@euconform/core 1.0.1 → 1.2.0

package/src/legal-checks/gpai-classifier.ts

@@ -0,0 +1,281 @@
+/**
+ * GPAI / Foundation Model Compliance Classifier
+ * Based on EU AI Act (Regulation EU 2024/1689) – Art. 53–55 + Art. 51 + Art. 71
+ *
+ * Obligations enforceable since August 2, 2025 (Phase 2, Art. 113(2)).
+ *
+ * IMPORTANT: This module provides technical orientation, not legal advice.
+ */
+
+import type { QuizAnswer, QuizQuestion } from "../types";
+
+/** The specific obligations checked under Art. 53–55 */
+export type GPAIObligationType =
+  | "technical-docs"
+  | "downstream-info"
+  | "copyright-policy"
+  | "eu-database"
+  | "open-source"
+  | "systemic-risk"
+  | "red-teaming"
+  | "incident-reporting"
+  | "cybersecurity";
+
+/** Overall compliance determination */
+export type GPAIComplianceLevel = "compliant" | "partial" | "non-compliant";
+
+/** A specific obligation that is missing or only partially met */
+export interface GPAIComplianceFlag {
+  obligation: GPAIObligationType;
+  status: "missing" | "partial";
+  articleRef: string;
+}
+
+/** Full result of GPAI compliance classification */
+export interface GPAIComplianceResult {
+  level: GPAIComplianceLevel;
+  isSystemicRisk: boolean;
+  flags: GPAIComplianceFlag[];
+  legalBasis: string[];
+  notes: string[];
+}
+
+/**
+ * The 9 GPAI compliance questions (Art. 53–55).
+ * Order matters: q1–q9 map to i18n keys gpai_q1–gpai_q9.
+ */
+export const GPAI_QUESTIONS: QuizQuestion[] = [
+  {
+    id: "gpai-technical-docs",
+    question: "Art. 53(1)(a): Technical documentation (Annex XI/XII)?",
+    description:
+      "Have you prepared and maintain up-to-date technical documentation for the GPAI model per Annex XI/XII (general-purpose) or the systemic-risk extension?",
+    options: [
+      { value: "yes", label: "Yes, implemented" },
+      { value: "no", label: "No, missing" },
+      { value: "unsure", label: "In progress / unsure" },
+    ],
+  },
+  {
+    id: "gpai-downstream-info",
+    question: "Art. 53(1)(b): Downstream provider information?",
+    description:
+      "Do you provide downstream providers / deployers with the information they need to comply with their own EU AI Act obligations (capabilities, limitations, intended use)?",
+    options: [
+      { value: "yes", label: "Yes, implemented" },
+      { value: "no", label: "No, missing" },
+      { value: "unsure", label: "In progress / unsure" },
+    ],
+  },
+  {
+    id: "gpai-copyright-policy",
+    question: "Art. 53(1)(c–d): Copyright policy + training data summary?",
+    description:
+      "Have you established a copyright compliance policy (Art. 53(1)(c)) and published a sufficiently detailed training data summary for copyright purposes (Art. 53(1)(d))?",
+    options: [
+      { value: "yes", label: "Yes, implemented" },
+      { value: "no", label: "No, missing" },
+      { value: "unsure", label: "In progress / unsure" },
+    ],
+  },
+  {
+    id: "gpai-eu-database",
+    question: "Art. 71: EU AI Database registration?",
+    description:
+      "Is the GPAI model registered in the EU AI Database as required under Art. 71 (providers of GPAI models must register before placing the model on the EU market)?",
+    options: [
+      { value: "yes", label: "Yes, registered" },
+      { value: "no", label: "No, not registered" },
+      { value: "unsure", label: "In progress / unsure" },
+    ],
+  },
+  {
+    id: "gpai-open-source",
+    question: "Art. 53(2): Open-source model release?",
+    description:
+      "Is the model released as open source with weights publicly available? Open-source GPAI models are exempt from Art. 53(1)(a–c) obligations (technical docs, downstream info, copyright policy) but not from Art. 53(1)(d) (training data summary) or Art. 55 systemic-risk obligations.",
+    options: [
+      { value: "yes", label: "Yes, open source" },
+      { value: "no", label: "No, proprietary" },
+      { value: "unsure", label: "Unsure / partially open" },
+    ],
+  },
+  {
+    id: "gpai-systemic-risk",
+    question: "Art. 51 + Annex XIII: Trained with ≥ 10²⁵ FLOP?",
+    description:
+      "Was the model trained using compute exceeding 10²⁵ floating-point operations (FLOP)? Models at or above this threshold are designated as GPAI models with systemic risk (Art. 51) and are subject to the additional Art. 55 obligations below.",
+    options: [
+      { value: "yes", label: "Yes (systemic risk)" },
+      { value: "no", label: "No (below threshold)" },
+      { value: "unsure", label: "Unknown / unsure" },
+    ],
+  },
+  {
+    id: "gpai-red-teaming",
+    question: "Art. 55(1)(a): Adversarial testing / red-teaming?",
+    description:
+      "Have you conducted model evaluations, adversarial testing, and red-teaming to identify and mitigate systemic risks (required only for Art. 51 systemic-risk models)?",
+    options: [
+      { value: "yes", label: "Yes, conducted" },
+      { value: "no", label: "No, not done" },
+      { value: "unsure", label: "In progress / unsure" },
+    ],
+  },
+  {
+    id: "gpai-incident-reporting",
+    question: "Art. 55(1)(b): Serious incident reporting mechanisms?",
+    description:
+      "Do you have mechanisms to track, document, and report serious incidents caused by the GPAI model to the AI Office and affected national authorities (required only for Art. 51 systemic-risk models)?",
+    options: [
+      { value: "yes", label: "Yes, in place" },
+      { value: "no", label: "No, missing" },
