+                return true;
+            if (/\b(?:full\s+name|date\s+of\s+birth|home\s+address|phone\s+number|email\s+address)\b.*\b(?:australia|au\s+client|au\s+customer)/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    AU_PI_SENSITIVE: {
+        references: ['Privacy Act 1988 s.6 — sensitive information; APP 3/6 heightened protection'],
+        classifier: (input) => {
+            if (/\b(?:health\s+information|biometric|racial\s+origin|ethnic\s+origin|political\s+opinion|religious\s+belief|sexual\s+orientation|criminal\s+record|trade\s+union\s+membership)/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    AU_PI_CHILD: {
+        references: ['Privacy Act 1988 anticipated Children\'s Online Privacy Code (2024)'],
+        classifier: (input) => {
+            if (/\b(?:under\s*18|minor\s+user|child\s+(?:user|account|data)|age\s*[<:]\s*1[0-7]\b)/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    AU_PI_GOVERNMENT_ID: {
+        references: ['Privacy Act 1988 APP 9 — government-related identifiers'],
+        classifier: (input) => {
+            // TFN: three-group numeric format (123 456 789) or inline
+            if (/\b(?:TFN|tax\s+file\s+number)\b/i.test(input))
+                return true;
+            if (/\b\d{3}\s+\d{3}\s+\d{3}\b/.test(input))
+                return true; // TFN pattern
+            // Medicare
+            if (/\b(?:medicare\s+(?:number|card|no)|Medicare\s+#)/i.test(input))
+                return true;
+            if (/\b\d{4}\s+\d{5}\s+\d{1}\b/.test(input))
+                return true; // Medicare number pattern
+            return false;
+        },
+    },
+    AU_PI_OFFSHORE_TRANSFER: {
+        references: ['Privacy Act 1988 APP 8 — cross-border disclosure of personal information'],
+        classifier: (input) => {
+            if (/\b(?:transfer(?:ring|red)?\s+(?:to\s+)?(?:overseas|offshore|outside\s+australia)|cross[_\-\s]?border\s+(?:data|transfer|disclosure)|overseas\s+(?:recipient|processor|provider))/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    AU_PI_SECONDARY_USE: {
+        references: ['Privacy Act 1988 APP 6 — use and disclosure for secondary purpose'],
+        classifier: (input) => {
+            if (/\b(?:secondary\s+(?:use|purpose|analytics)|ai\s+training\s+(?:data|on\s+customer)|model\s+training.*personal\s+information|re[_\-]?use.*personal\s+information\s+for)/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    AU_PI_AUTOMATED_DECISION: {
+        references: ['Privacy and Other Legislation Amendment Act 2024 — automated decisions transparency'],
+        classifier: (input) => {
+            if (/\b(?:automated\s+(?:decision|decision[_\-]making|scoring|assessment)|ai[_\-\s]?(?:decision|determination|verdict|recommendation).*(?:individual|customer|applicant))/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    AU_PI_RETENTION_ELAPSED: {
+        references: ['Privacy Act 1988 APP 11 — security and de-identification when no longer needed'],
+        classifier: (input) => {
+            if (/\b(?:retention\s+(?:period\s+)?(?:elapsed|expired|exceeded|overdue)|data\s+(?:held\s+beyond|past)\s+retention|no\s+longer\s+needed.*personal\s+information)/i.test(input))
+                return true;
+            return false;
+        },
+    },
+};
+export const AU_PRIVACY_ACT_PACK = {
+    categoryClassifiers: AU_PRIVACY_ACT_CATEGORY_CLASSIFIERS,
+    /**
+     * P3.5: PI of AU individuals is subject-keyed — every processing event
+     * must carry a data subject identifier to satisfy APP 12 access-right
+     * tracking and the NDB disclosure obligation under Part IIIC.
+     * Retention-elapsed is non-subject-keyed (bulk schedule enforcement).
