Deploy ReguAI: Neuro-Symbolic AI GRC & Automated Conformity Assessment Engine

data/active_learning_triplets.jsonl

@@ -7,3 +7,4 @@
 {"timestamp": "2026-09-20T19:34:57.435307+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}
 {"timestamp": "2026-09-20T19:37:14.849175+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}
 {"timestamp": "2026-09-20T19:38:35.112557+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}
+{"timestamp": "2026-09-20T19:47:07.934259+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}

src/ontology/builder.py

@@ -5,6 +5,7 @@ binding them to formal legal ontologies.
 """
 
 from typing import Tuple, Dict, Any, List
+import re
 import rdflib
 from rdflib import Graph, URIRef, Literal, RDF, RDFS, XSD
 
@@ -61,8 +62,20 @@ class NormativeGraphBuilder:
 
         sys_uri = REGU[f"system_{spec.metadata.system_id.replace('-', '_')}"]
         
-        # System Node & Typing
-        if "High-Risk" in spec.metadata.eu_risk_classification:
+        # System Node & Regulatory Typing
+        risk_class_lower = spec.metadata.eu_risk_classification.lower()
+        is_prohibited = "prohibited" in risk_class_lower or bool(re.search(r"\barticle\s*5\b", risk_class_lower))
+        
+        if is_prohibited:
+            g.add((sys_uri, RDF.type, REGU.ProhibitedAISystem))
+            g.add((sys_uri, REGU.prohibitionStatus, REGU.ProhibitedPracticeDetected))
+            g.add((sys_uri, REGU.hasProhibitedPracticeType, REGU.ProhibitedPracticeDetected))
+        elif "general purpose" in risk_class_lower or "gpai" in risk_class_lower:
+            if "systemic" in risk_class_lower or "article 51" in risk_class_lower:
+                g.add((sys_uri, RDF.type, REGU.GPAISystemicRiskModel))
+            else:
+                g.add((sys_uri, RDF.type, REGU.GPAIModel))
+        elif "high-risk" in risk_class_lower or "annex iii" in risk_class_lower or "annex i" in risk_class_lower:
             g.add((sys_uri, RDF.type, REGU.HighRiskAISystem))
         else:
             g.add((sys_uri, RDF.type, REGU.AISystem))

src/ontology/shacl/gpai_shapes.ttl

@@ -0,0 +1,75 @@
+@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
+@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
+@prefix sh: <http://www.w3.org/ns/shacl#> .
+@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
+@prefix regu: <http://regu.ai/schema#> .
+@prefix eu: <http://data.europa.eu/eli/reg/2024/1689#> .
+
+# =========================================================================
+# ReguAI Normative SHACL Shape Validation: General-Purpose AI (GPAI)
+# Regulation (EU) 2024/1689 - Chapter V (Articles 51, 53, 55)
+# =========================================================================
+
+regu:GPAISystemicRiskShape
+    a sh:NodeShape ;
+    sh:targetClass regu:GPAISystemicRiskModel ;
+    sh:name "EU AI Act Chapter V GPAI with Systemic Risk Conformity Shape" ;
+    sh:description "Enforces mandatory requirements for General-Purpose AI Models with Systemic Risk (> 10^25 FLOPs) under Articles 51, 53, and 55." ;
+
+    # ---------------------------------------------------------------------
+    # Article 53: Technical Documentation (Annex XI)
+    # ---------------------------------------------------------------------
+    sh:property [
+        sh:path regu:hasTechnicalDocumentation ;
+        sh:minCount 1 ;
+        sh:severity sh:Violation ;
+        sh:message "EU AI Act Art 53(1)(a) Non-Conformity: Providers of general-purpose AI models must draw up and keep up-to-date technical documentation of the model (Annex XI)." ;
+    ] ;
+    sh:property [
+        sh:path ( regu:hasTechnicalDocumentation regu:implementationStatus ) ;
+        sh:hasValue regu:Implemented ;
+        sh:severity sh:Violation ;
+        sh:message "EU AI Act Art 53(1)(a) Non-Conformity: GPAI technical documentation package must be 'Implemented' and available for the AI Office." ;
+    ] ;
+
+    # ---------------------------------------------------------------------
+    # Article 53(1)(c): Copyright Compliance & TDM Opt-Out
+    # ---------------------------------------------------------------------
+    sh:property [
+        sh:path regu:hasDataGovernance ;
+        sh:minCount 1 ;
+        sh:severity sh:Violation ;
+        sh:message "EU AI Act Art 53(1)(c) Non-Conformity: Providers of GPAI models must put in place a policy to comply with Union copyright law (Directive (EU) 2019/790) and respect text and data mining opt-outs." ;
+    ] ;
+
+    # ---------------------------------------------------------------------
+    # Article 55: Adversarial Red-Teaming & Safety Evaluation
+    # ---------------------------------------------------------------------
+    sh:property [
+        sh:path regu:hasCybersecurityControl ;
+        sh:minCount 1 ;
+        sh:severity sh:Violation ;
+        sh:message "EU AI Act Art 55(1)(a) Non-Conformity: Providers of GPAI models with systemic risk must conduct and document continuous adversarial testing (red-teaming) to identify and mitigate systemic risks." ;
+    ] ;
+    sh:property [
+        sh:path ( regu:hasCybersecurityControl regu:implementationStatus ) ;
+        sh:hasValue regu:Implemented ;
+        sh:severity sh:Violation ;
+        sh:message "EU AI Act Art 55(1)(a) Non-Conformity: Adversarial red-teaming defenses must be verified as 'Implemented'." ;
+    ] ;
+
+    # ---------------------------------------------------------------------
+    # Article 55(1)(b): Systemic Risk Mitigation & Monitoring
+    # ---------------------------------------------------------------------
+    sh:property [
+        sh:path regu:hasRiskManagementSystem ;
+        sh:minCount 1 ;
+        sh:severity sh:Violation ;
+        sh:message "EU AI Act Art 55(1)(b) Non-Conformity: Providers of GPAI models with systemic risk must continuously assess and mitigate systemic risks, including serious incidents." ;
+    ] ;
+    sh:property [
+        sh:path ( regu:hasRiskManagementSystem regu:implementationStatus ) ;
+        sh:hasValue regu:Implemented ;
+        sh:severity sh:Violation ;
+        sh:message "EU AI Act Art 55(1)(b) Non-Conformity: Systemic risk management system must be 'Implemented'." ;
+    ] .

