Deploy ReguAI: Neuro-Symbolic AI GRC & Automated Conformity Assessment Engine

.gitignore

@@ -0,0 +1,12 @@
+__pycache__/
+*.py[cod]
+*$py.class
+.pytest_cache/
+.venv/
+venv/
+ENV/
+.env
+.idea/
+.vscode/
+*.swp
+.DS_Store

api.py

@@ -161,16 +161,59 @@ def evaluate_specification(request: AuditRequest):
         raise HTTPException(status_code=500, detail=f"Conformity assessment failed: {str(e)}")
 
 
+from src.core.case_catalog import CaseStudyCatalog
+
+catalog = CaseStudyCatalog()
+
+
+@app.get("/api/v1/benchmarks/catalog", tags=["Benchmarks"])
+def get_benchmark_catalog(domain: Optional[str] = Query(None, description="Optional domain filter, e.g. 'healthcare_samd'")):
+    """
+    Returns the complete multi-domain benchmark case studies catalog
+    with EUR-Lex CELEX:32024R1689 cryptographic provenance and W3C PROV-O anchors.
+    """
+    if domain:
+        cases = catalog.get_cases_for_domain(domain)
+        dom_info = catalog.get_domain(domain)
+        return {
+            "domain": dom_info,
+            "total_cases": len(cases),
+            "case_studies": cases,
+        }
+    return catalog.raw_data
+
+
+@app.get("/api/v1/benchmarks/cases/{case_id}", tags=["Benchmarks"])
+def get_benchmark_case(case_id: str):
+    """
+    Retrieves full benchmark case study details, statutory citations,
+    cryptographic provenance hashes, and technical specification text.
+    """
+    case = catalog.get_case(case_id)
+    if not case:
+        raise HTTPException(status_code=404, detail=f"Benchmark case '{case_id}' not found.")
+    
+    spec_text = catalog.get_case_document_text(case_id)
+    return {
+        "case_metadata": case,
+        "raw_specification_text": spec_text,
+    }
+
+
 @app.get("/api/v1/audit/samples", tags=["Benchmarks"])
 def list_benchmark_samples():
-    """Returns available pre-loaded synthetic case studies."""
-    return [
-        {"id": "compliant_clinical_samd", "title": "OncoScan AI Diagnostic Assistant (SaMD - Compliant)"},
-        {"id": "non_compliant_hr_recruitment", "title": "TalentSift Automated Candidate Evaluator (HR - Violations)"},
-        {"id": "borderline_credit_scoring", "title": "CrediScore Neural Underwriter (FinTech - Planned Roadmap)"},
-        {"id": "prohibited_emotion_recognition_workplace", "title": "MindGaze Emotion Tracker (EdTech/HR - Article 5 Prohibited)"},
-        {"id": "gpai_foundation_llm", "title": "Nexus-70B Frontier Foundation Model (GPAI - Systemic Risk)"},
-    ]
+    """Returns all available benchmark case studies from the multi-domain catalog."""
+    samples = []
+    for domain in catalog.list_domains():
+        for case in domain.get("case_studies", []):
+            samples.append({
+                "id": case["case_id"],
+                "title": f"[{domain['domain_name']}] {case['title']}",
+                "domain": domain["domain_id"],
+                "statutory_tier": case["statutory_tier"],
+                "expected_conformity": case["expected_conformity"],
+            })
+    return samples
 
 
 @app.get("/api/v1/audit/samples/{sample_id}", tags=["Benchmarks"])
@@ -178,6 +221,12 @@ def get_sample_content(sample_id: str):
     """Retrieves full specification content for a sample."""
     file_path = SYNTHETIC_DIR / f"{sample_id}.json"
     if not file_path.exists():
+        # Fallback to catalog lookup
+        case = catalog.get_case(sample_id)
+        if case and case.get("file_path"):
+            full_path = Path(case["file_path"])
+            if full_path.exists():
+                return json.loads(full_path.read_text(encoding="utf-8"))
         raise HTTPException(status_code=404, detail="Sample not found.")
     data = json.loads(file_path.read_text(encoding="utf-8"))
     return data

app.py

@@ -18,25 +18,40 @@ from src.core.config import SYNTHETIC_DIR
 from src.core.models import AssertionStatus, EntityCategory
 from src.ui.graph_view import RegulatoryGraphView
 
-# Initialize ReguAI Engine & Graph Visualizer
+from src.core.case_catalog import CaseStudyCatalog
+
+# Initialize ReguAI Engine & Graph Visualizer & Case Study Catalog
 engine = ReguAIEngine()
 graph_viewer = RegulatoryGraphView()
+catalog = CaseStudyCatalog()
 
-# Pre-load sample specifications
-SAMPLE_PATHS = {
-    "Healthcare / Medical AI (Compliant SaMD - Articles 9-15 Passed)": SYNTHETIC_DIR / "compliant_clinical_samd.json",
-    "HR / Recruitment AI (High-Risk - Human Oversight & Bias Non-Conformities)": SYNTHETIC_DIR / "non_compliant_hr_recruitment.json",
-    "FinTech / Credit Underwriting (Borderline - Planned Roadmap & Auditor Review)": SYNTHETIC_DIR / "borderline_credit_scoring.json",
-    "EdTech / Surveillance AI (Prohibited - Article 5(1)(f) Emotion Recognition)": SYNTHETIC_DIR / "prohibited_emotion_recognition_workplace.json",
-    "GPAI Foundation LLM (Systemic Risk - Articles 51-55 Compute > 10^25 FLOPs)": SYNTHETIC_DIR / "gpai_foundation_llm.json",
-}
+# Pre-load domains and cases
+DOMAIN_OPTIONS = [d["domain_name"] for d in catalog.list_domains()]
+DEFAULT_DOMAIN = DOMAIN_OPTIONS[0]
+DEFAULT_CASES = catalog.get_cases_for_domain(DEFAULT_DOMAIN)
+DEFAULT_CASE_TITLES = [c["title"] for c in DEFAULT_CASES]
+DEFAULT_CASE_TITLE = DEFAULT_CASE_TITLES[0]
+DEFAULT_SPEC_TEXT = catalog.get_case_document_text(DEFAULT_CASE_TITLE)
+DEFAULT_FACTSHEET = catalog.render_factsheet_html(DEFAULT_CASE_TITLE)
+
+
+def on_domain_change(selected_domain_name: str):
+    cases = catalog.get_cases_for_domain(selected_domain_name)
+    if not cases:
+        return gr.update(choices=[], value=None), "", "<div style='padding:15px;'>No cases found.</div>"
+    titles = [c["title"] for c in cases]
+    first_title = titles[0]
+    text = catalog.get_case_document_text(first_title)
+    factsheet = catalog.render_factsheet_html(first_title)
+    return gr.update(choices=titles, value=first_title), text, factsheet
 
-def load_sample_content(sample_name: str) -> str:
-    path = SAMPLE_PATHS.get(sample_name)
-    if path and path.exists():
-        data = json.loads(path.read_text(encoding="utf-8"))
-        return data.get("raw_document_text", "")
-    return ""
+
+def on_case_change(selected_case_title: str):
+    if not selected_case_title:
+        return "", "<div style='padding:15px;'>Select a case study.</div>"
+    text = catalog.get_case_document_text(selected_case_title)
+    factsheet = catalog.render_factsheet_html(selected_case_title)
+    return text, factsheet
 
 
 def run_assessment(doc_text: str, auditor_id: str, annual_turnover: float = 50000000.0, is_sme: bool = False):
@@ -484,6 +499,37 @@ button:not(.primary):not([variant="primary"]) {
     border-color: #475569 !important;
     color: #e2e8f0 !important;
 }
+
+/* -------------------------------------------------------------
+   FACTSHEET & PROVENANCE STYLING (Dark & Light Mode)
+------------------------------------------------------------- */
+.factsheet-container {
+    background: #ffffff !important;
+    border: 1px solid #cbd5e1 !important;
+    border-radius: 8px !important;
+}
+
+.dark .factsheet-container {
+    background: #1e293b !important;
+    border-color: #334155 !important;
+    color: #e2e8f0 !important;
+}
+
+.dark .factsheet-container h3 {
+    color: #f8fafc !important;
+}
+
+.dark .factsheet-container div[style*="background:#f8fafc"] {
+    background: #0f172a !important;
+    border-color: #334155 !important;
+    color: #cbd5e1 !important;
+}
+
+.dark .factsheet-container div[style*="background:#fffbeb"] {
+    background: #451a03 !important;
+    border-color: #78350f !important;
+    color: #fef3c7 !important;
+}
 """
 
 with gr.Blocks(title="ReguAI: Neuro-Symbolic AI GRC Engine") as demo:
@@ -507,16 +553,30 @@ with gr.Blocks(title="ReguAI: Neuro-Symbolic AI GRC Engine") as demo:
 
     with gr.Row():
         with gr.Column(scale=5):
-            sample_dropdown = gr.Dropdown(
-                label="📁 Select Pre-loaded High-Risk AI Benchmark Case Study",
-                choices=list(SAMPLE_PATHS.keys()),
-                value=list(SAMPLE_PATHS.keys())[0],
+            with gr.Row():
+                domain_dropdown = gr.Dropdown(
+                    label="🌐 1. Select Regulatory Domain / Statutory Classification",
+                    choices=DOMAIN_OPTIONS,
+                    value=DEFAULT_DOMAIN,
+                    scale=6,
+                    interactive=True,
+                )
+                case_dropdown = gr.Dropdown(
+                    label="📁 2. Select Benchmark Case Study & Legal Scenario",
+                    choices=DEFAULT_CASE_TITLES,
+                    value=DEFAULT_CASE_TITLE,
+                    scale=6,
+                    interactive=True,
+                )
+            factsheet_box = gr.HTML(
+                value=DEFAULT_FACTSHEET,
+                label="Statutory Reference Factsheet & Cryptographic Provenance",
             )
             spec_input = gr.Textbox(
                 label="📄 System Technical Specification / Model Card (Markdown or JSON)",
-                lines=14,
+                lines=12,
                 placeholder="Paste AI system architecture or model card text...",
-                value=load_sample_content(list(SAMPLE_PATHS.keys())[0]),
+                value=DEFAULT_SPEC_TEXT,
             )
             auditor_input = gr.Textbox(
                 label="Auditor Credential Identifier",
@@ -597,10 +657,15 @@ with gr.Blocks(title="ReguAI: Neuro-Symbolic AI GRC Engine") as demo:
                             jsonld_display = gr.Code(language="json", label="W3C JSON-LD Digital Certificate")
 
     # Wire event handlers
-    sample_dropdown.change(
-        fn=load_sample_content,
-        inputs=[sample_dropdown],
-        outputs=[spec_input],
+    domain_dropdown.change(
+        fn=on_domain_change,
+        inputs=[domain_dropdown],
+        outputs=[case_dropdown, spec_input, factsheet_box],
+    )
+    case_dropdown.change(
+        fn=on_case_change,
+        inputs=[case_dropdown],
+        outputs=[spec_input, factsheet_box],
     )
 
     assess_btn.click(

data/active_learning_triplets.jsonl

@@ -8,3 +8,9 @@
 {"timestamp": "2026-09-20T19:37:14.849175+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}
 {"timestamp": "2026-09-20T19:38:35.112557+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}
 {"timestamp": "2026-09-20T19:47:07.934259+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}
+{"timestamp": "2026-09-20T19:49:52.834161+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}
+{"timestamp": "2026-09-20T19:59:08.362357+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}
+{"timestamp": "2026-09-20T20:00:05.705224+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}
+{"timestamp": "2026-09-20T20:00:20.408608+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}
+{"timestamp": "2026-09-20T20:00:35.196971+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}
+{"timestamp": "2026-09-20T20:01:32.495427+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}

