@connexum/ai-governance 1.0.0-beta.11

package/dist/audit/report-templates/dora-ict-major-incident.d.ts

@@ -0,0 +1,39 @@
+/**
+ * DORA ICT Major Incident Report Template
+ *
+ * Satisfies DORA Article 19 -- Classification and Reporting of ICT-Related
+ * Incidents. Financial entities subject to DORA must submit initial, interim,
+ * and final reports to competent authorities within prescribed deadlines.
+ *
+ * The 4-hour initial classification deadline from incident detection is
+ * embedded as a structural constraint in the timeline section.
+ *
+ * Regulatory references:
+ *   Regulation (EU) 2022/2554 (DORA), Article 17 -- ICT-related incident management
+ *   Regulation (EU) 2022/2554 (DORA), Article 18 -- Classification of ICT incidents
+ *   Regulation (EU) 2022/2554 (DORA), Article 19 -- Reporting of major ICT incidents
+ *   Commission Delegated Regulation (EU) 2024/1772 -- RTS on classification
+ *   Commission Implementing Regulation (EU) 2024/2956 -- ITS on reporting templates
+ *   EBA/ESMA/EIOPA Joint Guidelines on ICT Incident Reporting
+ *
+ * Classification thresholds (Art. 18 + RTS 2024/1772):
+ *   - Clients or counterparts affected (number or percentage)
+ *   - Geographical spread (cross-border impact)
+ *   - Data loss (confidentiality, integrity, availability)
+ *   - Duration and service unavailability
+ *   - Economic impact (direct costs threshold set by regulator)
+ *   - Reputational impact
+ *   - Criticality of services affected
+ *
+ * Required audit event types:
+ *   security:incident:major -- classified major ICT incident
+ *   approval:escalated -- incident escalated for management/board review
+ *   retention:deleted -- any data deletion during/after incident
+ *
+ * Spec: P4-AIR-02 item 5
+ *
+ * @connexum/ai-governance
+ */
+import type { ReportTemplate } from './index.js';
+export declare const DORA_ICT_MAJOR_INCIDENT_TEMPLATE: ReportTemplate;
+//# sourceMappingURL=dora-ict-major-incident.d.ts.map

package/dist/audit/report-templates/dora-ict-major-incident.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dora-ict-major-incident.d.ts","sourceRoot":"","sources":["../../../src/audit/report-templates/dora-ict-major-incident.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAmBjD,eAAO,MAAM,gCAAgC,EAAE,cA4K9C,CAAC"}

