Deploy ReguAI: Neuro-Symbolic AI GRC & Automated Conformity Assessment Engine

api.py

@@ -43,6 +43,14 @@ CERTIFICATE_CACHE: Dict[str, ConformityReport] = {}
 class AuditRequest(BaseModel):
     specification_text: str = Field(..., description="Markdown model card, YAML spec, or JSON system document.")
     auditor_id: Optional[str] = Field("ci_cd_automated_pipeline", description="Identifier of the executing pipeline or auditor.")
+    annual_turnover_eur: Optional[float] = Field(0.0, description="Annual corporate worldwide turnover in EUR for fine exposure modeling.")
+    is_sme: Optional[bool] = Field(False, description="Whether the organization qualifies as an SME/startup under Article 99(6).")
+
+
+class PenaltyCalculationRequest(BaseModel):
+    violations: List[str] = Field(default_factory=list, description="List of violated articles, e.g. ['Article 5(1)(c)', 'Article 14'].")
+    annual_turnover_eur: float = Field(0.0, description="Annual corporate turnover in EUR.")
+    is_sme: bool = Field(False, description="SME cap flag under Article 99(6).")
 
 
 class TripletFeedbackRequest(BaseModel):
@@ -63,6 +71,45 @@ def health_check():
     }
 
 
+@app.get("/api/v1/frameworks/crosswalk", tags=["Harmonization"])
+def get_regulatory_crosswalk():
+    """
+    Returns the complete bidirectional regulatory ontology crosswalk linking
+    EU AI Act Articles to NIST AI RMF 1.0, ISO/IEC 42001:2023, and GDPR.
+    """
+    return {
+        "total_mappings": len(engine.crosswalk.mappings),
+        "mappings": engine.crosswalk.mappings,
+    }
+
+
+@app.post("/api/v1/penalties/calculate", tags=["Penalties"])
+def calculate_penalties(request: PenaltyCalculationRequest):
+    """
+    Calculates statutory fine liability and financial balance sheet risk under Article 99.
+    """
+    from src.core.models import ValidationViolation
+    mock_violations = [
+        ValidationViolation(
+            focus_node="MockNode",
+            result_path="MockPath",
+            source_constraint_component="MockComponent",
+            message="Violated constraint",
+            severity="Violation",
+            regulatory_article=art,
+            normative_reference=art,
+            remediation_guidance="Remediate constraint",
+        )
+        for art in request.violations
+    ]
+    estimate = engine.fine_calculator.calculate_exposure(
+        violations=mock_violations,
+        annual_turnover_eur=request.annual_turnover_eur,
+        is_sme=request.is_sme,
+    )
+    return estimate.model_dump()
+
+
 @app.post("/api/v1/audit/evaluate", response_model=Dict[str, Any], tags=["Conformity Assessment"])
 def evaluate_specification(request: AuditRequest):
     """
@@ -72,7 +119,12 @@ def evaluate_specification(request: AuditRequest):
         raise HTTPException(status_code=400, detail="Specification text cannot be empty.")
 
     try:
-        report = engine.evaluate_system(request.specification_text, auditor_id=request.auditor_id)
+        report = engine.evaluate_system(
+            request.specification_text,
+            auditor_id=request.auditor_id,
+            annual_turnover_eur=request.annual_turnover_eur or 0.0,
+            is_sme=request.is_sme or False,
+        )
         token = report.provenance.digital_signature
         CERTIFICATE_CACHE[token] = report
 
@@ -97,6 +149,8 @@ def evaluate_specification(request: AuditRequest):
             "claims_extracted_count": len(report.claims_analyzed),
             "borderline_claims_count": len(report.borderline_claims),
             "executive_summary": report.executive_summary,
+            "fine_exposure": report.fine_exposure,
+            "harmonized_frameworks": report.harmonized_frameworks,
             "provenance": {
                 "source_doc_sha256": report.provenance.input_doc_sha256,
                 "graph_sha256": report.provenance.graph_triples_sha256,

app.py

@@ -39,7 +39,7 @@ def load_sample_content(sample_name: str) -> str:
     return ""
 
 
-def run_assessment(doc_text: str, auditor_id: str):
+def run_assessment(doc_text: str, auditor_id: str, annual_turnover: float = 50000000.0, is_sme: bool = False):
     if not doc_text or not doc_text.strip():
         return (
             "⚠️ Please enter model card text or select a pre-loaded sample.",
@@ -52,9 +52,16 @@ def run_assessment(doc_text: str, auditor_id: str):
             "",
             "<div>No certificate generated.</div>",
             [],
+            [],
+            "<div style='padding:15px;'>No fine liability evaluated.</div>",
         )
 