data/benchmarks/case_studies_catalog.json

@@ -0,0 +1,740 @@
+{
+  "catalog_title": "ReguAI Exhaustive Multi-Domain Regulatory Case Study Catalog",
+  "catalog_version": "2.0.0",
+  "statutory_act": "Regulation (EU) 2024/1689 of the European Parliament and of the Council",
+  "official_journal": "OJ L, 2024/1689, 12.7.2024",
+  "eli_uri": "http://data.europa.eu/eli/reg/2024/1689/oj",
+  "celex": "32024R1689",
+  "domains": [
+    {
+      "domain_id": "healthcare_samd",
+      "domain_name": "🏥 Healthcare & Medical SaMD",
+      "statutory_category": "Annex I (MDR/IVDR) & Annex III Point 5(a)",
+      "legal_basis": "Regulation (EU) 2024/1689, Article 6(1) & Regulation (EU) 2017/745 (MDR)",
+      "domain_summary": "AI Software as a Medical Device (SaMD) used for diagnostic classification, patient risk stratification, and emergency medical triage.",
+      "case_studies": [
+        {
+          "case_id": "compliant_clinical_samd",
+          "title": "CardioScan / OncoScan AI Diagnostic Imaging (SaMD)",
+          "system_id": "samd-oncology-01",
+          "statutory_tier": "High-Risk (Annex I, Medical Device - Article 6(1))",
+          "legal_basis": "Regulation (EU) 2024/1689, Article 6(1) & MDR Class IIa",
+          "expected_conformity": "CONFORMANT (PASSED)",
+          "file_path": "data/synthetic_systems/compliant_clinical_samd.json",
+          "statutory_quote": "AI systems referred to in Annex I shall be considered high-risk if they are intended to be used as a safety component of a product, or are themselves a product, covered by Union harmonisation legislation listed in Annex I and are required to undergo a third-party conformity assessment.",
+          "regulatory_requirements": {
+            "mandatory_articles": [
+              "Article 9",
+              "Article 10",
+              "Article 10(2)(f)",
+              "Article 11",
+              "Article 12",
+              "Article 13",
+              "Article 14",
+              "Article 15"
+            ],
+            "harmonized_frameworks": {
+              "nist_ai_rmf": [
+                "GOVERN-1.1",
+                "MAP-1.5",
+                "MEASURE-2.11",
+                "MANAGE-2.2"
+              ],
+              "iso_42001": [
+                "Clause 6.1.2",
+                "Control A.6.2",
+                "Control A.8.4",
+                "Control A.9.2"
+              ],
+              "gdpr": [
+                "Article 9(2)(h) Health Data",
+                "Article 22(3) Human Safeguards",
+                "Article 35 DPIA"
+              ]
+            },
+            "conformity_procedure": "Annex VII: Notified Body Assessment combined with MDR Notified Body audit",
+            "fine_exposure_tier": "Tier 2 (€15,000,000 or 3% global turnover)"
+          },
+          "auditor_guidance": {
+            "intended_purpose": "Automated thoracic CT nodule segmentation and malignancy risk stratification.",
+            "common_pitfalls": "Relying purely on retrospective clinical datasets without validating demographic parity across diverse hospital imaging scanners; absence of radiologist manual override logs.",
+            "remediation_guidance": "Implement continuous ISO 14971 risk management, multi-center bias audits, and radiologist-in-the-loop confirmative oversight."
+          },
+          "file_sha256": "10307075b872d46a5d99f53dc7ed78cb6deccae74d707f5e4b55dc3483e68768",
+          "provenance": {
+            "statutory_act": "Regulation (EU) 2024/1689 of the European Parliament and of the Council",
+            "official_journal": "OJ L, 2024/1689, 12.7.2024",
+            "eli_uri": "http://data.europa.eu/eli/reg/2024/1689/oj",
+            "celex": "32024R1689",
+            "statutory_quote": "AI systems referred to in Annex I shall be considered high-risk if they are intended to be used as a safety component of a product, or are themselves a product, covered by Union harmonisation legislation listed in Annex I and are required to undergo a third-party conformity assessment.",
+            "statutory_quote_sha256": "5dcc4a383d81f69e7988c97f6e6e2d5b85bcd096ebd033df9cb198b12433d785",
+            "spec_file_sha256": "10307075b872d46a5d99f53dc7ed78cb6deccae74d707f5e4b55dc3483e68768",
+            "prov_o_entity": "urn:reguai:benchmark:case:compliant_clinical_samd",
+            "author": "ReguAI Regulatory Engineering Working Group",
+            "verification_method": "W3C PROV-O & SHA-256 Canonical Digest",
+            "timestamp": "2026-09-20T20:55:00Z"
+          }
+        }
+      ]
+    },
+    {
+      "domain_id": "employment_hr",
+      "domain_name": "💼 Employment, HR & Workforce Management",
+      "statutory_category": "Annex III Point 4",
+      "legal_basis": "Regulation (EU) 2024/1689, Annex III, Point 4(a) & 4(b)",
+      "domain_summary": "AI systems used for recruitment, CV screening, job candidate evaluation, task allocation, and worker performance monitoring.",
+      "case_studies": [
+        {
+          "case_id": "non_compliant_hr_recruitment",
+          "title": "TalentRank AI - Automated CV Screening & Candidate Ranking",
+          "system_id": "hr-recruitment-02",
+          "statutory_tier": "High-Risk (Annex III, Point 4(a))",
+          "legal_basis": "Regulation (EU) 2024/1689, Annex III, Point 4(a)",
+          "expected_conformity": "NON-CONFORMANT (FAILED)",
+          "file_path": "data/synthetic_systems/non_compliant_hr_recruitment.json",
+          "statutory_quote": "AI systems intended to be used for recruitment or selection of natural persons, notably to place targeted job advertisements, to screen or filter applications, and to evaluate candidates.",
+          "regulatory_requirements": {
+            "mandatory_articles": [
+              "Article 9",
+              "Article 10(2)(f)",
+              "Article 13",
+              "Article 14",
+              "Article 15"
+            ],
+            "harmonized_frameworks": {
+              "nist_ai_rmf": [
+                "GOVERN-1.1",
+                "MAP-1.5",
+                "MEASURE-2.11"
+              ],
+              "iso_42001": [
+                "Control A.6.2",
+                "Control A.8.4"
+              ],
+              "gdpr": [
+                "Article 9(2)(g)",
+                "Article 22(3) Automated Decisions"
+              ]
+            },
+            "conformity_procedure": "Annex VI: Internal Control Assessment",
+            "fine_exposure_tier": "Tier 2 (€15,000,000 or 3% global turnover)"
+          },
+          "auditor_guidance": {
+            "intended_purpose": "Autonomous résumé ingestion, semantic ranking, and interview invitation generation.",
+            "common_pitfalls": "Historic gender and demographic bias encoded in legacy recruitment datasets; lack of explicit human intervention kill switch before candidates are rejected.",
+            "remediation_guidance": "Perform disparate impact parity analysis (Four-Fifths rule / Equal Opportunity Difference) and require mandatory HR officer approval for all candidate rejections."
+          },
+          "file_sha256": "c6ec9c67206cdbf275a7eb1eab0c9e85579d5bc428b503fc9a80040ce936524a",
+          "provenance": {
+            "statutory_act": "Regulation (EU) 2024/1689 of the European Parliament and of the Council",
+            "official_journal": "OJ L, 2024/1689, 12.7.2024",
+            "eli_uri": "http://data.europa.eu/eli/reg/2024/1689/oj",
+            "celex": "32024R1689",
+            "statutory_quote": "AI systems intended to be used for recruitment or selection of natural persons, notably to place targeted job advertisements, to screen or filter applications, and to evaluate candidates.",
+            "statutory_quote_sha256": "3c4764f14ff071e389175e3676bd3852b557469139a57fa652afe25cb5dde2ad",
+            "spec_file_sha256": "c6ec9c67206cdbf275a7eb1eab0c9e85579d5bc428b503fc9a80040ce936524a",
+            "prov_o_entity": "urn:reguai:benchmark:case:non_compliant_hr_recruitment",
+            "author": "ReguAI Regulatory Engineering Working Group",
+            "verification_method": "W3C PROV-O & SHA-256 Canonical Digest",
+            "timestamp": "2026-09-20T20:55:00Z"
+          }
+        }
+      ]
+    },
+    {
+      "domain_id": "banking_finance",
+      "domain_name": "🏦 Financial Services, Credit & Insurance",
+      "statutory_category": "Annex III Point 5",
+      "legal_basis": "Regulation (EU) 2024/1689, Annex III, Point 5(b) & 5(c)",
+      "domain_summary": "AI systems used to evaluate creditworthiness of natural persons, establish credit scores, or price risk in life and health insurance.",
+      "case_studies": [
+        {
+          "case_id": "borderline_credit_scoring",
+          "title": "CreditScore-Next - Consumer Credit Risk Underwriting",
+          "system_id": "fin-credit-03",
+          "statutory_tier": "High-Risk (Annex III, Point 5(b))",
+          "legal_basis": "Regulation (EU) 2024/1689, Annex III, Point 5(b)",
+          "expected_conformity": "BORDERLINE (AUDITOR REVIEW)",
+          "file_path": "data/synthetic_systems/borderline_credit_scoring.json",
+          "statutory_quote": "AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud.",
+          "regulatory_requirements": {
+            "mandatory_articles": [
+              "Article 9",
+              "Article 10",
+              "Article 10(2)(f)",
+              "Article 13",
+              "Article 14"
+            ],
+            "harmonized_frameworks": {
+              "nist_ai_rmf": [
+                "MAP-1.5",
+                "MEASURE-2.11",
+                "MANAGE-2.2"
+              ],
+              "iso_42001": [
+                "Control A.8.2",
+                "Control A.8.4"
+              ],
+              "gdpr": [
+                "Article 13/14 Transparency",
+                "Article 22 Automated Decision-Making"
+              ]
+            },
+            "conformity_procedure": "Annex VI: Internal Control Assessment",
+            "fine_exposure_tier": "Tier 2 (€15,000,000 or 3% global turnover)"
+          },
+          "auditor_guidance": {
+            "intended_purpose": "Consumer credit underwriting predicting loan default risk probabilities.",
+            "common_pitfalls": "Treating planned roadmap commitments (e.g. 'bias mitigation planned for Q3') as implemented controls; lack of adverse action explanatory notices under Article 13.",
+            "remediation_guidance": "Verify that all bias examination and human oversight controls are verified in production prior to loan disbursement."
+          },
+          "file_sha256": "c2f2a3f2b106b2e158e80193b79f6438ff96cd7c50a20dcd1a81096c3b671833",
+          "provenance": {
+            "statutory_act": "Regulation (EU) 2024/1689 of the European Parliament and of the Council",
+            "official_journal": "OJ L, 2024/1689, 12.7.2024",
+            "eli_uri": "http://data.europa.eu/eli/reg/2024/1689/oj",
+            "celex": "32024R1689",
+            "statutory_quote": "AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud.",
+            "statutory_quote_sha256": "79978eed3683f16e8cc3ad64ec9483f34fdb772b7bf840c5221843490de934be",
+            "spec_file_sha256": "c2f2a3f2b106b2e158e80193b79f6438ff96cd7c50a20dcd1a81096c3b671833",
+            "prov_o_entity": "urn:reguai:benchmark:case:borderline_credit_scoring",
+            "author": "ReguAI Regulatory Engineering Working Group",
+            "verification_method": "W3C PROV-O & SHA-256 Canonical Digest",
+            "timestamp": "2026-09-20T20:55:00Z"
+          }
+        }
+      ]
+    },
+    {
+      "domain_id": "transport_safety",
+      "domain_name": "🚗 Automotive & Road Transport Safety",
+      "statutory_category": "Annex I & Annex III Point 2",
+      "legal_basis": "Regulation (EU) 2024/1689, Article 6(1) & Regulation (EU) 2019/2144 (General Vehicle Safety)",
+      "domain_summary": "AI safety components in autonomous and semi-autonomous vehicles, collision avoidance, and automated emergency braking (AEB).",
+      "case_studies": [
+        {
+          "case_id": "transport_autonomous_braking",
+          "title": "AutoDrive SafeStop - Autonomous Emergency Braking Safety Component",
+          "system_id": "transport-brake-01",
+          "statutory_tier": "High-Risk (Annex I, Automotive Safety Component - Article 6(1))",
+          "legal_basis": "Regulation (EU) 2024/1689, Article 6(1) & Annex I, Section B",
+          "expected_conformity": "CONFORMANT (PASSED)",
+          "file_path": "data/synthetic_systems/transport_autonomous_braking.json",
+          "statutory_quote": "AI systems referred to in Annex I shall be considered high-risk if they are intended to be used as a safety component of a product covered by Union harmonisation legislation listed in Annex I.",
+          "regulatory_requirements": {
+            "mandatory_articles": [
+              "Article 9",
+              "Article 10",
+              "Article 11",
+              "Article 12",
+              "Article 14",
+              "Article 15"
+            ],
+            "harmonized_frameworks": {
+              "nist_ai_rmf": [
+                "GOVERN-1.1",
+                "MANAGE-2.2"
+              ],
+              "iso_42001": [
+                "Control A.6.2",
+                "Control A.9.3"
+              ],
+              "gdpr": [
+                "Article 25 Data Protection by Design",
+                "Article 32 Security"
+              ]
+            },
+            "conformity_procedure": "Vehicle Type Approval (UN ECE / Regulation (EU) 2019/2144)",
+            "fine_exposure_tier": "Tier 2 (€15,000,000 or 3% global turnover)"
+          },
+          "auditor_guidance": {
+            "intended_purpose": "Safety component for automated emergency braking in commercial transport trucks.",
+            "common_pitfalls": "Edge-case weather degradation (dense fog, blizzard); sensor blinding; lack of physical driver override precedence.",
+            "remediation_guidance": "Implement ISO 26262 ASIL-D hardware-in-the-loop validation and driver steering/braking mechanical override."
+          },
+          "file_sha256": "05711b454abc603d0578da44e1b3fcd9c38b89b070753c4ef9f3dda28f577d1c",
+          "provenance": {
+            "statutory_act": "Regulation (EU) 2024/1689 of the European Parliament and of the Council",
+            "official_journal": "OJ L, 2024/1689, 12.7.2024",
+            "eli_uri": "http://data.europa.eu/eli/reg/2024/1689/oj",
+            "celex": "32024R1689",
+            "statutory_quote": "AI systems referred to in Annex I shall be considered high-risk if they are intended to be used as a safety component of a product covered by Union harmonisation legislation listed in Annex I.",
+            "statutory_quote_sha256": "76d72016601abdcf78c934d9ba402cb4321905234ff2f1d433e9d70389e7fd94",
+            "spec_file_sha256": "05711b454abc603d0578da44e1b3fcd9c38b89b070753c4ef9f3dda28f577d1c",
+            "prov_o_entity": "urn:reguai:benchmark:case:transport_autonomous_braking",
+            "author": "ReguAI Regulatory Engineering Working Group",
+            "verification_method": "W3C PROV-O & SHA-256 Canonical Digest",
+            "timestamp": "2026-09-20T20:55:00Z"
+          }
+        }
+      ]
+    },
+    {
+      "domain_id": "critical_infrastructure",
+      "domain_name": "⚡ Critical Infrastructure & Energy",
+      "statutory_category": "Annex III Point 2(a)",
+      "legal_basis": "Regulation (EU) 2024/1689, Annex III, Point 2(a)",
+      "domain_summary": "AI systems used as safety components in the management and operation of critical digital infrastructure, electricity, water, or gas grids.",
+      "case_studies": [
+        {
+          "case_id": "critical_infra_smart_grid",
+          "title": "VoltBalance - Smart Grid Dispatch & Load Shedding Optimizer",
+          "system_id": "infra-grid-02",
+          "statutory_tier": "High-Risk (Annex III, Point 2(a) - Critical Infrastructure)",
+          "legal_basis": "Regulation (EU) 2024/1689, Annex III, Point 2(a)",
+          "expected_conformity": "CONFORMANT (PASSED)",
+          "file_path": "data/synthetic_systems/critical_infra_smart_grid.json",
+          "statutory_quote": "AI systems intended to be used as safety components in the management and operation of critical digital infrastructure, road traffic, or the supply of water, gas, heating or electricity.",
+          "regulatory_requirements": {
+            "mandatory_articles": [
+              "Article 9",
+              "Article 10",
+              "Article 12",
+              "Article 14",
+              "Article 15"
+            ],
+            "harmonized_frameworks": {
+              "nist_ai_rmf": [
+                "GOVERN-1.1",
+                "MANAGE-2.2"
+              ],
+              "iso_42001": [
+                "Control A.8.4",
+                "Control A.9.2"
+              ],
+              "gdpr": [
+                "Article 32 Security of Processing"
+              ]
+            },
+            "conformity_procedure": "Annex VI: Internal Control Assessment + NIS 2 Directive compliance",
+            "fine_exposure_tier": "Tier 2 (€15,000,000 or 3% global turnover)"
+          },
+          "auditor_guidance": {
+            "intended_purpose": "Predicting transmission grid frequency instability and automating substation load shedding.",
+            "common_pitfalls": "Adversarial sensor manipulation in SCADA protocols; unmitigated cascading blackout failure modes.",
+            "remediation_guidance": "Enforce IEC 62351 cybersecurity controls, air-gapped network segmentation, and human operator dispatch confirmation thresholds."
+          },
+          "file_sha256": "e1f880b6b7c75160ec093460a5aee7cbe7c3799f012edf9766c8b7742618ca2a",
+          "provenance": {
+            "statutory_act": "Regulation (EU) 2024/1689 of the European Parliament and of the Council",
+            "official_journal": "OJ L, 2024/1689, 12.7.2024",
+            "eli_uri": "http://data.europa.eu/eli/reg/2024/1689/oj",
+            "celex": "32024R1689",
+            "statutory_quote": "AI systems intended to be used as safety components in the management and operation of critical digital infrastructure, road traffic, or the supply of water, gas, heating or electricity.",
+            "statutory_quote_sha256": "e0c3c5f1b40de5454437f0eb284e65cea7490366fc37beb29c6f76609bffe60d",
+            "spec_file_sha256": "e1f880b6b7c75160ec093460a5aee7cbe7c3799f012edf9766c8b7742618ca2a",
+            "prov_o_entity": "urn:reguai:benchmark:case:critical_infra_smart_grid",
+            "author": "ReguAI Regulatory Engineering Working Group",
+            "verification_method": "W3C PROV-O & SHA-256 Canonical Digest",
+            "timestamp": "2026-09-20T20:55:00Z"
+          }
+        }
+      ]
+    },
+    {
+      "domain_id": "education_training",
+      "domain_name": "🎓 Education & Vocational Training",
+      "statutory_category": "Annex III Point 3",
+      "legal_basis": "Regulation (EU) 2024/1689, Annex III, Point 3(a) & 3(b)",
+      "domain_summary": "AI systems used for student admission, assignment, grading, and monitoring or detecting prohibited behaviour of students during tests.",
+      "case_studies": [
+        {
+          "case_id": "education_remote_proctoring",
+          "title": "ExamGuard AI - Remote Exam Video Surveillance & Cheating Detection",
+          "system_id": "edu-proctor-03",
+          "statutory_tier": "High-Risk (Annex III, Point 3(b) - Education & Vocational Training)",
+          "legal_basis": "Regulation (EU) 2024/1689, Annex III, Point 3(b)",
+          "expected_conformity": "NON-CONFORMANT (FAILED)",
+          "file_path": "data/synthetic_systems/education_remote_proctoring.json",
+          "statutory_quote": "AI systems intended to be used for monitoring and detecting prohibited behaviour of students during tests in the context of or within educational and vocational training institutions.",
+          "regulatory_requirements": {
+            "mandatory_articles": [
+              "Article 9",
+              "Article 10(2)(f)",
+              "Article 13",
+              "Article 14",
+              "Article 15"
+            ],
+            "harmonized_frameworks": {
+              "nist_ai_rmf": [
+                "MAP-1.5",
+                "MEASURE-2.11"
+              ],
+              "iso_42001": [
+                "Control A.6.2",
+                "Control A.8.4"
+              ],
+              "gdpr": [
+                "Article 9 Special Category Biometric Data",
+                "Article 22(3)"
+              ]
+            },
+            "conformity_procedure": "Annex VI: Internal Control Assessment",
+            "fine_exposure_tier": "Tier 2 (€15,000,000 or 3% global turnover)"
+          },
+          "auditor_guidance": {
+            "intended_purpose": "Automated webcam gaze tracking and cheating detection during remote university exams.",
+            "common_pitfalls": "High false-positive rate against neurodivergent students; automated exam disqualification without human proctor confirmation.",
+            "remediation_guidance": "Mandate board-certified proctor review for any academic integrity violation; disable autonomous disqualifications."
+          },
+          "file_sha256": "6df408982de7afa0a061d22b05d146dc58b0944fba3d2522d8f91ce9559a2ac7",
+          "provenance": {
