gitmodelmujtaba commited on
Commit
2f11f4d
·
verified ·
1 Parent(s): ac8e628

Deploy ReguAI: Neuro-Symbolic AI GRC & Automated Conformity Assessment Engine

Browse files
api.py CHANGED
@@ -114,6 +114,8 @@ def list_benchmark_samples():
114
  {"id": "compliant_clinical_samd", "title": "OncoScan AI Diagnostic Assistant (SaMD - Compliant)"},
115
  {"id": "non_compliant_hr_recruitment", "title": "TalentSift Automated Candidate Evaluator (HR - Violations)"},
116
  {"id": "borderline_credit_scoring", "title": "CrediScore Neural Underwriter (FinTech - Planned Roadmap)"},
 
 
117
  ]
118
 
119
 
 
114
  {"id": "compliant_clinical_samd", "title": "OncoScan AI Diagnostic Assistant (SaMD - Compliant)"},
115
  {"id": "non_compliant_hr_recruitment", "title": "TalentSift Automated Candidate Evaluator (HR - Violations)"},
116
  {"id": "borderline_credit_scoring", "title": "CrediScore Neural Underwriter (FinTech - Planned Roadmap)"},
117
+ {"id": "prohibited_emotion_recognition_workplace", "title": "MindGaze Emotion Tracker (EdTech/HR - Article 5 Prohibited)"},
118
+ {"id": "gpai_foundation_llm", "title": "Nexus-70B Frontier Foundation Model (GPAI - Systemic Risk)"},
119
  ]
120
 
121
 
app.py CHANGED
@@ -27,6 +27,8 @@ SAMPLE_PATHS = {
27
  "Healthcare / Medical AI (Compliant SaMD - Articles 9-15 Passed)": SYNTHETIC_DIR / "compliant_clinical_samd.json",
28
  "HR / Recruitment AI (High-Risk - Human Oversight & Bias Non-Conformities)": SYNTHETIC_DIR / "non_compliant_hr_recruitment.json",
29
  "FinTech / Credit Underwriting (Borderline - Planned Roadmap & Auditor Review)": SYNTHETIC_DIR / "borderline_credit_scoring.json",
 
 
30
  }
31
 
32
  def load_sample_content(sample_name: str) -> str:
 
27
  "Healthcare / Medical AI (Compliant SaMD - Articles 9-15 Passed)": SYNTHETIC_DIR / "compliant_clinical_samd.json",
28
  "HR / Recruitment AI (High-Risk - Human Oversight & Bias Non-Conformities)": SYNTHETIC_DIR / "non_compliant_hr_recruitment.json",
29
  "FinTech / Credit Underwriting (Borderline - Planned Roadmap & Auditor Review)": SYNTHETIC_DIR / "borderline_credit_scoring.json",
30
+ "EdTech / Surveillance AI (Prohibited - Article 5(1)(f) Emotion Recognition)": SYNTHETIC_DIR / "prohibited_emotion_recognition_workplace.json",
31
+ "GPAI Foundation LLM (Systemic Risk - Articles 51-55 Compute > 10^25 FLOPs)": SYNTHETIC_DIR / "gpai_foundation_llm.json",
32
  }
33
 
34
  def load_sample_content(sample_name: str) -> str:
data/active_learning_triplets.jsonl CHANGED
@@ -1,2 +1,3 @@
1
  {"timestamp": "2026-09-20T18:40:55.762828+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}
2
  {"timestamp": "2026-09-20T18:41:12.550631+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}
 