package/dist/audit/report-templates/dora-ict-major-incident.js

@@ -0,0 +1,227 @@
+"use strict";
+/**
+ * DORA ICT Major Incident Report Template
+ *
+ * Satisfies DORA Article 19 -- Classification and Reporting of ICT-Related
+ * Incidents. Financial entities subject to DORA must submit initial, interim,
+ * and final reports to competent authorities within prescribed deadlines.
+ *
+ * The 4-hour initial classification deadline from incident detection is
+ * embedded as a structural constraint in the timeline section.
+ *
+ * Regulatory references:
+ *   Regulation (EU) 2022/2554 (DORA), Article 17 -- ICT-related incident management
+ *   Regulation (EU) 2022/2554 (DORA), Article 18 -- Classification of ICT incidents
+ *   Regulation (EU) 2022/2554 (DORA), Article 19 -- Reporting of major ICT incidents
+ *   Commission Delegated Regulation (EU) 2024/1772 -- RTS on classification
+ *   Commission Implementing Regulation (EU) 2024/2956 -- ITS on reporting templates
+ *   EBA/ESMA/EIOPA Joint Guidelines on ICT Incident Reporting
+ *
+ * Classification thresholds (Art. 18 + RTS 2024/1772):
+ *   - Clients or counterparts affected (number or percentage)
+ *   - Geographical spread (cross-border impact)
+ *   - Data loss (confidentiality, integrity, availability)
+ *   - Duration and service unavailability
+ *   - Economic impact (direct costs threshold set by regulator)
+ *   - Reputational impact
+ *   - Criticality of services affected
+ *
+ * Required audit event types:
+ *   security:incident:major -- classified major ICT incident
+ *   approval:escalated -- incident escalated for management/board review
+ *   retention:deleted -- any data deletion during/after incident
+ *
+ * Spec: P4-AIR-02 item 5
+ *
+ * @connexum/ai-governance
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DORA_ICT_MAJOR_INCIDENT_TEMPLATE = void 0;
+const CITATION_INSTRUCTION = `
+MANDATORY CITATION RULES: Every factual claim MUST immediately reference the
+audit-chain event ID in square brackets, e.g. [EVT-abc123]. You may ONLY cite
+event IDs from the AVAILABLE EVENTS list. If evidence is insufficient, write
+"Evidence not available in audit chain; financial entity must supplement with
+operational records per DORA Art. 19(3)." Never invent event IDs.
+`.trim();
+/** DORA 4-hour classification deadline notice embedded in section prompts. */
+const DEADLINE_NOTICE = `
+IMPORTANT DORA DEADLINE: Under DORA Art. 19 and RTS 2024/1772, the initial
+notification to the competent authority must be submitted within 4 hours of
+classifying the incident as major, and no later than 24 hours after detection.
+Identify the detection timestamp from the audit chain and calculate whether
+the 4-hour window has been met.
+`.trim();
+exports.DORA_ICT_MAJOR_INCIDENT_TEMPLATE = {
+    templateId: 'tpl-dora-ict-major-incident-v1',
+    name: 'DORA Art. 19 Major ICT Incident Report',
+    framework: 'dora',
+    requiredAuditEventTypes: [
+        'security:incident:major',
+        'approval:escalated',
+        'retention:deleted',
+    ],
+    artefactFormat: 'pdf',
+    legalReviewRequired: true,
+    sections: [
+        {
+            id: 'dora-incident-classification',
+            title: '1. Incident Classification (DORA Art. 18 + RTS 2024/1772)',
+            citationRequirement: 'required',
+            promptTemplate: `
+You are drafting the Incident Classification section for a DORA Major ICT
+Incident Report under Article 18 of Regulation (EU) 2022/2554 and Commission
+Delegated Regulation (EU) 2024/1772.
+
+An ICT incident qualifies as "major" if it meets materiality thresholds in at
+least one of the seven classification criteria: (a) clients affected, (b)
+geographical spread, (c) data losses, (d) duration and service unavailability,
+(e) economic impact, (f) reputational impact, (g) criticality of services.
+
+${DEADLINE_NOTICE}
+
+Using ONLY the audit-chain events provided, describe:
+1. The incident trigger: the security:incident:major event, its timestamp, and
+   the AI governance signals that led to its classification.
+2. Assessment against each DORA classification criterion -- for each criterion,
+   state whether the threshold was met, not met, or indeterminate based on
+   available chain evidence.
+3. The classification decision: who made it, when, and which criteria were met.
+4. Calculate the time from first detection (earliest relevant chain event) to
+   formal classification. Flag if this exceeds 24 hours.
+
+${CITATION_INSTRUCTION}
+
+Write 4-6 formal paragraphs. Use the DORA Art. 19 reporting template structure.
+`.trim(),
+        },
+        {
+            id: 'dora-timeline-and-deadlines',
+            title: '2. Incident Timeline and Reporting Deadlines (DORA Art. 19)',
+            citationRequirement: 'required',
+            promptTemplate: `
+You are drafting the Timeline and Deadlines section for a DORA Major ICT
+Incident Report under Article 19 of Regulation (EU) 2022/2554.
+
+DORA Art. 19 reporting obligations:
+  - Initial notification: within 4 hours of major classification, ≤24h from detection
+  - Intermediate report: within 72 hours of initial notification
+  - Final report: within 1 month of intermediate report (or resolution, whichever first)
+
+${DEADLINE_NOTICE}
+
+Using ONLY the audit-chain events provided, construct a precise timeline:
+1. T0 -- Incident detection timestamp (earliest alert or anomaly event in chain).
+2. T1 -- Incident classification as "major" (security:incident:major event).
+3. T2 -- Escalation to management/board (approval:escalated event).
+4. T3 -- Initial notification to competent authority (if evidenced in chain).
+5. Derived deadlines: T1+4h (initial notification due), T3+72h (intermediate
+   report due), T3+30d (final report due).
+6. Compliance assessment: were each deadline met, at risk, or breached?
+
+${CITATION_INSTRUCTION}
+
+Write 3-5 formal paragraphs. Include a structured timeline table if evidence permits.
+`.trim(),
+        },
+        {
+            id: 'dora-impact-assessment',
+            title: '3. Impact Assessment and Affected Services',
+            citationRequirement: 'required',
+            promptTemplate: `
+You are drafting the Impact Assessment section for a DORA Major ICT Incident
+Report. DORA requires quantification of impact across clients, services, and
+economic dimensions.
+
+Using ONLY the audit-chain events provided, describe:
+1. Affected AI agents and services: which agents were suspended or experienced
+   governance failures during the incident window.
+2. Client/counterpart exposure: evidence in the chain of external-facing service
+   disruption.
+3. Data integrity impact: retention:deleted events during the incident that may
+   indicate data loss or unauthorised deletion.
+4. Service availability: duration of unavailability as evidenced by enforcement
+   events (circuit breakers, suspensions) and their resolution timestamps.
+5. Economic impact: if the chain contains cost-tracking events relevant to the
+   incident, summarise them.
+
+${CITATION_INSTRUCTION}
+
+Write 4-6 formal paragraphs.
+`.trim(),
+        },
+        {
+            id: 'dora-containment-response',
+            title: '4. Containment and Response Actions',
+            citationRequirement: 'required',
+            promptTemplate: `
+You are drafting the Containment and Response section for a DORA Major ICT
+Incident Report under DORA Art. 17 (ICT-related incident management).
+
+DORA Art. 17 requires financial entities to have incident management processes
+that include: detection, management and notification, classification, response,
+recovery, post-incident review, and communication.
+
+Using ONLY the audit-chain events provided, describe:
+1. Automated containment actions taken by the governance runtime (circuit
+   breakers, agent suspensions, access revocations) -- cite each event.
+2. Human response: escalation events, approval decisions during containment.
+3. Recovery actions and their outcomes.
+4. Communication events: internal escalation, board/management notification.
+5. Outstanding remediation items not yet resolved at report time.
+
+${CITATION_INSTRUCTION}
+
+Write 4-6 formal paragraphs.
+`.trim(),
+        },
+        {
+            id: 'dora-root-cause-and-prevention',
+            title: '5. Root Cause Analysis and Recurrence Prevention',
+            citationRequirement: 'required',
+            promptTemplate: `
+You are drafting the Root Cause and Prevention section for a DORA Major ICT
+Incident Report. DORA Art. 17(1)(e) requires post-incident review and
+identification of root causes.
+
+Using ONLY the audit-chain events provided, describe:
+1. Root cause of the incident as evidenced by audit-chain patterns.
+2. Contributing factors: policy gaps, misconfigured AI agents, or external attack
+   vectors indicated by the event sequence.
+3. Lessons learned from the incident timeline and response.
+4. Corrective controls implemented or planned to prevent recurrence.
+5. Evidence that the corrective controls have been or will be subject to human
+   approval before activation.
+
+${CITATION_INSTRUCTION}
+
+Write 4-6 formal paragraphs.
+`.trim(),
+        },
+        {
+            id: 'dora-supervisory-disclosure',
+            title: '6. Supervisory Disclosure and Regulatory Communication',
+            citationRequirement: 'optional',
+            promptTemplate: `
+You are drafting the Supervisory Disclosure section for a DORA Major ICT
+Incident Report. DORA Art. 19(5) requires financial entities to notify clients
+and counterparts when the incident has or is likely to have an adverse impact on
+their financial interests.
+
+Describe:
+1. Whether client/counterpart notification was required based on the impact
+   assessment.
+2. The competent authority to which notification must be submitted (determined
+   by the financial entity's home member state).
+3. Status of regulatory submissions: submitted, pending, or planned.
+4. Communication plan for affected clients/counterparts.
+
+If the audit chain does not contain supervisory disclosure events, state that
+this section must be completed with external records. The chain provides the
+technical evidence basis; the regulatory submission itself is outside the
+governance platform's scope.
+`.trim(),
+        },
+    ],
+};
+//# sourceMappingURL=dora-ict-major-incident.js.map