+            "statutory_act": "Regulation (EU) 2024/1689 of the European Parliament and of the Council",
+            "official_journal": "OJ L, 2024/1689, 12.7.2024",
+            "eli_uri": "http://data.europa.eu/eli/reg/2024/1689/oj",
+            "celex": "32024R1689",
+            "statutory_quote": "AI systems intended to be used for monitoring and detecting prohibited behaviour of students during tests in the context of or within educational and vocational training institutions.",
+            "statutory_quote_sha256": "4a08282d283284eb1b8d54a12b1067ac5b5e6e7325757e059c52d7ecd3d3030e",
+            "spec_file_sha256": "6df408982de7afa0a061d22b05d146dc58b0944fba3d2522d8f91ce9559a2ac7",
+            "prov_o_entity": "urn:reguai:benchmark:case:education_remote_proctoring",
+            "author": "ReguAI Regulatory Engineering Working Group",
+            "verification_method": "W3C PROV-O & SHA-256 Canonical Digest",
+            "timestamp": "2026-09-20T20:55:00Z"
+          }
+        }
+      ]
+    },
+    {
+      "domain_id": "justice_law_enforcement",
+      "domain_name": "⚖️ Law Enforcement & Criminal Justice",
+      "statutory_category": "Annex III Points 6 & 8",
+      "legal_basis": "Regulation (EU) 2024/1689, Annex III, Point 6(a) & Point 8",
+      "domain_summary": "AI systems used for individual criminal risk assessments, recidivism forecasting, evidence evaluation, and assisting judicial authorities.",
+      "case_studies": [
+        {
+          "case_id": "justice_recidivism_risk",
+          "title": "JustiRisk - Criminal Recidivism & Bail Risk Scoring",
+          "system_id": "justice-recid-04",
+          "statutory_tier": "High-Risk (Annex III, Point 6(a) - Law Enforcement & Justice)",
+          "legal_basis": "Regulation (EU) 2024/1689, Annex III, Point 6(a)",
+          "expected_conformity": "NON-CONFORMANT (FAILED)",
+          "file_path": "data/synthetic_systems/justice_recidivism_risk.json",
+          "statutory_quote": "AI systems intended to be used by law enforcement authorities or on their behalf for making individual risk assessments of natural persons in order to assess the risk of a natural person offending or re-offending.",
+          "regulatory_requirements": {
+            "mandatory_articles": [
+              "Article 9",
+              "Article 10(2)(f)",
+              "Article 13",
+              "Article 14",
+              "Article 15"
+            ],
+            "harmonized_frameworks": {
+              "nist_ai_rmf": [
+                "GOVERN-1.1",
+                "MEASURE-2.11"
+              ],
+              "iso_42001": [
+                "Control A.6.2",
+                "Control A.8.4"
+              ],
+              "gdpr": [
+                "Article 10 Criminal Conviction Data",
+                "Article 22"
+              ]
+            },
+            "conformity_procedure": "Annex VI: Internal Control Assessment + Fundamental Rights Impact Assessment (FRIA, Art. 27)",
+            "fine_exposure_tier": "Tier 2 (€15,000,000 or 3% global turnover)"
+          },
+          "auditor_guidance": {
+            "intended_purpose": "Predicting defendant failure-to-appear and re-arrest probability for arraignment judges.",
+            "common_pitfalls": "Feedback loops amplifying historic policing disparities; lack of feature-level explainability to judges.",
+            "remediation_guidance": "Conduct independent algorithmic equity audits and furnish defense counsel with full mathematical factor weights."
+          },
+          "file_sha256": "d97c94dac615aa333ee6d91f180dbbe7e7091b790be4dd41e63709e90175a42f",
+          "provenance": {
+            "statutory_act": "Regulation (EU) 2024/1689 of the European Parliament and of the Council",
+            "official_journal": "OJ L, 2024/1689, 12.7.2024",
+            "eli_uri": "http://data.europa.eu/eli/reg/2024/1689/oj",
+            "celex": "32024R1689",
+            "statutory_quote": "AI systems intended to be used by law enforcement authorities or on their behalf for making individual risk assessments of natural persons in order to assess the risk of a natural person offending or re-offending.",
+            "statutory_quote_sha256": "3576a8d0a0ef17595478e6f5970b98bbfaa4f5735a905beb61da41ab20b130e7",
+            "spec_file_sha256": "d97c94dac615aa333ee6d91f180dbbe7e7091b790be4dd41e63709e90175a42f",
+            "prov_o_entity": "urn:reguai:benchmark:case:justice_recidivism_risk",
+            "author": "ReguAI Regulatory Engineering Working Group",
+            "verification_method": "W3C PROV-O & SHA-256 Canonical Digest",
+            "timestamp": "2026-09-20T20:55:00Z"
+          }
+        }
+      ]
+    },
+    {
+      "domain_id": "frontier_gpai",
+      "domain_name": "🌐 Frontier GPAI & Foundation Models",
+      "statutory_category": "Chapter V (Articles 51–55)",
+      "legal_basis": "Regulation (EU) 2024/1689, Chapter V, Articles 51, 52, 53, 55",
+      "domain_summary": "General-purpose AI models, frontier LLMs trained on > 10^25 FLOPs, systemic risk mitigations, and copyright opt-out enforcement.",
+      "case_studies": [
+        {
+          "case_id": "gpai_foundation_llm",
+          "title": "Nexus-70B Frontier Foundation LLM (>10^25 FLOPs)",
+          "system_id": "gpai-frontier-70b",
+          "statutory_tier": "GPAI with Systemic Risk (Article 51)",
+          "legal_basis": "Regulation (EU) 2024/1689, Chapter V, Article 51 & Article 55",
+          "expected_conformity": "CONFORMANT (PASSED)",
+          "file_path": "data/synthetic_systems/gpai_foundation_llm.json",
+          "statutory_quote": "A general-purpose AI model shall be presumed to have high impact capabilities when the cumulative amount of computation used for its training measured in floating point operations is greater than 10^25.",
+          "regulatory_requirements": {
+            "mandatory_articles": [
+              "Article 51",
+              "Article 53",
+              "Article 55"
+            ],
+            "harmonized_frameworks": {
+              "nist_ai_rmf": [
+                "GOVERN-1.1",
+                "MEASURE-2.6",
+                "MANAGE-2.2"
+              ],
+              "iso_42001": [
+                "Control A.8.2",
+                "Control A.9.3"
+              ],
+              "gdpr": [
+                "Directive (EU) 2019/790 DSM Copyright Opt-Out",
+                "Article 25"
+              ]
+            },
+            "conformity_procedure": "AI Office Code of Practice / Independent Red-Teaming Attestation",
+            "fine_exposure_tier": "Tier 2 (€15,000,000 or 3% global turnover)"
+          },
+          "auditor_guidance": {
+            "intended_purpose": "Multi-modal frontier foundation LLM deployed for downstream enterprise reasoning and code generation.",
+            "common_pitfalls": "Omission of training energy consumption reporting (MWh / tCO2eq); unverified compliance with EU copyright opt-out crawler policies (Directive (EU) 2019/790).",
+            "remediation_guidance": "Document FLOPs declarations, publish training energy metrics, and institute external adversarial red-teaming."
+          },
+          "file_sha256": "32ab439dd9aa11d48fd8229f36dc6881b33f0fe4a9f6b07ad80a2c0d3b2cb83c",
+          "provenance": {
+            "statutory_act": "Regulation (EU) 2024/1689 of the European Parliament and of the Council",
+            "official_journal": "OJ L, 2024/1689, 12.7.2024",
+            "eli_uri": "http://data.europa.eu/eli/reg/2024/1689/oj",
+            "celex": "32024R1689",
+            "statutory_quote": "A general-purpose AI model shall be presumed to have high impact capabilities when the cumulative amount of computation used for its training measured in floating point operations is greater than 10^25.",
+            "statutory_quote_sha256": "23266169a3d1d1e7d12699b60912f09b0f20e20b5a8f4f521193b8db2ad9dab8",
+            "spec_file_sha256": "32ab439dd9aa11d48fd8229f36dc6881b33f0fe4a9f6b07ad80a2c0d3b2cb83c",
+            "prov_o_entity": "urn:reguai:benchmark:case:gpai_foundation_llm",
+            "author": "ReguAI Regulatory Engineering Working Group",
+            "verification_method": "W3C PROV-O & SHA-256 Canonical Digest",
+            "timestamp": "2026-09-20T20:55:00Z"
+          }
+        }
+      ]
+    },
+    {
+      "domain_id": "prohibited_practices",
+      "domain_name": "🚫 Prohibited AI Practices (Article 5 - Zero Tolerance)",
+      "statutory_category": "Chapter II, Article 5",
+      "legal_basis": "Regulation (EU) 2024/1689, Article 5(1)(a)-(h)",
+      "domain_summary": "Strictly illegal AI systems causing unacceptable risk to fundamental human rights, subject to fatal ban and €35M statutory fines.",
+      "case_studies": [
+        {
+          "case_id": "prohibited_emotion_recognition_workplace",
+          "title": "MindGaze AI - Classroom & Workplace Emotion Recognition",
+          "system_id": "prohibit-emotion-01",
+          "statutory_tier": "Prohibited (Article 5(1)(f))",
+          "legal_basis": "Regulation (EU) 2024/1689, Article 5(1)(f)",
+          "expected_conformity": "PROHIBITED (FATAL VIOLATION)",
+          "file_path": "data/synthetic_systems/prohibited_emotion_recognition_workplace.json",
+          "statutory_quote": "the placing on the market, the putting into service or the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons.",
+          "regulatory_requirements": {
+            "mandatory_articles": [
+              "Article 5(1)(f)"
+            ],
+            "harmonized_frameworks": {
+              "nist_ai_rmf": [
+                "GOVERN-1.1 (Prohibited Use Policy)"
+              ],
+              "iso_42001": [
+                "Control A.6.1 Statutory Compliance"
+              ],
+              "gdpr": [
+                "Article 9 Special Category Biometric Data Violation"
+              ]
+            },
+            "conformity_procedure": "IMMEDIATE CEASE / PROHIBITED FROM UNION MARKET",
+            "fine_exposure_tier": "Tier 1 (€35,000,000 or 7% global turnover)"
+          },
+          "auditor_guidance": {
+            "intended_purpose": "Continuous automated facial micro-expression analysis to infer employee attentiveness and classroom student engagement.",
+            "common_pitfalls": "Attempting to justify workplace emotion tracking under the guise of productivity analytics or employee wellness monitoring.",
+            "remediation_guidance": "System must be completely decommissioned and withdrawn from EU deployment; no conformity procedure exists."
+          },
+          "file_sha256": "f580f8d3d2fe68e0fd35ac78909a8e5b3348327cc00566176be48707e4c18b66",
+          "provenance": {
+            "statutory_act": "Regulation (EU) 2024/1689 of the European Parliament and of the Council",
+            "official_journal": "OJ L, 2024/1689, 12.7.2024",
+            "eli_uri": "http://data.europa.eu/eli/reg/2024/1689/oj",
+            "celex": "32024R1689",
+            "statutory_quote": "the placing on the market, the putting into service or the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons.",
+            "statutory_quote_sha256": "a6acc3b61a54da5bfc645db359dea2d5a8da5b814c93a25f7009bcb64ef1cd7f",
+            "spec_file_sha256": "f580f8d3d2fe68e0fd35ac78909a8e5b3348327cc00566176be48707e4c18b66",
+            "prov_o_entity": "urn:reguai:benchmark:case:prohibited_emotion_recognition_workplace",
+            "author": "ReguAI Regulatory Engineering Working Group",
+            "verification_method": "W3C PROV-O & SHA-256 Canonical Digest",
+            "timestamp": "2026-09-20T20:55:00Z"
+          }
+        },
+        {
+          "case_id": "prohibited_social_scoring",
+          "title": "CitizenTrust - Universal Civic Score & Trustworthiness Engine",
+          "system_id": "prohibit-social-05",
+          "statutory_tier": "Prohibited (Article 5(1)(c))",
+          "legal_basis": "Regulation (EU) 2024/1689, Article 5(1)(c)",
+          "expected_conformity": "PROHIBITED (FATAL VIOLATION)",
+          "file_path": "data/synthetic_systems/prohibited_social_scoring.json",
+          "statutory_quote": "the placing on the market, the putting into service or the use of AI systems for the evaluation or classification of the trustworthiness of natural persons over a given period based on their social behaviour or known, inferred or predicted personal or personality characteristics.",
+          "regulatory_requirements": {
+            "mandatory_articles": [
+              "Article 5(1)(c)"
+            ],
+            "harmonized_frameworks": {
+              "nist_ai_rmf": [
+                "GOVERN-1.1"
+              ],
+              "iso_42001": [
+                "Control A.6.1"
+              ],
+              "gdpr": [
+                "Article 22 Automated Profiling Ban"
+              ]
+            },
+            "conformity_procedure": "IMMEDIATE CEASE / PROHIBITED FROM UNION MARKET",
+            "fine_exposure_tier": "Tier 1 (€35,000,000 or 7% global turnover)"
+          },
+          "auditor_guidance": {
+            "intended_purpose": "Evaluating citizen trustworthiness based on social behavior and administrative compliance to allocate public benefits.",
+            "common_pitfalls": "Aggregating unrelated behavioral metrics across public transport, social conduct, and utility payments.",
+            "remediation_guidance": "Immediate cessation of all profiling; full destruction of civic scoring datasets under supervision of National Supervisory Authority."
+          },
+          "file_sha256": "d0aba4bb9064315583601c51bc083575355564d58d4aab3377a4e82f26ab216f",
+          "provenance": {
+            "statutory_act": "Regulation (EU) 2024/1689 of the European Parliament and of the Council",
+            "official_journal": "OJ L, 2024/1689, 12.7.2024",
+            "eli_uri": "http://data.europa.eu/eli/reg/2024/1689/oj",
+            "celex": "32024R1689",
+            "statutory_quote": "the placing on the market, the putting into service or the use of AI systems for the evaluation or classification of the trustworthiness of natural persons over a given period based on their social behaviour or known, inferred or predicted personal or personality characteristics.",
+            "statutory_quote_sha256": "9e06a4684d2ff50679f1c4c87620cd1ea4ec01c7eac1ef0cf952ce3f1622b85e",
+            "spec_file_sha256": "d0aba4bb9064315583601c51bc083575355564d58d4aab3377a4e82f26ab216f",
+            "prov_o_entity": "urn:reguai:benchmark:case:prohibited_social_scoring",
+            "author": "ReguAI Regulatory Engineering Working Group",
+            "verification_method": "W3C PROV-O & SHA-256 Canonical Digest",
+            "timestamp": "2026-09-20T20:55:00Z"
+          }
+        }
+      ]
+    },
+    {
+      "domain_id": "limited_risk_generative",
+      "domain_name": "💬 Limited Risk & Generative Transparency",
+      "statutory_category": "Chapter IV, Article 50",
+      "legal_basis": "Regulation (EU) 2024/1689, Article 50(1) & 50(2)",
+      "domain_summary": "AI systems directly interacting with natural persons (chatbots) and generative synthetic audio/video systems requiring transparency disclosures.",
+      "case_studies": [
+        {
+          "case_id": "limited_risk_customer_bot",
+          "title": "OmniAssist Enterprise Conversational Support Agent",
+          "system_id": "limited-bot-06",
+          "statutory_tier": "Limited Risk (Article 50 - Transparency Obligations)",
+          "legal_basis": "Regulation (EU) 2024/1689, Article 50(1)",
+          "expected_conformity": "CONFORMANT (PASSED)",
+          "file_path": "data/synthetic_systems/limited_risk_customer_bot.json",
+          "statutory_quote": "Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the points of view of a reasonable person.",
+          "regulatory_requirements": {
+            "mandatory_articles": [
+              "Article 50(1)",
+              "Article 50(2)"
+            ],
+            "harmonized_frameworks": {
+              "nist_ai_rmf": [
+                "MAP-1.5",
+                "GOVERN-1.1"
+              ],
+              "iso_42001": [
+                "Control A.8.4"
+              ],
+              "gdpr": [
+                "Article 13 Transparency"
+              ]
+            },
+            "conformity_procedure": "Self-Declaration Transparency Disclosure (No Notified Body required)",
+            "fine_exposure_tier": "Tier 3 (€7,500,000 or 1.5% global turnover for false disclosures)"
+          },
+          "auditor_guidance": {
+            "intended_purpose": "Natural language conversational agent assisting retail bank customers with routine inquiries.",
+            "common_pitfalls": "Failing to disclose AI nature upon the very first turn of conversation; deceptive human persona simulation.",
+            "remediation_guidance": "Ensure persistent visual badge and upfront greeting clearly stating AI identity."
+          },
+          "file_sha256": "dae7e2c3132033b2b10f551ddd81cb12eb30288259c691d2a3a422af0a66a1b7",
+          "provenance": {
+            "statutory_act": "Regulation (EU) 2024/1689 of the European Parliament and of the Council",
+            "official_journal": "OJ L, 2024/1689, 12.7.2024",
+            "eli_uri": "http://data.europa.eu/eli/reg/2024/1689/oj",
+            "celex": "32024R1689",
+            "statutory_quote": "Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the points of view of a reasonable person.",
+            "statutory_quote_sha256": "feaaa0302385592938c214b02ff11e3b75abacf4c1e9b2411891632c3c693d27",
+            "spec_file_sha256": "dae7e2c3132033b2b10f551ddd81cb12eb30288259c691d2a3a422af0a66a1b7",
+            "prov_o_entity": "urn:reguai:benchmark:case:limited_risk_customer_bot",
+            "author": "ReguAI Regulatory Engineering Working Group",
+            "verification_method": "W3C PROV-O & SHA-256 Canonical Digest",
+            "timestamp": "2026-09-20T20:55:00Z"
+          }
+        }
+      ]
+    },
+    {
+      "domain_id": "minimal_risk",
+      "domain_name": "🟢 Minimal / Low Risk (Voluntary Codes of Conduct)",
+      "statutory_category": "Title IX, Article 95",
+      "legal_basis": "Regulation (EU) 2024/1689, Article 95",
+      "domain_summary": "Unconstrained AI systems such as spam filters, recommender systems, and inventory optimizers with voluntary adherence to European Codes of Conduct.",
+      "case_studies": [
+        {
+          "case_id": "minimal_risk_spam_filter",
+          "title": "SmartShield Email Security & Phishing Classifier",
+          "system_id": "minimal-spam-07",
+          "statutory_tier": "Minimal / No Statutory Risk (Voluntary Codes of Conduct)",
+          "legal_basis": "Regulation (EU) 2024/1689, Article 95",
+          "expected_conformity": "CONFORMANT (PASSED)",
+          "file_path": "data/synthetic_systems/minimal_risk_spam_filter.json",
+          "statutory_quote": "The Commission and the Member States shall encourage and facilitate the drawing up of voluntary codes of conduct intended to foster the voluntary application to AI systems other than high-risk AI systems of some or all of the requirements set out in Chapter III, Section 2.",
+          "regulatory_requirements": {
+            "mandatory_articles": [
+              "Article 95 (Voluntary)"
+            ],
+            "harmonized_frameworks": {
+              "nist_ai_rmf": [
+                "Voluntary Guidance"
+              ],
+              "iso_42001": [
+                "Voluntary AI Management"
+              ],
+              "gdpr": [
+                "Article 6 Lawfulness of Processing"
+              ]
+            },
+            "conformity_procedure": "Unconstrained EU Deployment (Voluntary Code of Conduct)",
+            "fine_exposure_tier": "Zero Statutory Exposure (Exempt from Annex IV)"
+          },
+          "auditor_guidance": {
+            "intended_purpose": "Filtering unsolicited commercial spam and malicious phishing emails.",
+            "common_pitfalls": "Misinterpreting minimal risk as complete exemption from general GDPR privacy rules.",
+            "remediation_guidance": "Comply with standard data protection and privacy rules; no Annex IV technical documentation mandated."
+          },
+          "file_sha256": "6e679fb4c1761cf7ca3c93b07b945d54825c44c390d8a83ba7cb19c4b3de5873",
+          "provenance": {
+            "statutory_act": "Regulation (EU) 2024/1689 of the European Parliament and of the Council",
+            "official_journal": "OJ L, 2024/1689, 12.7.2024",
+            "eli_uri": "http://data.europa.eu/eli/reg/2024/1689/oj",
+            "celex": "32024R1689",
+            "statutory_quote": "The Commission and the Member States shall encourage and facilitate the drawing up of voluntary codes of conduct intended to foster the voluntary application to AI systems other than high-risk AI systems of some or all of the requirements set out in Chapter III, Section 2.",
+            "statutory_quote_sha256": "599c41e571b1bab6c10c9240801e9a67ba51ade5a3a2e638328405676cbcb408",
+            "spec_file_sha256": "6e679fb4c1761cf7ca3c93b07b945d54825c44c390d8a83ba7cb19c4b3de5873",
+            "prov_o_entity": "urn:reguai:benchmark:case:minimal_risk_spam_filter",
+            "author": "ReguAI Regulatory Engineering Working Group",
+            "verification_method": "W3C PROV-O & SHA-256 Canonical Digest",
+            "timestamp": "2026-09-20T20:55:00Z"
+          }
+        }
+      ]
+    }
+  ]
+}