-    report = engine.evaluate_system(doc_text, auditor_id=auditor_id or "auditor_01")
+    report = engine.evaluate_system(
+        doc_text,
+        auditor_id=auditor_id or "auditor_01",
+        annual_turnover_eur=float(annual_turnover or 0.0),
+        is_sme=bool(is_sme),
+    )
     
     # 1. Executive Summary HTML
     status_color = "#10b981" if report.overall_conforms else "#ef4444"
@@ -131,7 +138,49 @@ def run_assessment(doc_text: str, auditor_id: str):
             b.evidence_quote[:100],
         ])
 
-    # 6. Cryptographic Ledger Proofs
+    # 6. Multi-Framework Harmonization Data Table
+    frameworks_data = []
+    if report.harmonized_frameworks:
+        fw_dict = report.harmonized_frameworks.get("frameworks", {})
+        for fw_name, fw_info in fw_dict.items():
+            for ctrl in fw_info.get("controls", []):
+                stat_badge = "🟢 SATISFIED" if ctrl.get("status") == "SATISFIED" else "🔴 NON-COMPLIANT"
+                frameworks_data.append([
+                    fw_name,
+                    ctrl.get("control_id"),
+                    ctrl.get("control_name"),
+                    stat_badge,
+                    ctrl.get("eu_ai_act_article"),
+                    ctrl.get("audit_guidance"),
+                ])
+
+    # 7. Article 99 Fine Liability Scorecard HTML
+    fine = report.fine_exposure or {}
+    ceiling = fine.get("applicable_ceiling_eur", 0.0)
+    tier_name = fine.get("highest_tier_triggered", "NONE")
+    color = "#10b981" if ceiling == 0.0 else ("#ef4444" if "PROHIBITED" in tier_name else "#f59e0b")
+    bg = "#f0fdf4" if ceiling == 0.0 else "#fff7ed"
+    border = "#bbf7d0" if ceiling == 0.0 else "#fed7aa"
+
+    fine_html = f"""
+    <div style="background: {bg}; border: 1px solid {border}; padding: 20px; border-radius: 8px; margin-bottom: 15px;">
+        <div style="font-size: 13px; font-weight: 700; color: {color}; text-transform: uppercase; letter-spacing: 0.5px;">Regulation (EU) 2024/1689 Article 99 Corporate Fine Exposure</div>
+        <div style="font-size: 32px; font-weight: 800; color: {color}; margin: 8px 0;">
+            €{ceiling:,.2f}
+        </div>
+        <div style="display: flex; gap: 25px; font-size: 13px; color: #475569; margin-bottom: 14px; flex-wrap: wrap;">
+            <div><strong>Penalty Tier:</strong> <code>{tier_name}</code></div>
+            <div><strong>Turnover Percentage:</strong> {fine.get('turnover_percentage', 0)}% of global annual turnover</div>
+            <div><strong>SME Discount (Art. 99(6)):</strong> {'✓ Active' if fine.get('is_sme_discount_applied') else '✗ Inactive (Standard Enterprise)'}</div>
+            <div><strong>Simulated Turnover:</strong> €{float(annual_turnover):,.2f}</div>
+        </div>
+        <div style="font-size: 13px; color: #1e293b; line-height: 1.6; background: rgba(255,255,255,0.85); padding: 12px 16px; border-radius: 6px; border: 1px solid #e2e8f0;">
+            <strong>Statutory Basis & Remediations:</strong> {fine.get('executive_liability_summary', '')}
+        </div>
+    </div>
+    """
+
+    # 8. Cryptographic Ledger Proofs
     prov = report.provenance
     cert_token = prov.digital_signature
     hash_summary = (
@@ -144,7 +193,7 @@ def run_assessment(doc_text: str, auditor_id: str):
         f"| Conformity Assessment Digest | `{prov.certificate_sha256}` |\n"
     )
 
-    # 7. Annex IV Markdown, JSON-LD & Styled HTML Certificate
+    # 9. Annex IV Markdown, JSON-LD & Styled HTML Certificate
     md_report = engine.report_generator.generate_markdown_report(report)
     json_ld_cert = json.dumps(engine.report_generator.generate_json_ld(report), indent=2)
     raw_cert_html = engine.report_generator.generate_html_certificate(report)
@@ -164,6 +213,8 @@ def run_assessment(doc_text: str, auditor_id: str):
         md_report,
         cert_iframe_html,
         borderline_data,
+        frameworks_data,
+        fine_html,
     )
 
 
@@ -435,7 +486,7 @@ button:not(.primary):not([variant="primary"]) {
 }
 """
 