 
1
  {"timestamp": "2026-09-20T18:40:55.762828+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}
2
  {"timestamp": "2026-09-20T18:41:12.550631+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}
3
+ {"timestamp": "2026-09-20T19:17:17.024922+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}
data/benchmarks/conformity_ground_truth_benchmark.jsonl ADDED
@@ -0,0 +1,20 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ {"id": "bench_001", "sentence": "A clinician-in-the-loop human oversight mechanism is strictly operational before diagnosis is confirmed.", "gold_category": "HUMAN_OVERSIGHT", "gold_status": "IMPLEMENTED", "target_article": "Article 14", "is_borderline": false}
2
+ {"id": "bench_002", "sentence": "Candidate rejections are executed autonomously with no human oversight mechanism.", "gold_category": "HUMAN_OVERSIGHT", "gold_status": "ABSENT", "target_article": "Article 14", "is_borderline": false}
3
+ {"id": "bench_003", "sentence": "A manual override capability is currently in development and planned for future release in Q4.", "gold_category": "HUMAN_OVERSIGHT", "gold_status": "PLANNED", "target_article": "Article 14", "is_borderline": false}
4
+ {"id": "bench_004", "sentence": "Bias examination and demographic parity across patient demographics was verified with zero disparity.", "gold_category": "BIAS_MITIGATION", "gold_status": "IMPLEMENTED", "target_article": "Article 10(2)(f)", "is_borderline": false}
5
+ {"id": "bench_005", "sentence": "The development team did not conduct bias examination or demographic parity audits.", "gold_category": "BIAS_MITIGATION", "gold_status": "ABSENT", "target_article": "Article 10(2)(f)", "is_borderline": false}
6
+ {"id": "bench_006", "sentence": "Disparate impact testing across immigrant zip codes is scheduled for evaluation next quarter.", "gold_category": "BIAS_MITIGATION", "gold_status": "PLANNED", "target_article": "Article 10(2)(f)", "is_borderline": false}
7
+ {"id": "bench_007", "sentence": "A continuous risk management system is implemented in accordance with ISO 14971.", "gold_category": "RISK_MANAGEMENT", "gold_status": "IMPLEMENTED", "target_article": "Article 9", "is_borderline": false}
8
+ {"id": "bench_008", "sentence": "The prototype operates without risk management procedures or hazard logs.", "gold_category": "RISK_MANAGEMENT", "gold_status": "ABSENT", "target_article": "Article 9", "is_borderline": false}
9
+ {"id": "bench_009", "sentence": "Training data provenance is documented across multi-center clinical cohorts comprising 45,000 scans.", "gold_category": "DATA_GOVERNANCE", "gold_status": "IMPLEMENTED", "target_article": "Article 10", "is_borderline": false}
10
+ {"id": "bench_010", "sentence": "Dataset lineage records were lost and no data governance protocols were applied.", "gold_category": "DATA_GOVERNANCE", "gold_status": "ABSENT", "target_article": "Article 10", "is_borderline": false}
11
+ {"id": "bench_011", "sentence": "Automated logging of every inference request and model confidence score is active.", "gold_category": "RECORD_KEEPING", "gold_status": "IMPLEMENTED", "target_article": "Article 12", "is_borderline": false}
12
+ {"id": "bench_012", "sentence": "Audit trail logging was omitted due to database storage constraints.", "gold_category": "RECORD_KEEPING", "gold_status": "ABSENT", "target_article": "Article 12", "is_borderline": false}
13
+ {"id": "bench_013", "sentence": "An emergency stop kill switch is implemented for immediate operator intervention.", "gold_category": "FAIL_SAFE", "gold_status": "IMPLEMENTED", "target_article": "Article 14(4)(e)", "is_borderline": false}
14
+ {"id": "bench_014", "sentence": "The system lacks fail-safe fallback triggers or automated circuit breakers.", "gold_category": "FAIL_SAFE", "gold_status": "ABSENT", "target_article": "Article 14(4)(e)", "is_borderline": false}
15
+ {"id": "bench_015", "sentence": "Cybersecurity controls and defenses against adversarial image perturbations are deployed.", "gold_category": "CYBERSECURITY", "gold_status": "IMPLEMENTED", "target_article": "Article 15(4)", "is_borderline": false}
16
+ {"id": "bench_016", "sentence": "Adversarial testing against resume prompt injection was untested.", "gold_category": "CYBERSECURITY", "gold_status": "ABSENT", "target_article": "Article 15(4)", "is_borderline": false}
17
+ {"id": "bench_017", "sentence": "Robustness testing against feature noise manipulation is under evaluation.", "gold_category": "ACCURACY_ROBUSTNESS", "gold_status": "PLANNED", "target_article": "Article 15(1)", "is_borderline": false}
18
+ {"id": "bench_018", "sentence": "Comprehensive instructions for use and model card transparency disclosures are provided.", "gold_category": "TRANSPARENCY", "gold_status": "IMPLEMENTED", "target_article": "Article 13", "is_borderline": false}
19
+ {"id": "bench_019", "sentence": "Technical documentation conforming to Annex IV is maintained and archived.", "gold_category": "TECHNICAL_DOCUMENTATION", "gold_status": "IMPLEMENTED", "target_article": "Article 11", "is_borderline": false}
20
+ {"id": "bench_020", "sentence": "Human supervisor review might be considered in future releases if budget permits.", "gold_category": "HUMAN_OVERSIGHT", "gold_status": "PLANNED", "target_article": "Article 14", "is_borderline": true}
data/benchmarks/eu_ai_act_normative_triples.jsonld CHANGED
@@ -9,15 +9,45 @@
9
  },
10
  "@graph": [
11
  {
12
- "@id": "eu:Article_9",
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
13
  "@type": "regu:RegulatoryRequirement",
14
- "rdfs:label": "Risk Management System",
15
  "eu:legalBasis": "Regulation (EU) 2024/1689 Chapter III Article 9",
16
  "regu:targetClass": "regu:RiskManagementSystem",
17
  "regu:mandatoryFor": "regu:HighRiskAISystem",
18
  "skos:closeMatch": "nist:GOVERN_1.1",
19
  "skos:relatedMatch": "iso:Clause_6_1",
20
- "regu:description": "Establish, implement, document and maintain a continuous risk management system throughout the entire lifecycle of a high-risk AI system."
 