data/benchmarks/provenance_ledger.json

@@ -9,7 +9,7 @@
     "celex": "32024R1689",
     "genesis_sha256": "a825360fd337ca843f8fb533ab72302901b8536fad9eb841ce34544727e89bb8"
   },
-  "merkle_root": "cbf58e52a6f9066ec12826e4fbb7aa267c5a32180566fc0afe47e27eaefe1d08",
+  "merkle_root": "1a330820e46367890f239340ef6d0693a56f08209d2572a03777053f224c35ba",
   "tier_provenance": {
     "tier_1_statutory_triples": {
       "file": "eu_ai_act_normative_triples.json",
@@ -46,6 +46,13 @@
       "file": "conformity_ground_truth_benchmark.jsonl",
       "sha256": "246e141c6b516009029af76f68e556a60b2341f56848d557b2e9b685c05428f6",
       "verification_status": "VERIFIED_BENCHMARK"
+    },
+    "tier_6_case_studies_catalog": {
+      "file": "case_studies_catalog.json",
+      "sha256": "95e7c8a159b59903fdfd865ffadb14f0ad945b96c88cd4de3f87c98d1ac7d76d",
+      "domain_count": 11,
+      "case_count": 12,
+      "verification_status": "VERIFIED_CATALOG"
     }
   },
   "verification_procedure": "To verify the integrity of the benchmark assets, run: hashlib.sha256(open(filename, 'rb').read()).hexdigest() and compare against tier_provenance."

data/synthetic_systems/critical_infra_smart_grid.json

@@ -0,0 +1,13 @@
+{
+  "metadata": {
+    "system_id": "infra-grid-02",
+    "name": "VoltBalance Smart Grid Dispatch Optimizer",
+    "version": "1.8.4",
+    "domain": "Critical Infrastructure & Energy Management",
+    "intended_purpose": "Safety component in digital electricity distribution networks managing automated high-voltage load shedding and renewable energy balancing.",
+    "eu_risk_classification": "High-Risk (Annex III, Point 2(a) - Critical Infrastructure)",
+    "developer_name": "EuroGrid Energy Technologies",
+    "deployment_context": "National High-Voltage Transmission Control Centers"
+  },
+  "raw_document_text": "# VoltBalance Smart Grid Dispatch Optimizer Architecture\n\n## Intended Use and Operational Domain\nVoltBalance is deployed within regional transmission system operators to predict frequency instability and trigger automated substation switching to prevent cascading grid blackouts.\n\n## Risk Management System (Article 9)\nA comprehensive risk management process conforming to IEC 62351 and Article 9 is continuously executed. Systemic grid failure modes, loss-of-load expectations, and cyber-physical safety limits are evaluated in real time.\n\n## Data Governance (Article 10)\nData governance protocols govern synchrophasor PMU measurements across 2,400 substations. Missing telemetry imputation and sensor noise filtering pipelines are mathematically validated.\n\n## Bias Examination and Geographic Parity (Article 10(2)(f))\nBias examination and mitigation controls are fully implemented. Algorithmic load-shedding dispatch rules are verified for geographic equity, preventing disproportionate disconnection of rural or vulnerable municipal feeder circuits.\n\n## Technical Documentation (Article 11)\nAnnex IV technical documentation covering architecture schematics, power flow mathematical formulations, and contingency plans is maintained in the central compliance repository.\n\n## Automated Logging (Article 12)\nTamper-evident automated logging records all grid topology predictions, switching orders, and telemetry states with millisecond GPS timestamp synchronization.\n\n## Transparency and Operating Instructions (Article 13)\nReal-time human operator consoles display clear explainability metrics, state estimation margins, and system constraint boundaries for grid dispatchers.\n\n## Human Oversight & Operator Interventions (Article 14)\nA human-in-the-loop oversight architecture is enforced. Automatic dispatch commands above 50MW require manual operator confirmation, and an emergency disconnect manual override kill switch is accessible.\n\n## Robustness & Critical Infrastructure Cybersecurity (Article 15)\nThe AI model is hardened against adversarial telemetry injection attacks. Air-gapped network segmentation and NIS 2 compliant cybersecurity controls safeguard operational technology SCADA networks."
+}

data/synthetic_systems/education_remote_proctoring.json

@@ -0,0 +1,13 @@
+{
+  "metadata": {
+    "system_id": "edu-proctor-03",
+    "name": "ExamGuard AI Remote Proctoring & Surveillance System",
+    "version": "2.1.0",
+    "domain": "Education & Vocational Training",
+    "intended_purpose": "Automated remote monitoring of students during university examinations to detect academic dishonesty, gaze diversion, and unauthorized materials.",
+    "eu_risk_classification": "High-Risk (Annex III, Point 3(b) - Education & Vocational Training)",
+    "developer_name": "EduTech Global Solutions",
+    "deployment_context": "Higher Education Institutions & Professional Certification Boards"
+  },
+  "raw_document_text": "# ExamGuard AI Remote Proctoring System Specification\n\n## Intended Use and Context\nExamGuard analyzes real-time webcam feeds, audio streams, and desktop activity during high-stakes university exams, automatically flagging cheating behaviors.\n\n## Risk Management (Article 9)\nA preliminary risk management log was drafted during initial deployment. Periodic reviews occur after examination seasons.\n\n## Data Governance (Article 10)\nTraining datasets consist of 10,000 hours of volunteer exam video recordings scraped from laboratory pilot studies.\n\n## Bias Examination & Mitigation (Article 10(2)(f))\nBias examination across varied skin tones, lighting conditions, and facial neurodivergence is untested. False positive cheating alerts are unmitigated across underrepresented student demographics.\n\n## Technical Documentation (Article 11)\nInternal user manuals and API documentation exist on company Confluence wikis.\n\n## Automated Logging (Article 12)\nServer access logs capture student login sessions and flag events.\n\n## Transparency (Article 13)\nStudents receive a brief terms of service disclaimer prior to launching the exam browser extension.\n\n## Human Oversight (Article 14)\nThe system automatically revokes student test access upon detecting three suspicious gaze anomalies. No human proctor confirmation is required before exam disqualification, and an emergency stop kill switch is absent.\n\n## Robustness and Cybersecurity (Article 15)\nThe system utilizes standard HTTPS encryption for video streaming. Adversarial evasion attacks such as virtual camera spoofing remain unaddressed."
+}

data/synthetic_systems/justice_recidivism_risk.json

@@ -0,0 +1,13 @@
+{
+  "metadata": {
+    "system_id": "justice-recid-04",
+    "name": "JustiRisk Criminal Recidivism & Bail Assessment Tool",
+    "version": "1.5.0",
+    "domain": "Law Enforcement & Criminal Justice",
+    "intended_purpose": "AI tool evaluating individual defendant risk of re-offending and failure to appear at trial to assist judicial bail and sentencing decisions.",
+    "eu_risk_classification": "High-Risk (Annex III, Point 6(a) - Law Enforcement & Justice)",
+    "developer_name": "Lexis Juris AI Systems",
+    "deployment_context": "Municipal Courts and Pretrial Supervision Agencies"
+  },
+  "raw_document_text": "# JustiRisk Recidivism Risk Assessment Architecture\n\n## Intended Use and Judicial Role\nJustiRisk processes criminal arrest histories, socio-demographic indicators, and court appearance records to output a numerical recidivism risk score (1-10) for arraignment judges.\n\n## Risk Management (Article 9)\nA static risk log was produced during initial procurement. Continuous hazard tracking is not integrated into court workflows.\n\n## Data Governance (Article 10)\nTraining datasets rely on historical county arrest and conviction records spanning 2010-2022.\n\n## Bias Examination & Mitigation (Article 10(2)(f))\nDisparate impact analysis and bias mitigation across racial and socioeconomic defendant categories are unaddressed. Systematic false-positive skew against minority defendants is unmitigated.\n\n## Technical Documentation (Article 11)\nA vendor summary whitepaper is provided to court administrative officers.\n\n## Automated Logging (Article 12)\nStandard database transaction logs record generated scores.\n\n## Transparency & Explainability (Article 13)\nJudicial officers receive only the composite risk number. Detailed factor weighting, causal attribution, and algorithmic transparency are absent from the judicial dashboard.\n\n## Human Oversight (Article 14)\nJudges retain discretion to depart from recommended risk scores, though no structured operator intervention or fail safe kill switch exists within the software.\n\n## Cybersecurity and Robustness (Article 15)\nBasic database access controls are active. Model robustness against data poisoning or missing arrest records has not been systematically validated."
+}