-with gr.Blocks(title="ReguAI: Neuro-Symbolic AI GRC Engine", css=CUSTOM_CSS, theme=gr.themes.Soft()) as demo:
+with gr.Blocks(title="ReguAI: Neuro-Symbolic AI GRC Engine") as demo:
     gr.Markdown(
         """
         # 🏛️ ReguAI: Deterministic Neuro-Symbolic AI GRC & Conformity Engine
@@ -446,9 +497,9 @@ with gr.Blocks(title="ReguAI: Neuro-Symbolic AI GRC Engine", css=CUSTOM_CSS, the
         <div style="display: flex; gap: 8px; margin-top: 8px; flex-wrap: wrap;">
             <span class="header-badge">🇪🇺 EU AI Act High-Risk (Arts. 9-15)</span>
             <span class="header-badge">📐 W3C SHACL Deterministic Proofs</span>
-            <span class="header-badge">🌐 Interactive Knowledge Graph</span>
+            <span class="header-badge">🌐 Multi-Framework Crosswalk (NIST & ISO)</span>
+            <span class="header-badge">💰 Article 99 Statutory Fine Modeling</span>
             <span class="header-badge">🔗 W3C PROV-O Audit Ledger</span>
-            <span class="header-badge">🛡️ Zero-Hallucination Guarantee</span>
             <span class="header-badge">👤 Auditor-in-the-Loop Active Learning</span>
         </div>
         """
@@ -472,6 +523,18 @@ with gr.Blocks(title="ReguAI: Neuro-Symbolic AI GRC Engine", css=CUSTOM_CSS, the
                 value="lead_compliance_auditor_01",
                 placeholder="e.g. auditor@enterprise.org",
             )
+            with gr.Accordion("💰 Article 99 Corporate Fine Modeling", open=False):
+                turnover_input = gr.Number(
+                    label="Worldwide Annual Turnover (EUR)",
+                    value=50000000.0,
+                    step=5000000.0,
+                    info="Used to calculate maximum turnover percentage ceilings under Article 99"
+                )
+                is_sme_input = gr.Checkbox(
+                    label="SME / Startup Status (Article 99(6) Special Ceiling)",
+                    value=False,
+                    info="Applies lower of fixed amount or turnover percentage"
+                )
             assess_btn = gr.Button("⚡ Run Deterministic Conformity Assessment", variant="primary", size="lg")
 
         with gr.Column(scale=7):
@@ -488,6 +551,17 @@ with gr.Blocks(title="ReguAI: Neuro-Symbolic AI GRC Engine", css=CUSTOM_CSS, the
                         label="Mathematical Proof: Non-Conformities Found",
                     )
 
+                with gr.TabItem("🌐 Multi-Framework Crosswalk"):
+                    gr.Markdown("### 🇪🇺 EU AI Act ⟷ NIST AI RMF 1.0 ⟷ ISO/IEC 42001:2023 ⟷ GDPR")
+                    frameworks_table = gr.Dataframe(
+                        headers=["Target Framework", "Control ID", "Control Name", "Status", "Linked AI Act Article", "Audit Guidance"],
+                        datatype=["str", "str", "str", "str", "str", "str"],
+                        label="Automated Cross-Regulatory Control Status",
+                    )
+
+                with gr.TabItem("💰 Article 99 Fine Liability"):
+                    fine_liability_output = gr.HTML(label="Corporate Balance Sheet Exposure")
+
                 with gr.TabItem("🔍 Extracted Regulatory Claims"):
                     claims_table = gr.Dataframe(
                         headers=["Claim ID", "Category", "Status", "Confidence", "Target Article", "Evidence Span"],
@@ -531,7 +605,7 @@ with gr.Blocks(title="ReguAI: Neuro-Symbolic AI GRC Engine", css=CUSTOM_CSS, the
 
     assess_btn.click(
         fn=run_assessment,
-        inputs=[spec_input, auditor_input],
+        inputs=[spec_input, auditor_input, turnover_input, is_sme_input],
         outputs=[
             exec_output,
             violations_table,
@@ -543,6 +617,8 @@ with gr.Blocks(title="ReguAI: Neuro-Symbolic AI GRC Engine", css=CUSTOM_CSS, the
             report_markdown,
             cert_html_output,
             borderline_table,
+            frameworks_table,
+            fine_liability_output,
         ],
     )
 