package/dist/audit/report-templates/dora-ict-major-incident.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dora-ict-major-incident.js","sourceRoot":"","sources":["../../../src/audit/report-templates/dora-ict-major-incident.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;;;AAIH,MAAM,oBAAoB,GAAG;;;;;;CAM5B,CAAC,IAAI,EAAE,CAAC;AAET,8EAA8E;AAC9E,MAAM,eAAe,GAAG;;;;;;CAMvB,CAAC,IAAI,EAAE,CAAC;AAEI,QAAA,gCAAgC,GAAmB;IAC9D,UAAU,EAAE,gCAAgC;IAC5C,IAAI,EAAE,wCAAwC;IAC9C,SAAS,EAAE,MAAM;IACjB,uBAAuB,EAAE;QACvB,yBAAyB;QACzB,oBAAoB;QACpB,mBAAmB;KACpB;IACD,cAAc,EAAE,KAAK;IACrB,mBAAmB,EAAE,IAAI;IAEzB,QAAQ,EAAE;QACR;YACE,EAAE,EAAE,8BAA8B;YAClC,KAAK,EAAE,2DAA2D;YAClE,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;EAUpB,eAAe;;;;;;;;;;;;EAYf,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,6BAA6B;YACjC,KAAK,EAAE,6DAA6D;YACpE,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;EASpB,eAAe;;;;;;;;;;;EAWf,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,wBAAwB;YAC5B,KAAK,EAAE,4CAA4C;YACnD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;;;;;EAiBpB,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,2BAA2B;YAC/B,KAAK,EAAE,qCAAqC;YAC5C,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;;;;EAgBpB,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,gCAAgC;YACpC,KAAK,EAAE,kDAAkD;YACzD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;;EAcpB,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,6BAA6B;YACjC,KAAK,EAAE,wDAAwD;YAC/D,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;;;;;;CAkBrB,CAAC,IAAI,EAAE;SACH;KACF;CACF,CAAC"}

