@euconform/core 1.0.1 → 1.2.0

package/dist/legal-checks/gap-analysis.js

@@ -0,0 +1,397 @@
+/**
+ * Compliance Gap Analysis Generator
+ * Produces prioritized action plans from EU AI Act assessment results.
+ *
+ * Supports:
+ * - Annex III high-risk assessment → mandatory Art. 9–15 + Art. 43 + Art. 71 obligations
+ * - GPAI compliance assessment → gaps directly from GPAIComplianceResult flags
+ *
+ * IMPORTANT: This module provides technical orientation, not legal advice.
+ */
+// ---------------------------------------------------------------------------
+// Annex III: Mandatory obligations for ALL high-risk systems (Art. 9–15 + Art. 43 + Art. 71 + Art. 72)
+// ---------------------------------------------------------------------------
+const HIGH_RISK_OBLIGATIONS = [
+    {
+        id: "risk-management-system",
+        title: "Risk Management System",
+        description: "Establish and maintain a continuous risk management system covering the full AI system lifecycle.",
+        articleRef: "Art. 9",
+        priority: "critical",
+        status: "missing",
+        steps: [
+            "Identify and analyze foreseeable risks to health, safety, and fundamental rights",
+            "Implement risk mitigation measures proportionate to identified risks",
+            "Test residual risks against acceptance criteria before deployment",
+            "Document and update risk assessment throughout lifecycle",
+        ],
+        penaltyRef: "Art. 99(3)",
+    },
+    {
+        id: "data-governance",
+        title: "Data Governance & Training Data",
+        description: "Implement data governance practices covering training, validation, and testing datasets.",
+        articleRef: "Art. 10",
+        priority: "critical",
+        status: "missing",
+        steps: [
+            "Document data sources, collection methods, and data preparation processes",
+            "Assess training data for biases that could lead to discriminatory outcomes",
+            "Implement data quality and relevance criteria appropriate to the intended purpose",
+            "Establish and document data governance policies",
+        ],
+        penaltyRef: "Art. 99(3)",
+    },
+    {
+        id: "technical-documentation",
+        title: "Technical Documentation (Annex IV)",
+        description: "Prepare and maintain comprehensive technical documentation per Annex IV.",
+        articleRef: "Art. 11 + Annex IV",
+        priority: "critical",
+        status: "missing",
+        steps: [
+            "Document general system description including intended purpose and high-risk category",
+            "Describe design specifications, architecture, and development methods",
+            "Document training methods, datasets, and accuracy/robustness metrics",
+            "Keep documentation up-to-date throughout the system lifecycle",
+        ],
+        penaltyRef: "Art. 99(3)",
+    },
+    {
+        id: "record-keeping",
+        title: "Logging & Record-Keeping",
+        description: "Implement automatic logging capabilities throughout system operation.",
+        articleRef: "Art. 12",
+        priority: "high",
+        status: "missing",
+        steps: [
+            "Enable automatic logging of system events during operation",
+            "Ensure logs identify operating periods and referenced databases used",
+            "Retain logs for minimum 6 months (or as required by sector regulations)",
+            "Implement secure log storage with appropriate access controls",
+        ],
+        penaltyRef: "Art. 99(3)",
+    },
+    {
+        id: "transparency-information",
+        title: "Transparency & User Information",
+        description: "Provide clear instructions for use and ensure deployers and users understand the system.",
+        articleRef: "Art. 13",
+        priority: "high",
+        status: "missing",
+        steps: [
+            "Prepare instructions for use covering capabilities, limitations, and intended purpose",
+            "Disclose the AI nature of the system clearly",
+            "Inform users about accuracy levels and known limitations",
+            "Document contact information for user questions and complaints",
+        ],
+        penaltyRef: "Art. 99(3)",
+    },
+    {
+        id: "human-oversight",
+        title: "Human Oversight Measures",
+        description: "Enable meaningful human oversight of the AI system throughout its operation.",
+        articleRef: "Art. 14",
+        priority: "high",
+        status: "missing",
+        steps: [
+            "Implement interfaces enabling human monitoring of AI outputs",
+            "Ensure humans can override, correct, or disregard AI decisions",
+            "Train persons responsible for oversight on capabilities and limitations",
+            "Document human oversight procedures",