@@ -553,4 +629,4 @@ with gr.Blocks(title="ReguAI: Neuro-Symbolic AI GRC Engine", css=CUSTOM_CSS, the
     )
 
 if __name__ == "__main__":
-    demo.launch(server_name="0.0.0.0", server_port=7860, share=False)
+    demo.launch(server_name="0.0.0.0", server_port=7860, share=False, theme=gr.themes.Soft(), css=CUSTOM_CSS)

data/active_learning_triplets.jsonl

@@ -4,3 +4,6 @@
 {"timestamp": "2026-09-20T19:21:17.032615+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}
 {"timestamp": "2026-09-20T19:25:13.983379+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}
 {"timestamp": "2026-09-20T19:29:16.657657+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}
+{"timestamp": "2026-09-20T19:34:57.435307+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}
+{"timestamp": "2026-09-20T19:37:14.849175+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}
+{"timestamp": "2026-09-20T19:38:35.112557+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}

src/core/models.py

@@ -101,3 +101,5 @@ class ConformityReport(BaseModel):
     provenance: AuditProvenance
     generated_at_utc: str
     executive_summary: str
+    fine_exposure: Optional[Dict[str, Any]] = None
+    harmonized_frameworks: Optional[Dict[str, Any]] = None

src/engine.py

@@ -19,6 +19,8 @@ from src.reasoning.shacl_engine import DeterministicSHACLEngine
 from src.ledger.provenance import ProvenanceLedger
 from src.triage.active_learning import ActiveLearningTriageQueue
 from src.triage.report_generator import ConformityReportGenerator
+from src.reasoning.framework_crosswalk import MultiFrameworkCrosswalk
+from src.reasoning.fine_calculator import FineLiabilityCalculator
 
 
 class ReguAIEngine:
@@ -30,11 +32,15 @@ class ReguAIEngine:
         self.ledger = ProvenanceLedger()
         self.triage_queue = ActiveLearningTriageQueue()
         self.report_generator = ConformityReportGenerator()
+        self.crosswalk = MultiFrameworkCrosswalk()
+        self.fine_calculator = FineLiabilityCalculator()
 
     def evaluate_system(
         self,
         input_data: Union[str, Path, Dict[str, Any]],
         auditor_id: str = "reguai_lead_auditor",
+        annual_turnover_eur: float = 0.0,
+        is_sme: bool = False,
     ) -> ConformityReport:
         """
         Executes full deterministic conformity assessment pipeline:
@@ -43,7 +49,9 @@ class ReguAIEngine:
         3. Construct RDF normative graph
         4. Run deterministic W3C SHACL shape validation
         5. Generate cryptographic W3C PROV-O audit ledger
-        6. Generate comprehensive ConformityReport
+        6. Compute Multi-Framework Harmonization Crosswalk (NIST / ISO / GDPR)
+        7. Calculate Article 99 Statutory Fine Liability
+        8. Generate comprehensive ConformityReport
         """
         # 1. Parsing
         if isinstance(input_data, Path):
@@ -77,7 +85,15 @@ class ReguAIEngine:
             auditor_id=auditor_id,
         )
 
-        # 6. Build Conformity Report
+        # 6. Multi-Framework Harmonization & Article 99 Liability
+        crosswalk_res = self.crosswalk.harmonize(violations=violations)
+        fine_res = self.fine_calculator.calculate_exposure(
+            violations=violations,
+            annual_turnover_eur=annual_turnover_eur,
+            is_sme=is_sme,
+        )
+
+        # 7. Build Conformity Report
         total_reqs = len(violations) + len(warnings) + 6
         passed_reqs = max(0, total_reqs - len(violations))
         now_utc = datetime.now(timezone.utc).isoformat()
@@ -94,7 +110,8 @@ class ReguAIEngine:
             summary = (
                 f"The AI system '{spec.metadata.name}' fails mandatory EU AI Act Chapter III high-risk requirements. "
                 f"Formal W3C SHACL constraint validation discovered {len(violations)} non-conformities affecting {violation_articles}. "
-                f"Remediation is required before deployment into high-impact environments."
+                f"Remediation is required before deployment into high-impact environments. "
+                f"{fine_res.executive_liability_summary}"
             )
 
         report = ConformityReport(
@@ -111,6 +128,8 @@ class ReguAIEngine:
             provenance=provenance,
             generated_at_utc=now_utc,
             executive_summary=summary,
+            fine_exposure=fine_res.model_dump(),
+            harmonized_frameworks=crosswalk_res.model_dump(),
         )
 
         return report

src/extraction/assertion_triage.py

@@ -25,8 +25,10 @@ class AssertionTriage:
         self.planned_patterns = [
             r"\b(planned|planning|roadmap|scheduled|targeted|proposed)\b",
             r"\b(will\s+be|to\s+be\s+implemented|in\s+development|in\s+progress)\b",
-            r"\b(future\s+(?:release|version|iteration|work))\b",
+            r"\b(future\s+(?:releases?|versions?|iterations?|work))\b",
             r"\b(under\s+(?:consideration|evaluation|review))\b",
+            r"\b(might\s+be\s+considered|could\s+be\s+considered|considered\s+for)\b",
+            r"\b(if\s+budget\s+permits|pending\s+approval)\b",
             r"\b(q[1-4]\s*202[0-9])\b",
         ]
 

src/extraction/gliner_extractor.py

@@ -24,6 +24,13 @@ class RegulatoryClaimExtractor:
 