 
 
 
 
 
 
 
 
 
 
 
21
  },
22
  {
23
  "@id": "eu:Article_10_Data_Governance",
@@ -28,7 +58,8 @@
28
  "regu:mandatoryFor": "regu:HighRiskAISystem",
29
  "skos:closeMatch": "nist:MAP_1.5",
30
  "skos:relatedMatch": "iso:Control_A_8_2",
31
- "regu:description": "Training, validation and testing datasets shall be subject to appropriate data governance and management practices."
 
32
  },
33
  {
34
  "@id": "eu:Article_10_2_f_Bias_Mitigation",
@@ -39,40 +70,55 @@
39
  "regu:mandatoryFor": "regu:HighRiskAISystem",
40
  "skos:closeMatch": "nist:MEASURE_2.11",
41
  "skos:relatedMatch": "iso:Control_A_8_4",
42
- "regu:description": "Examination in view of possible biases that are likely to affect the health and safety of persons, negatively impact fundamental rights or lead to discrimination."
 
 
 
 
 
 
 
 
 
 
 
 
43
  },
44
  {
45
  "@id": "eu:Article_11_Technical_Documentation",
46
  "@type": "regu:RegulatoryRequirement",
47
- "rdfs:label": "Technical Documentation",
48
  "eu:legalBasis": "Regulation (EU) 2024/1689 Chapter III Article 11 & Annex IV",
49
  "regu:targetClass": "regu:TechnicalDocumentation",
50
  "regu:mandatoryFor": "regu:HighRiskAISystem",
51
  "skos:closeMatch": "nist:GOVERN_1.4",
52
  "skos:relatedMatch": "iso:Control_A_6_2",
53
- "regu:description": "Drawn up before the system is placed on the market or put into service and kept up-to-date."
 
54
  },
55
  {
56
  "@id": "eu:Article_12_Record_Keeping",
57
  "@type": "regu:RegulatoryRequirement",
58
- "rdfs:label": "Record-Keeping & Logging",
59
  "eu:legalBasis": "Regulation (EU) 2024/1689 Chapter III Article 12",
60
  "regu:targetClass": "regu:AutomatedLogging",
61
  "regu:mandatoryFor": "regu:HighRiskAISystem",
62
  "skos:closeMatch": "nist:GOVERN_1.5",
63
  "skos:relatedMatch": "iso:Control_A_9_3",
64
- "regu:description": "High-risk AI systems shall technically allow for the automatic recording of events (logging) over their lifecycle."
 
65
  },
66
  {
67
  "@id": "eu:Article_13_Transparency",
68
  "@type": "regu:RegulatoryRequirement",
69
- "rdfs:label": "Transparency and Provision of Information",
70
  "eu:legalBasis": "Regulation (EU) 2024/1689 Chapter III Article 13",
71
  "regu:targetClass": "regu:TransparencySpecification",
72
  "regu:mandatoryFor": "regu:HighRiskAISystem",
73
  "skos:closeMatch": "nist:MAP_1.2",
74
  "skos:relatedMatch": "iso:Control_A_7_2",
75
- "regu:description": "High-risk AI systems shall be designed and developed in such a way as to ensure that their operation is sufficiently transparent to enable deployers to interpret the system's output."
 