+        ],
+        penaltyRef: "Art. 99(3)",
+    },
+    {
+        id: "accuracy-robustness",
+        title: "Accuracy, Robustness & Cybersecurity",
+        description: "Ensure the system meets required accuracy levels and is resilient against errors and attacks.",
+        articleRef: "Art. 15",
+        priority: "high",
+        status: "missing",
+        steps: [
+            "Define and test accuracy metrics appropriate to the intended purpose",
+            "Test for robustness against errors, faults, and inconsistencies",
+            "Implement cybersecurity measures against adversarial manipulation",
+            "Document all performance metrics in technical documentation",
+        ],
+        penaltyRef: "Art. 99(3)",
+    },
+    {
+        id: "conformity-assessment",
+        title: "Conformity Assessment",
+        description: "Conduct conformity assessment before placing the system on the EU market.",
+        articleRef: "Art. 43",
+        priority: "critical",
+        status: "missing",
+        steps: [
+            "Determine the applicable conformity assessment procedure for your category",
+            "Conduct internal assessment OR involve a notified body (depending on category)",
+            "Draw up EU declaration of conformity per Annex V",
+            "Affix CE marking to the system or accompanying documentation",
+        ],
+        penaltyRef: "Art. 99(4)",
+    },
+    {
+        id: "eu-database-registration",
+        title: "EU AI Database Registration",
+        description: "Register the high-risk AI system in the EU AI Database before market placement.",
+        articleRef: "Art. 71",
+        priority: "critical",
+        status: "missing",
+        steps: [
+            "Create an account on the EU AI Database (managed by the AI Office)",
+            "Provide all required information per Art. 71(3)",
+            "Register before placing the system on the EU market",
+            "Update the registration when significant modifications occur",
+        ],
+        penaltyRef: "Art. 99(4)",
+    },
+    {
+        id: "post-market-monitoring",
+        title: "Post-Market Monitoring",
+        description: "Set up a post-market monitoring system to track performance and report incidents.",
+        articleRef: "Art. 72",
+        priority: "medium",
+        status: "missing",
+        steps: [
+            "Establish a post-market monitoring plan before deployment",
+            "Collect and analyze data on system performance over time",
+            "Report serious incidents to national market surveillance authorities",
+            "Report near misses and systemic issues to the AI Office",
+        ],
+        penaltyRef: "Art. 99(3)",
+    },
+];
+// ---------------------------------------------------------------------------
+// GPAI: Detailed gap definitions for each obligation type
+// ---------------------------------------------------------------------------
+const GPAI_OBLIGATION_GAPS = {
+    "technical-docs": {
+        title: "Technical Documentation (Annex XI/XII)",
+        description: "Prepare and maintain technical documentation covering the GPAI model per Annex XI (standard) or Annex XII (systemic risk extension).",
+        articleRef: "Art. 53(1)(a)",
+        priority: "critical",
+        steps: [
+            "Document general model description, training approach, and architecture",
+            "List training data sources, data governance policies, and total compute (FLOP)",
+            "Document capabilities, limitations, and foreseeable misuse risks",
+            "Keep documentation updated with each significant model change",
+        ],
+        penaltyRef: "Art. 101",
+    },
+    "downstream-info": {
+        title: "Downstream Provider Information Package",
+        description: "Provide downstream providers with all information they need for their own EU AI Act obligations.",
+        articleRef: "Art. 53(1)(b)",
+        priority: "critical",
+        steps: [
+            "Document model capabilities, limitations, and intended use cases",
+            "Specify restrictions on use and integration requirements",
+            "Provide API documentation and integration guidance",
+            "Update the information package when the model is updated",
+        ],
+        penaltyRef: "Art. 101",
+    },
+    "copyright-policy": {
+        title: "Copyright Policy + Training Data Summary",
+        description: "Establish a copyright compliance policy and publish a training data summary.",
+        articleRef: "Art. 53(1)(c–d)",
+        priority: "high",
+        steps: [
+            "Implement a text and data mining (TDM) opt-out compliance policy (Art. 53(1)(c))",
+            "Publish a sufficiently detailed training data summary (Art. 53(1)(d))",
