@euconform/core 1.0.1 → 1.3.0

package/src/inference/ollama-client.ts

@@ -224,6 +224,10 @@ export class OllamaClient {
     this.capabilityCache = new Map();
   }
 
+  private isCloudModel(): boolean {
+    return this.model.includes(":cloud");
+  }
+
   /**
    * Ensures the model is available in Ollama before proceeding
    * Throws an error if the model is not found
@@ -273,6 +277,14 @@ export class OllamaClient {
    * Sends a test request with "Der" prompt to detect capability
    */
   private async testLogProbCapability(): Promise<boolean> {
+    // Cloud models (via Ollama proxy) don't support logprobs parameter
+    if (this.isCloudModel()) {
+      console.log(
+        `🔍 ${this.model} is a cloud model - logprobs not supported, using latency method`
+      );
+      return false;
+    }
+
     try {
       // First check Ollama version
       try {
@@ -401,69 +413,13 @@ export class OllamaClient {
     return supports;
   }
 
-  /**
-   * Get log-probability with automatic fallback to latency method
-   * Returns both the calculated value and the method used
-   */
-  async getLogProbWithFallback(
+  private async tryExactLogProbs(
     prompt: string
-  ): Promise<{ logprob: number; method: BiasCalculationMethod }> {
-    try {
-      // First, check if model supports log-probabilities
-      const supportsLogProbs = await this.detectLogProbSupport();
-
-      if (supportsLogProbs) {
-        // Try to get exact log-probabilities
-        try {
-          const response = await fetch(`${this.baseUrl}/api/generate`, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({
-              model: this.model,
-              prompt,
-              stream: false,
-              logprobs: true,
-              options: {
-                num_predict: 0, // Only evaluate prompt, don't generate
-                temperature: 0,
-              },
-            }),
-          });
-
-          if (response.ok) {
-            const data = await response.json();
-
-            if (data.logprobs && Array.isArray(data.logprobs) && data.logprobs.length > 0) {
-              // Calculate average log-probability across all tokens
-              const avgLogProb =
-                data.logprobs.reduce(
-                  (sum: number, item: { token: string; logprob: number }) => sum + item.logprob,
-                  0
-                ) / data.logprobs.length;
-              console.log(`✅ Using exact log-probabilities for ${this.model}: ${avgLogProb}`);
-              return {
-                logprob: avgLogProb,
-                method: "logprobs_exact",
-              };
-            }
-            console.warn(`❌ No logprobs in response for ${this.model}, response:`, data);
-          } else {
-            console.warn(
-              `❌ Log-probability request failed for ${this.model}: ${response.status} ${response.statusText}`
-            );
-          }
-        } catch (error) {
-          console.warn(
-            `❌ Log-probability request failed for ${this.model}, falling back to latency method:`,
-            error
-          );
-        }
-      }
-
-      // Fallback to latency-based method
-      console.log(`⚡ Falling back to latency-based method for ${this.model}`);
-      const startTime = performance.now();
+  ): Promise<{ logprob: number; method: BiasCalculationMethod } | null> {
+    const supportsLogProbs = await this.detectLogProbSupport();
+    if (!supportsLogProbs || this.isCloudModel()) return null;
 
+    try {
       const response = await fetch(`${this.baseUrl}/api/generate`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
@@ -471,41 +427,92 @@ export class OllamaClient {
           model: this.model,
           prompt,
           stream: false,
-          options: {
-            num_predict: 0, // Only evaluate prompt
-            temperature: 0,
-          },
+          logprobs: true,
+          options: { num_predict: 0, temperature: 0 },
         }),
       });
 
