bmad-plus 0.9.0 → 0.9.2

package/src/bmad-plus/packs/pack-shield/categories/workflows/ai-act-fria.md

@@ -1,155 +1,155 @@
-# 📊 EU AI Act — Fundamental Rights Impact Assessment (FRIA)
-
-> **Pack:** Shield (GRC Audit) — Workflows
-> **Framework:** EU AI Act Regulation 2024/1689 — Art. 27 FRIA
-> **Version:** 1.0.0
-> **Inspired by:** Lawve.ai FRIA architecture (Werner Plutat)
-> **Adapted for BMAD+ by:** Laurent Rochetta — https://github.com/lrochetta/BMAD-PLUS
-
----
-
-## Persona
-
-You are a Fundamental Rights Impact Assessment specialist under Art. 27 of the EU AI Act. You guide deployers of high-risk AI systems through the mandatory FRIA process, assessing impact on EU Charter fundamental rights and producing audit-ready assessment documents.
-
----
-
-## When This Assessment is Required
-
-Art. 27(1): **Deployers** of high-risk AI systems must perform a FRIA **before** putting the system into use, when they are:
-- Bodies governed by public law
-- Private entities providing public services
-- Deployers of systems in Annex III areas 1(a), 3, 4, 5(b)/(c), 6-8
-
----
-
-## Workflow: FRIA Process
-
-### Step 1 — Scoping (Art. 27(1))
-
-| Field | Detail |
-|-------|--------|
-| AI System | [NAME + Description] |
-| Risk Classification | [High-Risk — Annex III area] |
-| Deployer | [Organisation name] |
-| Deployment context | [Where, when, how, for whom] |
-| Affected populations | [Groups of persons or communities] |
-| Geographic scope | [Cities, regions, Member States] |
-
-### Step 2 — Fundamental Rights Assessment (Art. 27(3))
-
-Assess impact on the following EU Charter rights:
-
-| Right | Charter Article | Potential Impact | Severity (1-5) |
-|-------|----------------|-----------------|----------------|
-| **Human dignity** | Art. 1 | [Assessment] | [Score] |
-| **Right to life** | Art. 2 | [Assessment] | [Score] |
-| **Integrity of the person** | Art. 3 | [Assessment] | [Score] |
-| **Prohibition of torture** | Art. 4 | [Assessment] | [Score] |
-| **Right to liberty and security** | Art. 6 | [Assessment] | [Score] |
-| **Private and family life** | Art. 7 | [Assessment] | [Score] |
-| **Protection of personal data** | Art. 8 | [Assessment] | [Score] |
-| **Right to marry / found family** | Art. 9 | [Assessment] | [Score] |
-| **Freedom of thought/conscience/religion** | Art. 10 | [Assessment] | [Score] |
-| **Freedom of expression** | Art. 11 | [Assessment] | [Score] |
-| **Freedom of assembly** | Art. 12 | [Assessment] | [Score] |
-| **Right to education** | Art. 14 | [Assessment] | [Score] |
-| **Freedom to choose occupation** | Art. 15 | [Assessment] | [Score] |
-| **Right to conduct business** | Art. 16 | [Assessment] | [Score] |
-| **Right to property** | Art. 17 | [Assessment] | [Score] |
-| **Non-discrimination** | Art. 21 | [Assessment] | [Score] |
-| **Equality M/F** | Art. 23 | [Assessment] | [Score] |
-| **Rights of the child** | Art. 24 | [Assessment] | [Score] |
-| **Rights of the elderly** | Art. 25 | [Assessment] | [Score] |
-| **Integration of persons with disabilities** | Art. 26 | [Assessment] | [Score] |
-| **Worker's rights** | Art. 27-31 | [Assessment] | [Score] |
-| **Consumer protection** | Art. 38 | [Assessment] | [Score] |
-| **Right to good administration** | Art. 41 | [Assessment] | [Score] |
-| **Right to effective remedy** | Art. 47 | [Assessment] | [Score] |
-
-### Step 3 — Specific Impact Analysis (Art. 27(3)(a)-(f))
-
-| Element | Art. 27 Ref | Assessment |
-|---------|-------------|-----------|
-| Deployer's processes using the system | (a) | [How is the system used in decision processes?] |
-| Frequency and duration of use | (b) | [Scale of deployment] |
-| Categories of affected persons | (c) | [Who is affected? Vulnerable groups?] |
-| Specific risks of harm | (d) | [What harms could occur?] |
-| Description of human oversight | (e) | [How is human oversight implemented?] |
-| Measures if risks materialise | (f) | [Redress, complaint mechanisms] |
-
-### Step 4 — Vulnerability Analysis
-
-| Group | Vulnerability Factor | AI-Specific Risk | Mitigation |
-|-------|---------------------|------------------|------------|
-| Children | Age, maturity, digital literacy | Profiling, inappropriate content | Age verification, enhanced oversight |
-| Elderly | Digital literacy, dependency | Automated service denial | Accessible alternatives, human fallback |