76
  },
77
  {
78
  "@id": "eu:Article_14_Human_Oversight",
@@ -83,18 +129,64 @@
83
  "regu:mandatoryFor": "regu:HighRiskAISystem",
84
  "skos:closeMatch": "nist:MANAGE_2.2",
85
  "skos:relatedMatch": "iso:Control_A_8_5",
86
- "regu:description": "High-risk AI systems shall be designed and developed in such a way, including with appropriate human-machine interface tools, that they can be effectively overseen by natural persons."
 
87
  },
88
  {
89
- "@id": "eu:Article_15_Cybersecurity_Robustness",
 
 
 
 
 
 
 
 
 
 
 
90
  "@type": "regu:RegulatoryRequirement",
91
  "rdfs:label": "Accuracy, Robustness and Cybersecurity",
92
  "eu:legalBasis": "Regulation (EU) 2024/1689 Chapter III Article 15",
93
- "regu:targetClass": "regu:CybersecurityControl",
94
  "regu:mandatoryFor": "regu:HighRiskAISystem",
95
  "skos:closeMatch": "nist:MEASURE_2.6",
96
  "skos:relatedMatch": "iso:Control_A_9_2",
97
- "regu:description": "Resilient against attempts by unauthorised third parties to alter their use, outputs or performance by exploiting system vulnerabilities."
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
98
  }
99
  ]
100
  }
 
9
  },
10
  "@graph": [
11
  {
12
+ "@id": "eu:Article_5_1_c_Social_Scoring",
13
+ "@type": "regu:ProhibitedPractice",
14
+ "rdfs:label": "Prohibition of Social Scoring",
15
+ "eu:legalBasis": "Regulation (EU) 2024/1689 Chapter II Article 5(1)(c)",
16
+ "regu:complianceTier": "Prohibited (Unacceptable Risk)",
17
+ "skos:closeMatch": "nist:GOVERN_1.1",
18
+ "regu:description": "Placing on the market, putting into service or use of AI systems for the evaluation or classification of natural persons based on their social behaviour or personality characteristics, leading to detrimental or unfavourable treatment."
19
+ },
20
+ {
21
+ "@id": "eu:Article_5_1_f_Emotion_Recognition_Workplace",
22
+ "@type": "regu:ProhibitedPractice",
23
+ "rdfs:label": "Prohibition of Emotion Recognition in Workplace & Education",
24
+ "eu:legalBasis": "Regulation (EU) 2024/1689 Chapter II Article 5(1)(f)",
25
+ "regu:complianceTier": "Prohibited (Unacceptable Risk)",
26
+ "skos:closeMatch": "nist:MAP_1.1",
27
+ "regu:description": "Placing on the market, putting into service or use of AI systems to infer emotions of a natural person in the areas of workplace and educational institutions, except for medical or safety reasons."
28
+ },
29
+ {
30
+ "@id": "eu:Article_9_Risk_Management_System",
31
  "@type": "regu:RegulatoryRequirement",
32
+ "rdfs:label": "Continuous Risk Management System",
33
  "eu:legalBasis": "Regulation (EU) 2024/1689 Chapter III Article 9",
34
  "regu:targetClass": "regu:RiskManagementSystem",
35
  "regu:mandatoryFor": "regu:HighRiskAISystem",
36
  "skos:closeMatch": "nist:GOVERN_1.1",
37
  "skos:relatedMatch": "iso:Clause_6_1",
38
+ "regu:shaclShape": "regu:HighRiskSystemShape",
39
+ "regu:description": "A risk management system shall be established, implemented, documented and maintained in relation to high-risk AI systems as a continuous iterative process throughout the entire lifecycle."
40
+ },
41
+ {
42
+ "@id": "eu:Article_9_2_Residual_Risk",
43
+ "@type": "regu:RegulatoryRequirement",
44
+ "rdfs:label": "Identification and Mitigation of Residual Risks",
45
+ "eu:legalBasis": "Regulation (EU) 2024/1689 Chapter III Article 9(2)",
46
+ "regu:targetClass": "regu:RiskManagementSystem",
47
+ "regu:mandatoryFor": "regu:HighRiskAISystem",
48
+ "skos:closeMatch": "nist:MANAGE_1.3",
49
+ "skos:relatedMatch": "iso:Clause_6_1_2",
50
+ "regu:description": "Identification, estimation, and evaluation of the most likely risks, with targeted mitigation measures to judge residual risks as acceptable."
51
  },
52
  {
53
  "@id": "eu:Article_10_Data_Governance",
 