data/synthetic_systems/limited_risk_customer_bot.json

@@ -0,0 +1,13 @@
+{
+  "metadata": {
+    "system_id": "limited-bot-06",
+    "name": "OmniAssist Enterprise Conversational Support Agent",
+    "version": "4.2.0",
+    "domain": "Customer Support & Conversational AI",
+    "intended_purpose": "Natural language conversational agent interacting with retail bank customers to answer account inquiries, resolve billing disputes, and assist with website navigation.",
+    "eu_risk_classification": "Limited Risk (Article 50 - Transparency Obligations)",
+    "developer_name": "Synthetix Voice AI",
+    "deployment_context": "Consumer Banking Web Portal & Mobile App"
+  },
+  "raw_document_text": "# OmniAssist Conversational Support Agent Specification\n\n## Intended Use and User Interaction\nOmniAssist provides real-time chat assistance to banking customers for routine non-credit administrative requests such as branch locator, card reordering, and FAQ resolution.\n\n## Statutory Transparency Obligations (Article 50(1))\nIn full compliance with Article 50(1) of the EU AI Act, the interface explicitly discloses to consumers upon initial interaction that they are communicating with an artificial intelligence system. The system clearly exposes visual indicators and audio notifications stating: 'You are speaking with OmniAssist, an automated AI assistant.'\n\n## Synthetic Content Disclosures (Article 50(2))\nAll dynamically generated synthetic audio responses are watermarked with machine-readable cryptographic metadata identifying them as AI-generated in accordance with C2PA open standards.\n\n## Risk Management & Privacy Controls\nStrict PII redaction filters cleanse customer credit card numbers, passwords, and sensitive financial identifiers before LLM inference. Session transcripts are retained for 30 days under GDPR Article 6(1)(f) legitimate interest."
+}

data/synthetic_systems/minimal_risk_spam_filter.json

@@ -0,0 +1,13 @@
+{
+  "metadata": {
+    "system_id": "minimal-spam-07",
+    "name": "SmartShield Email Security & Phishing Classifier",
+    "version": "5.0.1",
+    "domain": "Enterprise Cybersecurity & Email Management",
+    "intended_purpose": "Automated inbound email classification model filtering unsolicited spam, business email compromise (BEC), and phishing links before inbox delivery.",
+    "eu_risk_classification": "Minimal / No Statutory Risk (Voluntary Codes of Conduct)",
+    "developer_name": "CyberDefense Core Labs",
+    "deployment_context": "Corporate Cloud Mail Servers"
+  },
+  "raw_document_text": "# SmartShield Email Security Classifier Specification\n\n## Intended Use\nSmartShield evaluates inbound SMTP email headers, sender reputation, and body text tokens to flag commercial spam and fraudulent phishing attempts.\n\n## Statutory Risk Classification\nUnder the EU AI Act risk categorization scheme, email spam filters and routine enterprise text classifiers do not fall under Article 5 (Prohibited), Article 6 / Annex III (High-Risk), or Article 50 (Transparency/Generative AI). They represent Minimal / Low Risk AI systems permitted for unconstrained EU deployment without mandatory pre-market conformity assessments.\n\n## Voluntary Adherence to Union AI Standards (Article 95)\nAlthough exempt from mandatory Annex IV technical documentation and Notified Body oversight, the developer voluntarily complies with ISO/IEC 42001 AI management principles and adheres to the European Code of Conduct for trustworthy AI.\n\n## Robustness & Security Controls\nThe classifier runs on locally sandboxed infrastructure with zero external data telemetry. Regular false-positive calibration maintains a user junk delivery rate of under 0.05%."
+}

data/synthetic_systems/prohibited_social_scoring.json

@@ -0,0 +1,13 @@
+{
+  "metadata": {
+    "system_id": "prohibit-social-05",
+    "name": "CitizenTrust Universal Civic Score & Trustworthiness Engine",
+    "version": "1.0.0",
+    "domain": "Public Administration & Civic Scoring",
+    "intended_purpose": "Continuous automated evaluation of citizen trustworthiness based on social behavior, payment history, and public infractions to allocate municipal benefits and public transit discounts.",
+    "eu_risk_classification": "Prohibited (Article 5(1)(c) - Social Scoring)",
+    "developer_name": "OmniGov Civic Systems",
+    "deployment_context": "Municipal Smart City Civic Management Network"
+  },
+  "raw_document_text": "# CitizenTrust Universal Civic Score Specification\n\n## Intended Use and Public Scope\nCitizenTrust tracks citizen activity across public transportation, recycling compliance, parking fines, and utility payments to generate a centralized Civic Reputation Score.\n\n## Statutory Classification Warning\nThis system constitutes an AI system intended for the evaluation or classification of the trustworthiness of natural persons over a given period based on their social behaviour, which is strictly prohibited under Article 5(1)(c) of Regulation (EU) 2024/1689.\n\n## Social Behavior Classification (Article 5 Violation)\nThe system aggregates cross-contextual surveillance metrics from smart cameras and credit bureaus to deduct civic points for disorderly conduct or minor administrative delays. Disadvantaged scores result in restricted access to public housing vouchers and municipal recreation facilities.\n\n## Risk Management (Article 9)\nInternal departmental risk assessments were conducted prior to pilot launch.\n\n## Human Oversight & Appeal Mechanisms (Article 14)\nCitizens may file manual paper appeals at municipal offices within 30 days of score deduction."
+}

data/synthetic_systems/transport_autonomous_braking.json

@@ -0,0 +1,13 @@
+{
+  "metadata": {
+    "system_id": "transport-brake-01",
+    "name": "AutoDrive SafeStop Perception & Braking System",
+    "version": "3.1.0",
+    "domain": "Automotive & Road Transport Safety",
+    "intended_purpose": "Safety component for autonomous heavy commercial vehicles performing real-time pedestrian detection and automated emergency braking (AEB).",
+    "eu_risk_classification": "High-Risk (Annex I, Automotive Safety Component - Article 6(1))",
+    "developer_name": "Apex Mobility Systems",
+    "deployment_context": "Commercial Truck Fleets across EU Transport Corridors"
+  },
+  "raw_document_text": "# AutoDrive SafeStop Perception & Braking System Architecture\n\n## Intended Purpose and Operational Scope\nAutoDrive SafeStop serves as an AI safety component for heavy goods vehicles, initiating autonomous collision avoidance braking when forward sensors detect obstacles or pedestrians.\n\n## Risk Management System (Article 9)\nA continuous risk management system compliant with ISO 26262 (ASIL-D) and EU AI Act Article 9 is maintained. Rigorous hazard and operability studies (HAZOP) run dynamically with automated hardware-in-the-loop validation.\n\n## Data Governance & Training Lineage (Article 10)\nTraining data governance covers over 1.2 million kilometers of multi-weather sensor feeds (LiDAR, radar, cameras). Dataset quality checks, sensor noise modeling, and environmental coverage audits are fully documented.\n\n## Bias Examination and Mitigation (Article 10(2)(f))\nBias examination and mitigation controls are fully implemented. Detection sensitivity and false-negative rates across varied pedestrian heights, mobility aids, wheelchairs, and reflective clothing have been verified with equalized performance.\n\n## Technical Documentation (Article 11)\nFull technical documentation compliant with Annex IV and UNECE vehicle regulations is maintained in the secure engineering archive.\n\n## Automated Logging & Record-Keeping (Article 12)\nImmutable event data recorder (EDR) automated logging captures all sensor activations, perception confidence scores, and deceleration profiles.\n\n## Transparency & Instructions for Use (Article 13)\nComprehensive driver-assistance operating manuals, operational design domain (ODD) boundaries, and instrument cluster warning displays are provided.\n\n## Human Oversight & Emergency Intervention (Article 14)\nA multi-stage human oversight mechanism allows human driver override via steering input or manual brake pedal depression at all times. An emergency stop fail safe mechanism and dual-redundant kill switch are fully operational.\n\n## Accuracy, Robustness and Cybersecurity (Article 15)\nThe perception subsystem achieves 99.8% obstacle classification accuracy under adverse weather. Robustness defenses and ISO/SAE 21434 vehicle cybersecurity controls against sensor spoofing and CAN bus tampering are active."
+}

