@euconform/core 1.0.0 → 1.2.0

package/dist/legal-checks/gpai-classifier.js

@@ -0,0 +1,197 @@
+/**
+ * GPAI / Foundation Model Compliance Classifier
+ * Based on EU AI Act (Regulation EU 2024/1689) – Art. 53–55 + Art. 51 + Art. 71
+ *
+ * Obligations enforceable since August 2, 2025 (Phase 2, Art. 113(2)).
+ *
+ * IMPORTANT: This module provides technical orientation, not legal advice.
+ */
+/**
+ * The 9 GPAI compliance questions (Art. 53–55).
+ * Order matters: q1–q9 map to i18n keys gpai_q1–gpai_q9.
+ */
+export const GPAI_QUESTIONS = [
+    {
+        id: "gpai-technical-docs",
+        question: "Art. 53(1)(a): Technical documentation (Annex XI/XII)?",
+        description: "Have you prepared and maintain up-to-date technical documentation for the GPAI model per Annex XI/XII (general-purpose) or the systemic-risk extension?",
+        options: [
+            { value: "yes", label: "Yes, implemented" },
+            { value: "no", label: "No, missing" },
+            { value: "unsure", label: "In progress / unsure" },
+        ],
+    },
+    {
+        id: "gpai-downstream-info",
+        question: "Art. 53(1)(b): Downstream provider information?",
+        description: "Do you provide downstream providers / deployers with the information they need to comply with their own EU AI Act obligations (capabilities, limitations, intended use)?",
+        options: [
+            { value: "yes", label: "Yes, implemented" },
+            { value: "no", label: "No, missing" },
+            { value: "unsure", label: "In progress / unsure" },
+        ],
+    },
+    {
+        id: "gpai-copyright-policy",
+        question: "Art. 53(1)(c–d): Copyright policy + training data summary?",
+        description: "Have you established a copyright compliance policy (Art. 53(1)(c)) and published a sufficiently detailed training data summary for copyright purposes (Art. 53(1)(d))?",
+        options: [
+            { value: "yes", label: "Yes, implemented" },
+            { value: "no", label: "No, missing" },
+            { value: "unsure", label: "In progress / unsure" },
+        ],
+    },
+    {
+        id: "gpai-eu-database",
+        question: "Art. 71: EU AI Database registration?",
+        description: "Is the GPAI model registered in the EU AI Database as required under Art. 71 (providers of GPAI models must register before placing the model on the EU market)?",
+        options: [
+            { value: "yes", label: "Yes, registered" },
+            { value: "no", label: "No, not registered" },
+            { value: "unsure", label: "In progress / unsure" },
+        ],
+    },
+    {
+        id: "gpai-open-source",
+        question: "Art. 53(2): Open-source model release?",
+        description: "Is the model released as open source with weights publicly available? Open-source GPAI models are exempt from Art. 53(1)(a–c) obligations (technical docs, downstream info, copyright policy) but not from Art. 53(1)(d) (training data summary) or Art. 55 systemic-risk obligations.",
+        options: [
+            { value: "yes", label: "Yes, open source" },
+            { value: "no", label: "No, proprietary" },
+            { value: "unsure", label: "Unsure / partially open" },
+        ],
+    },
+    {
+        id: "gpai-systemic-risk",
+        question: "Art. 51 + Annex XIII: Trained with ≥ 10²⁵ FLOP?",
+        description: "Was the model trained using compute exceeding 10²⁵ floating-point operations (FLOP)? Models at or above this threshold are designated as GPAI models with systemic risk (Art. 51) and are subject to the additional Art. 55 obligations below.",
+        options: [
+            { value: "yes", label: "Yes (systemic risk)" },
+            { value: "no", label: "No (below threshold)" },
+            { value: "unsure", label: "Unknown / unsure" },
+        ],
+    },
+    {
+        id: "gpai-red-teaming",
+        question: "Art. 55(1)(a): Adversarial testing / red-teaming?",
+        description: "Have you conducted model evaluations, adversarial testing, and red-teaming to identify and mitigate systemic risks (required only for Art. 51 systemic-risk models)?",
+        options: [
+            { value: "yes", label: "Yes, conducted" },
+            { value: "no", label: "No, not done" },
+            { value: "unsure", label: "In progress / unsure" },
+        ],
+    },
+    {
+        id: "gpai-incident-reporting",
+        question: "Art. 55(1)(b): Serious incident reporting mechanisms?",
+        description: "Do you have mechanisms to track, document, and report serious incidents caused by the GPAI model to the AI Office and affected national authorities (required only for Art. 51 systemic-risk models)?",
+        options: [
+            { value: "yes", label: "Yes, in place" },
+            { value: "no", label: "No, missing" },
+            { value: "unsure", label: "In progress / unsure" },
+        ],
+    },
+    {
+        id: "gpai-cybersecurity",
+        question: "Art. 55(1)(c): Cybersecurity measures?",