         # Domain Regex & Semantic Keywords for Regulatory Concepts
         self.category_patterns: Dict[EntityCategory, Dict[str, Any]] = {
+            EntityCategory.FAIL_SAFE: {
+                "article": "Article 14(4)(e) / Art 15",
+                "keywords": [
+                    r"\b(emergency\s+stop|kill\s+switch|fail-safe|fallback\s+mechanism)\b",
+                    r"\b(graceful\s+degradation|circuit\s+breaker|safe\s+shutdown)\b",
+                ],
+            },
             EntityCategory.HUMAN_OVERSIGHT: {
                 "article": "Article 14",
                 "keywords": [
@@ -32,13 +39,6 @@ class RegulatoryClaimExtractor:
                     r"\b(two-person\s+rule|dual\s+authorization|doctor\s+approval)\b",
                 ],
             },
-            EntityCategory.FAIL_SAFE: {
-                "article": "Article 14(4)(e) / Art 15",
-                "keywords": [
-                    r"\b(emergency\s+stop|kill\s+switch|fail-safe|fallback\s+mechanism)\b",
-                    r"\b(graceful\s+degradation|circuit\s+breaker|safe\s+shutdown)\b",
-                ],
-            },
             EntityCategory.DATA_GOVERNANCE: {
                 "article": "Article 10",
                 "keywords": [
@@ -88,8 +88,8 @@ class RegulatoryClaimExtractor:
             EntityCategory.CYBERSECURITY: {
                 "article": "Article 15(4)",
                 "keywords": [
-                    r"\b(cybersecurity|adversarial\s+robustness|adversarial\s+attack)\b",
-                    r"\b(prompt\s+injection\s+defense|data\s+poisoning|model\s+inversion)\b",
+                    r"\b(cybersecurity|adversarial\s+(?:robustness|attack|testing)|adversarial)\b",
+                    r"\b(prompt\s+injection(?:\s+defense)?|data\s+poisoning|model\s+inversion)\b",
                     r"\b(input\s+sanitization|model\s+extraction\s+defense)\b",
                 ],
             },