+      { value: "unsure", label: "In progress / unsure" },
+    ],
+  },
+  {
+    id: "gpai-cybersecurity",
+    question: "Art. 55(1)(c): Cybersecurity measures?",
+    description:
+      "Have you implemented adequate cybersecurity protections for the GPAI model and its infrastructure, including adversarial robustness measures (required only for Art. 51 systemic-risk models)?",
+    options: [
+      { value: "yes", label: "Yes, implemented" },
+      { value: "no", label: "No, missing" },
+      { value: "unsure", label: "In progress / unsure" },
+    ],
+  },
+];
+
+/** Returns the full ordered list of GPAI compliance questions */
+export function getGPAIQuestions(): QuizQuestion[] {
+  return GPAI_QUESTIONS;
+}
+
+/** Returns true if the model meets the systemic risk threshold (Art. 51) */
+export function isSystemicRiskModel(answers: QuizAnswer[]): boolean {
+  const systemicAnswer = answers.find((a) => a.questionId === "gpai-systemic-risk");
+  return systemicAnswer?.value === "yes";
+}
+
+/** Push a flag if the answer value is "no" or "unsure" */
+function checkObligation(
+  value: string | undefined,
+  obligation: GPAIObligationType,
+  articleRef: string,
+  flags: GPAIComplianceFlag[]
+): void {
+  if (value === "no") {
+    flags.push({ obligation, status: "missing", articleRef });
+  } else if (value === "unsure") {
+    flags.push({ obligation, status: "partial", articleRef });
+  }
+}
+
+/** Evaluate Art. 53 obligations and populate flags / notes */
+function evaluateArt53Obligations(
+  byId: Map<string, string>,
+  isOpenSource: boolean,
+  flags: GPAIComplianceFlag[],
+  legalBasis: string[],
+  notes: string[]
+): void {
+  if (!isOpenSource) {
+    checkObligation(byId.get("gpai-technical-docs"), "technical-docs", "Art. 53(1)(a)", flags);
+    checkObligation(byId.get("gpai-downstream-info"), "downstream-info", "Art. 53(1)(b)", flags);
+    checkObligation(
+      byId.get("gpai-copyright-policy"),
+      "copyright-policy",
+      "Art. 53(1)(c–d)",
+      flags
+    );
+  } else {
+    // Open-source: Art. 53(1)(a–c) exempt, but training data summary (Art. 53(1)(d)) still applies
+    const copyrightVal = byId.get("gpai-copyright-policy");
+    checkObligation(copyrightVal, "copyright-policy", "Art. 53(1)(d)", flags);
+    if (copyrightVal === "no" || copyrightVal === "unsure") {
+      notes.push(
+        "Open-source models are exempt from Art. 53(1)(c) copyright policy obligations, but Art. 53(1)(d) training data summary still applies."
+      );
+    }
+  }
+
+  const euDatabase = byId.get("gpai-eu-database");
+  checkObligation(euDatabase, "eu-database", "Art. 71", flags);
+  if (euDatabase === "no") {
+    legalBasis.push("Verordnung (EU) 2024/1689 – Art. 71 (EU AI Database)");
+  }
+}
+
+/** Evaluate Art. 55 systemic risk obligations and populate flags */
+function evaluateArt55Obligations(
+  byId: Map<string, string>,
+  flags: GPAIComplianceFlag[],
+  legalBasis: string[]
+): void {
+  legalBasis.push("Verordnung (EU) 2024/1689 – Art. 51 + Art. 55 (Systemic Risk)");
+  legalBasis.push("Verordnung (EU) 2024/1689 – Annex XIII (Systemic Risk Indicators)");
+  checkObligation(byId.get("gpai-red-teaming"), "red-teaming", "Art. 55(1)(a)", flags);
+  checkObligation(
+    byId.get("gpai-incident-reporting"),
+    "incident-reporting",
+    "Art. 55(1)(b)",
+    flags
+  );
+  checkObligation(byId.get("gpai-cybersecurity"), "cybersecurity", "Art. 55(1)(c)", flags);
+}
+
+/** Determine overall compliance level from accumulated flags */
+function determineLevel(flags: GPAIComplianceFlag[], isOpenSource: boolean): GPAIComplianceLevel {
+  const criticalObligations: GPAIObligationType[] = isOpenSource
+    ? ["eu-database"]
+    : ["technical-docs", "downstream-info", "copyright-policy", "eu-database"];
+
+  const allCriticalMissing =
+    !isOpenSource &&
+    criticalObligations.every((obl) =>
+      flags.some((f) => f.obligation === obl && f.status === "missing")
+    );
+
+  if (allCriticalMissing) return "non-compliant";
+  if (flags.length > 0) return "partial";
+  return "compliant";
+}
+
+/**
+ * Classify GPAI compliance based on answers to the 9 questions.
+ * Returns a GPAIComplianceResult with level, flags, and legal basis.
+ *
+ * Classification logic:
+ * - Open-source (Art. 53(2)): exempt from docs/downstream/copyright obligations
+ * - Systemic risk (Art. 51): Art. 55 obligations apply
+ * - Critical Art. 53 all missing → "non-compliant"
+ * - Any "unsure" or partial → "partial"
+ * - All applicable "yes" → "compliant"
+ */
+export function classifyGPAICompliance(answers: QuizAnswer[]): GPAIComplianceResult {
+  const byId = new Map(answers.map((a) => [a.questionId, a.value] as const));
+  const isOpenSource = byId.get("gpai-open-source") === "yes";
+  const hasSystemicRisk = byId.get("gpai-systemic-risk") === "yes";
+
+  const flags: GPAIComplianceFlag[] = [];
+  const legalBasis: string[] = ["Verordnung (EU) 2024/1689 – Art. 53 (GPAI obligations)"];
+  const notes: string[] = [];
+
+  evaluateArt53Obligations(byId, isOpenSource, flags, legalBasis, notes);
+
+  if (hasSystemicRisk) {
+    evaluateArt55Obligations(byId, flags, legalBasis);
+  } else {
+    notes.push(
+      "Art. 55 systemic risk obligations (red-teaming, incident reporting, cybersecurity) are not applicable as the model does not meet the Art. 51 threshold (≥ 10²⁵ FLOP)."
+    );
+  }
+
+  return {
+    level: determineLevel(flags, isOpenSource),
+    isSystemicRisk: hasSystemicRisk,
+    flags,
+    legalBasis,
+    notes,
+  };
+}