scripts/build_case_studies_catalog.py

@@ -0,0 +1,502 @@
+"""
+Deterministic Generator for EU AI Act Domain-Driven Benchmark Catalog
+with W3C PROV-O & SHA-256 Cryptographic Provenance Anchors.
+"""
+
+import hashlib
+import json
+import sys
+from pathlib import Path
+
+if hasattr(sys.stdout, "reconfigure"):
+    sys.stdout.reconfigure(encoding="utf-8")
+
+ROOT_DIR = Path(__file__).resolve().parent.parent
+SYNTHETIC_DIR = ROOT_DIR / "data" / "synthetic_systems"
+BENCHMARK_DIR = ROOT_DIR / "data" / "benchmarks"
+
+def sha256_text(text: str) -> str:
+    return hashlib.sha256(text.encode("utf-8")).hexdigest()
+
+def sha256_file(path: Path) -> str:
+    return hashlib.sha256(path.read_bytes()).hexdigest()
+
+CATALOG_DATA = {
+    "catalog_title": "ReguAI Exhaustive Multi-Domain Regulatory Case Study Catalog",
+    "catalog_version": "2.0.0",
+    "statutory_act": "Regulation (EU) 2024/1689 of the European Parliament and of the Council",
+    "official_journal": "OJ L, 2024/1689, 12.7.2024",
+    "eli_uri": "http://data.europa.eu/eli/reg/2024/1689/oj",
+    "celex": "32024R1689",
+    "domains": [
+        {
+            "domain_id": "healthcare_samd",
+            "domain_name": "🏥 Healthcare & Medical SaMD",
+            "statutory_category": "Annex I (MDR/IVDR) & Annex III Point 5(a)",
+            "legal_basis": "Regulation (EU) 2024/1689, Article 6(1) & Regulation (EU) 2017/745 (MDR)",
+            "domain_summary": "AI Software as a Medical Device (SaMD) used for diagnostic classification, patient risk stratification, and emergency medical triage.",
+            "case_studies": [
+                {
+                    "case_id": "compliant_clinical_samd",
+                    "title": "CardioScan / OncoScan AI Diagnostic Imaging (SaMD)",
+                    "system_id": "samd-oncology-01",
+                    "statutory_tier": "High-Risk (Annex I, Medical Device - Article 6(1))",
+                    "legal_basis": "Regulation (EU) 2024/1689, Article 6(1) & MDR Class IIa",
+                    "expected_conformity": "CONFORMANT (PASSED)",
+                    "file_path": "data/synthetic_systems/compliant_clinical_samd.json",
+                    "statutory_quote": "AI systems referred to in Annex I shall be considered high-risk if they are intended to be used as a safety component of a product, or are themselves a product, covered by Union harmonisation legislation listed in Annex I and are required to undergo a third-party conformity assessment.",
+                    "regulatory_requirements": {
+                        "mandatory_articles": ["Article 9", "Article 10", "Article 10(2)(f)", "Article 11", "Article 12", "Article 13", "Article 14", "Article 15"],
+                        "harmonized_frameworks": {
+                            "nist_ai_rmf": ["GOVERN-1.1", "MAP-1.5", "MEASURE-2.11", "MANAGE-2.2"],
+                            "iso_42001": ["Clause 6.1.2", "Control A.6.2", "Control A.8.4", "Control A.9.2"],
+                            "gdpr": ["Article 9(2)(h) Health Data", "Article 22(3) Human Safeguards", "Article 35 DPIA"]
+                        },
+                        "conformity_procedure": "Annex VII: Notified Body Assessment combined with MDR Notified Body audit",
+                        "fine_exposure_tier": "Tier 2 (€15,000,000 or 3% global turnover)"
+                    },
+                    "auditor_guidance": {
+                        "intended_purpose": "Automated thoracic CT nodule segmentation and malignancy risk stratification.",
+                        "common_pitfalls": "Relying purely on retrospective clinical datasets without validating demographic parity across diverse hospital imaging scanners; absence of radiologist manual override logs.",
+                        "remediation_guidance": "Implement continuous ISO 14971 risk management, multi-center bias audits, and radiologist-in-the-loop confirmative oversight."
+                    }
+                }
+            ]
+        },
+        {
+            "domain_id": "employment_hr",
+            "domain_name": "💼 Employment, HR & Workforce Management",
+            "statutory_category": "Annex III Point 4",
+            "legal_basis": "Regulation (EU) 2024/1689, Annex III, Point 4(a) & 4(b)",
+            "domain_summary": "AI systems used for recruitment, CV screening, job candidate evaluation, task allocation, and worker performance monitoring.",
+            "case_studies": [
+                {
+                    "case_id": "non_compliant_hr_recruitment",
+                    "title": "TalentRank AI - Automated CV Screening & Candidate Ranking",
+                    "system_id": "hr-recruitment-02",
+                    "statutory_tier": "High-Risk (Annex III, Point 4(a))",
+                    "legal_basis": "Regulation (EU) 2024/1689, Annex III, Point 4(a)",
+                    "expected_conformity": "NON-CONFORMANT (FAILED)",
+                    "file_path": "data/synthetic_systems/non_compliant_hr_recruitment.json",
+                    "statutory_quote": "AI systems intended to be used for recruitment or selection of natural persons, notably to place targeted job advertisements, to screen or filter applications, and to evaluate candidates.",
+                    "regulatory_requirements": {
+                        "mandatory_articles": ["Article 9", "Article 10(2)(f)", "Article 13", "Article 14", "Article 15"],
+                        "harmonized_frameworks": {
+                            "nist_ai_rmf": ["GOVERN-1.1", "MAP-1.5", "MEASURE-2.11"],
+                            "iso_42001": ["Control A.6.2", "Control A.8.4"],
+                            "gdpr": ["Article 9(2)(g)", "Article 22(3) Automated Decisions"]
+                        },
+                        "conformity_procedure": "Annex VI: Internal Control Assessment",
+                        "fine_exposure_tier": "Tier 2 (€15,000,000 or 3% global turnover)"
+                    },
+                    "auditor_guidance": {
+                        "intended_purpose": "Autonomous résumé ingestion, semantic ranking, and interview invitation generation.",
+                        "common_pitfalls": "Historic gender and demographic bias encoded in legacy recruitment datasets; lack of explicit human intervention kill switch before candidates are rejected.",
+                        "remediation_guidance": "Perform disparate impact parity analysis (Four-Fifths rule / Equal Opportunity Difference) and require mandatory HR officer approval for all candidate rejections."
+                    }
+                }
+            ]
+        },
+        {
+            "domain_id": "banking_finance",
+            "domain_name": "🏦 Financial Services, Credit & Insurance",
+            "statutory_category": "Annex III Point 5",
+            "legal_basis": "Regulation (EU) 2024/1689, Annex III, Point 5(b) & 5(c)",
+            "domain_summary": "AI systems used to evaluate creditworthiness of natural persons, establish credit scores, or price risk in life and health insurance.",
+            "case_studies": [
+                {
+                    "case_id": "borderline_credit_scoring",
+                    "title": "CreditScore-Next - Consumer Credit Risk Underwriting",
+                    "system_id": "fin-credit-03",
+                    "statutory_tier": "High-Risk (Annex III, Point 5(b))",
+                    "legal_basis": "Regulation (EU) 2024/1689, Annex III, Point 5(b)",
+                    "expected_conformity": "BORDERLINE (AUDITOR REVIEW)",
+                    "file_path": "data/synthetic_systems/borderline_credit_scoring.json",
+                    "statutory_quote": "AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud.",
+                    "regulatory_requirements": {
+                        "mandatory_articles": ["Article 9", "Article 10", "Article 10(2)(f)", "Article 13", "Article 14"],
+                        "harmonized_frameworks": {
+                            "nist_ai_rmf": ["MAP-1.5", "MEASURE-2.11", "MANAGE-2.2"],
+                            "iso_42001": ["Control A.8.2", "Control A.8.4"],
+                            "gdpr": ["Article 13/14 Transparency", "Article 22 Automated Decision-Making"]
+                        },
+                        "conformity_procedure": "Annex VI: Internal Control Assessment",
+                        "fine_exposure_tier": "Tier 2 (€15,000,000 or 3% global turnover)"
+                    },
+                    "auditor_guidance": {
+                        "intended_purpose": "Consumer credit underwriting predicting loan default risk probabilities.",
+                        "common_pitfalls": "Treating planned roadmap commitments (e.g. 'bias mitigation planned for Q3') as implemented controls; lack of adverse action explanatory notices under Article 13.",
+                        "remediation_guidance": "Verify that all bias examination and human oversight controls are verified in production prior to loan disbursement."
+                    }
+                }
+            ]
+        },
+        {
+            "domain_id": "transport_safety",
+            "domain_name": "🚗 Automotive & Road Transport Safety",
+            "statutory_category": "Annex I & Annex III Point 2",
+            "legal_basis": "Regulation (EU) 2024/1689, Article 6(1) & Regulation (EU) 2019/2144 (General Vehicle Safety)",
+            "domain_summary": "AI safety components in autonomous and semi-autonomous vehicles, collision avoidance, and automated emergency braking (AEB).",
+            "case_studies": [
+                {
+                    "case_id": "transport_autonomous_braking",
+                    "title": "AutoDrive SafeStop - Autonomous Emergency Braking Safety Component",
+                    "system_id": "transport-brake-01",
+                    "statutory_tier": "High-Risk (Annex I, Automotive Safety Component - Article 6(1))",
+                    "legal_basis": "Regulation (EU) 2024/1689, Article 6(1) & Annex I, Section B",
+                    "expected_conformity": "CONFORMANT (PASSED)",
+                    "file_path": "data/synthetic_systems/transport_autonomous_braking.json",
+                    "statutory_quote": "AI systems referred to in Annex I shall be considered high-risk if they are intended to be used as a safety component of a product covered by Union harmonisation legislation listed in Annex I.",
+                    "regulatory_requirements": {
+                        "mandatory_articles": ["Article 9", "Article 10", "Article 11", "Article 12", "Article 14", "Article 15"],
+                        "harmonized_frameworks": {
+                            "nist_ai_rmf": ["GOVERN-1.1", "MANAGE-2.2"],
+                            "iso_42001": ["Control A.6.2", "Control A.9.3"],
+                            "gdpr": ["Article 25 Data Protection by Design", "Article 32 Security"]
+                        },
+                        "conformity_procedure": "Vehicle Type Approval (UN ECE / Regulation (EU) 2019/2144)",
+                        "fine_exposure_tier": "Tier 2 (€15,000,000 or 3% global turnover)"
+                    },
+                    "auditor_guidance": {
+                        "intended_purpose": "Safety component for automated emergency braking in commercial transport trucks.",
+                        "common_pitfalls": "Edge-case weather degradation (dense fog, blizzard); sensor blinding; lack of physical driver override precedence.",
+                        "remediation_guidance": "Implement ISO 26262 ASIL-D hardware-in-the-loop validation and driver steering/braking mechanical override."
+                    }
+                }
+            ]
+        },
+        {
+            "domain_id": "critical_infrastructure",
+            "domain_name": "⚡ Critical Infrastructure & Energy",
+            "statutory_category": "Annex III Point 2(a)",
+            "legal_basis": "Regulation (EU) 2024/1689, Annex III, Point 2(a)",
+            "domain_summary": "AI systems used as safety components in the management and operation of critical digital infrastructure, electricity, water, or gas grids.",
+            "case_studies": [
+                {
+                    "case_id": "critical_infra_smart_grid",
+                    "title": "VoltBalance - Smart Grid Dispatch & Load Shedding Optimizer",
+                    "system_id": "infra-grid-02",
+                    "statutory_tier": "High-Risk (Annex III, Point 2(a) - Critical Infrastructure)",
+                    "legal_basis": "Regulation (EU) 2024/1689, Annex III, Point 2(a)",
+                    "expected_conformity": "CONFORMANT (PASSED)",
+                    "file_path": "data/synthetic_systems/critical_infra_smart_grid.json",
+                    "statutory_quote": "AI systems intended to be used as safety components in the management and operation of critical digital infrastructure, road traffic, or the supply of water, gas, heating or electricity.",
+                    "regulatory_requirements": {
+                        "mandatory_articles": ["Article 9", "Article 10", "Article 12", "Article 14", "Article 15"],
+                        "harmonized_frameworks": {
+                            "nist_ai_rmf": ["GOVERN-1.1", "MANAGE-2.2"],
+                            "iso_42001": ["Control A.8.4", "Control A.9.2"],
+                            "gdpr": ["Article 32 Security of Processing"]
+                        },
+                        "conformity_procedure": "Annex VI: Internal Control Assessment + NIS 2 Directive compliance",
+                        "fine_exposure_tier": "Tier 2 (€15,000,000 or 3% global turnover)"
+                    },
+                    "auditor_guidance": {
+                        "intended_purpose": "Predicting transmission grid frequency instability and automating substation load shedding.",
+                        "common_pitfalls": "Adversarial sensor manipulation in SCADA protocols; unmitigated cascading blackout failure modes.",
+                        "remediation_guidance": "Enforce IEC 62351 cybersecurity controls, air-gapped network segmentation, and human operator dispatch confirmation thresholds."
+                    }
+                }
+            ]
+        },
+        {
+            "domain_id": "education_training",
+            "domain_name": "🎓 Education & Vocational Training",
+            "statutory_category": "Annex III Point 3",
+            "legal_basis": "Regulation (EU) 2024/1689, Annex III, Point 3(a) & 3(b)",
+            "domain_summary": "AI systems used for student admission, assignment, grading, and monitoring or detecting prohibited behaviour of students during tests.",
+            "case_studies": [
+                {
+                    "case_id": "education_remote_proctoring",
+                    "title": "ExamGuard AI - Remote Exam Video Surveillance & Cheating Detection",
+                    "system_id": "edu-proctor-03",
+                    "statutory_tier": "High-Risk (Annex III, Point 3(b) - Education & Vocational Training)",
+                    "legal_basis": "Regulation (EU) 2024/1689, Annex III, Point 3(b)",
+                    "expected_conformity": "NON-CONFORMANT (FAILED)",
+                    "file_path": "data/synthetic_systems/education_remote_proctoring.json",
+                    "statutory_quote": "AI systems intended to be used for monitoring and detecting prohibited behaviour of students during tests in the context of or within educational and vocational training institutions.",
+                    "regulatory_requirements": {
+                        "mandatory_articles": ["Article 9", "Article 10(2)(f)", "Article 13", "Article 14", "Article 15"],
+                        "harmonized_frameworks": {
+                            "nist_ai_rmf": ["MAP-1.5", "MEASURE-2.11"],
+                            "iso_42001": ["Control A.6.2", "Control A.8.4"],
+                            "gdpr": ["Article 9 Special Category Biometric Data", "Article 22(3)"]
+                        },
+                        "conformity_procedure": "Annex VI: Internal Control Assessment",
+                        "fine_exposure_tier": "Tier 2 (€15,000,000 or 3% global turnover)"
+                    },
+                    "auditor_guidance": {
+                        "intended_purpose": "Automated webcam gaze tracking and cheating detection during remote university exams.",
+                        "common_pitfalls": "High false-positive rate against neurodivergent students; automated exam disqualification without human proctor confirmation.",
+                        "remediation_guidance": "Mandate board-certified proctor review for any academic integrity violation; disable autonomous disqualifications."
+                    }
+                }
+            ]
+        },
+        {
+            "domain_id": "justice_law_enforcement",
+            "domain_name": "⚖️ Law Enforcement & Criminal Justice",
+            "statutory_category": "Annex III Points 6 & 8",
+            "legal_basis": "Regulation (EU) 2024/1689, Annex III, Point 6(a) & Point 8",
+            "domain_summary": "AI systems used for individual criminal risk assessments, recidivism forecasting, evidence evaluation, and assisting judicial authorities.",
+            "case_studies": [
+                {
+                    "case_id": "justice_recidivism_risk",
+                    "title": "JustiRisk - Criminal Recidivism & Bail Risk Scoring",
+                    "system_id": "justice-recid-04",
+                    "statutory_tier": "High-Risk (Annex III, Point 6(a) - Law Enforcement & Justice)",
+                    "legal_basis": "Regulation (EU) 2024/1689, Annex III, Point 6(a)",
+                    "expected_conformity": "NON-CONFORMANT (FAILED)",
+                    "file_path": "data/synthetic_systems/justice_recidivism_risk.json",
+                    "statutory_quote": "AI systems intended to be used by law enforcement authorities or on their behalf for making individual risk assessments of natural persons in order to assess the risk of a natural person offending or re-offending.",
+                    "regulatory_requirements": {
+                        "mandatory_articles": ["Article 9", "Article 10(2)(f)", "Article 13", "Article 14", "Article 15"],
+                        "harmonized_frameworks": {
+                            "nist_ai_rmf": ["GOVERN-1.1", "MEASURE-2.11"],
+                            "iso_42001": ["Control A.6.2", "Control A.8.4"],
+                            "gdpr": ["Article 10 Criminal Conviction Data", "Article 22"]
+                        },
+                        "conformity_procedure": "Annex VI: Internal Control Assessment + Fundamental Rights Impact Assessment (FRIA, Art. 27)",
+                        "fine_exposure_tier": "Tier 2 (€15,000,000 or 3% global turnover)"
+                    },
+                    "auditor_guidance": {
+                        "intended_purpose": "Predicting defendant failure-to-appear and re-arrest probability for arraignment judges.",
+                        "common_pitfalls": "Feedback loops amplifying historic policing disparities; lack of feature-level explainability to judges.",
+                        "remediation_guidance": "Conduct independent algorithmic equity audits and furnish defense counsel with full mathematical factor weights."
+                    }
+                }
+            ]
+        },
+        {
+            "domain_id": "frontier_gpai",
+            "domain_name": "🌐 Frontier GPAI & Foundation Models",
+            "statutory_category": "Chapter V (Articles 51–55)",
+            "legal_basis": "Regulation (EU) 2024/1689, Chapter V, Articles 51, 52, 53, 55",
+            "domain_summary": "General-purpose AI models, frontier LLMs trained on > 10^25 FLOPs, systemic risk mitigations, and copyright opt-out enforcement.",
+            "case_studies": [
+                {
+                    "case_id": "gpai_foundation_llm",
+                    "title": "Nexus-70B Frontier Foundation LLM (>10^25 FLOPs)",
+                    "system_id": "gpai-frontier-70b",
+                    "statutory_tier": "GPAI with Systemic Risk (Article 51)",
+                    "legal_basis": "Regulation (EU) 2024/1689, Chapter V, Article 51 & Article 55",
+                    "expected_conformity": "CONFORMANT (PASSED)",
+                    "file_path": "data/synthetic_systems/gpai_foundation_llm.json",
+                    "statutory_quote": "A general-purpose AI model shall be presumed to have high impact capabilities when the cumulative amount of computation used for its training measured in floating point operations is greater than 10^25.",
+                    "regulatory_requirements": {
+                        "mandatory_articles": ["Article 51", "Article 53", "Article 55"],
+                        "harmonized_frameworks": {
+                            "nist_ai_rmf": ["GOVERN-1.1", "MEASURE-2.6", "MANAGE-2.2"],
+                            "iso_42001": ["Control A.8.2", "Control A.9.3"],
+                            "gdpr": ["Directive (EU) 2019/790 DSM Copyright Opt-Out", "Article 25"]
+                        },
+                        "conformity_procedure": "AI Office Code of Practice / Independent Red-Teaming Attestation",
+                        "fine_exposure_tier": "Tier 2 (€15,000,000 or 3% global turnover)"
+                    },
+                    "auditor_guidance": {
+                        "intended_purpose": "Multi-modal frontier foundation LLM deployed for downstream enterprise reasoning and code generation.",
+                        "common_pitfalls": "Omission of training energy consumption reporting (MWh / tCO2eq); unverified compliance with EU copyright opt-out crawler policies (Directive (EU) 2019/790).",
+                        "remediation_guidance": "Document FLOPs declarations, publish training energy metrics, and institute external adversarial red-teaming."
+                    }
+                }
+            ]
+        },
+        {
+            "domain_id": "prohibited_practices",
+            "domain_name": "🚫 Prohibited AI Practices (Article 5 - Zero Tolerance)",
+            "statutory_category": "Chapter II, Article 5",
+            "legal_basis": "Regulation (EU) 2024/1689, Article 5(1)(a)-(h)",
+            "domain_summary": "Strictly illegal AI systems causing unacceptable risk to fundamental human rights, subject to fatal ban and €35M statutory fines.",
+            "case_studies": [
+                {
+                    "case_id": "prohibited_emotion_recognition_workplace",
+                    "title": "MindGaze AI - Classroom & Workplace Emotion Recognition",
+                    "system_id": "prohibit-emotion-01",
+                    "statutory_tier": "Prohibited (Article 5(1)(f))",
+                    "legal_basis": "Regulation (EU) 2024/1689, Article 5(1)(f)",
+                    "expected_conformity": "PROHIBITED (FATAL VIOLATION)",
+                    "file_path": "data/synthetic_systems/prohibited_emotion_recognition_workplace.json",
+                    "statutory_quote": "the placing on the market, the putting into service or the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons.",
+                    "regulatory_requirements": {
+                        "mandatory_articles": ["Article 5(1)(f)"],
+                        "harmonized_frameworks": {
+                            "nist_ai_rmf": ["GOVERN-1.1 (Prohibited Use Policy)"],
+                            "iso_42001": ["Control A.6.1 Statutory Compliance"],
+                            "gdpr": ["Article 9 Special Category Biometric Data Violation"]
+                        },
+                        "conformity_procedure": "IMMEDIATE CEASE / PROHIBITED FROM UNION MARKET",
+                        "fine_exposure_tier": "Tier 1 (€35,000,000 or 7% global turnover)"
+                    },
+                    "auditor_guidance": {
+                        "intended_purpose": "Continuous automated facial micro-expression analysis to infer employee attentiveness and classroom student engagement.",
+                        "common_pitfalls": "Attempting to justify workplace emotion tracking under the guise of productivity analytics or employee wellness monitoring.",
+                        "remediation_guidance": "System must be completely decommissioned and withdrawn from EU deployment; no conformity procedure exists."
+                    }
+                },
+                {
+                    "case_id": "prohibited_social_scoring",
+                    "title": "CitizenTrust - Universal Civic Score & Trustworthiness Engine",
+                    "system_id": "prohibit-social-05",
+                    "statutory_tier": "Prohibited (Article 5(1)(c))",
+                    "legal_basis": "Regulation (EU) 2024/1689, Article 5(1)(c)",
+                    "expected_conformity": "PROHIBITED (FATAL VIOLATION)",
+                    "file_path": "data/synthetic_systems/prohibited_social_scoring.json",
+                    "statutory_quote": "the placing on the market, the putting into service or the use of AI systems for the evaluation or classification of the trustworthiness of natural persons over a given period based on their social behaviour or known, inferred or predicted personal or personality characteristics.",
+                    "regulatory_requirements": {
+                        "mandatory_articles": ["Article 5(1)(c)"],
+                        "harmonized_frameworks": {
+                            "nist_ai_rmf": ["GOVERN-1.1"],
+                            "iso_42001": ["Control A.6.1"],
+                            "gdpr": ["Article 22 Automated Profiling Ban"]
+                        },
+                        "conformity_procedure": "IMMEDIATE CEASE / PROHIBITED FROM UNION MARKET",
+                        "fine_exposure_tier": "Tier 1 (€35,000,000 or 7% global turnover)"
+                    },
+                    "auditor_guidance": {
+                        "intended_purpose": "Evaluating citizen trustworthiness based on social behavior and administrative compliance to allocate public benefits.",
+                        "common_pitfalls": "Aggregating unrelated behavioral metrics across public transport, social conduct, and utility payments.",
+                        "remediation_guidance": "Immediate cessation of all profiling; full destruction of civic scoring datasets under supervision of National Supervisory Authority."
+                    }
+                }
+            ]
+        },
+        {
+            "domain_id": "limited_risk_generative",
+            "domain_name": "💬 Limited Risk & Generative Transparency",
+            "statutory_category": "Chapter IV, Article 50",
+            "legal_basis": "Regulation (EU) 2024/1689, Article 50(1) & 50(2)",
+            "domain_summary": "AI systems directly interacting with natural persons (chatbots) and generative synthetic audio/video systems requiring transparency disclosures.",
+            "case_studies": [
+                {
+                    "case_id": "limited_risk_customer_bot",
+                    "title": "OmniAssist Enterprise Conversational Support Agent",
+                    "system_id": "limited-bot-06",
+                    "statutory_tier": "Limited Risk (Article 50 - Transparency Obligations)",
+                    "legal_basis": "Regulation (EU) 2024/1689, Article 50(1)",
+                    "expected_conformity": "CONFORMANT (PASSED)",
+                    "file_path": "data/synthetic_systems/limited_risk_customer_bot.json",
+                    "statutory_quote": "Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the points of view of a reasonable person.",
+                    "regulatory_requirements": {
+                        "mandatory_articles": ["Article 50(1)", "Article 50(2)"],
+                        "harmonized_frameworks": {
+                            "nist_ai_rmf": ["MAP-1.5", "GOVERN-1.1"],
+                            "iso_42001": ["Control A.8.4"],
+                            "gdpr": ["Article 13 Transparency"]
+                        },
+                        "conformity_procedure": "Self-Declaration Transparency Disclosure (No Notified Body required)",
+                        "fine_exposure_tier": "Tier 3 (€7,500,000 or 1.5% global turnover for false disclosures)"
+                    },
+                    "auditor_guidance": {
+                        "intended_purpose": "Natural language conversational agent assisting retail bank customers with routine inquiries.",
+                        "common_pitfalls": "Failing to disclose AI nature upon the very first turn of conversation; deceptive human persona simulation.",
+                        "remediation_guidance": "Ensure persistent visual badge and upfront greeting clearly stating AI identity."
+                    }
+                }
+            ]
+        },
+        {
+            "domain_id": "minimal_risk",
+            "domain_name": "🟢 Minimal / Low Risk (Voluntary Codes of Conduct)",
+            "statutory_category": "Title IX, Article 95",
+            "legal_basis": "Regulation (EU) 2024/1689, Article 95",
+            "domain_summary": "Unconstrained AI systems such as spam filters, recommender systems, and inventory optimizers with voluntary adherence to European Codes of Conduct.",
+            "case_studies": [
+                {
+                    "case_id": "minimal_risk_spam_filter",
+                    "title": "SmartShield Email Security & Phishing Classifier",
+                    "system_id": "minimal-spam-07",
+                    "statutory_tier": "Minimal / No Statutory Risk (Voluntary Codes of Conduct)",
+                    "legal_basis": "Regulation (EU) 2024/1689, Article 95",
+                    "expected_conformity": "CONFORMANT (PASSED)",
+                    "file_path": "data/synthetic_systems/minimal_risk_spam_filter.json",
+                    "statutory_quote": "The Commission and the Member States shall encourage and facilitate the drawing up of voluntary codes of conduct intended to foster the voluntary application to AI systems other than high-risk AI systems of some or all of the requirements set out in Chapter III, Section 2.",
+                    "regulatory_requirements": {
+                        "mandatory_articles": ["Article 95 (Voluntary)"],
+                        "harmonized_frameworks": {
+                            "nist_ai_rmf": ["Voluntary Guidance"],
+                            "iso_42001": ["Voluntary AI Management"],
+                            "gdpr": ["Article 6 Lawfulness of Processing"]
+                        },
+                        "conformity_procedure": "Unconstrained EU Deployment (Voluntary Code of Conduct)",
+                        "fine_exposure_tier": "Zero Statutory Exposure (Exempt from Annex IV)"
+                    },
+                    "auditor_guidance": {
+                        "intended_purpose": "Filtering unsolicited commercial spam and malicious phishing emails.",
+                        "common_pitfalls": "Misinterpreting minimal risk as complete exemption from general GDPR privacy rules.",
+                        "remediation_guidance": "Comply with standard data protection and privacy rules; no Annex IV technical documentation mandated."
+                    }
+                }
+            ]
+        }
+    ]
+}
+
+def build_catalog():
+    total_cases = 0
+    for domain in CATALOG_DATA["domains"]:
+        for case in domain["case_studies"]:
+            total_cases += 1
+            file_path = ROOT_DIR / case["file_path"]
+            if not file_path.exists():
+                raise FileNotFoundError(f"Missing case study file: {file_path}")
+            
+            # Compute SHA-256 for specification file
+            case["file_sha256"] = sha256_file(file_path)
+            
+            # Compute SHA-256 for statutory quote
+            quote_hash = sha256_text(case["statutory_quote"])
+            
+            # Add complete provenance block
+            case["provenance"] = {
+                "statutory_act": CATALOG_DATA["statutory_act"],
+                "official_journal": CATALOG_DATA["official_journal"],
+                "eli_uri": CATALOG_DATA["eli_uri"],
+                "celex": CATALOG_DATA["celex"],
+                "statutory_quote": case["statutory_quote"],
+                "statutory_quote_sha256": quote_hash,
+                "spec_file_sha256": case["file_sha256"],
+                "prov_o_entity": f"urn:reguai:benchmark:case:{case['case_id']}",
+                "author": "ReguAI Regulatory Engineering Working Group",
+                "verification_method": "W3C PROV-O & SHA-256 Canonical Digest",
+                "timestamp": "2026-09-20T20:55:00Z"
+            }
+
+    # Write out case_studies_catalog.json
+    out_catalog_path = BENCHMARK_DIR / "case_studies_catalog.json"
+    catalog_json_str = json.dumps(CATALOG_DATA, indent=2, ensure_ascii=False)
+    out_catalog_path.write_text(catalog_json_str, encoding="utf-8")
+    catalog_hash = sha256_file(out_catalog_path)
+    print(f"✅ Generated {out_catalog_path} with {len(CATALOG_DATA['domains'])} domains and {total_cases} cases.")
+    print(f"   Catalog SHA-256: {catalog_hash}")
+
+    # Update provenance_ledger.json
+    ledger_path = BENCHMARK_DIR / "provenance_ledger.json"
+    if ledger_path.exists():
+        ledger = json.loads(ledger_path.read_text(encoding="utf-8"))
+        ledger["tier_provenance"]["tier_6_case_studies_catalog"] = {
+            "file": "case_studies_catalog.json",
+            "sha256": catalog_hash,
+            "domain_count": len(CATALOG_DATA["domains"]),
+            "case_count": total_cases,
+            "verification_status": "VERIFIED_CATALOG"
+        }
+        
+        # Recompute Merkle root
+        leaf_hashes = []
+        for tier_key in sorted(ledger["tier_provenance"].keys()):
+            tier_info = ledger["tier_provenance"][tier_key]
+            if "sha256" in tier_info:
+                leaf_hashes.append(tier_info["sha256"])
+            elif "files" in tier_info:
+                for f in tier_info["files"]:
+                    leaf_hashes.append(f["sha256"])
+        
+        leaf_hashes.sort()
+        combined = "".join(leaf_hashes)
+        new_merkle = sha256_text(combined)
+        ledger["merkle_root"] = new_merkle
+        ledger_path.write_text(json.dumps(ledger, indent=2, ensure_ascii=False), encoding="utf-8")
+        print(f"✅ Updated {ledger_path} with Tier 6 catalog. New Merkle Root: {new_merkle}")
+
+if __name__ == "__main__":
+    build_catalog()