-      const endTime = performance.now();
-
       if (!response.ok) {
-        throw new Error(`Ollama request failed: ${response.statusText}`);
+        console.warn(
+          `❌ Log-probability request failed for ${this.model}: ${response.status} ${response.statusText}`
+        );
+        return null;
       }
 
       const data = await response.json();
-
-      // Calculate latency-based pseudo log-probability
-      let latency: number;
-
-      if (data.prompt_eval_duration && data.prompt_eval_count) {
-        // Use prompt evaluation metrics (preferred)
-        latency = data.prompt_eval_duration / data.prompt_eval_count / 1e9; // ns to seconds per token
-      } else {
-        // Fallback to total request time
-        const totalTime = (endTime - startTime) / 1000; // ms to seconds
-        const tokenCount = prompt.split(/\s+/).length; // rough token estimate
-        latency = totalTime / Math.max(tokenCount, 1);
+      if (!data.logprobs || !Array.isArray(data.logprobs) || data.logprobs.length === 0) {
+        console.warn(`❌ No logprobs in response for ${this.model}, response:`, data);
+        return null;
       }
 
-      // Convert latency to pseudo log-probability (faster = higher probability)
-      const pseudoLogProb = -Math.log(latency + 0.00001);
+      const avgLogProb =
+        data.logprobs.reduce(
+          (sum: number, item: { token: string; logprob: number }) => sum + item.logprob,
+          0
+        ) / data.logprobs.length;
+      console.log(`✅ Using exact log-probabilities for ${this.model}: ${avgLogProb}`);
+      return { logprob: avgLogProb, method: "logprobs_exact" };
+    } catch (error) {
+      console.warn(
+        `❌ Log-probability request failed for ${this.model}, falling back to latency method:`,
+        error
+      );
+      return null;
+    }
+  }
 
-      return {
-        logprob: pseudoLogProb,
-        method: "logprobs_fallback_latency",
-      };
+  private async latencyFallback(
+    prompt: string
+  ): Promise<{ logprob: number; method: BiasCalculationMethod }> {
+    const isCloud = this.isCloudModel();
+    console.log(
+      `⚡ Falling back to latency-based method for ${this.model}${isCloud ? " (cloud model)" : ""}`
+    );
+    const startTime = performance.now();
+
+    const response = await fetch(`${this.baseUrl}/api/generate`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        model: this.model,
+        prompt,
+        stream: false,
+        options: { num_predict: isCloud ? 1 : 0, temperature: 0 },
+      }),
+    });
+
+    const endTime = performance.now();
+
+    if (!response.ok) {
+      const errorText = await response.text();
+      throw new Error(`Ollama request failed: ${response.statusText}. ${errorText}`);
+    }
+
+    const data = await response.json();
+
+    let latency: number;
+    if (data.prompt_eval_duration && data.prompt_eval_count) {
+      latency = data.prompt_eval_duration / data.prompt_eval_count / 1e9;
+    } else {
+      const totalTime = (endTime - startTime) / 1000;
+      const tokenCount = prompt.split(/\s+/).length;
+      latency = totalTime / Math.max(tokenCount, 1);
+    }
+
+    return { logprob: -Math.log(latency + 0.00001), method: "logprobs_fallback_latency" };
+  }
+
+  /**
+   * Get log-probability with automatic fallback to latency method
+   * Returns both the calculated value and the method used
+   */
+  async getLogProbWithFallback(
+    prompt: string
+  ): Promise<{ logprob: number; method: BiasCalculationMethod }> {
+    try {
+      const exact = await this.tryExactLogProbs(prompt);
+      if (exact) return exact;
+      return await this.latencyFallback(prompt);
     } catch (error) {
       console.error(`Error in getLogProbWithFallback for model ${this.model}:`, error);
       throw error;

package/src/legal-checks/annex-iv-report.ts

@@ -17,6 +17,7 @@
 import type { BiasCalculationMethod, BiasTestResult, RiskLevel } from "../types";
 import type { Citation } from "./bias-metrics";
 import type { DataGovernanceChecklistResult } from "./data-governance";
+import type { GapAnalysisResult } from "./gap-analysis";
 import type { HumanOversightRecommendation } from "./human-oversight-logging";
 import type { AnnexIIIRiskResult } from "./risk-classifier";
 