package/dist/audit/report-templates/eu-ai-act-annex-iv.d.ts

@@ -0,0 +1,38 @@
+/**
+ * EU AI Act Annex IV Technical Documentation Template
+ *
+ * Annex IV of Regulation (EU) 2024/1689 (AI Act) mandates technical
+ * documentation for high-risk AI systems under Article 11. Deployers of
+ * high-risk AI systems must maintain documentation demonstrating conformity.
+ *
+ * Art. 50 disclosure is non-optional for every AI-generated section:
+ * the rendered report carries a visible AI-authorship declaration
+ * because the report itself is partially AI-generated (ironic, but required).
+ *
+ * Regulatory references:
+ *   Regulation (EU) 2024/1689, Article 11 -- Technical documentation
+ *   Regulation (EU) 2024/1689, Annex IV -- Technical documentation content
+ *   Regulation (EU) 2024/1689, Article 50 -- Transparency obligations for AI systems
+ *   Regulation (EU) 2024/1689, Article 13 -- Transparency and provision of information
+ *   Regulation (EU) 2024/1689, Article 14 -- Human oversight
+ *   Regulation (EU) 2024/1689, Article 17 -- Quality management system
+ *   Recital 49 -- Deployer obligations for high-risk AI systems
+ *
+ * Required audit event types:
+ *   agent:registered -- AI system registration in the governance registry
+ *   policy:snapshot  -- policy version captured in the tamper-evident chain
+ *   governance:verdict -- runtime governance decisions
+ *
+ * Spec: P4-AIR-02 item 4
+ *
+ * @connexum/ai-governance
+ */
+import type { ReportTemplate } from './index.js';
+/**
+ * Art. 50 disclosure block appended to every AI-generated section.
+ * This is non-optional per the spec and must survive into the rendered
+ * artefact even if the operator attempts to suppress it.
+ */
+export declare const ART50_DISCLOSURE: string;
+export declare const EU_AI_ACT_ANNEX_IV_TEMPLATE: ReportTemplate;
+//# sourceMappingURL=eu-ai-act-annex-iv.d.ts.map