+            "Document copyright clearances obtained for training data",
+            "Establish an ongoing compliance process for future training data updates",
+        ],
+        penaltyRef: "Art. 101",
+    },
+    "eu-database": {
+        title: "EU AI Database Registration",
+        description: "Register the GPAI model in the EU AI Database before placing it on the EU market.",
+        articleRef: "Art. 71",
+        priority: "critical",
+        steps: [
+            "Access the EU AI Database portal managed by the AI Office",
+            "Provide required model information including name, type, and capabilities",
+            "Register before placing the model on the EU market",
+            "Update the registration when the model is significantly updated",
+        ],
+        penaltyRef: "Art. 101",
+    },
+    "open-source": {
+        title: "Open-Source Release Compliance",
+        description: "Verify compliance with remaining obligations that apply despite the open-source exemption.",
+        articleRef: "Art. 53(2)",
+        priority: "medium",
+        steps: [
+            "Confirm that weights, parameters, and architecture are publicly available",
+            "Ensure Art. 53(1)(d) training data summary obligation is still fulfilled",
+            "If systemic risk threshold is met, Art. 55 obligations remain applicable",
+        ],
+    },
+    "systemic-risk": {
+        title: "Systemic Risk Threshold Verification",
+        description: "Formally determine if the model meets the ≥10²⁵ FLOP systemic risk threshold.",
+        articleRef: "Art. 51 + Annex XIII",
+        priority: "high",
+        steps: [
+            "Document total training compute (FLOP) with engineering sign-off",
+            "Consult with technical experts if compute is near the threshold",
+            "If threshold is met, implement all Art. 55 obligations",
+            "Notify the AI Office if the systemic risk threshold is reached",
+        ],
+    },
+    "red-teaming": {
+        title: "Adversarial Testing / Red-Teaming",
+        description: "Conduct model evaluations and adversarial testing to identify and mitigate systemic risks.",
+        articleRef: "Art. 55(1)(a)",
+        priority: "critical",
+        steps: [
+            "Define red-teaming scope covering systemic risks (CBRN, cyberattacks, disinformation, etc.)",
+            "Conduct standardized evaluations per AI Office guidelines and emerging standards",
+            "Engage external domain experts for adversarial testing",
+            "Document findings and implement mitigation measures",
+            "Repeat evaluations before each significant model release",
+        ],
+        penaltyRef: "Art. 101",
+    },
+    "incident-reporting": {
+        title: "Serious Incident Reporting Mechanisms",
+        description: "Establish systems to track and report serious incidents caused by the GPAI model.",
+        articleRef: "Art. 55(1)(b)",
+        priority: "critical",
+        steps: [
+            "Define criteria for what constitutes a serious incident for your GPAI model",
+            "Implement an incident tracking and documentation system",
+            "Establish a direct reporting channel to the AI Office",
+            "Set up notification procedures for affected national authorities and users",
+            "Document incident response and remediation procedures",
+        ],
+        penaltyRef: "Art. 101",
+    },
+    cybersecurity: {
+        title: "Cybersecurity Measures",
+        description: "Implement adequate cybersecurity protections for the GPAI model and its infrastructure.",
+        articleRef: "Art. 55(1)(c)",
+        priority: "high",
+        steps: [
+            "Assess cybersecurity risks specific to the GPAI model and API surface",
+            "Implement adversarial robustness measures against prompt injection and model extraction",
+            "Secure training infrastructure, model weights, and API endpoints",
+            "Document cybersecurity measures in Annex XII technical documentation",
+        ],
+        penaltyRef: "Art. 101",
+    },
+};
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+const PRIORITY_ORDER = { critical: 0, high: 1, medium: 2 };
+const SORTED_HIGH_RISK_OBLIGATIONS = [...HIGH_RISK_OBLIGATIONS].sort((a, b) => PRIORITY_ORDER[a.priority] - PRIORITY_ORDER[b.priority]);
+function countByPriority(actions) {
+    let criticalCount = 0;
+    let highCount = 0;
+    let mediumCount = 0;
+    for (const a of actions) {
+        if (a.priority === "critical")
+            criticalCount++;
+        else if (a.priority === "high")
+            highCount++;
+        else
+            mediumCount++;
+    }
+    return { criticalCount, highCount, mediumCount };
+}
+/**
+ * Generate a gap analysis action plan from an Annex III risk assessment.