+     */
+    subjectKeyedCategories: [
+        'AU_PI_INDIVIDUAL',
+        'AU_PI_SENSITIVE',
+        'AU_PI_CHILD',
+        'AU_PI_GOVERNMENT_ID',
+        'AU_PI_OFFSHORE_TRANSFER',
+        'AU_PI_SECONDARY_USE',
+        'AU_PI_AUTOMATED_DECISION',
+    ],
+    id: 'au-privacy-act',
+    name: 'AU Privacy Act 1988 — Australian Privacy Principles (APPs 1-13)',
+    version: '1.0.0',
+    description: 'Privacy Act 1988 (Cth) compliance for AI systems processing personal information of Australian individuals. Covers APPs 1-13, NDB breach notification (30-day assessment), APP 9 government identifier prohibition, APP 8 overseas transfer controls, and 2024 amendments including AUD 50M penalties and statutory tort for serious privacy invasions.',
+    authority: 'Office of the Australian Information Commissioner (OAIC)',
+    industries: [
+        'all-au', 'healthcare', 'fintech', 'edtech', 'saas',
+        'retail', 'legal', 'insurance', 'government',
+    ],
+    requiredModules: [
+        {
+            name: 'governance-runtime',
+            required: true,
+            reason: 'APP 6 secondary-use basis enforcement; APP 8 overseas-transfer gate; APP 9 government-identifier block; automated decision disclosure (2024 amendments)',
+            reference: 'Privacy Act 1988 APP 6, APP 8, APP 9; Privacy and Other Legislation Amendment Act 2024',
+        },
+        {
+            name: 'audit-integrity',
+            required: true,
+            reason: 'NDB assessment audit trail; disclosure records per data subject for APP 12 access tracking',
+            reference: 'Privacy Act 1988 Part IIIC (NDB scheme); APP 12 (access); APP 5 (notification)',
+        },
+        {
+            name: 'encryption-layer',
+            required: true,
+            reason: 'APP 11 security obligation — reasonable technical measures protecting PI at rest and in transit',
+            reference: 'Privacy Act 1988 APP 11',
+        },
+        {
+            name: 'data-classifier',
+            required: true,
+            reason: 'Classify PI categories, detect sensitive information, government identifiers, children\'s data, secondary-use events, overseas transfers',
+            reference: 'Privacy Act 1988 s.6 (definitions); APP 3; APP 9',
+        },
+        {
+            name: 'session-persistence',
+            required: true,
+            reason: 'Per-data-subject rights tracking; consent lifecycle; retention schedule enforcement',
+            reference: 'Privacy Act 1988 APP 12 (access 30d); APP 13 (correction); APP 11 (retention)',
+        },
+        {
+            name: 'supply-chain',
+            required: true,
+            reason: 'APP 8 overseas recipient contractual controls; AI vendor data processing agreements with APP-equivalent protections',
+            reference: 'Privacy Act 1988 APP 8',
+        },
+        {
+            name: 'approval-queue',
+            required: true,
+            reason: 'Secondary-use approval gate; overseas transfer approval; automated decision approval (2024); NDB notification workflow',
+            reference: 'Privacy Act 1988 APP 6; APP 8; Part IIIC',
+        },
+        {
+            name: 'transparency-injector',
+            required: true,
+            reason: 'APP 5 collection notice; APP 1 privacy policy disclosure of AI data flows and automated processing',
+            reference: 'Privacy Act 1988 APP 1, APP 5',
+        },
+        {
+            name: 'event-bus',
+            required: true,
+            reason: 'NDB eligible-breach event stream; consent-revocation events; APP 8 offshore transfer events',
+            reference: 'Privacy Act 1988 Part IIIC (NDB); APP 12/13 access/correction workflow',
+        },
+    ],
+    moduleConfig: {
+        'data-classifier': {
+            enabledCategories: [
+                'AU_PI_INDIVIDUAL',
+                'AU_PI_SENSITIVE',
+                'AU_PI_CHILD',
+                'AU_PI_GOVERNMENT_ID',
+                'AU_PI_OFFSHORE_TRANSFER',
+                'AU_PI_SECONDARY_USE',
+                'AU_PI_AUTOMATED_DECISION',
+                'AU_PI_RETENTION_ELAPSED',
+            ],
+            sensitiveInfoApprovalRequired: true,
+            offshoreTransferApprovalRequired: true,
+            secondaryUseApprovalRequired: true,
+            automatedDecisionLoggingActive: true,
+            govtIdUnauthorisedUseBlock: true,
+        },
+        'governance-runtime': {
+            sensitiveInfoApprovalRequired: true,
+            offshoreTransferApprovalRequired: true,
+            secondaryUseApprovalRequired: true,
+            automatedDecisionLoggingActive: true,
+            govtIdUnauthorisedUseBlock: true,
+            ndbAssessmentDays: 30,
+            accessRequestSlaDays: 30,
+            retentionScheduleEnforced: true,
+        },
+        'session-persistence': {
+            perSubjectRightsTrackingRequired: true,
+            accessRequestSlaDays: 30,
+        },
+        'supply-chain': {
+            overseasRecipientContractRequired: true,