package/dist/audit/report-templates/eu-ai-act-annex-iv.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eu-ai-act-annex-iv.d.ts","sourceRoot":"","sources":["../../../src/audit/report-templates/eu-ai-act-annex-iv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,QAOrB,CAAC;AAcT,eAAO,MAAM,2BAA2B,EAAE,cAkNzC,CAAC"}

package/dist/audit/report-templates/eu-ai-act-annex-iv.js

@@ -0,0 +1,267 @@
+"use strict";
+/**
+ * EU AI Act Annex IV Technical Documentation Template
+ *
+ * Annex IV of Regulation (EU) 2024/1689 (AI Act) mandates technical
+ * documentation for high-risk AI systems under Article 11. Deployers of
+ * high-risk AI systems must maintain documentation demonstrating conformity.
+ *
+ * Art. 50 disclosure is non-optional for every AI-generated section:
+ * the rendered report carries a visible AI-authorship declaration
+ * because the report itself is partially AI-generated (ironic, but required).
+ *
+ * Regulatory references:
+ *   Regulation (EU) 2024/1689, Article 11 -- Technical documentation
+ *   Regulation (EU) 2024/1689, Annex IV -- Technical documentation content
+ *   Regulation (EU) 2024/1689, Article 50 -- Transparency obligations for AI systems
+ *   Regulation (EU) 2024/1689, Article 13 -- Transparency and provision of information
+ *   Regulation (EU) 2024/1689, Article 14 -- Human oversight
+ *   Regulation (EU) 2024/1689, Article 17 -- Quality management system
+ *   Recital 49 -- Deployer obligations for high-risk AI systems
+ *
+ * Required audit event types:
+ *   agent:registered -- AI system registration in the governance registry
+ *   policy:snapshot  -- policy version captured in the tamper-evident chain
+ *   governance:verdict -- runtime governance decisions
+ *
+ * Spec: P4-AIR-02 item 4
+ *
+ * @connexum/ai-governance
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EU_AI_ACT_ANNEX_IV_TEMPLATE = exports.ART50_DISCLOSURE = void 0;
+/**
+ * Art. 50 disclosure block appended to every AI-generated section.
+ * This is non-optional per the spec and must survive into the rendered
+ * artefact even if the operator attempts to suppress it.
+ */
+exports.ART50_DISCLOSURE = `
+[AI-GENERATED SECTION -- EU AI Act Art. 50 Disclosure]
+This section was generated by an AI system. The generating model, prompt
+template hash, and audit-chain provenance reference are recorded in the
+report provenance block at the beginning of this document. Human review of
+AI-generated sections is required before submission to a conformity assessment
+body or notified body.
+`.trim();
+const CITATION_INSTRUCTION = `
+MANDATORY CITATION RULES: Every factual claim MUST immediately reference the
+audit-chain event ID in square brackets, e.g. [EVT-abc123]. You may ONLY cite
+event IDs from the AVAILABLE EVENTS list. If evidence is absent, write
+"Evidence not available in the audit window; deployer must supplement with
+direct technical documentation per Annex IV." Never invent event IDs.
+
+Additionally, append the following disclosure at the end of every section you
+generate:
+${exports.ART50_DISCLOSURE}
+`.trim();
+exports.EU_AI_ACT_ANNEX_IV_TEMPLATE = {
+    templateId: 'tpl-eu-ai-act-annex-iv-v1',
+    name: 'EU AI Act Annex IV Technical Documentation',
+    framework: 'eu-ai-act',
+    requiredAuditEventTypes: [
+        'agent:registered',
+        'policy:snapshot',
+        'governance:verdict',
+    ],
+    artefactFormat: 'pdf',
+    legalReviewRequired: true,
+    sections: [
+        {
+            id: 'euai-annex-iv-1-general-description',
+            title: 'Annex IV §1: General Description of the AI System',
+            citationRequirement: 'required',
+            promptTemplate: `
+You are drafting Annex IV §1 (General Description) for EU AI Act technical
+documentation under Article 11 and Annex IV of Regulation (EU) 2024/1689.
+
+Annex IV §1 requires:
+  (a) Intended purpose, including the persons, groups, or categories of persons
+      on whom the AI system is intended to be used
+  (b) The category of high-risk AI system per Annex III
+  (c) Version of the AI system
+  (d) Interaction with hardware or software not part of the AI system itself
+
+Using ONLY the audit-chain events provided, describe:
+1. The AI agent(s) registered in the governance system during the reporting
+   period -- cite each agent:registered event with its timestamp, agent name,
+   and declared purpose.
+2. The operational category and intended use case for each registered agent.
+3. Interactions with external LLM providers as evidenced by governance verdicts.
+4. Changes in the AI system population during the period (new registrations,
+   decommissions).
+
+${CITATION_INSTRUCTION}
+
+Write 3-5 formal paragraphs suitable for submission to a conformity assessment body.
+`.trim(),
+        },
+        {
+            id: 'euai-annex-iv-2-development-process',
+            title: 'Annex IV §2: Development Process Description',
+            citationRequirement: 'required',
+            promptTemplate: `
+You are drafting Annex IV §2 (Development Process) for EU AI Act technical
+documentation.
+
+Annex IV §2 requires documentation of:
+  (a) Development methods and design choices including mathematical methods
+  (b) System architecture and computational resources
+  (c) Data governance and examination procedures
+  (d) Pre-determined changes to the system
+
+Using ONLY the audit-chain events provided, describe:
+1. Policy versioning evidence: policy:snapshot events that demonstrate a
+   version-controlled governance policy was in place.
+2. How governance policies are structured, versioned, and applied to AI agents.
+3. Evidence that policy changes followed a documented change process with
+   human review (cite approval events).
+4. The governance runtime architecture as evidenced by the types of enforcement
+   events present in the chain.
+
+${CITATION_INSTRUCTION}
+
+Write 3-5 formal paragraphs.
+`.trim(),
+        },
+        {
+            id: 'euai-annex-iv-3-monitoring-functioning',
+            title: 'Annex IV §3: Monitoring, Functioning, and Controls (Art. 14)',
