@euconform/core 1.0.1 → 1.2.0

package/dist/legal-checks/index.js

@@ -4,3 +4,6 @@ export { runDataGovernanceChecklist } from "./data-governance";
 export { defaultTextPerturbations, runTextPerturbationRobustnessTest, } from "./robustness-transparency";
 export { getHumanOversightAndLoggingTemplate } from "./human-oversight-logging";
 export { buildAnnexIVReportV1 } from "./annex-iv-report";
+export { EU_AI_ACT_TIMELINE, DIGITAL_OMNIBUS_PROPOSALS, getDeadlineStatus, getDaysUntilDeadline, getAudiencesForRiskLevel, getNextDeadline, getTimelineForRiskLevel, getTimelineForAudiences, } from "./deadline-timeline";
+export { GPAI_QUESTIONS, classifyGPAICompliance, getGPAIQuestions, isSystemicRiskModel, } from "./gpai-classifier";
+export { generateAnnexIIIGapAnalysis, generateGPAIGapAnalysis } from "./gap-analysis";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@euconform/core",
-  "version": "1.0.1",
+  "version": "1.2.0",
   "license": "MIT OR EUPL-1.2",
   "author": "Benedikt Hiepler",
   "description": "Core engine for EU AI Act compliance, risk classification, and fairness metrics.",

package/src/index.ts

@@ -31,6 +31,12 @@ export {
   classifyAnnexIIIRisk,
   getAnnexIIIQuestions,
   getProhibitedAIScreeningQuestions,
+  GPAI_QUESTIONS,
+  classifyGPAICompliance,
+  getGPAIQuestions,
+  isSystemicRiskModel,
+  generateAnnexIIIGapAnalysis,
+  generateGPAIGapAnalysis,
   AI_ACT_SOURCES,
   METRIC_SOURCES,
   createPerspectiveApiToxicityScorer,
@@ -48,6 +54,14 @@ export {
   runCrowsPairsLogProbTest,
   runRegardTest,
   runToxicityTest,
+  EU_AI_ACT_TIMELINE,
+  DIGITAL_OMNIBUS_PROPOSALS,
+  getDeadlineStatus,
+  getDaysUntilDeadline,
+  getAudiencesForRiskLevel,
+  getNextDeadline,
+  getTimelineForRiskLevel,
+  getTimelineForAudiences,
 } from "./legal-checks";
 export type {
   AnnexIIIAnswer,
@@ -71,6 +85,17 @@ export type {
   SensitiveAttribute,
   ToxicityResult,
   ToxicityScorer,
+  DeadlineStatus,
+  AffectedAudience,
+  DeadlineObligation,
+  DeadlinePhase,
+  GPAIObligationType,
+  GPAIComplianceLevel,
+  GPAIComplianceFlag,
+  GPAIComplianceResult,
+  GapPriority,
+  GapAction,
+  GapAnalysisResult,
 } from "./legal-checks";
 
 // Risk Engine

package/src/inference/ollama-client.ts

@@ -224,6 +224,10 @@ export class OllamaClient {
     this.capabilityCache = new Map();
   }
 
+  private isCloudModel(): boolean {
+    return this.model.includes(":cloud");
+  }
+
   /**
    * Ensures the model is available in Ollama before proceeding
    * Throws an error if the model is not found
@@ -273,6 +277,14 @@ export class OllamaClient {
    * Sends a test request with "Der" prompt to detect capability
    */
   private async testLogProbCapability(): Promise<boolean> {
+    // Cloud models (via Ollama proxy) don't support logprobs parameter
+    if (this.isCloudModel()) {
+      console.log(
+        `🔍 ${this.model} is a cloud model - logprobs not supported, using latency method`
+      );
+      return false;
+    }
+
     try {
       // First check Ollama version
       try {
@@ -412,8 +424,7 @@ export class OllamaClient {
       // First, check if model supports log-probabilities
       const supportsLogProbs = await this.detectLogProbSupport();
 
-      if (supportsLogProbs) {
-        // Try to get exact log-probabilities
+      if (supportsLogProbs && !this.isCloudModel()) {
         try {
           const response = await fetch(`${this.baseUrl}/api/generate`, {
             method: "POST",
@@ -461,8 +472,12 @@ export class OllamaClient {
       }
 