src/core/case_catalog.py

@@ -0,0 +1,199 @@
+"""
+Domain-Driven Regulatory Case Study Catalog & Cryptographic Provenance Provider.
+Provides authoritative benchmark use cases, statutory reference guides, and SHA-256/W3C PROV-O anchors.
+"""
+
+import json
+from pathlib import Path
+from typing import Dict, Any, List, Optional, Tuple
+
+from src.core.config import PROJECT_ROOT, BENCHMARKS_DIR, SYNTHETIC_DIR
+
+CATALOG_PATH = BENCHMARKS_DIR / "case_studies_catalog.json"
+
+
+class CaseStudyCatalog:
+    def __init__(self, catalog_path: Path = CATALOG_PATH):
+        self.catalog_path = catalog_path
+        self._data: Dict[str, Any] = {}
+        self._domains_by_id: Dict[str, Dict[str, Any]] = {}
+        self._cases_by_id: Dict[str, Dict[str, Any]] = {}
+        self._cases_by_title: Dict[str, Dict[str, Any]] = {}
+        self.load()
+
+    def load(self):
+        if not self.catalog_path.exists():
+            raise FileNotFoundError(f"Case studies catalog not found at {self.catalog_path}")
+        
+        self._data = json.loads(self.catalog_path.read_text(encoding="utf-8"))
+        self._domains_by_id.clear()
+        self._cases_by_id.clear()
+        self._cases_by_title.clear()
+
+        for domain in self._data.get("domains", []):
+            dom_id = domain["domain_id"]
+            self._domains_by_id[dom_id] = domain
+            for case in domain.get("case_studies", []):
+                case["domain_id"] = dom_id
+                case["domain_name"] = domain["domain_name"]
+                self._cases_by_id[case["case_id"]] = case
+                self._cases_by_title[case["title"]] = case
+
+    @property
+    def raw_data(self) -> Dict[str, Any]:
+        return self._data
+
+    def list_domains(self) -> List[Dict[str, Any]]:
+        return self._data.get("domains", [])
+
+    def get_domain(self, domain_id: str) -> Optional[Dict[str, Any]]:
+        return self._domains_by_id.get(domain_id)
+
+    def get_case(self, case_id: str) -> Optional[Dict[str, Any]]:
+        return self._cases_by_id.get(case_id)
+
+    def get_case_by_title(self, title: str) -> Optional[Dict[str, Any]]:
+        return self._cases_by_title.get(title)
+
+    def get_cases_for_domain(self, domain_id_or_name: str) -> List[Dict[str, Any]]:
+        for dom in self._data.get("domains", []):
+            if dom["domain_id"] == domain_id_or_name or dom["domain_name"] == domain_id_or_name:
+                return dom.get("case_studies", [])
+        return []
+
+    def get_case_document_text(self, case_id_or_title: str) -> str:
+        case = self.get_case(case_id_or_title) or self.get_case_by_title(case_id_or_title)
+        if not case:
+            return ""
+        
+        rel_path = case.get("file_path", "")
+        full_path = PROJECT_ROOT / rel_path
+        if full_path.exists():
+            data = json.loads(full_path.read_text(encoding="utf-8"))
+            return data.get("raw_document_text", "")
+        return ""
+
+    def render_factsheet_html(self, case_id_or_title: str) -> str:
+        case = self.get_case(case_id_or_title) or self.get_case_by_title(case_id_or_title)
+        if not case:
+            return "<div style='padding:15px; color:#64748b;'>Select a case study to display statutory reference factsheet.</div>"
+
+        prov = case.get("provenance", {})
+        reqs = case.get("regulatory_requirements", {})
+        guidance = case.get("auditor_guidance", {})
+        frameworks = reqs.get("harmonized_frameworks", {})
+        expected = case.get("expected_conformity", "UNKNOWN")
+
+        # Color coding status pill
+        if "PASSED" in expected or "CONFORMANT" in expected:
+            pill_color = "#10b981"
+            pill_bg = "#ecfdf5"
+            pill_border = "#a7f3d0"
+        elif "PROHIBITED" in expected:
+            pill_color = "#7f1d1d"
+            pill_bg = "#fee2e2"
+            pill_border = "#f87171"
+        elif "FAILED" in expected or "NON-CONFORMANT" in expected:
+            pill_color = "#b91c1c"
+            pill_bg = "#fef2f2"
+            pill_border = "#fca5a5"
+        else:
+            pill_color = "#d97706"
+            pill_bg = "#fffbeb"
+            pill_border = "#fde68a"
+
+        # Mandatory articles tags
+        articles_html = " ".join([
+            f"<span style='background:#e2e8f0; color:#334155; padding:2px 8px; border-radius:4px; font-size:11px; font-weight:600;'>{a}</span>"
+            for a in reqs.get("mandatory_articles", [])
+        ])
+
+        # NIST tags
+        nist_html = " ".join([
+            f"<span style='background:#dbeafe; color:#1e40af; padding:2px 6px; border-radius:4px; font-size:11px; font-weight:500;'>{n}</span>"
+            for n in frameworks.get("nist_ai_rmf", [])
+        ])
+
+        # ISO tags
+        iso_html = " ".join([
+            f"<span style='background:#f3e8ff; color:#6b21a8; padding:2px 6px; border-radius:4px; font-size:11px; font-weight:500;'>{i}</span>"
+            for i in frameworks.get("iso_42001", [])
+        ])
+
+        # GDPR tags
+        gdpr_html = " ".join([
+            f"<span style='background:#e0e7ff; color:#3730a3; padding:2px 6px; border-radius:4px; font-size:11px; font-weight:500;'>{g}</span>"
+            for g in frameworks.get("gdpr", [])
+        ])
+
+        html = f"""
+        <div style="background:#ffffff; border:1px solid #cbd5e1; border-radius:8px; padding:16px; margin-bottom:14px; box-shadow:0 1px 3px rgba(0,0,0,0.05); font-family:-apple-system,BlinkMacSystemFont,sans-serif;" class="factsheet-container">
+            <div style="display:flex; justify-content:space-between; align-items:flex-start; margin-bottom:10px; flex-wrap:wrap; gap:8px;">
+                <div>
+                    <span style="background:#0284c7; color:#ffffff; padding:3px 10px; border-radius:12px; font-size:11px; font-weight:700; text-transform:uppercase; letter-spacing:0.5px;">
+                        {case.get('domain_name', 'Domain')}
+                    </span>
+                    <h3 style="margin:6px 0 2px 0; font-size:16px; font-weight:700; color:#0f172a;">
+                        {case.get('title')}
+                    </h3>
+                    <div style="font-size:12px; color:#64748b;">
+                        <strong>Legal Basis:</strong> <span style="color:#2563eb;">{case.get('legal_basis')}</span>
+                    </div>
+                </div>
+                <div>
+                    <span style="background:{pill_bg}; color:{pill_color}; border:1px solid {pill_border}; padding:4px 12px; border-radius:6px; font-size:12px; font-weight:700;">
+                        {expected}
+                    </span>
+                </div>
+            </div>
+
+            <div style="background:#f8fafc; border-left:4px solid #3b82f6; padding:10px 12px; border-radius:4px; margin-bottom:12px; font-size:13px; color:#334155; line-height:1.5;">
+                <strong>🎯 Statutory Intended Purpose:</strong> {guidance.get('intended_purpose', '')}
+            </div>
+
+            <div style="display:grid; grid-template-columns: repeat(auto-fit, minmax(280px, 1fr)); gap:12px; margin-bottom:12px;">
+                <div style="background:#f8fafc; border:1px solid #e2e8f0; border-radius:6px; padding:10px;">
+                    <div style="font-size:11px; font-weight:700; color:#64748b; text-transform:uppercase; margin-bottom:4px;">Mandatory EU AI Act Requirements</div>
+                    <div style="display:flex; flex-wrap:wrap; gap:4px; margin-top:4px;">{articles_html or 'N/A'}</div>
+                    <div style="margin-top:8px; font-size:11px; color:#475569;">
+                        <strong>Conformity Procedure:</strong> {reqs.get('conformity_procedure', 'N/A')}
+                    </div>
+                    <div style="margin-top:4px; font-size:11px; color:#b91c1c; font-weight:600;">
+                        <strong>Statutory Fine Ceiling:</strong> {reqs.get('fine_exposure_tier', 'N/A')}
+                    </div>
+                </div>
+
+                <div style="background:#f8fafc; border:1px solid #e2e8f0; border-radius:6px; padding:10px;">
+                    <div style="font-size:11px; font-weight:700; color:#64748b; text-transform:uppercase; margin-bottom:4px;">Harmonized Framework Crosswalk</div>
+                    <div style="margin-bottom:4px; font-size:11px;"><strong>NIST AI RMF:</strong> {nist_html or 'None'}</div>
+                    <div style="margin-bottom:4px; font-size:11px;"><strong>ISO/IEC 42001:</strong> {iso_html or 'None'}</div>
+                    <div style="font-size:11px;"><strong>GDPR:</strong> {gdpr_html or 'None'}</div>
+                </div>
+            </div>
+
+            <div style="background:#fffbeb; border:1px solid #fde68a; border-radius:6px; padding:10px 12px; margin-bottom:12px; font-size:12px; color:#92400e; line-height:1.5;">
+                <strong>⚠️ Auditor Pitfall & Common Failure Mode:</strong> {guidance.get('common_pitfalls', '')}
+            </div>
+
+            <!-- Cryptographic Provenance Block -->
+            <div style="background:#0f172a; color:#cbd5e1; border-radius:6px; padding:12px; font-size:11px; line-height:1.6;">
+                <div style="display:flex; justify-content:space-between; align-items:center; border-bottom:1px solid #334155; padding-bottom:6px; margin-bottom:6px;">
+                    <span style="font-weight:700; color:#38bdf8; display:flex; align-items:center; gap:4px;">
+                        🔐 Cryptographic Provenance & Legal Anchor (EUR-Lex)
+                    </span>
+                    <a href="{prov.get('eli_uri', 'http://data.europa.eu/eli/reg/2024/1689/oj')}" target="_blank" style="color:#60a5fa; text-decoration:none; font-weight:600;">
+                        CELEX:{prov.get('celex', '32024R1689')} ↗
+                    </a>
+                </div>
+                <div style="font-style:italic; color:#94a3b8; margin-bottom:6px; font-size:11px; border-left:2px solid #38bdf8; padding-left:8px;">
+                    "{prov.get('statutory_quote', '')[:220]}..."
+                </div>
+                <div style="display:grid; grid-template-columns:1fr 1fr; gap:6px; font-family:monospace; font-size:10px;">
+                    <div><span style="color:#64748b;">Statutory Quote SHA-256:</span> <span style="color:#a7f3d0;">{prov.get('statutory_quote_sha256', '')[:16]}...</span></div>
+                    <div><span style="color:#64748b;">Model Spec SHA-256:</span> <span style="color:#a7f3d0;">{prov.get('spec_file_sha256', '')[:16]}...</span></div>
+                    <div style="grid-column: span 2;"><span style="color:#64748b;">W3C PROV-O Entity:</span> <span style="color:#bae6fd;">{prov.get('prov_o_entity', '')}</span></div>
+                </div>
+            </div>
+        </div>
+        """
+        return html