+            citationRequirement: 'required',
+            promptTemplate: `
+You are drafting Annex IV §3 (Monitoring and Controls) for EU AI Act technical
+documentation, addressing Article 14 (Human Oversight) and Annex IV §3.
+
+Article 14 requires high-risk AI systems to be designed to allow natural persons
+to effectively oversee and intervene during the period of use, including the
+ability to stop the system.
+
+Using ONLY the audit-chain events provided, describe:
+1. Human-in-the-loop controls: approval events where humans intervened in AI
+   agent operations -- cite each with timestamp and outcome.
+2. Circuit-breaker and suspension mechanisms: evidence that the system can be
+   stopped by an authorised human.
+3. Monitoring controls: anomaly detection events and how they triggered human
+   review.
+4. Metrics on human oversight engagement during the review period (approval
+   rate, response times, escalation counts).
+
+${CITATION_INSTRUCTION}
+
+Write 3-5 formal paragraphs.
+`.trim(),
+        },
+        {
+            id: 'euai-annex-iv-4-risk-management',
+            title: 'Annex IV §4: Risk Management System (Art. 9)',
+            citationRequirement: 'required',
+            promptTemplate: `
+You are drafting Annex IV §4 (Risk Management) for EU AI Act technical
+documentation, addressing Article 9 of Regulation (EU) 2024/1689.
+
+Article 9 requires providers of high-risk AI systems to establish and maintain
+a risk management system throughout the lifecycle. The system must:
+  (a) Identify and analyse known and reasonably foreseeable risks
+  (b) Estimate and evaluate risks that may emerge from use
+  (c) Evaluate risks based on post-market monitoring data
+
+Using ONLY the audit-chain events provided, describe:
+1. Known risks identified and governed by the compliance packs active during
+   the period.
+2. Risk events observed (governance verdicts, anomalies, policy violations)
+   and their frequency and severity.
+3. Residual risk assessment: which risk categories had zero events (indicating
+   effective prevention) vs. which had recurring events (indicating residual risk).
+4. Risk-mitigation effectiveness: compare enforcement events against denials
+   to demonstrate active risk reduction.
+
+${CITATION_INSTRUCTION}
+
+Write 4-6 formal paragraphs.
+`.trim(),
+        },
+        {
+            id: 'euai-annex-iv-5-transparency-obligations',
+            title: 'Annex IV §5 + Art. 50: Transparency Obligations',
+            citationRequirement: 'optional',
+            promptTemplate: `
+You are drafting the Transparency Obligations section for EU AI Act technical
+documentation under Article 50 and Annex IV §5.
+
+Article 50(1): Providers of AI systems intended to interact with natural persons
+shall ensure that natural persons are notified that they are interacting with
+an AI system.
+
+Article 50(4): Any person deploying an AI system that generates synthetic audio,
+image, video, or text content shall label it as AI-generated.
+
+Describe the transparency mechanisms implemented:
+1. How users and oversight staff are notified of AI agent involvement in decisions.
+2. AI-authorship labelling on generated content and reports (including this report).
+3. How the audit chain's provenance records satisfy Art. 50 documentation
+   requirements.
+4. Any content-generation events in the chain where the AI-authorship label was
+   applied.
+
+This section may contain procedural statements not backed by audit-chain events
+where the transparency mechanism is structural (e.g., UI labels).
+
+${exports.ART50_DISCLOSURE}
+`.trim(),
+        },
+        {
+            id: 'euai-annex-iv-6-quality-management',
+            title: 'Annex IV §6: Quality Management System (Art. 17)',
+            citationRequirement: 'required',
+            promptTemplate: `
+You are drafting Annex IV §6 (Quality Management) for EU AI Act technical
+documentation under Article 17 of Regulation (EU) 2024/1689.
+
+Article 17 requires providers to implement a quality management system covering:
+  (a) Regulatory compliance strategy
+  (b) Techniques, procedures, and actions for design, control, and verification
+  (c) Examination, test, and validation procedures
+  (d) Responsibilities and accountability structures
+
+Using ONLY the audit-chain events provided, describe:
+1. Evidence that governance policies were validated against regulatory compliance
+   packs during the review period (policy:snapshot events with pack bindings).
+2. Approval workflows that demonstrate accountability structures for AI governance
+   decisions.
+3. Test or validation events in the chain confirming that controls were
+   operationally effective.
+4. Accountability trail: which human roles approved which classes of AI agent
+   actions during the period.
+
+${CITATION_INSTRUCTION}
+
+Write 3-5 formal paragraphs.
+`.trim(),
+        },
+        {
+            id: 'euai-annex-iv-7-post-market-monitoring',
+            title: 'Annex IV §7: Post-Market Monitoring (Art. 72)',
+            citationRequirement: 'required',
+            promptTemplate: `
+You are drafting Annex IV §7 (Post-Market Monitoring) for EU AI Act technical
+documentation under Article 72 of Regulation (EU) 2024/1689.
+
+Article 72 requires providers to actively monitor performance of high-risk AI
+systems after placing them on the market, including collecting data on serious
+incidents.
+
+Using ONLY the audit-chain events provided, describe:
+1. Continuous monitoring activities during the reporting period -- anomaly
+   detection events, performance drift signals, and monitoring gaps.
+2. Any serious incidents detected and whether they were reported to relevant
+   market surveillance authorities.
+3. Corrective actions taken in response to post-market findings.
+4. Evidence that the monitoring system operated effectively throughout the period.
+
+${CITATION_INSTRUCTION}
+
+Write 3-5 formal paragraphs.
+`.trim(),
+        },
+    ],
+};
+//# sourceMappingURL=eu-ai-act-annex-iv.js.map

