Global Regulatory Landscape

"""Map regulatory requirements to checks that examine a deployment.

Each requirement carries the Article it cites (so an auditor can verify
the source), a check function that returns (passed, evidence), and a
remediation hint shown when the check fails.
"""
from dataclasses import dataclass
from datetime import datetime
from typing import Callable
import json

@dataclass
class Requirement:
    article: str                                   # e.g. "EU AI Act Art.13"
    name: str
    check: Callable[[dict], tuple[bool, str]]
    remediation: str

def has_transparency_notice(cfg: dict) -> tuple[bool, str]:
    """EU AI Act Art.13: users must be informed they are interacting with AI."""
    notice = cfg.get("ui", {}).get("ai_disclosure")
    if not notice:
        return False, "No AI disclosure on the user-facing UI"
    if "ai" not in notice.lower():
        return False, f"Disclosure too vague: {notice!r}"
    return True, f"Disclosure present: {notice!r}"

def has_dpia(cfg: dict) -> tuple[bool, str]:
    """GDPR Art.35: a Data Protection Impact Assessment is required."""
    dpia = cfg.get("dpia", {})
    if not dpia.get("completed"):
        return False, "No DPIA on file"
    age = (datetime.utcnow() - datetime.fromisoformat(dpia["last_review"])).days
    if age > 365:
        return False, f"DPIA older than 12 months ({age} days)"
    return True, f"DPIA reviewed {age} days ago"

def has_human_oversight(cfg: dict) -> tuple[bool, str]:
    """EU AI Act Art.14: high-risk systems need a human-in-the-loop path."""
    esc = cfg.get("escalation_to_human", {})
    if not esc.get("enabled"):
        return False, "Human escalation path not configured"
    sla = esc.get("sla_minutes", 9999)
    if sla > 30:
        return False, f"Human SLA {sla}min exceeds 30min threshold"
    return True, f"Human escalation within {sla}min"

def has_retention_policy(cfg: dict) -> tuple[bool, str]:
    """GDPR Art.5(1)(e): personal data kept no longer than necessary."""
    days = cfg.get("logs", {}).get("retention_days")
    if days is None:
        return False, "Log retention period not set"
    if days > 90:
        return False, f"Retention {days}d exceeds 90d default"
    return True, f"Logs retained {days} days"

def has_audit_logging(cfg: dict) -> tuple[bool, str]:
    """EU AI Act Art.12: high-risk systems must log operational events."""
    fields = set(cfg.get("logs", {}).get("fields_captured", []))
    required = {"prompt", "response", "user_id", "timestamp", "model_version"}
    missing = required - fields
    if missing:
        return False, f"Audit log missing fields: {sorted(missing)}"
    return True, "All required fields captured"

REQUIREMENTS = [
    Requirement("EU AI Act Art.13", "transparency_notice",
                has_transparency_notice,
                "Add an 'Powered by AI' disclosure to the chat UI"),
    Requirement("GDPR Art.35", "dpia_completed", has_dpia,
                "Complete a DPIA and refresh annually"),
    Requirement("EU AI Act Art.14", "human_oversight", has_human_oversight,
                "Configure escalation_to_human with SLA <= 30 minutes"),
    Requirement("GDPR Art.5(1)(e)", "data_retention", has_retention_policy,
                "Set logs.retention_days <= 90"),
    Requirement("EU AI Act Art.12", "audit_logging", has_audit_logging,
                "Capture prompt, response, user_id, timestamp, model_version"),
]

def audit(cfg: dict) -> dict:
    findings = []
    for req in REQUIREMENTS:
        passed, evidence = req.check(cfg)
        findings.append({
            "article": req.article,
            "requirement": req.name,
            "passed": passed,
            "evidence": evidence,
            "remediation": None if passed else req.remediation,
        })
    return {
        "score": f"{sum(f['passed'] for f in findings)}/{len(findings)}",
        "compliant": all(f["passed"] for f in findings),
        "findings": findings,
        "assessed_at": datetime.utcnow().isoformat() + "Z",
    }

# Demo: audit a sample deployment config
deployment = {
    "ui": {"ai_disclosure": "This chat is powered by AI"},
    "dpia": {"completed": True, "last_review": "2026-01-15T00:00:00"},
    "escalation_to_human": {"enabled": True, "sla_minutes": 15},
    "logs": {
        "retention_days": 365,                     # too long: fails
        "fields_captured": ["prompt", "response", "timestamp"],
    },
}
print(json.dumps(audit(deployment), indent=2))

# implement get_sector_requirements
def get_sector_requirements(sector: str) -> dict:
    """Return regulatory requirements by sector for LLM deployments."""
    requirements = {
        "healthcare": {
        "regulations": ["HIPAA", "FDA guidance on AI/ML", "21 CFR Part 11"],
        "requirements": [
        "PHI de-identification before LLM processing",
        "BAA with cloud/API providers",
        "Clinical validation for diagnostic support",
        "Audit trail for all AI-assisted decisions",
        ],
        },
        "finance": {
        "regulations": ["SR 11-7", "ECOA", "FCRA", "SEC guidance"],
        "requirements": [
        "Model risk management documentation",
        "Fair lending compliance testing",
        "Explainability for credit decisions",
        "Independent model validation",
        ],
        },
        "education": {
        "regulations": ["FERPA", "COPPA", "state AI laws"],
        "requirements": [
        "Student data privacy protection",
        "Parental consent for minors (COPPA)",
        "Transparency about AI use in grading",
        "Opt-out mechanisms for students",
        ],
        },
    }
    return requirements.get(sector, {"error": "Sector not found"})
import json
print(json.dumps(get_sector_requirements("healthcare"), indent=2))