58
  "regu:mandatoryFor": "regu:HighRiskAISystem",
59
  "skos:closeMatch": "nist:MAP_1.5",
60
  "skos:relatedMatch": "iso:Control_A_8_2",
61
+ "regu:shaclShape": "regu:HighRiskSystemShape",
62
+ "regu:description": "Training, validation and testing datasets shall be subject to appropriate data governance and management practices covering design choices, collection, curation, and provenance."
63
  },
64
  {
65
  "@id": "eu:Article_10_2_f_Bias_Mitigation",
 
70
  "regu:mandatoryFor": "regu:HighRiskAISystem",
71
  "skos:closeMatch": "nist:MEASURE_2.11",
72
  "skos:relatedMatch": "iso:Control_A_8_4",
73
+ "regu:shaclShape": "regu:HighRiskSystemShape",
74
+ "regu:description": "Examination in view of possible biases that are likely to affect health, safety, fundamental rights or lead to discrimination; appropriate measures to prevent and mitigate detected biases."
75
+ },
76
+ {
77
+ "@id": "eu:Article_10_3_Data_Representativeness",
78
+ "@type": "regu:RegulatoryRequirement",
79
+ "rdfs:label": "Data Representativeness & Statistical Properties",
80
+ "eu:legalBasis": "Regulation (EU) 2024/1689 Chapter III Article 10(3)",
81
+ "regu:targetClass": "regu:DataGovernanceProcess",
82
+ "regu:mandatoryFor": "regu:HighRiskAISystem",
83
+ "skos:closeMatch": "nist:MEASURE_1.2",
84
+ "skos:relatedMatch": "iso:Control_A_8_3",
85
+ "regu:description": "Datasets shall be sufficiently representative, free of errors and complete, having regard to the specific geographical, contextual, behavioural or functional setting within which the AI system is intended to be used."
86
  },
87
  {
88
  "@id": "eu:Article_11_Technical_Documentation",
89
  "@type": "regu:RegulatoryRequirement",
90
+ "rdfs:label": "Technical Documentation (Annex IV)",
91
  "eu:legalBasis": "Regulation (EU) 2024/1689 Chapter III Article 11 & Annex IV",
92
  "regu:targetClass": "regu:TechnicalDocumentation",
93
  "regu:mandatoryFor": "regu:HighRiskAISystem",
94
  "skos:closeMatch": "nist:GOVERN_1.4",
95
  "skos:relatedMatch": "iso:Control_A_6_2",
96
+ "regu:shaclShape": "regu:HighRiskSystemShape",
97
+ "regu:description": "Technical documentation shall be drawn up before the system is placed on the market or put into service and kept up to date, complying with Annex IV requirements."
98
  },
99
  {
100
  "@id": "eu:Article_12_Record_Keeping",
101
  "@type": "regu:RegulatoryRequirement",
102
+ "rdfs:label": "Record-Keeping & Automated Logging",
103
  "eu:legalBasis": "Regulation (EU) 2024/1689 Chapter III Article 12",
104
  "regu:targetClass": "regu:AutomatedLogging",
105
  "regu:mandatoryFor": "regu:HighRiskAISystem",
106
  "skos:closeMatch": "nist:GOVERN_1.5",
107
  "skos:relatedMatch": "iso:Control_A_9_3",
108
+ "regu:shaclShape": "regu:HighRiskSystemShape",
109
+ "regu:description": "High-risk AI systems shall technically allow for the automatic recording of events (logging) over their lifecycle, ensuring traceability of system functioning and operator interventions."
110
  },
111
  {
112
  "@id": "eu:Article_13_Transparency",
113
  "@type": "regu:RegulatoryRequirement",
114
+ "rdfs:label": "Transparency and Provision of Information to Deployers",
115
  "eu:legalBasis": "Regulation (EU) 2024/1689 Chapter III Article 13",
116
  "regu:targetClass": "regu:TransparencySpecification",
117
  "regu:mandatoryFor": "regu:HighRiskAISystem",
118
  "skos:closeMatch": "nist:MAP_1.2",
119
  "skos:relatedMatch": "iso:Control_A_7_2",
120
+ "regu:shaclShape": "regu:HighRiskSystemShape",
121
+ "regu:description": "Designed and developed in such a way as to ensure operation is sufficiently transparent to enable deployers to interpret outputs and use them appropriately; accompanied by comprehensive instructions for use."
122
  },
123
  {
124
  "@id": "eu:Article_14_Human_Oversight",
 