+ *
+ * - unacceptable → Art. 5 prohibition action (critical)
+ * - high         → all mandatory Art. 9–15 + Art. 43 + Art. 71 + Art. 72 obligations
+ * - limited      → Art. 50 transparency obligations
+ * - minimal      → no gaps
+ */
+export function generateAnnexIIIGapAnalysis(assessment) {
+    if (assessment.level === "minimal") {
+        return { totalGaps: 0, criticalCount: 0, highCount: 0, mediumCount: 0, actions: [] };
+    }
+    if (assessment.level === "unacceptable") {
+        const actions = [
+            {
+                id: "prohibited-ai",
+                title: "Prohibited AI System (Art. 5)",
+                description: "This system shows characteristics potentially prohibited under Art. 5. Do not deploy in the EU without comprehensive legal review.",
+                articleRef: "Art. 5",
+                priority: "critical",
+                status: "missing",
+                steps: [
+                    "Immediately halt deployment plans for the EU market",
+                    "Seek qualified legal counsel to assess whether the Art. 5 prohibition applies",
+                    "Consider fundamental system redesign to eliminate prohibited characteristics",
+                ],
+                penaltyRef: "Art. 99(4)",
+            },
+        ];
+        return { totalGaps: 1, criticalCount: 1, highCount: 0, mediumCount: 0, actions };
+    }
+    if (assessment.level === "limited") {
+        const actions = [
+            {
+                id: "ai-interaction-disclosure",
+                title: "AI Interaction Disclosure",
+                description: "Inform users that they are interacting with an AI system (Art. 50(1)).",
+                articleRef: "Art. 50(1)",
+                priority: "high",
+                status: "missing",
+                steps: [
+                    "Add a clear disclosure at the start of each AI interaction",
+                    "Exception: disclosure not required if obvious from context to a reasonable person",
+                    "Document the disclosure mechanism in your compliance records",
+                ],
+                penaltyRef: "Art. 99(3)",
+            },
+            {
+                id: "ai-content-labeling",
+                title: "AI-Generated Content Labeling",
+                description: "Label AI-generated audio, image, video, or text content that could mislead users (Art. 50(2–4)).",
+                articleRef: "Art. 50(2–4)",
+                priority: "high",
+                status: "partial",
+                steps: [
+                    "Implement machine-readable marking of AI-generated content",
+                    "Add visible disclosure for synthetic media (deepfakes, AI-generated images/video)",
+                    "Apply Art. 50(4) disclosure for emotion recognition or biometric categorization",
+                ],
+                penaltyRef: "Art. 99(3)",
+            },
+        ];
+        return {
+            totalGaps: actions.length,
+            ...countByPriority(actions),
+            actions,
+        };
+    }
+    // high: all mandatory obligations, pre-sorted at module init
+    return {
+        totalGaps: SORTED_HIGH_RISK_OBLIGATIONS.length,
+        ...countByPriority(SORTED_HIGH_RISK_OBLIGATIONS),
+        actions: SORTED_HIGH_RISK_OBLIGATIONS,
+    };
+}
+/**
+ * Generate a gap analysis action plan from a GPAI compliance result.
+ * Only generates actions for obligations flagged as missing or partial.
+ */
+export function generateGPAIGapAnalysis(result) {
+    if (result.flags.length === 0) {
+        return { totalGaps: 0, criticalCount: 0, highCount: 0, mediumCount: 0, actions: [] };
+    }
+    const actions = result.flags
+        .map((flag) => ({
+        id: flag.obligation,
+        status: flag.status,
+        ...GPAI_OBLIGATION_GAPS[flag.obligation],
+    }))
+        .sort((a, b) => PRIORITY_ORDER[a.priority] - PRIORITY_ORDER[b.priority]);
+    return { totalGaps: actions.length, ...countByPriority(actions), actions };
+}

package/dist/legal-checks/gpai-classifier.d.ts

@@ -0,0 +1,49 @@
+/**
+ * GPAI / Foundation Model Compliance Classifier
+ * Based on EU AI Act (Regulation EU 2024/1689) – Art. 53–55 + Art. 51 + Art. 71
+ *
+ * Obligations enforceable since August 2, 2025 (Phase 2, Art. 113(2)).