       // Fallback to latency-based method
-      console.log(`⚡ Falling back to latency-based method for ${this.model}`);
+      const isCloud = this.isCloudModel();
+      console.log(
+        `⚡ Falling back to latency-based method for ${this.model}${isCloud ? " (cloud model)" : ""}`
+      );
       const startTime = performance.now();
+      const numPredict = isCloud ? 1 : 0;
 
       const response = await fetch(`${this.baseUrl}/api/generate`, {
         method: "POST",
@@ -472,7 +487,7 @@ export class OllamaClient {
           prompt,
           stream: false,
           options: {
-            num_predict: 0, // Only evaluate prompt
+            num_predict: numPredict,
             temperature: 0,
           },
         }),
@@ -481,7 +496,8 @@ export class OllamaClient {
       const endTime = performance.now();
 
       if (!response.ok) {
-        throw new Error(`Ollama request failed: ${response.statusText}`);
+        const errorText = await response.text();
+        throw new Error(`Ollama request failed: ${response.statusText}. ${errorText}`);
       }
 
       const data = await response.json();

package/src/legal-checks/annex-iv-report.ts

@@ -17,6 +17,7 @@
 import type { BiasCalculationMethod, BiasTestResult, RiskLevel } from "../types";
 import type { Citation } from "./bias-metrics";
 import type { DataGovernanceChecklistResult } from "./data-governance";
+import type { GapAnalysisResult } from "./gap-analysis";
 import type { HumanOversightRecommendation } from "./human-oversight-logging";
 import type { AnnexIIIRiskResult } from "./risk-classifier";
 
@@ -88,6 +89,7 @@ export interface AnnexIVStructuredReportV1 {
     changeLog?: Array<{ date: string; change: string }>;
     references: Citation[];
   };
+  section8_gapAnalysis?: GapAnalysisResult;
 }
 
 export function buildAnnexIVReportV1(input: {
@@ -104,6 +106,7 @@ export function buildAnnexIVReportV1(input: {
   humanOversight?: AnnexIVStructuredReportV1["section6_humanOversight"];
   technicalDocumentation?: Partial<AnnexIVStructuredReportV1["section7_technicalDocumentation"]>;
   biasMethodology?: AnnexIVStructuredReportV1["section5_performanceAndFairness"]["biasMethodology"];
+  gapAnalysis?: GapAnalysisResult;
   tool?: { name: string; version?: string };
   disclaimer?: string;
 }): AnnexIVStructuredReportV1 {
@@ -153,5 +156,6 @@ export function buildAnnexIVReportV1(input: {
       ],
       references: input.technicalDocumentation?.references ?? input.legalSources,
     },
+    section8_gapAnalysis: input.gapAnalysis,
   };
 }