129
  "regu:mandatoryFor": "regu:HighRiskAISystem",
130
  "skos:closeMatch": "nist:MANAGE_2.2",
131
  "skos:relatedMatch": "iso:Control_A_8_5",
132
+ "regu:shaclShape": "regu:HighRiskSystemShape",
133
+ "regu:description": "Designed to enable natural persons to oversee the system operation during use, preventing or minimising risks to health, safety or fundamental rights."
134
  },
135
  {
136
+ "@id": "eu:Article_14_4_e_Emergency_Stop",
137
+ "@type": "regu:RegulatoryRequirement",
138
+ "rdfs:label": "Human Override & Emergency Stop / Kill Switch",
139
+ "eu:legalBasis": "Regulation (EU) 2024/1689 Chapter III Article 14(4)(e)",
140
+ "regu:targetClass": "regu:StopMechanism",
141
+ "regu:mandatoryFor": "regu:HighRiskAISystem",
142
+ "skos:closeMatch": "nist:MANAGE_2.4",
143
+ "skos:relatedMatch": "iso:Control_A_8_5",
144
+ "regu:description": "Ability to intervene on the operation of the high-risk AI system or interrupt the system through a stop button or a similar procedure."
145
+ },
146
+ {
147
+ "@id": "eu:Article_15_Accuracy_Robustness_Cybersecurity",
148
  "@type": "regu:RegulatoryRequirement",
149
  "rdfs:label": "Accuracy, Robustness and Cybersecurity",
150
  "eu:legalBasis": "Regulation (EU) 2024/1689 Chapter III Article 15",
151
+ "regu:targetClass": "regu:RobustnessControl",
152
  "regu:mandatoryFor": "regu:HighRiskAISystem",
153
  "skos:closeMatch": "nist:MEASURE_2.6",
154
  "skos:relatedMatch": "iso:Control_A_9_2",
155
+ "regu:shaclShape": "regu:HighRiskSystemShape",
156
+ "regu:description": "Designed to achieve appropriate level of accuracy, robustness and cybersecurity, resilient against errors, faults, inconsistencies, and adversarial attacks."
157
+ },
158
+ {
159
+ "@id": "eu:Article_15_4_Cybersecurity_Defense",
160
+ "@type": "regu:RegulatoryRequirement",
161
+ "rdfs:label": "Cybersecurity & Adversarial Defense",
162
+ "eu:legalBasis": "Regulation (EU) 2024/1689 Chapter III Article 15(4)",
163
+ "regu:targetClass": "regu:CybersecurityControl",
164
+ "regu:mandatoryFor": "regu:HighRiskAISystem",
165
+ "skos:closeMatch": "nist:GOVERN_1.6",
166
+ "skos:relatedMatch": "iso:Control_A_9_2",
167
+ "regu:description": "Resilient against attempts by unauthorised third parties to alter system use, outputs or performance through data poisoning, model evasion, adversarial perturbations, and prompt injection."
168
+ },
169
+ {
170
+ "@id": "eu:Article_51_GPAI_Systemic_Risk",
171
+ "@type": "regu:RegulatoryRequirement",
172
+ "rdfs:label": "General-Purpose AI Models with Systemic Risk",
173
+ "eu:legalBasis": "Regulation (EU) 2024/1689 Chapter V Article 51",
174
+ "regu:targetClass": "regu:GeneralPurposeAIModel",
175
+ "regu:mandatoryFor": "regu:GPAIWithSystemicRisk",
176
+ "skos:closeMatch": "nist:MEASURE_1.1",
177
+ "skos:relatedMatch": "iso:Control_A_6_1",
178
+ "regu:description": "A general-purpose AI model shall be classified as having systemic risk if the cumulative amount of computation used for its training measured in floating point operations is greater than 10^25 FLOPs."
179
+ },
180
+ {
181
+ "@id": "eu:Article_55_GPAI_Safety_Evaluation",
182
+ "@type": "regu:RegulatoryRequirement",
183
+ "rdfs:label": "GPAI Model Evaluation & Adversarial Red-Teaming",
184
+ "eu:legalBasis": "Regulation (EU) 2024/1689 Chapter V Article 55",
185
+ "regu:targetClass": "regu:GeneralPurposeAIModel",
186
+ "regu:mandatoryFor": "regu:GPAIWithSystemicRisk",
187
+ "skos:closeMatch": "nist:MEASURE_2.8",
188
+ "skos:relatedMatch": "iso:Control_A_9_4",
189
+ "regu:description": "Perform model evaluation in accordance with standardised protocols, including conducting and documenting adversarial testing (red-teaming) to identify and mitigate systemic risks."
190
  }
191
  ]
192
  }
data/synthetic_systems/gpai_foundation_llm.json ADDED
@@ -0,0 +1,13 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ {
2
+ "metadata": {
3
+ "system_id": "gpai-nexus-70b",
4
+ "name": "Nexus-70B Frontier Foundation Model",