package/dist/audit/report-templates/eu-ai-act-annex-iv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eu-ai-act-annex-iv.js","sourceRoot":"","sources":["../../../src/audit/report-templates/eu-ai-act-annex-iv.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;;;AAIH;;;;GAIG;AACU,QAAA,gBAAgB,GAAG;;;;;;;CAO/B,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,oBAAoB,GAAG;;;;;;;;;EAS3B,wBAAgB;CACjB,CAAC,IAAI,EAAE,CAAC;AAEI,QAAA,2BAA2B,GAAmB;IACzD,UAAU,EAAE,2BAA2B;IACvC,IAAI,EAAE,4CAA4C;IAClD,SAAS,EAAE,WAAW;IACtB,uBAAuB,EAAE;QACvB,kBAAkB;QAClB,iBAAiB;QACjB,oBAAoB;KACrB;IACD,cAAc,EAAE,KAAK;IACrB,mBAAmB,EAAE,IAAI;IAEzB,QAAQ,EAAE;QACR;YACE,EAAE,EAAE,qCAAqC;YACzC,KAAK,EAAE,mDAAmD;YAC1D,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;;;;;;;;EAoBpB,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,qCAAqC;YACzC,KAAK,EAAE,8CAA8C;YACrD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;;;;;;;EAmBpB,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,wCAAwC;YAC5C,KAAK,EAAE,8DAA8D;YACrE,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;;;;;;EAkBpB,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,iCAAiC;YACrC,KAAK,EAAE,8CAA8C;YACrD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;;;;;;;;EAoBpB,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,0CAA0C;YAC9C,KAAK,EAAE,iDAAiD;YACxD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;;;;;;;;;;EAsBpB,wBAAgB;CACjB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,oCAAoC;YACxC,KAAK,EAAE,kDAAkD;YACzD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;;;;;;;;EAoBpB,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,wCAAwC;YAC5C,KAAK,EAAE,+CAA+C;YACtD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;;;;EAgBpB,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;KACF;CACF,CAAC"}