src/reasoning/fine_calculator.py

@@ -0,0 +1,126 @@
+"""
+Article 99 Statutory Fine Liability & SME Exposure Calculator.
+Calculates maximum corporate balance sheet exposure under Regulation (EU) 2024/1689:
+- Tier 1 (Article 5 Prohibitions): Up to 35M€ or 7% global turnover
+- Tier 2 (Chapter III High-Risk Obligations): Up to 15M€ or 3% global turnover
+- Tier 3 (Misinformation / Notified Body Requests): Up to 7.5M€ or 1.5% global turnover
+- Article 99(6) Special Cap: Fines on SMEs/startups use min(fixed, percentage)
+"""
+
+import json
+from pathlib import Path
+from typing import List, Optional, Dict, Any
+from pydantic import BaseModel, Field
+
+from src.core.config import BENCHMARKS_DIR
+from src.core.models import ValidationViolation
+
+
+class FineExposureEstimate(BaseModel):
+    is_non_compliant: bool
+    highest_tier_triggered: str
+    statutory_legal_basis: str
+    maximum_fine_eur: float
+    turnover_percentage: float
+    applicable_ceiling_eur: float
+    is_sme_discount_applied: bool
+    assumed_annual_turnover_eur: float
+    affected_articles: List[str] = Field(default_factory=list)
+    executive_liability_summary: str
+
+
+class FineLiabilityCalculator:
+    def __init__(self, guidelines_path: Optional[Path] = None):
+        self.guidelines_file = guidelines_path or (BENCHMARKS_DIR / "rules" / "ai_act_fine_guidelines.json")
+        self.guidelines: Dict[str, Any] = {}
+        self._load_guidelines()
+
+    def _load_guidelines(self) -> None:
+        if self.guidelines_file.exists():
+            with open(self.guidelines_file, "r", encoding="utf-8") as f:
+                self.guidelines = json.load(f)
+        else:
+            # Standard statutory default fallbacks under Article 99
+            self.guidelines = {
+                "tiers": [
+                    {"tier": "TIER_1_PROHIBITED_AI", "maximum_fine_eur": 35000000, "maximum_turnover_pct": 7.0, "legal_basis": "Article 99(3)"},
+                    {"tier": "TIER_2_HIGH_RISK_OBLIGATIONS", "maximum_fine_eur": 15000000, "maximum_turnover_pct": 3.0, "legal_basis": "Article 99(4)"},
+                    {"tier": "TIER_3_MISINFORMATION_NOTIFICATION", "maximum_fine_eur": 7500000, "maximum_turnover_pct": 1.5, "legal_basis": "Article 99(5)"},
+                ]
+            }
+
+    def calculate_exposure(
+        self,
+        violations: List[ValidationViolation],
+        annual_turnover_eur: float = 0.0,
+        is_sme: bool = False,
+    ) -> FineExposureEstimate:
+        """
+        Calculates maximum fine liability exposure according to Article 99 rules.
+        """
+        if not violations:
+            return FineExposureEstimate(
+                is_non_compliant=False,
+                highest_tier_triggered="NONE",
+                statutory_legal_basis="Article 99 (Full Compliance)",
+                maximum_fine_eur=0.0,
+                turnover_percentage=0.0,
+                applicable_ceiling_eur=0.0,
+                is_sme_discount_applied=is_sme,
+                assumed_annual_turnover_eur=annual_turnover_eur,
+                affected_articles=[],
+                executive_liability_summary="Zero statutory fine liability. System satisfies audited regulatory constraints.",
+            )
+
+        affected_articles = sorted(set(v.regulatory_article for v in violations))
+        has_prohibited = any("5" in art for art in affected_articles)
+        has_high_risk = any(any(hr in art for hr in ["9", "10", "11", "12", "13", "14", "15", "16", "26", "27"]) for art in affected_articles)
+
+        if has_prohibited:
+            tier_name = "TIER_1_PROHIBITED_AI"
+            fixed_max = 35_000_000.0
+            pct_max = 7.0
+            legal_basis = "Article 99(3) [Infringement of Prohibited AI Practices in Article 5]"
+        elif has_high_risk:
+            tier_name = "TIER_2_HIGH_RISK_OBLIGATIONS"
+            fixed_max = 15_000_000.0
+            pct_max = 3.0
+            legal_basis = "Article 99(4) [Non-compliance with Chapter III High-Risk Requirements]"
+        else:
+            tier_name = "TIER_3_MISINFORMATION_NOTIFICATION"
+            fixed_max = 7_500_000.0
+            pct_max = 1.5
+            legal_basis = "Article 99(5) [General Infringement]"
+
+        turnover_based_fine = (annual_turnover_eur * (pct_max / 100.0)) if annual_turnover_eur > 0 else 0.0
+
+        if is_sme:
+            # Article 99(6): min(fixed_max, percentage_based_fine)
+            if annual_turnover_eur > 0:
+                applicable_ceiling = min(fixed_max, turnover_based_fine)
+            else:
+                applicable_ceiling = fixed_max
+            summary = (
+                f"SME Status Active (Article 99(6)): Maximum statutory fine capped at "
+                f"€{applicable_ceiling:,.2f} under {legal_basis} (subject to the lower of €{fixed_max:,.0f} or {pct_max}% of turnover)."
+            )
+        else:
+            # Standard enterprise: whichever is higher
+            applicable_ceiling = max(fixed_max, turnover_based_fine)
+            summary = (
+                f"Enterprise Exposure: Maximum statutory fine of up to "
+                f"€{applicable_ceiling:,.2f} under {legal_basis} (higher of €{fixed_max:,.0f} or {pct_max}% worldwide annual turnover)."
+            )
+
+        return FineExposureEstimate(
+            is_non_compliant=True,
+            highest_tier_triggered=tier_name,
+            statutory_legal_basis=legal_basis,
+            maximum_fine_eur=fixed_max,
+            turnover_percentage=pct_max,
+            applicable_ceiling_eur=applicable_ceiling,
+            is_sme_discount_applied=is_sme,
+            assumed_annual_turnover_eur=annual_turnover_eur,
+            affected_articles=affected_articles,
+            executive_liability_summary=summary,
+        )