package/src/legal-checks/index.ts

@@ -53,3 +53,36 @@ export { getHumanOversightAndLoggingTemplate } from "./human-oversight-logging";
 
 export type { AnnexIVStructuredReportV1 } from "./annex-iv-report";
 export { buildAnnexIVReportV1 } from "./annex-iv-report";
+
+export type {
+  DeadlineStatus,
+  AffectedAudience,
+  DeadlineObligation,
+  DeadlinePhase,
+} from "./deadline-timeline";
+export {
+  EU_AI_ACT_TIMELINE,
+  DIGITAL_OMNIBUS_PROPOSALS,
+  getDeadlineStatus,
+  getDaysUntilDeadline,
+  getAudiencesForRiskLevel,
+  getNextDeadline,
+  getTimelineForRiskLevel,
+  getTimelineForAudiences,
+} from "./deadline-timeline";
+
+export type {
+  GPAIObligationType,
+  GPAIComplianceLevel,
+  GPAIComplianceFlag,
+  GPAIComplianceResult,
+} from "./gpai-classifier";
+export {
+  GPAI_QUESTIONS,
+  classifyGPAICompliance,
+  getGPAIQuestions,
+  isSystemicRiskModel,
+} from "./gpai-classifier";
+
+export type { GapPriority, GapAction, GapAnalysisResult } from "./gap-analysis";
+export { generateAnnexIIIGapAnalysis, generateGPAIGapAnalysis } from "./gap-analysis";