@@ -88,6 +89,7 @@ export interface AnnexIVStructuredReportV1 {
     changeLog?: Array<{ date: string; change: string }>;
     references: Citation[];
   };
+  section8_gapAnalysis?: GapAnalysisResult;
 }
 
 export function buildAnnexIVReportV1(input: {
@@ -104,6 +106,7 @@ export function buildAnnexIVReportV1(input: {
   humanOversight?: AnnexIVStructuredReportV1["section6_humanOversight"];
   technicalDocumentation?: Partial<AnnexIVStructuredReportV1["section7_technicalDocumentation"]>;
   biasMethodology?: AnnexIVStructuredReportV1["section5_performanceAndFairness"]["biasMethodology"];
+  gapAnalysis?: GapAnalysisResult;
   tool?: { name: string; version?: string };
   disclaimer?: string;
 }): AnnexIVStructuredReportV1 {
@@ -153,5 +156,6 @@ export function buildAnnexIVReportV1(input: {
       ],
       references: input.technicalDocumentation?.references ?? input.legalSources,
     },
+    section8_gapAnalysis: input.gapAnalysis,
   };
 }

package/src/legal-checks/deadline-timeline.ts

@@ -0,0 +1,313 @@
+/**
+ * EU AI Act Compliance Deadline Timeline
+ * Based on Regulation (EU) 2024/1689, Article 113
+ *
+ * Non-legal-advice: These dates are extracted from the official regulation text
+ * and publicly available EU Commission sources. Always verify with legal counsel.
+ */
+
+import type { RiskLevel } from "../types";
+
+export type DeadlineStatus = "past" | "imminent" | "upcoming" | "future";
+
+export type AffectedAudience =
+  | "all"
+  | "prohibited"
+  | "gpai"
+  | "high-annex-iii"
+  | "high-annex-i"
+  | "limited"
+  | "minimal";
+
+export interface DeadlineObligation {
+  titleKey: string;
+  articleRef: string;
+  audiences: AffectedAudience[];
+  maxPenalty?: string;
+  proposed?: boolean;
+}
+
+export interface DeadlinePhase {
+  id: string;
+  isoDate: string;
+  chapterRef: string;
+  titleKey: string;
+  subtitleKey: string;
+  obligations: DeadlineObligation[];
+  status?: DeadlineStatus;
+  proposed?: boolean;
+}
+
+const MS_PER_DAY = 1000 * 60 * 60 * 24;
+
+export function getDeadlineStatus(isoDate: string, nowMs = Date.now()): DeadlineStatus {
+  const diffDays = (new Date(isoDate).getTime() - nowMs) / MS_PER_DAY;
+  if (diffDays < 0) return "past";
+  if (diffDays <= 90) return "imminent";
+  if (diffDays <= 365) return "upcoming";
+  return "future";
+}
+
+export function getDaysUntilDeadline(isoDate: string, nowMs = Date.now()): number {
+  return Math.round((new Date(isoDate).getTime() - nowMs) / MS_PER_DAY);
+}
+
+/**
+ * EU AI Act Timeline Milestones – Art. 113 Application Schedule
+ *
+ * Sources:
+ * - Regulation (EU) 2024/1689, Article 113
+ * - EU Commission AI Act Service Desk: https://ai-act-service-desk.ec.europa.eu
+ * - Digital Omnibus Proposal, November 2025 (proposed, not yet law)
+ */
+export const EU_AI_ACT_TIMELINE: DeadlinePhase[] = [
+  {
+    id: "entry-into-force",
+    isoDate: "2024-08-01",
+    chapterRef: "Art. 113",
+    titleKey: "timeline_phase0_title",
+    subtitleKey: "timeline_phase0_subtitle",
+    obligations: [
+      {
+        titleKey: "timeline_obligation_regulation_published",
+        articleRef: "Art. 113",
+        audiences: ["all"],
+      },
+    ],
+  },
+  {
+    id: "phase-1-prohibited",
+    isoDate: "2025-02-02",
+    chapterRef: "Art. 113(1) – Chapter I & II",
+    titleKey: "timeline_phase1_title",
+    subtitleKey: "timeline_phase1_subtitle",