src/ontology/shacl/prohibited_shapes.ttl

@@ -0,0 +1,31 @@
+@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
+@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
+@prefix sh: <http://www.w3.org/ns/shacl#> .
+@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
+@prefix regu: <http://regu.ai/schema#> .
+@prefix eu: <http://data.europa.eu/eli/reg/2024/1689#> .
+
+# =========================================================================
+# ReguAI Normative SHACL Shape Validation: Article 5 Prohibited AI Practices
+# Regulation (EU) 2024/1689 - Chapter II (Prohibited Practices)
+# =========================================================================
+
+regu:ProhibitedAISystemShape
+    a sh:NodeShape ;
+    sh:targetClass regu:ProhibitedAISystem ;
+    sh:name "EU AI Act Article 5 Prohibited Practice Mandatory Ban Shape" ;
+    sh:description "Enforces the absolute statutory prohibition on placing on the market, putting into service or using AI systems under Article 5." ;
+
+    sh:property [
+        sh:path regu:prohibitionStatus ;
+        sh:hasValue regu:PermittedSystem ;
+        sh:severity sh:Violation ;
+        sh:message "EU AI Act Art 5 Non-Conformity: The AI system engages in an explicitly prohibited AI practice under Article 5 (unacceptable risk). Placing on the market, putting into service or using this system is strictly unlawful across the European Union." ;
+    ] ;
+
+    sh:property [
+        sh:path regu:hasProhibitedPracticeType ;
+        sh:maxCount 0 ;
+        sh:severity sh:Violation ;
+        sh:message "EU AI Act Art 5(1) Non-Conformity: Detected prohibited AI capability (e.g. emotion recognition in workplace/education, social scoring, biometric scraping, or subliminal manipulation). Immediate market withdrawal required." ;
+    ] .

tests/test_shacl_engine.py

@@ -51,3 +51,29 @@ def test_non_compliant_hr_fails(components):
     assert any("14" in art for art in violation_articles)
     assert any("10" in art for art in violation_articles)
     assert score < 80.0
+
+
+def test_prohibited_emotion_recognition_fails(components):
+    proh_file = SYNTHETIC_DIR / "prohibited_emotion_recognition_workplace.json"
+    spec = components["parser"].parse_file(proh_file)
+    spec = components["extractor"].enrich_system_specification(spec)
+    graph = components["builder"].build_system_graph(spec)
+
+    conforms, violations, warnings, score = components["engine"].validate_system(graph)
+
+    assert conforms is False
+    assert len(violations) >= 1
+    violation_articles = [v.regulatory_article for v in violations]
+    # Must flag Article 5 Prohibited Practice
+    assert any("5" in art for art in violation_articles)
+
+
+def test_gpai_foundation_llm_evaluates(components):
+    gpai_file = SYNTHETIC_DIR / "gpai_foundation_llm.json"
+    spec = components["parser"].parse_file(gpai_file)
+    spec = components["extractor"].enrich_system_specification(spec)
+    graph = components["builder"].build_system_graph(spec)
+
+    conforms, violations, warnings, score = components["engine"].validate_system(graph)
+    assert conforms is True
+    assert len(violations) == 0