package/tests/gpai-classifier.test.ts

@@ -0,0 +1,125 @@
+import { describe, expect, it } from "vitest";
+import { classifyGPAICompliance, isSystemicRiskModel } from "../src/legal-checks/gpai-classifier";
+import type { QuizAnswer } from "../src/types";
+
+/** Helper: build a full set of GPAI answers with defaults, then override specific ones */
+function buildAnswers(overrides: Record<string, string> = {}): QuizAnswer[] {
+  const defaults: Record<string, string> = {
+    "gpai-technical-docs": "yes",
+    "gpai-downstream-info": "yes",
+    "gpai-copyright-policy": "yes",
+    "gpai-eu-database": "yes",
+    "gpai-open-source": "no",
+    "gpai-systemic-risk": "no",
+    "gpai-red-teaming": "yes",
+    "gpai-incident-reporting": "yes",
+    "gpai-cybersecurity": "yes",
+  };
+  const merged = { ...defaults, ...overrides };
+  return Object.entries(merged).map(([questionId, value]) => ({
+    questionId,
+    value,
+  }));
+}
+
+describe("classifyGPAICompliance", () => {
+  describe("open-source path (Art. 53(2))", () => {
+    it("flags copyright-policy as missing when open-source answers 'no'", () => {
+      const answers = buildAnswers({
+        "gpai-open-source": "yes",
+        "gpai-copyright-policy": "no",
+      });
+      const result = classifyGPAICompliance(answers);
+      const flag = result.flags.find((f) => f.obligation === "copyright-policy");
+      expect(flag).toBeDefined();
+      expect(flag!.status).toBe("missing");
+      expect(flag!.articleRef).toBe("Art. 53(1)(d)");
+    });
+
+    it("flags copyright-policy as partial when open-source answers 'unsure'", () => {
+      const answers = buildAnswers({
+        "gpai-open-source": "yes",
+        "gpai-copyright-policy": "unsure",
+      });
+      const result = classifyGPAICompliance(answers);
+      const flag = result.flags.find((f) => f.obligation === "copyright-policy");
+      expect(flag).toBeDefined();
+      expect(flag!.status).toBe("partial");
+      expect(flag!.articleRef).toBe("Art. 53(1)(d)");
+    });
+
+    it("does NOT flag copyright-policy when open-source answers 'yes'", () => {
+      const answers = buildAnswers({
+        "gpai-open-source": "yes",
+        "gpai-copyright-policy": "yes",
+      });
+      const result = classifyGPAICompliance(answers);
+      const flag = result.flags.find((f) => f.obligation === "copyright-policy");
+      expect(flag).toBeUndefined();
+    });
+
+    it("exempts technical-docs and downstream-info for open-source", () => {
+      const answers = buildAnswers({
+        "gpai-open-source": "yes",
+        "gpai-technical-docs": "no",
+        "gpai-downstream-info": "no",
+      });
+      const result = classifyGPAICompliance(answers);
+      expect(result.flags.find((f) => f.obligation === "technical-docs")).toBeUndefined();
+      expect(result.flags.find((f) => f.obligation === "downstream-info")).toBeUndefined();
+    });
+
+    it("includes explanatory note for open-source copyright gap", () => {
+      const answers = buildAnswers({
+        "gpai-open-source": "yes",
+        "gpai-copyright-policy": "unsure",
+      });
+      const result = classifyGPAICompliance(answers);
+      expect(result.notes.some((n) => n.includes("Art. 53(1)(d)"))).toBe(true);
+    });
+  });
+
+  describe("non-open-source path", () => {
+    it("flags all three Art. 53(1) obligations when missing", () => {
+      const answers = buildAnswers({
+        "gpai-technical-docs": "no",
+        "gpai-downstream-info": "no",
+        "gpai-copyright-policy": "no",
+        "gpai-eu-database": "no",
+      });
+      const result = classifyGPAICompliance(answers);
+      expect(result.level).toBe("non-compliant");
+      expect(result.flags.length).toBeGreaterThanOrEqual(4);
+    });
+  });
+
+  describe("systemic risk (Art. 51)", () => {
+    it("detects systemic risk model", () => {
+      const answers = buildAnswers({ "gpai-systemic-risk": "yes" });
+      expect(isSystemicRiskModel(answers)).toBe(true);
+    });
+
+    it("flags Art. 55 obligations when systemic risk and missing", () => {
+      const answers = buildAnswers({
+        "gpai-systemic-risk": "yes",
+        "gpai-red-teaming": "no",
+        "gpai-incident-reporting": "no",
+        "gpai-cybersecurity": "no",
+      });
+      const result = classifyGPAICompliance(answers);
+      expect(result.isSystemicRisk).toBe(true);
+      expect(result.flags.find((f) => f.obligation === "red-teaming")).toBeDefined();
+      expect(result.flags.find((f) => f.obligation === "incident-reporting")).toBeDefined();
+      expect(result.flags.find((f) => f.obligation === "cybersecurity")).toBeDefined();
+    });
+  });
+
+  describe("fully compliant", () => {
+    it("returns compliant with no flags when all obligations met", () => {
+      const answers = buildAnswers();
+      const result = classifyGPAICompliance(answers);
+      expect(result.level).toBe("compliant");
+      expect(result.flags).toHaveLength(0);
+    });
+  });
+});