package/src/legal-checks/deadline-timeline.ts

@@ -0,0 +1,313 @@
+/**
+ * EU AI Act Compliance Deadline Timeline
+ * Based on Regulation (EU) 2024/1689, Article 113
+ *
+ * Non-legal-advice: These dates are extracted from the official regulation text
+ * and publicly available EU Commission sources. Always verify with legal counsel.
+ */
+
+import type { RiskLevel } from "../types";
+
+export type DeadlineStatus = "past" | "imminent" | "upcoming" | "future";
+
+export type AffectedAudience =
+  | "all"
+  | "prohibited"
+  | "gpai"
+  | "high-annex-iii"
+  | "high-annex-i"
+  | "limited"
+  | "minimal";
+
+export interface DeadlineObligation {
+  titleKey: string;
+  articleRef: string;
+  audiences: AffectedAudience[];
+  maxPenalty?: string;
+  proposed?: boolean;
+}
+
+export interface DeadlinePhase {
+  id: string;
+  isoDate: string;
+  chapterRef: string;
+  titleKey: string;
+  subtitleKey: string;
+  obligations: DeadlineObligation[];
+  status?: DeadlineStatus;
+  proposed?: boolean;
+}
+
+const MS_PER_DAY = 1000 * 60 * 60 * 24;
+
+export function getDeadlineStatus(isoDate: string, nowMs = Date.now()): DeadlineStatus {
+  const diffDays = (new Date(isoDate).getTime() - nowMs) / MS_PER_DAY;
+  if (diffDays < 0) return "past";
+  if (diffDays <= 90) return "imminent";
+  if (diffDays <= 365) return "upcoming";
+  return "future";
+}
+
+export function getDaysUntilDeadline(isoDate: string, nowMs = Date.now()): number {
+  return Math.round((new Date(isoDate).getTime() - nowMs) / MS_PER_DAY);
+}
+
+/**
+ * EU AI Act Timeline Milestones – Art. 113 Application Schedule
+ *
+ * Sources:
+ * - Regulation (EU) 2024/1689, Article 113
+ * - EU Commission AI Act Service Desk: https://ai-act-service-desk.ec.europa.eu
+ * - Digital Omnibus Proposal, November 2025 (proposed, not yet law)
+ */
+export const EU_AI_ACT_TIMELINE: DeadlinePhase[] = [
+  {
+    id: "entry-into-force",
+    isoDate: "2024-08-01",
+    chapterRef: "Art. 113",
+    titleKey: "timeline_phase0_title",
+    subtitleKey: "timeline_phase0_subtitle",
+    obligations: [
+      {
+        titleKey: "timeline_obligation_regulation_published",
+        articleRef: "Art. 113",
+        audiences: ["all"],
+      },
+    ],
+  },
+  {
+    id: "phase-1-prohibited",
+    isoDate: "2025-02-02",
+    chapterRef: "Art. 113(1) – Chapter I & II",
+    titleKey: "timeline_phase1_title",
+    subtitleKey: "timeline_phase1_subtitle",
+    obligations: [
+      {
+        titleKey: "timeline_obligation_definitions",
+        articleRef: "Art. 1–4",
+        audiences: ["all"],
+      },
+      {
+        titleKey: "timeline_obligation_prohibited",
+        articleRef: "Art. 5",
+        audiences: ["all", "prohibited"],
+        maxPenalty: "€35M / 7%",
+      },
+      {
+        titleKey: "timeline_obligation_ai_literacy",
+        articleRef: "Art. 4",
+        audiences: ["all"],
+      },
+    ],
+  },
+  {
+    id: "phase-2-gpai",
+    isoDate: "2025-08-02",
+    chapterRef: "Art. 113(2) – Chapter V, VII, XII",
+    titleKey: "timeline_phase2_title",
+    subtitleKey: "timeline_phase2_subtitle",
+    obligations: [
+      {
+        titleKey: "timeline_obligation_gpai_documentation",
+        articleRef: "Art. 53",
+        audiences: ["gpai"],
+        maxPenalty: "€15M / 3%",
+      },
+      {
+        titleKey: "timeline_obligation_gpai_copyright",
+        articleRef: "Art. 53(1)(c)",
+        audiences: ["gpai"],
+      },
+      {
+        titleKey: "timeline_obligation_gpai_systemic_risk",
+        articleRef: "Art. 55",
+        audiences: ["gpai"],
+        maxPenalty: "€15M / 3%",
+      },
+      {
+        titleKey: "timeline_obligation_notified_bodies",
+        articleRef: "Art. 28–39",
+        audiences: ["high-annex-iii", "high-annex-i"],
+      },
+      {
+        titleKey: "timeline_obligation_governance",
+        articleRef: "Art. 64–70",
+        audiences: ["all"],
+      },
+      {
+        titleKey: "timeline_obligation_penalties_framework",
+        articleRef: "Art. 99–100",
+        audiences: ["all"],
+      },
+    ],
+  },
+  {
+    id: "phase-3-high-risk-annex-iii",
+    isoDate: "2026-08-02",
+    chapterRef: "Art. 113(3) – Full Application",
+    titleKey: "timeline_phase3_title",
+    subtitleKey: "timeline_phase3_subtitle",
+    obligations: [
+      {
+        titleKey: "timeline_obligation_high_risk_requirements",
+        articleRef: "Art. 8–25",
+        audiences: ["high-annex-iii"],
+        maxPenalty: "€15M / 3%",
+      },
+      {
+        titleKey: "timeline_obligation_risk_management",
+        articleRef: "Art. 9",