src/reasoning/framework_crosswalk.py

@@ -0,0 +1,134 @@
+"""
+Multi-Framework Regulatory Harmonization Crosswalk.
+Projects EU AI Act (Regulation EU 2024/1689) conformity findings onto:
+- NIST AI RMF 1.0 (GOVERN, MAP, MEASURE, MANAGE)
+- ISO/IEC 42001:2023 (Clauses & Annex A Controls)
+- GDPR (Regulation EU 2016/679)
+"""
+
+import json
+from pathlib import Path
+from typing import Dict, List, Any, Optional
+from pydantic import BaseModel, Field
+
+from src.core.config import BENCHMARKS_DIR
+from src.core.models import ValidationViolation
+
+
+class FrameworkControlStatus(BaseModel):
+    control_id: str
+    control_name: str
+    target_framework: str
+    status: str  # "SATISFIED", "NON_COMPLIANT", "NOT_EVALUATED"
+    eu_ai_act_article: str
+    relationship_type: str
+    semantic_rationale: str
+    audit_guidance: str
+
+
+class FrameworkSummary(BaseModel):
+    total_mapped_controls: int
+    satisfied_controls_count: int
+    non_compliant_controls_count: int
+    conformity_percentage: float
+    controls: List[FrameworkControlStatus] = Field(default_factory=list)
+
+
+class MultiFrameworkCrosswalkResult(BaseModel):
+    frameworks: Dict[str, FrameworkSummary] = Field(default_factory=dict)
+    high_level_summary: str = ""
+
+
+class MultiFrameworkCrosswalk:
+    def __init__(self, mappings_path: Optional[Path] = None):
+        self.mappings_file = mappings_path or (BENCHMARKS_DIR / "rules" / "cross_regulatory_frameworks.json")
+        self.mappings: List[Dict[str, Any]] = []
+        self._load_mappings()
+
+    def _load_mappings(self) -> None:
+        if self.mappings_file.exists():
+            with open(self.mappings_file, "r", encoding="utf-8") as f:
+                data = json.load(f)
+                self.mappings = data.get("mappings", [])
+        else:
+            self.mappings = []
+
+    def harmonize(
+        self,
+        violations: List[ValidationViolation],
+        all_evaluated_articles: Optional[List[str]] = None,
+    ) -> MultiFrameworkCrosswalkResult:
+        """
+        Projects EU AI Act conformity assessment results across target frameworks.
+        """
+        violation_articles = set(v.regulatory_article.strip() for v in violations)
+        # Normalize: e.g. "Article 9(2)" -> "Article 9" prefix match
+        def is_article_violated(article_name: str) -> bool:
+            for v_art in violation_articles:
+                if article_name.startswith(v_art) or v_art.startswith(article_name):
+                    return True
+            return False
+
+        framework_controls: Dict[str, List[FrameworkControlStatus]] = {
+            "NIST AI RMF 1.0": [],
+            "ISO/IEC 42001:2023": [],
+            "GDPR (EU 2016/679)": [],
+        }
+
+        for m in self.mappings:
+            target_fw = m.get("target_framework", "Unknown")
+            eu_art = m.get("eu_ai_act_article", "")
+            has_violation = is_article_violated(eu_art)
+
+            status = "NON_COMPLIANT" if has_violation else "SATISFIED"
+
+            ctrl_status = FrameworkControlStatus(
+                control_id=m.get("target_control_id", ""),
+                control_name=m.get("target_control_name", ""),
+                target_framework=target_fw,
+                status=status,
+                eu_ai_act_article=eu_art,
+                relationship_type=m.get("relationship_type", "EXACT_EQUIVALENT"),
+                semantic_rationale=m.get("semantic_rationale", ""),
+                audit_guidance=m.get("audit_guidance", ""),
+            )
+
+            if target_fw in framework_controls:
+                framework_controls[target_fw].append(ctrl_status)
+            else:
+                framework_controls.setdefault(target_fw, []).append(ctrl_status)
+
+        framework_summaries: Dict[str, FrameworkSummary] = {}
+        total_satisfied = 0
+        total_controls = 0
+
+        for fw_name, ctrls in framework_controls.items():
+            tot = len(ctrls)
+            sat = sum(1 for c in ctrls if c.status == "SATISFIED")
+            non = sum(1 for c in ctrls if c.status == "NON_COMPLIANT")
+            pct = round((sat / tot * 100.0), 1) if tot > 0 else 100.0
+
+            total_satisfied += sat
+            total_controls += tot
+
+            framework_summaries[fw_name] = FrameworkSummary(
+                total_mapped_controls=tot,
+                satisfied_controls_count=sat,
+                non_compliant_controls_count=non,
+                conformity_percentage=pct,
+                controls=ctrls,
+            )
+
+        overall_pct = round((total_satisfied / total_controls * 100.0), 1) if total_controls > 0 else 100.0
+        summary_text = (
+            f"Multi-framework crosswalk mapped across {len(framework_summaries)} international frameworks: "
+            f"{total_satisfied}/{total_controls} controls satisfied ({overall_pct}% alignment). "
+            f"NIST AI RMF: {framework_summaries.get('NIST AI RMF 1.0', FrameworkSummary(total_mapped_controls=0, satisfied_controls_count=0, non_compliant_controls_count=0, conformity_percentage=0.0)).conformity_percentage}%, "
+            f"ISO 42001: {framework_summaries.get('ISO/IEC 42001:2023', FrameworkSummary(total_mapped_controls=0, satisfied_controls_count=0, non_compliant_controls_count=0, conformity_percentage=0.0)).conformity_percentage}%, "
+            f"GDPR: {framework_summaries.get('GDPR (EU 2016/679)', FrameworkSummary(total_mapped_controls=0, satisfied_controls_count=0, non_compliant_controls_count=0, conformity_percentage=0.0)).conformity_percentage}%."
+        )
+
+        return MultiFrameworkCrosswalkResult(
+            frameworks=framework_summaries,
+            high_level_summary=summary_text,
+        )