package/tests/gpai-timeline.test.ts

@@ -0,0 +1,55 @@
+import { describe, expect, it } from "vitest";
+import { getTimelineForRiskLevel } from "../src/legal-checks/deadline-timeline";
+
+// This function will be implemented in Step 3
+import { getTimelineForAudiences } from "../src/legal-checks/deadline-timeline";
+
+describe("getTimelineForAudiences", () => {
+  it("returns GPAI-relevant phases for ['all', 'gpai'] audiences", () => {
+    const phases = getTimelineForAudiences(["all", "gpai"]);
+    const phaseIds = phases.map((p) => p.id);
+    expect(phaseIds).toContain("phase-2-gpai");
+  });
+
+  it("includes Art. 53 documentation obligation for GPAI audience", () => {
+    const phases = getTimelineForAudiences(["all", "gpai"]);
+    const phase2 = phases.find((p) => p.id === "phase-2-gpai");
+    expect(phase2).toBeDefined();
+    const gpaiObligation = phase2!.obligations.find((o) => o.articleRef === "Art. 53");
+    expect(gpaiObligation).toBeDefined();
+  });
+
+  it("includes Art. 55 systemic risk obligation for GPAI audience", () => {
+    const phases = getTimelineForAudiences(["all", "gpai"]);
+    const phase2 = phases.find((p) => p.id === "phase-2-gpai");
+    expect(phase2).toBeDefined();
+    const systemicObligation = phase2!.obligations.find((o) => o.articleRef === "Art. 55");
+    expect(systemicObligation).toBeDefined();
+  });
+
+  it("does NOT include high-risk Annex III obligations for GPAI audience", () => {
+    const phases = getTimelineForAudiences(["all", "gpai"]);
+    const phase3 = phases.find((p) => p.id === "phase-3-high-risk-annex-iii");
+    if (phase3) {
+      const hasAllAudience = phase3.obligations.some((o) =>
+        o.audiences.some((a) => ["all", "gpai"].includes(a))
+      );
+      expect(hasAllAudience).toBe(true);
+    }
+  });
+
+  it("minimal risk level does NOT include GPAI obligations (regression)", () => {
+    const phases = getTimelineForRiskLevel("minimal");
+    const phase2 = phases.find((p) => p.id === "phase-2-gpai");
+    if (phase2) {
+      const gpaiOnly = phase2.obligations.filter(
+        (o) => o.audiences.includes("gpai") && !o.audiences.includes("all")
+      );
+      const minimalAudiences = ["all", "minimal"];
+      for (const obl of gpaiOnly) {
+        const matches = obl.audiences.some((a) => minimalAudiences.includes(a));
+        expect(matches).toBe(false);
+      }
+    }
+  });
+});

package/.turbo/turbo-check-types.log

@@ -1,4 +0,0 @@
-
-> @repo/core@0.0.0 check-types /Users/benedikthiepler/projects/priv/aimpact/packages/core
-> tsc --noEmit
-