+        description: "Have you implemented adequate cybersecurity protections for the GPAI model and its infrastructure, including adversarial robustness measures (required only for Art. 51 systemic-risk models)?",
+        options: [
+            { value: "yes", label: "Yes, implemented" },
+            { value: "no", label: "No, missing" },
+            { value: "unsure", label: "In progress / unsure" },
+        ],
+    },
+];
+/** Returns the full ordered list of GPAI compliance questions */
+export function getGPAIQuestions() {
+    return GPAI_QUESTIONS;
+}
+/** Returns true if the model meets the systemic risk threshold (Art. 51) */
+export function isSystemicRiskModel(answers) {
+    const systemicAnswer = answers.find((a) => a.questionId === "gpai-systemic-risk");
+    return systemicAnswer?.value === "yes";
+}
+/** Push a flag if the answer value is "no" or "unsure" */
+function checkObligation(value, obligation, articleRef, flags) {
+    if (value === "no") {
+        flags.push({ obligation, status: "missing", articleRef });
+    }
+    else if (value === "unsure") {
+        flags.push({ obligation, status: "partial", articleRef });
+    }
+}
+/** Evaluate Art. 53 obligations and populate flags / notes */
+function evaluateArt53Obligations(byId, isOpenSource, flags, legalBasis, notes) {
+    if (!isOpenSource) {
+        checkObligation(byId.get("gpai-technical-docs"), "technical-docs", "Art. 53(1)(a)", flags);
+        checkObligation(byId.get("gpai-downstream-info"), "downstream-info", "Art. 53(1)(b)", flags);
+        checkObligation(byId.get("gpai-copyright-policy"), "copyright-policy", "Art. 53(1)(c–d)", flags);
+    }
+    else {
+        // Open-source: Art. 53(1)(a–c) exempt, but training data summary (Art. 53(1)(d)) still applies
+        const copyrightVal = byId.get("gpai-copyright-policy");
+        checkObligation(copyrightVal, "copyright-policy", "Art. 53(1)(d)", flags);
+        if (copyrightVal === "no" || copyrightVal === "unsure") {
+            notes.push("Open-source models are exempt from Art. 53(1)(c) copyright policy obligations, but Art. 53(1)(d) training data summary still applies.");
+        }
+    }
+    const euDatabase = byId.get("gpai-eu-database");
+    checkObligation(euDatabase, "eu-database", "Art. 71", flags);
+    if (euDatabase === "no") {
+        legalBasis.push("Verordnung (EU) 2024/1689 – Art. 71 (EU AI Database)");
+    }
+}
+/** Evaluate Art. 55 systemic risk obligations and populate flags */
+function evaluateArt55Obligations(byId, flags, legalBasis) {
+    legalBasis.push("Verordnung (EU) 2024/1689 – Art. 51 + Art. 55 (Systemic Risk)");
+    legalBasis.push("Verordnung (EU) 2024/1689 – Annex XIII (Systemic Risk Indicators)");
+    checkObligation(byId.get("gpai-red-teaming"), "red-teaming", "Art. 55(1)(a)", flags);
+    checkObligation(byId.get("gpai-incident-reporting"), "incident-reporting", "Art. 55(1)(b)", flags);
+    checkObligation(byId.get("gpai-cybersecurity"), "cybersecurity", "Art. 55(1)(c)", flags);
+}
+/** Determine overall compliance level from accumulated flags */
+function determineLevel(flags, isOpenSource) {
+    const criticalObligations = isOpenSource
+        ? ["eu-database"]
+        : ["technical-docs", "downstream-info", "copyright-policy", "eu-database"];
+    const allCriticalMissing = !isOpenSource &&
+        criticalObligations.every((obl) => flags.some((f) => f.obligation === obl && f.status === "missing"));
+    if (allCriticalMissing)
+        return "non-compliant";
+    if (flags.length > 0)
+        return "partial";
+    return "compliant";
+}
+/**
+ * Classify GPAI compliance based on answers to the 9 questions.
+ * Returns a GPAIComplianceResult with level, flags, and legal basis.
+ *
+ * Classification logic:
+ * - Open-source (Art. 53(2)): exempt from docs/downstream/copyright obligations
+ * - Systemic risk (Art. 51): Art. 55 obligations apply
+ * - Critical Art. 53 all missing → "non-compliant"
+ * - Any "unsure" or partial → "partial"
+ * - All applicable "yes" → "compliant"
+ */
+export function classifyGPAICompliance(answers) {
+    const byId = new Map(answers.map((a) => [a.questionId, a.value]));
+    const isOpenSource = byId.get("gpai-open-source") === "yes";
+    const hasSystemicRisk = byId.get("gpai-systemic-risk") === "yes";
+    const flags = [];
+    const legalBasis = ["Verordnung (EU) 2024/1689 – Art. 53 (GPAI obligations)"];
+    const notes = [];
+    evaluateArt53Obligations(byId, isOpenSource, flags, legalBasis, notes);
+    if (hasSystemicRisk) {
+        evaluateArt55Obligations(byId, flags, legalBasis);
+    }
+    else {
+        notes.push("Art. 55 systemic risk obligations (red-teaming, incident reporting, cybersecurity) are not applicable as the model does not meet the Art. 51 threshold (≥ 10²⁵ FLOP).");
+    }
+    return {
+        level: determineLevel(flags, isOpenSource),
+        isSystemicRisk: hasSystemicRisk,
+        flags,
+        legalBasis,
+        notes,
+    };
+}