5
+ "version": "1.0.0",
6
+ "domain": "General Purpose AI (GPAI)",
7
+ "intended_purpose": "Multimodal general-purpose foundation model capable of text generation, code synthesis, mathematical reasoning, and workflow automation.",
8
+ "eu_risk_classification": "General Purpose AI with Systemic Risk (Chapter V, Article 51)",
9
+ "developer_name": "Frontier Cognitive Labs",
10
+ "deployment_context": "Global Cloud API & Enterprise Self-Hosted Weight Weights"
11
+ },
12
+ "raw_document_text": "# Nexus-70B Frontier Foundation Model Specification\n\n## Intended Scope & Architecture\nNexus-70B is a 70-billion parameter autoregressive transformer trained on 15 trillion tokens of multilingual text, code, and scientific literature.\n\n## Systemic Risk & Computational Threshold (Article 51)\nThe cumulative computational capacity used for training exceeded 1.2e26 FLOPs, surpassing the EU AI Act Article 51 systemic risk threshold of 10^25 FLOPs. The model is therefore classified as a General Purpose AI Model with Systemic Risk.\n\n## Risk Management & Mitigation (Article 55)\nA continuous risk management system is implemented to identify and mitigate systemic risks including cybersecurity compromise, autonomous chemical/biological hazards, and societal manipulation.\n\n## Data Governance & Copyright (Article 53 & 10)\nTraining data provenance is documented in a detailed dataset summary. A robust opt-out compliance mechanism honoring robots.txt and EU DSM Copyright Directive (Directive (EU) 2019/790) is enforced.\n\n## Model Evaluation & Adversarial Red-Teaming (Article 55)\nAdversarial testing and red-teaming protocols were conducted across 40 specialized external safety testing organizations. Defenses against jailbreaking, prompt injection, and automated cyberattack planning are validated.\n\n## Energy Consumption & Transparency (Article 53 & Annex IV)\nTotal energy consumption during pre-training was measured at 1,420 MWh, with an estimated carbon footprint of 480 tCO2eq, fully documented in the technical documentation package."
13
+ }
data/synthetic_systems/prohibited_emotion_recognition_workplace.json ADDED
@@ -0,0 +1,13 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ {
2
+ "metadata": {
3
+ "system_id": "edu-mindgaze-08",
4
+ "name": "MindGaze Classroom Attentiveness & Emotion Tracker",
5
+ "version": "1.0.2",
6
+ "domain": "Education & Workplace Surveillance",
7
+ "intended_purpose": "Continuous facial micro-expression analysis and emotion recognition to score student attentiveness and worker engagement.",
8
+ "eu_risk_classification": "Prohibited (Article 5(1)(f) - Emotion Recognition in Education/Workplace)",
9
+ "developer_name": "CogniMetric Technologies",
10
+ "deployment_context": "University Exam Halls and Corporate Remote Workstations"
11
+ },
12
+ "raw_document_text": "# MindGaze Emotion Recognition System Specification\n\n## Intended Purpose & Operational Overview\nMindGaze analyzes student and employee webcam video streams in real-time. The neural network infers emotional states (boredom, confusion, distraction, frustration, engagement) from facial action units (FACS) and pupil dilation to assign an automated attentiveness score.\n\n## Compliance & Risk Classification (Article 5)\nThe system performs automated emotion recognition in educational institutions and workplace monitoring environments. Note: Regulation (EU) 2024/1689 Article 5(1)(f) explicitly prohibits placing on the market or putting into service AI systems intended to infer emotions of natural persons in workplace and educational settings.\n\n## Risk Management (Article 9)\nA risk management procedure was drafted for cloud server downtime.\n\n## Data Governance (Article 10)\nTraining data provenance consists of 80,000 scraped video clips of students taking online quizzes.\n\n## Bias Examination & Mitigation (Article 10(2)(f))\nBias examination was omitted due to timeline constraints. No demographic parity testing across neurodivergent students was conducted.\n\n## Human Oversight (Article 14)\nAutomated attentiveness alerts are dispatched to supervisors without human review or manual override.\n\n## Logging & Cybersecurity (Article 12 & 15)\nSession video clips and inferred emotional states are logged to cloud datacenters."