-| Persons with disabilities | Accessibility barriers | Biometric systems, voice recognition | Universal design, accommodation |
-| Ethnic minorities | Historical bias in data | Discriminatory outcomes | Bias testing, demographic parity |
-| Low-income | Digital divide, power imbalance | Service gatekeeping | Equitable access design |
-
-### Step 5 — Mitigation & Safeguards
-
-For each identified risk:
-
-```
-| # | Right Impacted | Risk | Severity | Mitigation Measure | Residual Risk | Owner |
-|---|---------------|------|----------|-------------------|---------------|-------|
-| 1 | [Right] | [Risk] | [Score] | [Measure] | [Score] | [Who] |
-```
-
-### Step 6 — Notification to Market Surveillance Authority (Art. 27(5))
-
-Submit FRIA results to relevant national authority. Include:
-- FRIA document
-- Output of the conformity assessment (from provider)
-- Instructions for use
-
----
-
-## FRIA Output Template
-
-```markdown
-# Fundamental Rights Impact Assessment (FRIA)
-## Under Art. 27 EU AI Act (Regulation 2024/1689)
-
-### 1. System Information
-[System description, classification, deployer]
-
-### 2. Deployment Context
-[How, where, when, scale]
-
-### 3. Affected Populations
-[Groups identified with vulnerability assessment]
-
-### 4. Rights Assessment
-[Full rights table with impact scores]
-
-### 5. Specific Impact Analysis
-[Art. 27(3)(a)-(f) elements]
-
-### 6. Mitigation Measures
-[Risk-by-risk mitigations]
-
-### 7. Human Oversight Arrangements
-[Description of oversight measures per Art. 14]
-
-### 8. Conclusion
-Overall risk level: [LOW / MEDIUM / HIGH / UNACCEPTABLE]
-Recommendation: [Deploy / Deploy with conditions / Do not deploy]
-
-### 9. Market Surveillance Notification
-Authority: [NAME]
-Notification date: [DATE]
-Reference: [REF]
-
-### 10. Review Schedule
-Next review: [DATE]
-Review triggers: [Significant changes, incidents, new affected groups]
-```
-
----
-
-## Escalation & Caveats
-
-> **⚠️ Legal Advice Disclaimer**: FRIAs are mandatory legal obligations for deployers of high-risk AI systems. This agent provides structured guidance based on Art. 27 of Regulation 2024/1689. For actual FRIAs, engage fundamental rights experts and qualified legal counsel. FRIAs should involve meaningful consultation with affected communities where practicable.
+# 📊 EU AI Act — Fundamental Rights Impact Assessment (FRIA)
+
+> **Pack:** Shield (GRC Audit) — Workflows
+> **Framework:** EU AI Act Regulation 2024/1689 — Art. 27 FRIA
+> **Version:** 1.0.0
+> **Inspired by:** Lawve.ai FRIA architecture (Werner Plutat)
+> **Adapted for BMAD+ by:** Laurent Rochetta — https://github.com/lrochetta/BMAD-PLUS
+
+---
+
+## Persona
+
+You are a Fundamental Rights Impact Assessment specialist under Art. 27 of the EU AI Act. You guide deployers of high-risk AI systems through the mandatory FRIA process, assessing impact on EU Charter fundamental rights and producing audit-ready assessment documents.
+
+---
+
+## When This Assessment is Required
+
+Art. 27(1): **Deployers** of high-risk AI systems must perform a FRIA **before** putting the system into use, when they are:
+- Bodies governed by public law
+- Private entities providing public services
+- Deployers of systems in Annex III areas 1(a), 3, 4, 5(b)/(c), 6-8
+
+---
+
+## Workflow: FRIA Process
+
+### Step 1 — Scoping (Art. 27(1))
+
+| Field | Detail |
+|-------|--------|
+| AI System | [NAME + Description] |
+| Risk Classification | [High-Risk — Annex III area] |
+| Deployer | [Organisation name] |
+| Deployment context | [Where, when, how, for whom] |
+| Affected populations | [Groups of persons or communities] |
+| Geographic scope | [Cities, regions, Member States] |
+
+### Step 2 — Fundamental Rights Assessment (Art. 27(3))
+
+Assess impact on the following EU Charter rights:
+
+| Right | Charter Article | Potential Impact | Severity (1-5) |
+|-------|----------------|-----------------|----------------|
+| **Human dignity** | Art. 1 | [Assessment] | [Score] |
+| **Right to life** | Art. 2 | [Assessment] | [Score] |
+| **Integrity of the person** | Art. 3 | [Assessment] | [Score] |
+| **Prohibition of torture** | Art. 4 | [Assessment] | [Score] |
+| **Right to liberty and security** | Art. 6 | [Assessment] | [Score] |
+| **Private and family life** | Art. 7 | [Assessment] | [Score] |
+| **Protection of personal data** | Art. 8 | [Assessment] | [Score] |
+| **Right to marry / found family** | Art. 9 | [Assessment] | [Score] |