package/dist/legal-checks/index.d.ts

@@ -10,4 +10,10 @@ export type { HumanOversightRecommendation, LoggingTemplate } from "./human-over
 export { getHumanOversightAndLoggingTemplate } from "./human-oversight-logging";
 export type { AnnexIVStructuredReportV1 } from "./annex-iv-report";
 export { buildAnnexIVReportV1 } from "./annex-iv-report";
+export type { DeadlineStatus, AffectedAudience, DeadlineObligation, DeadlinePhase, } from "./deadline-timeline";
+export { EU_AI_ACT_TIMELINE, DIGITAL_OMNIBUS_PROPOSALS, getDeadlineStatus, getDaysUntilDeadline, getAudiencesForRiskLevel, getNextDeadline, getTimelineForRiskLevel, getTimelineForAudiences, } from "./deadline-timeline";
+export type { GPAIObligationType, GPAIComplianceLevel, GPAIComplianceFlag, GPAIComplianceResult, } from "./gpai-classifier";
+export { GPAI_QUESTIONS, classifyGPAICompliance, getGPAIQuestions, isSystemicRiskModel, } from "./gpai-classifier";
+export type { GapPriority, GapAction, GapAnalysisResult } from "./gap-analysis";
+export { generateAnnexIIIGapAnalysis, generateGPAIGapAnalysis } from "./gap-analysis";
 //# sourceMappingURL=index.d.ts.map

package/dist/legal-checks/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/legal-checks/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EACL,mBAAmB,EACnB,iCAAiC,EACjC,oBAAoB,EACpB,oBAAoB,EACpB,iCAAiC,GAClC,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,QAAQ,EACR,kBAAkB,EAClB,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,cAAc,EACd,cAAc,EACd,kCAAkC,EAClC,8BAA8B,EAC9B,gCAAgC,EAChC,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,EACvB,4BAA4B,EAC5B,wBAAwB,EACxB,aAAa,EACb,eAAe,GAChB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EAAE,eAAe,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAE/D,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,aAAa,GACd,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,wBAAwB,EACxB,iCAAiC,GAClC,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EAAE,4BAA4B,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC/F,OAAO,EAAE,mCAAmC,EAAE,MAAM,2BAA2B,CAAC;AAEhF,YAAY,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/legal-checks/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EACL,mBAAmB,EACnB,iCAAiC,EACjC,oBAAoB,EACpB,oBAAoB,EACpB,iCAAiC,GAClC,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,QAAQ,EACR,kBAAkB,EAClB,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,cAAc,EACd,cAAc,EACd,kCAAkC,EAClC,8BAA8B,EAC9B,gCAAgC,EAChC,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,EACvB,4BAA4B,EAC5B,wBAAwB,EACxB,aAAa,EACb,eAAe,GAChB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EAAE,eAAe,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAE/D,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,aAAa,GACd,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,wBAAwB,EACxB,iCAAiC,GAClC,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EAAE,4BAA4B,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC/F,OAAO,EAAE,mCAAmC,EAAE,MAAM,2BAA2B,CAAC;AAEhF,YAAY,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/legal-checks/index.js