13
+ }
evaluate_benchmark.py ADDED
@@ -0,0 +1,91 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ """
2
+ ReguAI Benchmark Evaluation Runner.
3
+ Evaluates regulatory claim extraction, NegEx assertion triage, and normative mapping
4
+ against the ground-truth benchmark dataset.
5
+ """
6
+
7
+ import json
8
+ from pathlib import Path
9
+ from typing import Dict, Any, List
10
+
11
+ from src.core.config import BENCHMARKS_DIR
12
+ from src.extraction.gliner_extractor import RegulatoryClaimExtractor
13
+ from src.core.models import AssertionStatus, EntityCategory
14
+
15
+
16
+ def run_benchmark():
17
+ benchmark_file = BENCHMARKS_DIR / "conformity_ground_truth_benchmark.jsonl"
18
+ if not benchmark_file.exists():
19
+ print(f"Error: Benchmark file {benchmark_file} not found.")
20
+ return
21
+
22
+ extractor = RegulatoryClaimExtractor()
23
+
24
+ total_samples = 0
25
+ correct_category = 0
26
+ correct_status = 0
27
+ borderline_correct = 0
28
+
29
+ results_table = []
30
+
31
+ with open(benchmark_file, "r", encoding="utf-8") as f:
32
+ for line in f:
33
+ if not line.strip():
34
+ continue
35
+ item = json.loads(line.strip())
36
+ total_samples += 1
37
+
38
+ sentence = item["sentence"]
39
+ gold_cat = item["gold_category"]
40
+ gold_status = item["gold_status"]
41
+ gold_borderline = item.get("is_borderline", False)
42
+
43
+ claims = extractor.extract_claims(sentence)
44
+ pred_claim = claims[0] if claims else None
45
+
46
+ pred_cat = pred_claim.category.value if pred_claim else "NOT_FOUND"
47
+ pred_status = pred_claim.assertion_status.value if pred_claim else "NOT_FOUND"
48
+ pred_borderline = pred_claim.requires_auditor_review if pred_claim else False
49
+
50
+ cat_match = pred_cat == gold_cat
51
+ status_match = pred_status == gold_status
52
+
53
+ if cat_match:
54
+ correct_category += 1
55
+ if status_match:
56
+ correct_status += 1
57
+ if pred_borderline == gold_borderline:
58
+ borderline_correct += 1
59
+
60
+ results_table.append({
61
+ "id": item["id"],
62
+ "gold_cat": gold_cat,
63
+ "pred_cat": pred_cat,
64
+ "cat_match": cat_match,
65
+ "gold_status": gold_status,
66
+ "pred_status": pred_status,
67
+ "status_match": status_match,
68
+ })
69
+
70
+ cat_acc = (correct_category / total_samples) * 100.0
71
+ status_acc = (correct_status / total_samples) * 100.0
72
+
73
+ print("================================================================================")
74
+ print(" REGUAI REGULATORY EXTRACTION & TRIAGE BENCHMARK SCORECARD ")
75
+ print("================================================================================")
76
+ print(f"Total Evaluated Benchmark Sentences : {total_samples}")
77
+ print(f"Entity Category Extraction Accuracy : {correct_category}/{total_samples} ({cat_acc:.1f}%)")
78
+ print(f"NegEx Assertion Triage Accuracy : {correct_status}/{total_samples} ({status_acc:.1f}%)")
79
+ print("--------------------------------------------------------------------------------")
80
+ print(f"{'Sample ID':<12} | {'Gold Category':<22} | {'Pred Category':<22} | {'Status Match':<12}")
81
+ print("--------------------------------------------------------------------------------")
82
+ for r in results_table[:10]:
83
+ sm_badge = "[MATCH]" if r["status_match"] and r["cat_match"] else "[MISMATCH]"
84
+ print(f"{r['id']:<12} | {r['gold_cat']:<22} | {r['pred_cat']:<22} | {sm_badge:<12}")
85
+ if len(results_table) > 10:
86
+ print(f"... and {len(results_table) - 10} more benchmark cases.")
87
+ print("================================================================================")
88
+
89
+
90
+ if __name__ == "__main__":
91
+ run_benchmark()