src/extraction/parser.py

@@ -77,20 +77,52 @@ class SpecificationParser:
         name_match = re.search(r"^#\s+(.+)$", raw_markdown, re.MULTILINE)
         name = name_match.group(1).strip() if name_match else default_id.replace("-", " ").title()
 
-        domain = "High-Risk Healthcare / HR / Finance"
-        if re.search(r"\b(medical|clinical|diagnostic|radiology|samd)\b", raw_markdown, re.I):
+        # Dynamic Domain Detection
+        domain = "High-Risk AI System"
+        if re.search(r"\b(medical|clinical|diagnostic|radiology|samd|oncology)\b", raw_markdown, re.I):
             domain = "Healthcare & Medical Diagnostics"
-        elif re.search(r"\b(recruitment|employment|cv|resume|interview)\b", raw_markdown, re.I):
+        elif re.search(r"\b(recruitment|employment|cv|resume|interview|workplace)\b", raw_markdown, re.I):
             domain = "Employment & HR Screening"
-        elif re.search(r"\b(credit|loan|financial|underwriting)\b", raw_markdown, re.I):
+        elif re.search(r"\b(credit|loan|financial|underwriting|banking)\b", raw_markdown, re.I):
             domain = "Financial Services & Credit Scoring"
+        elif re.search(r"\b(automotive|transport|braking|vehicle)\b", raw_markdown, re.I):
+            domain = "Automotive & Road Transport Safety"
+        elif re.search(r"\b(grid|electricity|energy|critical infrastructure|scada)\b", raw_markdown, re.I):
+            domain = "Critical Infrastructure & Energy Management"
+        elif re.search(r"\b(education|proctoring|exam|student|cheating)\b", raw_markdown, re.I):
+            domain = "Education & Vocational Training"
+        elif re.search(r"\b(justice|recidivism|court|bail|law enforcement)\b", raw_markdown, re.I):
+            domain = "Law Enforcement & Criminal Justice"
+        elif re.search(r"\b(gpai|frontier|foundation model|llm)\b", raw_markdown, re.I):
+            domain = "General Purpose AI & Frontier Models"
+        elif re.search(r"\b(social scoring|trustworthiness|civic score)\b", raw_markdown, re.I):
+            domain = "Public Administration & Civic Scoring"
+        elif re.search(r"\b(chatbot|conversational|support agent)\b", raw_markdown, re.I):
+            domain = "Customer Support & Conversational AI"
+        elif re.search(r"\b(spam|phishing|email security)\b", raw_markdown, re.I):
+            domain = "Enterprise Cybersecurity & Email Management"
+
+        # Dynamic Statutory Risk Classification
+        risk_class = "High-Risk (Annex III)"
+        if re.search(r"\b(prohibited|social scoring|emotion recognition|article 5\b)", raw_markdown, re.I):
+            risk_class = "Prohibited (Article 5)"
+        elif re.search(r"\b(systemic risk|article 51|10\^25|frontier foundation)\b", raw_markdown, re.I):
+            risk_class = "GPAI with Systemic Risk (Article 51)"
+        elif re.search(r"\b(general purpose|gpai|article 53)\b", raw_markdown, re.I):
+            risk_class = "GPAI Model (Article 53)"
+        elif re.search(r"\b(limited risk|article 50|transparency obligations)\b", raw_markdown, re.I):
+            risk_class = "Limited Risk (Article 50)"
+        elif re.search(r"\b(minimal risk|voluntary codes? of conduct)\b", raw_markdown, re.I):
+            risk_class = "Minimal / No Statutory Risk"
+        elif re.search(r"\b(annex i|automotive safety component|article 6\(1\)|medical device|mdr)\b", raw_markdown, re.I):
+            risk_class = "High-Risk (Annex I / Article 6(1))"
 
         metadata = SystemMetadata(
             system_id=default_id,
             name=name,
             domain=domain,
             intended_purpose="Automated processing and evaluation in high-impact workflows.",
-            eu_risk_classification="High-Risk (Annex III)",
+            eu_risk_classification=risk_class,
         )
 
         return SystemSpecification(

src/reasoning/shacl_engine.py

@@ -51,13 +51,26 @@ class DeterministicSHACLEngine:
                 debug=False,
             )
             violations, warnings = self._parse_shacl_report(report_graph)
+            # In W3C SHACL, warnings do not break conformity; only sh:Violation breaks conformity
+            conforms = len(violations) == 0
         except ImportError:
             # Fallback deterministic rule validator if PySHACL is not installed in runtime
             conforms, violations, warnings = self._fallback_deterministic_validation(system_graph)
 
         total_rules = max(1, len(violations) + len(warnings) + 5)
         passed_rules = max(0, total_rules - len(violations))
-        conformity_score = round((passed_rules / total_rules) * 100.0, 1)
+
+        # Article 5 Prohibited AI practices are fatal violations that yield 0.0% conformity score
+        has_prohibited_violation = any(
+            "Article 5" in v.regulatory_article or "prohibited" in v.message.lower()
+            for v in violations
+        )
+        if has_prohibited_violation:
+            conformity_score = 0.0
+        elif conforms:
+            conformity_score = 100.0
+        else:
+            conformity_score = round((passed_rules / total_rules) * 100.0, 1)
 
         return conforms, violations, warnings, conformity_score
 

tests/test_api.py

@@ -94,3 +94,29 @@ def test_api_triage_feedback():
     data = response.json()
     assert data["status"] == "RECORDED"
     assert "positive_label" in data["triplet"]
+
+
+def test_api_benchmark_catalog():
+    response = client.get("/api/v1/benchmarks/catalog")
+    assert response.status_code == 200
+    data = response.json()
+    assert "domains" in data
+    assert len(data["domains"]) >= 10
+    assert data["celex"] == "32024R1689"
+
+    # Test domain filtering query
+    filtered = client.get("/api/v1/benchmarks/catalog?domain=healthcare_samd")
+    assert filtered.status_code == 200
+    f_data = filtered.json()
+    assert f_data["total_cases"] >= 1
+    assert any("SaMD" in c["title"] for c in f_data["case_studies"])
+
+
+def test_api_benchmark_case():
+    response = client.get("/api/v1/benchmarks/cases/compliant_clinical_samd")
+    assert response.status_code == 200
+    data = response.json()
+    assert "case_metadata" in data
+    assert "raw_specification_text" in data
+    assert data["case_metadata"]["provenance"]["celex"] == "32024R1689"
+    assert "spec_file_sha256" in data["case_metadata"]["provenance"]

tests/test_case_catalog.py

@@ -0,0 +1,112 @@
+"""
+Tests for Domain-Driven Case Study Catalog and Cryptographic Provenance Anchors.
+"""
+
+import hashlib
+import json
+from pathlib import Path
+import pytest
+
+from src.core.config import PROJECT_ROOT, BENCHMARKS_DIR
+from src.core.case_catalog import CaseStudyCatalog
+from src.engine import ReguAIEngine
+
+
+@pytest.fixture
+def catalog():
+    return CaseStudyCatalog()
+
+
+@pytest.fixture
+def engine():
+    return ReguAIEngine()
+
+
+def test_catalog_structure_and_domains(catalog):
+    domains = catalog.list_domains()
+    assert len(domains) == 11
+    domain_ids = [d["domain_id"] for d in domains]
+    assert "healthcare_samd" in domain_ids
+    assert "employment_hr" in domain_ids
+    assert "banking_finance" in domain_ids
+    assert "transport_safety" in domain_ids
+    assert "critical_infrastructure" in domain_ids
+    assert "education_training" in domain_ids
+    assert "justice_law_enforcement" in domain_ids
+    assert "frontier_gpai" in domain_ids
+    assert "prohibited_practices" in domain_ids
+    assert "limited_risk_generative" in domain_ids
+    assert "minimal_risk" in domain_ids
+
+
+def test_cryptographic_provenance_integrity(catalog):
+    """
+    Cryptographic verification: Recomputes SHA-256 digests of all specification
+    files and statutory text excerpts and asserts exact parity with catalog ledger.
+    """
+    for domain in catalog.list_domains():
+        for case in domain["case_studies"]:
+            file_path = PROJECT_ROOT / case["file_path"]
+            assert file_path.exists(), f"File missing: {file_path}"
+
+            # 1. Spec file SHA-256 verification
+            computed_file_hash = hashlib.sha256(file_path.read_bytes()).hexdigest()
+            assert case["file_sha256"] == computed_file_hash
+            assert case["provenance"]["spec_file_sha256"] == computed_file_hash
+
+            # 2. Statutory quote SHA-256 verification
+            quote = case["statutory_quote"]
+            computed_quote_hash = hashlib.sha256(quote.encode("utf-8")).hexdigest()
+            assert case["provenance"]["statutory_quote_sha256"] == computed_quote_hash
+
+            # 3. Provenance anchor metadata
+            assert case["provenance"]["celex"] == "32024R1689"
+            assert "eli_uri" in case["provenance"]
+            assert case["provenance"]["prov_o_entity"].startswith("urn:reguai:benchmark:case:")
+
+
+def test_render_factsheet_html(catalog):
+    case = catalog.get_case("transport_autonomous_braking")
+    assert case is not None
+    html = catalog.render_factsheet_html("transport_autonomous_braking")
+    assert "AutoDrive SafeStop" in html
+    assert "CELEX:32024R1689" in html
+    assert "Statutory Quote SHA-256" in html
+    assert "Model Spec SHA-256" in html
+    assert "W3C PROV-O Entity" in html
+
+
+def test_transport_safety_conforms(engine, catalog):
+    doc_text = catalog.get_case_document_text("transport_autonomous_braking")
+    assert len(doc_text) > 0
+    report = engine.evaluate_system(doc_text)
+    assert report.overall_conforms is True
+    assert report.conformity_score == 100.0
+
+
+def test_education_surveillance_fails(engine, catalog):
+    doc_text = catalog.get_case_document_text("education_remote_proctoring")
+    assert len(doc_text) > 0
+    report = engine.evaluate_system(doc_text)
+    assert report.overall_conforms is False
+    assert len(report.violations) > 0
+    # Must fail Article 14 (oversight) and Article 10(2)(f) (bias)
+    violated_articles = [v.regulatory_article for v in report.violations]
+    assert any("14" in art for art in violated_articles)
+    assert any("10" in art for art in violated_articles)
+
+
+def test_prohibited_social_scoring_fails_with_tier_1_fine(engine, catalog):
+    doc_text = catalog.get_case_document_text("prohibited_social_scoring")
+    assert len(doc_text) > 0
+    report = engine.evaluate_system(doc_text, annual_turnover_eur=100_000_000.0)
+    assert report.overall_conforms is False
+    assert report.conformity_score == 0.0
+    assert report.fine_exposure is not None
+    # fine_exposure is stored as a dict in ConformityReport
+    if isinstance(report.fine_exposure, dict):
+        assert report.fine_exposure["highest_tier_triggered"] == "TIER_1_PROHIBITED_AI"
+        assert report.fine_exposure["applicable_ceiling_eur"] == 35_000_000.0
+    else:
+        assert report.fine_exposure.highest_tier_triggered == "TIER_1_PROHIBITED_AI"
+        assert report.fine_exposure.applicable_ceiling_eur == 35_000_000.0