@@ -4,3 +4,6 @@ export { runDataGovernanceChecklist } from "./data-governance";
 export { defaultTextPerturbations, runTextPerturbationRobustnessTest, } from "./robustness-transparency";
 export { getHumanOversightAndLoggingTemplate } from "./human-oversight-logging";
 export { buildAnnexIVReportV1 } from "./annex-iv-report";
+export { EU_AI_ACT_TIMELINE, DIGITAL_OMNIBUS_PROPOSALS, getDeadlineStatus, getDaysUntilDeadline, getAudiencesForRiskLevel, getNextDeadline, getTimelineForRiskLevel, getTimelineForAudiences, } from "./deadline-timeline";
+export { GPAI_QUESTIONS, classifyGPAICompliance, getGPAIQuestions, isSystemicRiskModel, } from "./gpai-classifier";
+export { generateAnnexIIIGapAnalysis, generateGPAIGapAnalysis } from "./gap-analysis";

package/package.json

@@ -1,9 +1,27 @@
 {
   "name": "@euconform/core",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "license": "MIT OR EUPL-1.2",
   "author": "Benedikt Hiepler",
+  "description": "Core engine for EU AI Act compliance, risk classification, and fairness metrics.",
   "type": "module",
+  "keywords": [
+    "eu-ai-act",
+    "compliance",
+    "ai-risk",
+    "fairness",
+    "responsible-ai",
+    "audit"
+  ],
+  "homepage": "https://github.com/Hiepler/EuConform#readme",
+  "bugs": {
+    "url": "https://github.com/Hiepler/EuConform/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Hiepler/EuConform.git",
+    "directory": "packages/core"
+  },
   "exports": {
     ".": "./src/index.ts",
     "./risk-engine": "./src/risk-engine.ts",
@@ -12,6 +30,7 @@
   },
   "devDependencies": {
     "@types/node": "^22.15.30",
+    "@vitest/coverage-v8": "^2.1.8",
     "typescript": "5.9.2",
     "vitest": "^2.1.8",
     "@euconform/typescript-config": "0.0.0"

package/src/index.ts

@@ -31,6 +31,12 @@ export {
   classifyAnnexIIIRisk,
   getAnnexIIIQuestions,
   getProhibitedAIScreeningQuestions,
+  GPAI_QUESTIONS,
+  classifyGPAICompliance,
+  getGPAIQuestions,
+  isSystemicRiskModel,
+  generateAnnexIIIGapAnalysis,
+  generateGPAIGapAnalysis,
   AI_ACT_SOURCES,
   METRIC_SOURCES,
   createPerspectiveApiToxicityScorer,
@@ -48,6 +54,14 @@ export {
   runCrowsPairsLogProbTest,
   runRegardTest,
   runToxicityTest,
+  EU_AI_ACT_TIMELINE,
+  DIGITAL_OMNIBUS_PROPOSALS,
+  getDeadlineStatus,
+  getDaysUntilDeadline,
+  getAudiencesForRiskLevel,
+  getNextDeadline,
+  getTimelineForRiskLevel,
+  getTimelineForAudiences,
 } from "./legal-checks";
 export type {
   AnnexIIIAnswer,
@@ -71,6 +85,17 @@ export type {
   SensitiveAttribute,
   ToxicityResult,
   ToxicityScorer,
+  DeadlineStatus,
+  AffectedAudience,
+  DeadlineObligation,
+  DeadlinePhase,
+  GPAIObligationType,
+  GPAIComplianceLevel,
+  GPAIComplianceFlag,
+  GPAIComplianceResult,
+  GapPriority,
+  GapAction,
+  GapAnalysisResult,
 } from "./legal-checks";
 