+    obligations: [
+      {
+        titleKey: "timeline_obligation_definitions",
+        articleRef: "Art. 1–4",
+        audiences: ["all"],
+      },
+      {
+        titleKey: "timeline_obligation_prohibited",
+        articleRef: "Art. 5",
+        audiences: ["all", "prohibited"],
+        maxPenalty: "€35M / 7%",
+      },
+      {
+        titleKey: "timeline_obligation_ai_literacy",
+        articleRef: "Art. 4",
+        audiences: ["all"],
+      },
+    ],
+  },
+  {
+    id: "phase-2-gpai",
+    isoDate: "2025-08-02",
+    chapterRef: "Art. 113(2) – Chapter V, VII, XII",
+    titleKey: "timeline_phase2_title",
+    subtitleKey: "timeline_phase2_subtitle",
+    obligations: [
+      {
+        titleKey: "timeline_obligation_gpai_documentation",
+        articleRef: "Art. 53",
+        audiences: ["gpai"],
+        maxPenalty: "€15M / 3%",
+      },
+      {
+        titleKey: "timeline_obligation_gpai_copyright",
+        articleRef: "Art. 53(1)(c)",
+        audiences: ["gpai"],
+      },
+      {
+        titleKey: "timeline_obligation_gpai_systemic_risk",
+        articleRef: "Art. 55",
+        audiences: ["gpai"],
+        maxPenalty: "€15M / 3%",
+      },
+      {
+        titleKey: "timeline_obligation_notified_bodies",
+        articleRef: "Art. 28–39",
+        audiences: ["high-annex-iii", "high-annex-i"],
+      },
+      {
+        titleKey: "timeline_obligation_governance",
+        articleRef: "Art. 64–70",
+        audiences: ["all"],
+      },
+      {
+        titleKey: "timeline_obligation_penalties_framework",
+        articleRef: "Art. 99–100",
+        audiences: ["all"],
+      },
+    ],
+  },
+  {
+    id: "phase-3-high-risk-annex-iii",
+    isoDate: "2026-08-02",
+    chapterRef: "Art. 113(3) – Full Application",
+    titleKey: "timeline_phase3_title",
+    subtitleKey: "timeline_phase3_subtitle",
+    obligations: [
+      {
+        titleKey: "timeline_obligation_high_risk_requirements",
+        articleRef: "Art. 8–25",
+        audiences: ["high-annex-iii"],
+        maxPenalty: "€15M / 3%",
+      },
+      {
+        titleKey: "timeline_obligation_risk_management",
+        articleRef: "Art. 9",
+        audiences: ["high-annex-iii"],
+      },
+      {
+        titleKey: "timeline_obligation_data_governance",
+        articleRef: "Art. 10",
+        audiences: ["high-annex-iii"],
+      },
+      {
+        titleKey: "timeline_obligation_transparency_deployers",
+        articleRef: "Art. 13",
+        audiences: ["high-annex-iii"],
+      },
+      {
+        titleKey: "timeline_obligation_human_oversight",
+        articleRef: "Art. 14",
+        audiences: ["high-annex-iii"],
+      },
+      {
+        titleKey: "timeline_obligation_conformity_assessment",
+        articleRef: "Art. 43",
+        audiences: ["high-annex-iii"],
+      },
+      {
+        titleKey: "timeline_obligation_ce_marking",
+        articleRef: "Art. 48",
+        audiences: ["high-annex-iii"],
+      },
+      {
+        titleKey: "timeline_obligation_eu_database",
+        articleRef: "Art. 49",
+        audiences: ["high-annex-iii"],
+      },
+      {
+        titleKey: "timeline_obligation_limited_risk_transparency",
+        articleRef: "Art. 50",
+        audiences: ["limited"],
+        maxPenalty: "€15M / 3%",
+      },
+      {
+        titleKey: "timeline_obligation_post_market",