+ *
+ * IMPORTANT: This module provides technical orientation, not legal advice.
+ */
+import type { QuizAnswer, QuizQuestion } from "../types";
+/** The specific obligations checked under Art. 53–55 */
+export type GPAIObligationType = "technical-docs" | "downstream-info" | "copyright-policy" | "eu-database" | "open-source" | "systemic-risk" | "red-teaming" | "incident-reporting" | "cybersecurity";
+/** Overall compliance determination */
+export type GPAIComplianceLevel = "compliant" | "partial" | "non-compliant";
+/** A specific obligation that is missing or only partially met */
+export interface GPAIComplianceFlag {
+    obligation: GPAIObligationType;
+    status: "missing" | "partial";
+    articleRef: string;
+}
+/** Full result of GPAI compliance classification */
+export interface GPAIComplianceResult {
+    level: GPAIComplianceLevel;
+    isSystemicRisk: boolean;
+    flags: GPAIComplianceFlag[];
+    legalBasis: string[];
+    notes: string[];
+}
+/**
+ * The 9 GPAI compliance questions (Art. 53–55).
+ * Order matters: q1–q9 map to i18n keys gpai_q1–gpai_q9.
+ */
+export declare const GPAI_QUESTIONS: QuizQuestion[];
+/** Returns the full ordered list of GPAI compliance questions */
+export declare function getGPAIQuestions(): QuizQuestion[];
+/** Returns true if the model meets the systemic risk threshold (Art. 51) */
+export declare function isSystemicRiskModel(answers: QuizAnswer[]): boolean;
+/**
+ * Classify GPAI compliance based on answers to the 9 questions.
+ * Returns a GPAIComplianceResult with level, flags, and legal basis.
+ *
+ * Classification logic:
+ * - Open-source (Art. 53(2)): exempt from docs/downstream/copyright obligations
+ * - Systemic risk (Art. 51): Art. 55 obligations apply
+ * - Critical Art. 53 all missing → "non-compliant"
+ * - Any "unsure" or partial → "partial"
+ * - All applicable "yes" → "compliant"
+ */
+export declare function classifyGPAICompliance(answers: QuizAnswer[]): GPAIComplianceResult;
+//# sourceMappingURL=gpai-classifier.d.ts.map

package/dist/legal-checks/gpai-classifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gpai-classifier.d.ts","sourceRoot":"","sources":["../../src/legal-checks/gpai-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAEzD,wDAAwD;AACxD,MAAM,MAAM,kBAAkB,GAC1B,gBAAgB,GAChB,iBAAiB,GACjB,kBAAkB,GAClB,aAAa,GACb,aAAa,GACb,eAAe,GACf,aAAa,GACb,oBAAoB,GACpB,eAAe,CAAC;AAEpB,uCAAuC;AACvC,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,SAAS,GAAG,eAAe,CAAC;AAE5E,kEAAkE;AAClE,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,kBAAkB,CAAC;IAC/B,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,oDAAoD;AACpD,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,mBAAmB,CAAC;IAC3B,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,YAAY,EAoGxC,CAAC;AAEF,iEAAiE;AACjE,wBAAgB,gBAAgB,IAAI,YAAY,EAAE,CAEjD;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAGlE;AAsFD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,oBAAoB,CA0BlF"}

package/dist/legal-checks/gpai-classifier.js

@@ -0,0 +1,197 @@
+/**
+ * GPAI / Foundation Model Compliance Classifier
+ * Based on EU AI Act (Regulation EU 2024/1689) – Art. 53–55 + Art. 51 + Art. 71
+ *
+ * Obligations enforceable since August 2, 2025 (Phase 2, Art. 113(2)).
+ *
+ * IMPORTANT: This module provides technical orientation, not legal advice.
+ */
+/**
+ * The 9 GPAI compliance questions (Art. 53–55).
+ * Order matters: q1–q9 map to i18n keys gpai_q1–gpai_q9.