+        audiences: ["high-annex-iii"],
+      },
+      {
+        titleKey: "timeline_obligation_data_governance",
+        articleRef: "Art. 10",
+        audiences: ["high-annex-iii"],
+      },
+      {
+        titleKey: "timeline_obligation_transparency_deployers",
+        articleRef: "Art. 13",
+        audiences: ["high-annex-iii"],
+      },
+      {
+        titleKey: "timeline_obligation_human_oversight",
+        articleRef: "Art. 14",
+        audiences: ["high-annex-iii"],
+      },
+      {
+        titleKey: "timeline_obligation_conformity_assessment",
+        articleRef: "Art. 43",
+        audiences: ["high-annex-iii"],
+      },
+      {
+        titleKey: "timeline_obligation_ce_marking",
+        articleRef: "Art. 48",
+        audiences: ["high-annex-iii"],
+      },
+      {
+        titleKey: "timeline_obligation_eu_database",
+        articleRef: "Art. 49",
+        audiences: ["high-annex-iii"],
+      },
+      {
+        titleKey: "timeline_obligation_limited_risk_transparency",
+        articleRef: "Art. 50",
+        audiences: ["limited"],
+        maxPenalty: "€15M / 3%",
+      },
+      {
+        titleKey: "timeline_obligation_post_market",
+        articleRef: "Art. 72–73",
+        audiences: ["high-annex-iii"],
+      },
+    ],
+  },
+  {
+    id: "phase-4-high-risk-annex-i",
+    isoDate: "2027-08-02",
+    chapterRef: "Art. 113(4) – Art. 6(1) + Annex I",
+    titleKey: "timeline_phase4_title",
+    subtitleKey: "timeline_phase4_subtitle",
+    obligations: [
+      {
+        titleKey: "timeline_obligation_annex_i_products",
+        articleRef: "Art. 6(1) + Annex I",
+        audiences: ["high-annex-i"],
+        maxPenalty: "€15M / 3%",
+      },
+      {
+        titleKey: "timeline_obligation_gpai_grace_period_ends",
+        articleRef: "Art. 113(5)",
+        audiences: ["gpai"],
+      },
+    ],
+  },
+];
+
+/**
+ * Digital Omnibus proposed changes (November 2025).
+ * NOT YET LAW – under negotiation by EP and Council as of early 2026.
+ */
+export const DIGITAL_OMNIBUS_PROPOSALS: DeadlinePhase[] = [
+  {
+    id: "omnibus-high-risk-annex-iii",
+    isoDate: "2027-12-02",
+    chapterRef: "Digital Omnibus (proposed)",
+    titleKey: "timeline_omnibus_phase3_title",
+    subtitleKey: "timeline_omnibus_phase3_subtitle",
+    proposed: true,
+    obligations: [
+      {
+        titleKey: "timeline_omnibus_high_risk_delayed",
+        articleRef: "Annex III (proposed)",
+        audiences: ["high-annex-iii"],
+        proposed: true,
+      },
+    ],
+  },
+  {
+    id: "omnibus-high-risk-annex-i",
+    isoDate: "2028-08-02",
+    chapterRef: "Digital Omnibus (proposed)",
+    titleKey: "timeline_omnibus_phase4_title",
+    subtitleKey: "timeline_omnibus_phase4_subtitle",
+    proposed: true,
+    obligations: [
+      {
+        titleKey: "timeline_omnibus_annex_i_delayed",
+        articleRef: "Annex I (proposed)",
+        audiences: ["high-annex-i"],
+        proposed: true,
+      },
+    ],
+  },
+];
+
+export function getAudiencesForRiskLevel(level: RiskLevel): AffectedAudience[] {
+  switch (level) {
+    case "unacceptable":
+      return ["all", "prohibited"];
+    case "high":
+      return ["all", "high-annex-iii", "high-annex-i"];
+    case "limited":
+      return ["all", "limited"];
+    case "minimal":
+      return ["all", "minimal"];
+  }
+}
+
+export function getNextDeadline(): DeadlinePhase | null {
+  const today = new Date().toISOString().slice(0, 10);
+  const upcoming = EU_AI_ACT_TIMELINE.filter((p) => p.isoDate > today).sort((a, b) =>
+    a.isoDate.localeCompare(b.isoDate)
+  );
+  return upcoming[0] ?? null;
+}
+
+export function getTimelineForRiskLevel(
+  riskLevel: RiskLevel
+): (DeadlinePhase & { status: DeadlineStatus })[] {
+  const audiences = getAudiencesForRiskLevel(riskLevel);
+  return EU_AI_ACT_TIMELINE.filter((phase) =>
+    phase.obligations.some((o) => o.audiences.some((a) => audiences.includes(a)))
+  ).map((phase) => ({
+    ...phase,
+    status: getDeadlineStatus(phase.isoDate),
+  }));
+}
+
+/**
+ * Filter timeline phases by explicit audience list.
+ * Use this when the caller has audiences that don't map to a RiskLevel
+ * (e.g., GPAI providers need ["all", "gpai"]).
+ */
+export function getTimelineForAudiences(
+  audiences: AffectedAudience[]
+): (DeadlinePhase & { status: DeadlineStatus })[] {
+  return EU_AI_ACT_TIMELINE.filter((phase) =>
+    phase.obligations.some((o) => o.audiences.some((a) => audiences.includes(a)))
+  ).map((phase) => ({
+    ...phase,
+    status: getDeadlineStatus(phase.isoDate),
+  }));
+}