+            appEquivalentProtectionRequired: true,
+        },
+        'approval-queue': {
+            sensitiveInfoGateRequired: true,
+            offshoreTransferGateRequired: true,
+            secondaryUseGateRequired: true,
+            ndbNotificationWorkflowRequired: true,
+        },
+        'transparency-injector': {
+            collectionNoticeRequired: true,
+            aiDataFlowDisclosureRequired: true,
+        },
+    },
+    providerPolicy: {
+        blockedProviders: [],
+        requiredCapabilities: [
+            'DATA-RESIDENCY-AU-OR-EQUIVALENT',
+            'ZERO-TRAINING-ON-INPUTS',
+            'APP8-CONTRACTUAL-PROTECTIONS',
+        ],
+        blockReasons: {},
+    },
+    dataPolicy: {
+        scanCategories: [
+            'AU_PI_INDIVIDUAL',
+            'AU_PI_SENSITIVE',
+            'AU_PI_CHILD',
+            'AU_PI_GOVERNMENT_ID',
+            'AU_PI_OFFSHORE_TRANSFER',
+            'AU_PI_SECONDARY_USE',
+            'AU_PI_AUTOMATED_DECISION',
+            'AU_PI_RETENTION_ELAPSED',
+        ],
+        categoryActions: {
+            AU_PI_INDIVIDUAL: 'LOG',
+            AU_PI_SENSITIVE: 'REQUIRE_APPROVAL',
+            AU_PI_CHILD: 'REQUIRE_APPROVAL',
+            AU_PI_GOVERNMENT_ID: 'BLOCK',
+            AU_PI_OFFSHORE_TRANSFER: 'REQUIRE_APPROVAL',
+            AU_PI_SECONDARY_USE: 'REQUIRE_APPROVAL',
+            AU_PI_AUTOMATED_DECISION: 'REQUIRE_APPROVAL',
+            AU_PI_RETENTION_ELAPSED: 'WARN',
+        },
+        encryptionRequired: true,
+        encryptionStandard: 'AES-256',
+        minimumClassification: 'CONFIDENTIAL',
+    },
+    retentionPolicy: {
+        sovereignty: ['AU'],
+        // NDB notifications: 5 years; APP 8 overseas disclosure records: 7 years;
+        // Consent records: duration + 5 years; Access/correction: 7 years.
+        // Runtime default: 7 years (most conservative standard).
+        auditLogRetentionDays: 2555, // 7 years
+        sessionRetentionDays: 2555,
+        incidentRetentionDays: 1825, // 5 years (NDB standard)
+        reference: 'Privacy Act 1988 APP 8 overseas disclosure records (7y); APP 12 access records (7y); NDB notifications (5y)',
+    },
+    incidentPolicy: {
+        notificationDeadlineHours: 720, // 30 days = 720 hours (NDB internal assessment)
+        reference: 'Privacy Act 1988 Part IIIC s.26WK — 30 days from awareness of potential eligible data breach',
+        requiredRecipients: ['oaic', 'affected-individuals'],
+        formalNotificationRequired: true,
+    },
+    validators: [
+        {
+            id: 'au-privacy-sensitive-gate',
+            description: 'Sensitive PI (health, biometric, racial, religious, sexual orientation) requires approval gate',
+            reference: 'Privacy Act 1988 APP 3 (collection), APP 6 (use/disclosure)',
+            check: 'au_privacy_sensitive_gate_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'au-privacy-offshore-gate',
+            description: 'Overseas transfer of PI requires approval and APP 8 comparable-protection confirmation',
+            reference: 'Privacy Act 1988 APP 8',
+            check: 'au_privacy_offshore_gate_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'au-privacy-ndb-timer',
+            description: 'NDB internal assessment completed within 30 days of awareness of potential eligible breach',
+            reference: 'Privacy Act 1988 Part IIIC s.26WK',
+            check: 'au_privacy_ndb_timer_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'au-privacy-govt-id-block',
+            description: 'Government identifier (TFN, Medicare number) use blocked outside authorised purpose',
+            reference: 'Privacy Act 1988 APP 9',
+            check: 'au_privacy_govt_id_block_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'au-privacy-secondary-use-gate',
+            description: 'Secondary use or disclosure of PI blocked without lawful basis or consent',
+            reference: 'Privacy Act 1988 APP 6',
+            check: 'au_privacy_secondary_use_gate_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'au-privacy-automated-decision-log',
+            description: 'Automated decisions with significant individual effect logged and disclosed per 2024 amendments',
+            reference: 'Privacy and Other Legislation Amendment Act 2024',
+            check: 'au_privacy_automated_decision_log_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'au-privacy-access-sla',
+            description: 'Individual access requests actioned within 30-day SLA',
+            reference: 'Privacy Act 1988 APP 12',
+            check: 'au_privacy_access_sla_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'au-privacy-retention-check',
+            description: 'PI destruction or de-identification enforced when no longer needed for primary purpose',
+            reference: 'Privacy Act 1988 APP 11',
+            check: 'au_privacy_retention_check_active',
+            failSeverity: 'MEDIUM',
+        },
+    ],
+};
+//# sourceMappingURL=au-privacy-act.js.map