+ */
+export const GPAI_QUESTIONS = [
+    {
+        id: "gpai-technical-docs",
+        question: "Art. 53(1)(a): Technical documentation (Annex XI/XII)?",
+        description: "Have you prepared and maintain up-to-date technical documentation for the GPAI model per Annex XI/XII (general-purpose) or the systemic-risk extension?",
+        options: [
+            { value: "yes", label: "Yes, implemented" },
+            { value: "no", label: "No, missing" },
+            { value: "unsure", label: "In progress / unsure" },
+        ],
+    },
+    {
+        id: "gpai-downstream-info",
+        question: "Art. 53(1)(b): Downstream provider information?",
+        description: "Do you provide downstream providers / deployers with the information they need to comply with their own EU AI Act obligations (capabilities, limitations, intended use)?",
+        options: [
+            { value: "yes", label: "Yes, implemented" },
+            { value: "no", label: "No, missing" },
+            { value: "unsure", label: "In progress / unsure" },
+        ],
+    },
+    {
+        id: "gpai-copyright-policy",
+        question: "Art. 53(1)(c–d): Copyright policy + training data summary?",
+        description: "Have you established a copyright compliance policy (Art. 53(1)(c)) and published a sufficiently detailed training data summary for copyright purposes (Art. 53(1)(d))?",
+        options: [
+            { value: "yes", label: "Yes, implemented" },
+            { value: "no", label: "No, missing" },
+            { value: "unsure", label: "In progress / unsure" },
+        ],
+    },
+    {
+        id: "gpai-eu-database",
+        question: "Art. 71: EU AI Database registration?",
+        description: "Is the GPAI model registered in the EU AI Database as required under Art. 71 (providers of GPAI models must register before placing the model on the EU market)?",
+        options: [
+            { value: "yes", label: "Yes, registered" },
+            { value: "no", label: "No, not registered" },
+            { value: "unsure", label: "In progress / unsure" },
+        ],
+    },
+    {
+        id: "gpai-open-source",
+        question: "Art. 53(2): Open-source model release?",
+        description: "Is the model released as open source with weights publicly available? Open-source GPAI models are exempt from Art. 53(1)(a–c) obligations (technical docs, downstream info, copyright policy) but not from Art. 53(1)(d) (training data summary) or Art. 55 systemic-risk obligations.",
+        options: [
+            { value: "yes", label: "Yes, open source" },
+            { value: "no", label: "No, proprietary" },
+            { value: "unsure", label: "Unsure / partially open" },
+        ],
+    },
+    {
+        id: "gpai-systemic-risk",
+        question: "Art. 51 + Annex XIII: Trained with ≥ 10²⁵ FLOP?",
+        description: "Was the model trained using compute exceeding 10²⁵ floating-point operations (FLOP)? Models at or above this threshold are designated as GPAI models with systemic risk (Art. 51) and are subject to the additional Art. 55 obligations below.",
+        options: [
+            { value: "yes", label: "Yes (systemic risk)" },
+            { value: "no", label: "No (below threshold)" },
+            { value: "unsure", label: "Unknown / unsure" },
+        ],
+    },
+    {
+        id: "gpai-red-teaming",
+        question: "Art. 55(1)(a): Adversarial testing / red-teaming?",
+        description: "Have you conducted model evaluations, adversarial testing, and red-teaming to identify and mitigate systemic risks (required only for Art. 51 systemic-risk models)?",
+        options: [
+            { value: "yes", label: "Yes, conducted" },
+            { value: "no", label: "No, not done" },
+            { value: "unsure", label: "In progress / unsure" },
+        ],
+    },
+    {
+        id: "gpai-incident-reporting",
+        question: "Art. 55(1)(b): Serious incident reporting mechanisms?",
+        description: "Do you have mechanisms to track, document, and report serious incidents caused by the GPAI model to the AI Office and affected national authorities (required only for Art. 51 systemic-risk models)?",