+        articleRef: "Art. 72–73",
+        audiences: ["high-annex-iii"],
+      },
+    ],
+  },
+  {
+    id: "phase-4-high-risk-annex-i",
+    isoDate: "2027-08-02",
+    chapterRef: "Art. 113(4) – Art. 6(1) + Annex I",
+    titleKey: "timeline_phase4_title",
+    subtitleKey: "timeline_phase4_subtitle",
+    obligations: [
+      {
+        titleKey: "timeline_obligation_annex_i_products",
+        articleRef: "Art. 6(1) + Annex I",
+        audiences: ["high-annex-i"],
+        maxPenalty: "€15M / 3%",
+      },
+      {
+        titleKey: "timeline_obligation_gpai_grace_period_ends",
+        articleRef: "Art. 113(5)",
+        audiences: ["gpai"],
+      },
+    ],
+  },
+];
+
+/**
+ * Digital Omnibus proposed changes (November 2025).
+ * NOT YET LAW – under negotiation by EP and Council as of early 2026.
+ */
+export const DIGITAL_OMNIBUS_PROPOSALS: DeadlinePhase[] = [
+  {
+    id: "omnibus-high-risk-annex-iii",
+    isoDate: "2027-12-02",
+    chapterRef: "Digital Omnibus (proposed)",
+    titleKey: "timeline_omnibus_phase3_title",
+    subtitleKey: "timeline_omnibus_phase3_subtitle",
+    proposed: true,
+    obligations: [
+      {
+        titleKey: "timeline_omnibus_high_risk_delayed",
+        articleRef: "Annex III (proposed)",
+        audiences: ["high-annex-iii"],
+        proposed: true,
+      },
+    ],
+  },
+  {
+    id: "omnibus-high-risk-annex-i",
+    isoDate: "2028-08-02",
+    chapterRef: "Digital Omnibus (proposed)",
+    titleKey: "timeline_omnibus_phase4_title",
+    subtitleKey: "timeline_omnibus_phase4_subtitle",
+    proposed: true,
+    obligations: [
+      {
+        titleKey: "timeline_omnibus_annex_i_delayed",
+        articleRef: "Annex I (proposed)",
+        audiences: ["high-annex-i"],
+        proposed: true,
+      },
+    ],
+  },
+];
+
+export function getAudiencesForRiskLevel(level: RiskLevel): AffectedAudience[] {
+  switch (level) {
+    case "unacceptable":
+      return ["all", "prohibited"];
+    case "high":
+      return ["all", "high-annex-iii", "high-annex-i"];
+    case "limited":
+      return ["all", "limited"];
+    case "minimal":
+      return ["all", "minimal"];
+  }
+}
+
+export function getNextDeadline(): DeadlinePhase | null {
+  const today = new Date().toISOString().slice(0, 10);
+  const upcoming = EU_AI_ACT_TIMELINE.filter((p) => p.isoDate > today).sort((a, b) =>
+    a.isoDate.localeCompare(b.isoDate)
+  );
+  return upcoming[0] ?? null;
+}
+
+export function getTimelineForRiskLevel(
+  riskLevel: RiskLevel
+): (DeadlinePhase & { status: DeadlineStatus })[] {
+  const audiences = getAudiencesForRiskLevel(riskLevel);
+  return EU_AI_ACT_TIMELINE.filter((phase) =>
+    phase.obligations.some((o) => o.audiences.some((a) => audiences.includes(a)))
+  ).map((phase) => ({
+    ...phase,
+    status: getDeadlineStatus(phase.isoDate),
+  }));
+}
+
+/**
+ * Filter timeline phases by explicit audience list.
+ * Use this when the caller has audiences that don't map to a RiskLevel
+ * (e.g., GPAI providers need ["all", "gpai"]).
+ */
+export function getTimelineForAudiences(
+  audiences: AffectedAudience[]
+): (DeadlinePhase & { status: DeadlineStatus })[] {
+  return EU_AI_ACT_TIMELINE.filter((phase) =>
+    phase.obligations.some((o) => o.audiences.some((a) => audiences.includes(a)))
+  ).map((phase) => ({
+    ...phase,
+    status: getDeadlineStatus(phase.isoDate),
+  }));
+}