package/dist/audit/report-templates/gdpr-data-subject-rights.d.ts

@@ -0,0 +1,37 @@
+/**
+ * GDPR Data Subject Rights Evidence Template
+ *
+ * Covers Articles 15-22 of Regulation (EU) 2016/679 (GDPR):
+ *   Art. 15 -- Right of access
+ *   Art. 16 -- Right to rectification
+ *   Art. 17 -- Right to erasure ("right to be forgotten")
+ *   Art. 18 -- Right to restriction of processing
+ *   Art. 19 -- Notification obligation (rectification/erasure/restriction)
+ *   Art. 20 -- Right to data portability
+ *   Art. 21 -- Right to object
+ *   Art. 22 -- Automated individual decision-making, including profiling
+ *
+ * This template documents how an AI governance platform handles DSR requests
+ * affecting AI agent activity, produces evidence for DSR fulfilment audit,
+ * and satisfies GDPR Art. 5(2) accountability principle documentation.
+ *
+ * Regulatory references:
+ *   Regulation (EU) 2016/679 (GDPR) Articles 15-22
+ *   GDPR Art. 5(2) -- Accountability principle
+ *   GDPR Art. 30 -- Records of processing activities (RoPA)
+ *   GDPR Art. 22 -- Automated decision-making safeguards
+ *   EDPB Guidelines 01/2022 on data subject rights
+ *   EDPB Guidelines 05/2020 on consent
+ *
+ * Required audit event types:
+ *   retention:deleted           -- erasure fulfilment (Art. 17)
+ *   pack-binding-changed        -- processing scope change (restriction/portability)
+ *   approval:decided            -- legal-reviewer tier approval (Art. 22 safeguard)
+ *
+ * Spec: P4-AIR-02 item 7
+ *
+ * @connexum/ai-governance
+ */
+import type { ReportTemplate } from './index.js';
+export declare const GDPR_DATA_SUBJECT_RIGHTS_TEMPLATE: ReportTemplate;
+//# sourceMappingURL=gdpr-data-subject-rights.d.ts.map

package/dist/audit/report-templates/gdpr-data-subject-rights.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gdpr-data-subject-rights.d.ts","sourceRoot":"","sources":["../../../src/audit/report-templates/gdpr-data-subject-rights.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAWjD,eAAO,MAAM,iCAAiC,EAAE,cA6L/C,CAAC"}