+        options: [
+            { value: "yes", label: "Yes, in place" },
+            { value: "no", label: "No, missing" },
+            { value: "unsure", label: "In progress / unsure" },
+        ],
+    },
+    {
+        id: "gpai-cybersecurity",
+        question: "Art. 55(1)(c): Cybersecurity measures?",
+        description: "Have you implemented adequate cybersecurity protections for the GPAI model and its infrastructure, including adversarial robustness measures (required only for Art. 51 systemic-risk models)?",
+        options: [
+            { value: "yes", label: "Yes, implemented" },
+            { value: "no", label: "No, missing" },
+            { value: "unsure", label: "In progress / unsure" },
+        ],
+    },
+];
+/** Returns the full ordered list of GPAI compliance questions */
+export function getGPAIQuestions() {
+    return GPAI_QUESTIONS;
+}
+/** Returns true if the model meets the systemic risk threshold (Art. 51) */
+export function isSystemicRiskModel(answers) {
+    const systemicAnswer = answers.find((a) => a.questionId === "gpai-systemic-risk");
+    return systemicAnswer?.value === "yes";
+}
+/** Push a flag if the answer value is "no" or "unsure" */
+function checkObligation(value, obligation, articleRef, flags) {
+    if (value === "no") {
+        flags.push({ obligation, status: "missing", articleRef });
+    }
+    else if (value === "unsure") {
+        flags.push({ obligation, status: "partial", articleRef });
+    }
+}
+/** Evaluate Art. 53 obligations and populate flags / notes */
+function evaluateArt53Obligations(byId, isOpenSource, flags, legalBasis, notes) {
+    if (!isOpenSource) {
+        checkObligation(byId.get("gpai-technical-docs"), "technical-docs", "Art. 53(1)(a)", flags);
+        checkObligation(byId.get("gpai-downstream-info"), "downstream-info", "Art. 53(1)(b)", flags);
+        checkObligation(byId.get("gpai-copyright-policy"), "copyright-policy", "Art. 53(1)(c–d)", flags);
+    }
+    else {
+        // Open-source: Art. 53(1)(a–c) exempt, but training data summary (Art. 53(1)(d)) still applies
+        const copyrightVal = byId.get("gpai-copyright-policy");
+        checkObligation(copyrightVal, "copyright-policy", "Art. 53(1)(d)", flags);
+        if (copyrightVal === "no" || copyrightVal === "unsure") {
+            notes.push("Open-source models are exempt from Art. 53(1)(c) copyright policy obligations, but Art. 53(1)(d) training data summary still applies.");
+        }
+    }
+    const euDatabase = byId.get("gpai-eu-database");
+    checkObligation(euDatabase, "eu-database", "Art. 71", flags);
+    if (euDatabase === "no") {
+        legalBasis.push("Verordnung (EU) 2024/1689 – Art. 71 (EU AI Database)");
+    }
+}
+/** Evaluate Art. 55 systemic risk obligations and populate flags */
+function evaluateArt55Obligations(byId, flags, legalBasis) {
+    legalBasis.push("Verordnung (EU) 2024/1689 – Art. 51 + Art. 55 (Systemic Risk)");
+    legalBasis.push("Verordnung (EU) 2024/1689 – Annex XIII (Systemic Risk Indicators)");
+    checkObligation(byId.get("gpai-red-teaming"), "red-teaming", "Art. 55(1)(a)", flags);
+    checkObligation(byId.get("gpai-incident-reporting"), "incident-reporting", "Art. 55(1)(b)", flags);
+    checkObligation(byId.get("gpai-cybersecurity"), "cybersecurity", "Art. 55(1)(c)", flags);
+}
+/** Determine overall compliance level from accumulated flags */
+function determineLevel(flags, isOpenSource) {
+    const criticalObligations = isOpenSource
+        ? ["eu-database"]
+        : ["technical-docs", "downstream-info", "copyright-policy", "eu-database"];
+    const allCriticalMissing = !isOpenSource &&
+        criticalObligations.every((obl) => flags.some((f) => f.obligation === obl && f.status === "missing"));
+    if (allCriticalMissing)
+        return "non-compliant";
+    if (flags.length > 0)
+        return "partial";
+    return "compliant";
+}
+/**
+ * Classify GPAI compliance based on answers to the 9 questions.
+ * Returns a GPAIComplianceResult with level, flags, and legal basis.