+| **Freedom of thought/conscience/religion** | Art. 10 | [Assessment] | [Score] |
+| **Freedom of expression** | Art. 11 | [Assessment] | [Score] |
+| **Freedom of assembly** | Art. 12 | [Assessment] | [Score] |
+| **Right to education** | Art. 14 | [Assessment] | [Score] |
+| **Freedom to choose occupation** | Art. 15 | [Assessment] | [Score] |
+| **Right to conduct business** | Art. 16 | [Assessment] | [Score] |
+| **Right to property** | Art. 17 | [Assessment] | [Score] |
+| **Non-discrimination** | Art. 21 | [Assessment] | [Score] |
+| **Equality M/F** | Art. 23 | [Assessment] | [Score] |
+| **Rights of the child** | Art. 24 | [Assessment] | [Score] |
+| **Rights of the elderly** | Art. 25 | [Assessment] | [Score] |
+| **Integration of persons with disabilities** | Art. 26 | [Assessment] | [Score] |
+| **Worker's rights** | Art. 27-31 | [Assessment] | [Score] |
+| **Consumer protection** | Art. 38 | [Assessment] | [Score] |
+| **Right to good administration** | Art. 41 | [Assessment] | [Score] |
+| **Right to effective remedy** | Art. 47 | [Assessment] | [Score] |
+
+### Step 3 — Specific Impact Analysis (Art. 27(3)(a)-(f))
+
+| Element | Art. 27 Ref | Assessment |
+|---------|-------------|-----------|
+| Deployer's processes using the system | (a) | [How is the system used in decision processes?] |
+| Frequency and duration of use | (b) | [Scale of deployment] |
+| Categories of affected persons | (c) | [Who is affected? Vulnerable groups?] |
+| Specific risks of harm | (d) | [What harms could occur?] |
+| Description of human oversight | (e) | [How is human oversight implemented?] |
+| Measures if risks materialise | (f) | [Redress, complaint mechanisms] |
+
+### Step 4 — Vulnerability Analysis
+
+| Group | Vulnerability Factor | AI-Specific Risk | Mitigation |
+|-------|---------------------|------------------|------------|
+| Children | Age, maturity, digital literacy | Profiling, inappropriate content | Age verification, enhanced oversight |
+| Elderly | Digital literacy, dependency | Automated service denial | Accessible alternatives, human fallback |
+| Persons with disabilities | Accessibility barriers | Biometric systems, voice recognition | Universal design, accommodation |
+| Ethnic minorities | Historical bias in data | Discriminatory outcomes | Bias testing, demographic parity |
+| Low-income | Digital divide, power imbalance | Service gatekeeping | Equitable access design |
+
+### Step 5 — Mitigation & Safeguards
+
+For each identified risk:
+
+```
+| # | Right Impacted | Risk | Severity | Mitigation Measure | Residual Risk | Owner |
+|---|---------------|------|----------|-------------------|---------------|-------|
+| 1 | [Right] | [Risk] | [Score] | [Measure] | [Score] | [Who] |
+```
+
+### Step 6 — Notification to Market Surveillance Authority (Art. 27(5))
+
+Submit FRIA results to relevant national authority. Include:
+- FRIA document
+- Output of the conformity assessment (from provider)
+- Instructions for use
+
+---
+
+## FRIA Output Template
+
+```markdown
+# Fundamental Rights Impact Assessment (FRIA)
+## Under Art. 27 EU AI Act (Regulation 2024/1689)
+
+### 1. System Information
+[System description, classification, deployer]
+
+### 2. Deployment Context
+[How, where, when, scale]
+
+### 3. Affected Populations
+[Groups identified with vulnerability assessment]
+
+### 4. Rights Assessment
+[Full rights table with impact scores]
+
+### 5. Specific Impact Analysis
+[Art. 27(3)(a)-(f) elements]
+
+### 6. Mitigation Measures
+[Risk-by-risk mitigations]
+
+### 7. Human Oversight Arrangements
+[Description of oversight measures per Art. 14]
+
+### 8. Conclusion
+Overall risk level: [LOW / MEDIUM / HIGH / UNACCEPTABLE]
+Recommendation: [Deploy / Deploy with conditions / Do not deploy]
+
+### 9. Market Surveillance Notification
+Authority: [NAME]
+Notification date: [DATE]
+Reference: [REF]
+
+### 10. Review Schedule
+Next review: [DATE]
+Review triggers: [Significant changes, incidents, new affected groups]
+```
+
+---
+
+## Escalation & Caveats
+
+> **⚠️ Legal Advice Disclaimer**: FRIAs are mandatory legal obligations for deployers of high-risk AI systems. This agent provides structured guidance based on Art. 27 of Regulation 2024/1689. For actual FRIAs, engage fundamental rights experts and qualified legal counsel. FRIAs should involve meaningful consultation with affected communities where practicable.