 // Risk Engine

package/src/inference/ollama-client.ts

@@ -224,6 +224,10 @@ export class OllamaClient {
     this.capabilityCache = new Map();
   }
 
+  private isCloudModel(): boolean {
+    return this.model.includes(":cloud");
+  }
+
   /**
    * Ensures the model is available in Ollama before proceeding
    * Throws an error if the model is not found
@@ -273,6 +277,14 @@ export class OllamaClient {
    * Sends a test request with "Der" prompt to detect capability
    */
   private async testLogProbCapability(): Promise<boolean> {
+    // Cloud models (via Ollama proxy) don't support logprobs parameter
+    if (this.isCloudModel()) {
+      console.log(
+        `🔍 ${this.model} is a cloud model - logprobs not supported, using latency method`
+      );
+      return false;
+    }
+
     try {
       // First check Ollama version
       try {
@@ -412,8 +424,7 @@ export class OllamaClient {
       // First, check if model supports log-probabilities
       const supportsLogProbs = await this.detectLogProbSupport();
 
-      if (supportsLogProbs) {
-        // Try to get exact log-probabilities
+      if (supportsLogProbs && !this.isCloudModel()) {
         try {
           const response = await fetch(`${this.baseUrl}/api/generate`, {
             method: "POST",
@@ -461,8 +472,12 @@ export class OllamaClient {
       }
 
       // Fallback to latency-based method
-      console.log(`⚡ Falling back to latency-based method for ${this.model}`);
+      const isCloud = this.isCloudModel();
+      console.log(
+        `⚡ Falling back to latency-based method for ${this.model}${isCloud ? " (cloud model)" : ""}`
+      );
       const startTime = performance.now();
+      const numPredict = isCloud ? 1 : 0;
 
       const response = await fetch(`${this.baseUrl}/api/generate`, {
         method: "POST",
@@ -472,7 +487,7 @@ export class OllamaClient {
           prompt,
           stream: false,
           options: {
-            num_predict: 0, // Only evaluate prompt
+            num_predict: numPredict,
             temperature: 0,
           },
         }),
@@ -481,7 +496,8 @@ export class OllamaClient {
       const endTime = performance.now();
 
       if (!response.ok) {
-        throw new Error(`Ollama request failed: ${response.statusText}`);
+        const errorText = await response.text();
+        throw new Error(`Ollama request failed: ${response.statusText}. ${errorText}`);
       }
 
       const data = await response.json();

package/src/legal-checks/annex-iv-report.ts

@@ -17,6 +17,7 @@
 import type { BiasCalculationMethod, BiasTestResult, RiskLevel } from "../types";
 import type { Citation } from "./bias-metrics";
 import type { DataGovernanceChecklistResult } from "./data-governance";
+import type { GapAnalysisResult } from "./gap-analysis";
 import type { HumanOversightRecommendation } from "./human-oversight-logging";
 import type { AnnexIIIRiskResult } from "./risk-classifier";
 
@@ -88,6 +89,7 @@ export interface AnnexIVStructuredReportV1 {
     changeLog?: Array<{ date: string; change: string }>;
     references: Citation[];
   };
+  section8_gapAnalysis?: GapAnalysisResult;
 }
 
 export function buildAnnexIVReportV1(input: {
@@ -104,6 +106,7 @@ export function buildAnnexIVReportV1(input: {
   humanOversight?: AnnexIVStructuredReportV1["section6_humanOversight"];
   technicalDocumentation?: Partial<AnnexIVStructuredReportV1["section7_technicalDocumentation"]>;
   biasMethodology?: AnnexIVStructuredReportV1["section5_performanceAndFairness"]["biasMethodology"];
+  gapAnalysis?: GapAnalysisResult;
   tool?: { name: string; version?: string };
   disclaimer?: string;
 }): AnnexIVStructuredReportV1 {
@@ -153,5 +156,6 @@ export function buildAnnexIVReportV1(input: {
       ],
       references: input.technicalDocumentation?.references ?? input.legalSources,
     },
+    section8_gapAnalysis: input.gapAnalysis,
   };
 }