+ *
+ * Classification logic:
+ * - Open-source (Art. 53(2)): exempt from docs/downstream/copyright obligations
+ * - Systemic risk (Art. 51): Art. 55 obligations apply
+ * - Critical Art. 53 all missing → "non-compliant"
+ * - Any "unsure" or partial → "partial"
+ * - All applicable "yes" → "compliant"
+ */
+export function classifyGPAICompliance(answers) {
+    const byId = new Map(answers.map((a) => [a.questionId, a.value]));
+    const isOpenSource = byId.get("gpai-open-source") === "yes";
+    const hasSystemicRisk = byId.get("gpai-systemic-risk") === "yes";
+    const flags = [];
+    const legalBasis = ["Verordnung (EU) 2024/1689 – Art. 53 (GPAI obligations)"];
+    const notes = [];
+    evaluateArt53Obligations(byId, isOpenSource, flags, legalBasis, notes);
+    if (hasSystemicRisk) {
+        evaluateArt55Obligations(byId, flags, legalBasis);
+    }
+    else {
+        notes.push("Art. 55 systemic risk obligations (red-teaming, incident reporting, cybersecurity) are not applicable as the model does not meet the Art. 51 threshold (≥ 10²⁵ FLOP).");
+    }
+    return {
+        level: determineLevel(flags, isOpenSource),
+        isSystemicRisk: hasSystemicRisk,
+        flags,
+        legalBasis,
+        notes,
+    };
+}

package/dist/legal-checks/index.d.ts

@@ -10,4 +10,10 @@ export type { HumanOversightRecommendation, LoggingTemplate } from "./human-over
 export { getHumanOversightAndLoggingTemplate } from "./human-oversight-logging";
 export type { AnnexIVStructuredReportV1 } from "./annex-iv-report";
 export { buildAnnexIVReportV1 } from "./annex-iv-report";
+export type { DeadlineStatus, AffectedAudience, DeadlineObligation, DeadlinePhase, } from "./deadline-timeline";
+export { EU_AI_ACT_TIMELINE, DIGITAL_OMNIBUS_PROPOSALS, getDeadlineStatus, getDaysUntilDeadline, getAudiencesForRiskLevel, getNextDeadline, getTimelineForRiskLevel, getTimelineForAudiences, } from "./deadline-timeline";
+export type { GPAIObligationType, GPAIComplianceLevel, GPAIComplianceFlag, GPAIComplianceResult, } from "./gpai-classifier";
+export { GPAI_QUESTIONS, classifyGPAICompliance, getGPAIQuestions, isSystemicRiskModel, } from "./gpai-classifier";
+export type { GapPriority, GapAction, GapAnalysisResult } from "./gap-analysis";
+export { generateAnnexIIIGapAnalysis, generateGPAIGapAnalysis } from "./gap-analysis";
 //# sourceMappingURL=index.d.ts.map

package/dist/legal-checks/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/legal-checks/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EACL,mBAAmB,EACnB,iCAAiC,EACjC,oBAAoB,EACpB,oBAAoB,EACpB,iCAAiC,GAClC,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,QAAQ,EACR,kBAAkB,EAClB,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,cAAc,EACd,cAAc,EACd,kCAAkC,EAClC,8BAA8B,EAC9B,gCAAgC,EAChC,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,EACvB,4BAA4B,EAC5B,wBAAwB,EACxB,aAAa,EACb,eAAe,GAChB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EAAE,eAAe,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAE/D,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,aAAa,GACd,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,wBAAwB,EACxB,iCAAiC,GAClC,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EAAE,4BAA4B,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC/F,OAAO,EAAE,mCAAmC,EAAE,MAAM,2BAA2B,CAAC;AAEhF,YAAY,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/legal-checks/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EACL,mBAAmB,EACnB,iCAAiC,EACjC,oBAAoB,EACpB,oBAAoB,EACpB,iCAAiC,GAClC,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,QAAQ,EACR,kBAAkB,EAClB,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,cAAc,EACd,cAAc,EACd,kCAAkC,EAClC,8BAA8B,EAC9B,gCAAgC,EAChC,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,EACvB,4BAA4B,EAC5B,wBAAwB,EACxB,aAAa,EACb,eAAe,GAChB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EAAE,eAAe,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAE/D,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,aAAa,GACd,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,wBAAwB,EACxB,iCAAiC,GAClC,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EAAE,4BAA4B,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC/F,OAAO,EAAE,mCAAmC,EAAE,MAAM,2BAA2B,CAAC;AAEhF,YAAY,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC"}