src/triage/report_generator.py

@@ -68,8 +68,35 @@ class ConformityReportGenerator:
             md.append(f"| `{c.claim_id}` | `{c.category.value}` | {status_emoji} {c.assertion_status.value} | {c.confidence:.2f} | {c.normative_article} | *\"{c.evidence_quote[:75]}...\"* |")
         md.append("")
 
-        # Section 5: Cryptographic Provenance Ledger
-        md.append("## 5. Cryptographic Provenance & Audit Ledger (W3C PROV-O)")
+        # Section 5: Multi-Framework Regulatory Harmonization
+        if report.harmonized_frameworks:
+            md.append("## 5. Multi-Framework Regulatory Harmonization (NIST RMF / ISO 42001 / GDPR)")
+            fw_data = report.harmonized_frameworks.get("frameworks", {})
+            for fw_name, fw_summary in fw_data.items():
+                pct = fw_summary.get("conformity_percentage", 100.0)
+                sat = fw_summary.get("satisfied_controls_count", 0)
+                tot = fw_summary.get("total_mapped_controls", 0)
+                md.append(f"### {fw_name} (Alignment: {pct}% - {sat}/{tot} controls)")
+                md.append("| Target Control | Control Name | Status | Linked AI Act Article | Audit Guidance |")
+                md.append("|---|---|---|---|---|")
+                for ctrl in fw_summary.get("controls", []):
+                    c_badge = "🟢 SATISFIED" if ctrl.get("status") == "SATISFIED" else "🔴 NON-COMPLIANT"
+                    md.append(f"| `{ctrl.get('control_id')}` | {ctrl.get('control_name')} | {c_badge} | **{ctrl.get('eu_ai_act_article')}** | {ctrl.get('audit_guidance')} |")
+                md.append("")
+
+        # Section 6: Statutory Fine Liability Analysis
+        if report.fine_exposure:
+            fine = report.fine_exposure
+            md.append("## 6. Article 99 Statutory Fine & Financial Liability Audit")
+            md.append(f"- **Highest Triggered Penalty Tier:** `{fine.get('highest_tier_triggered')}`")
+            md.append(f"- **Legal Basis:** {fine.get('statutory_legal_basis')}")
+            md.append(f"- **Maximum Statutory Ceiling:** **€{fine.get('applicable_ceiling_eur', 0):,.2f}**")
+            md.append(f"- **Turnover Penalty Rate:** {fine.get('turnover_percentage', 0)}% of global annual turnover")
+            md.append(f"- **SME Special Cap Applied:** {'Yes (Article 99(6))' if fine.get('is_sme_discount_applied') else 'No'}")
+            md.append(f"- **Executive Liability Assessment:** {fine.get('executive_liability_summary')}\n")
+
+        # Section 7: Cryptographic Provenance Ledger
+        md.append("## 7. Cryptographic Provenance & Audit Ledger (W3C PROV-O)")
         md.append("Every artifact in this assessment is cryptographically anchored to prevent tampering and guarantee non-repudiation:")
         md.append(f"- **Source Specification SHA-256:** `{prov.input_doc_sha256}`")
         md.append(f"- **Normative RDF Knowledge Graph Canonical SHA-256:** `{prov.graph_triples_sha256}`")
@@ -144,6 +171,50 @@ class ConformityReportGenerator:
             </tr>
             """
 
+        fine_box_html = ""
+        if report.fine_exposure:
+            fine = report.fine_exposure
+            ceiling = fine.get("applicable_ceiling_eur", 0.0)
+            f_tier = fine.get("highest_tier_triggered", "NONE")
+            f_color = "#15803d" if ceiling == 0.0 else ("#b91c1c" if "PROHIBITED" in f_tier else "#c2410c")
+            f_bg = "#f0fdf4" if ceiling == 0.0 else "#fff7ed"
+            f_border = "#bbf7d0" if ceiling == 0.0 else "#fed7aa"
+
+            fine_box_html = f"""
+            <div style="background: {f_bg}; border: 1px solid {f_border}; padding: 12px 16px; border-radius: 6px; margin-bottom: 20px;">
+                <div style="font-size: 11px; font-weight: 700; color: {f_color}; text-transform: uppercase;">Article 99 Statutory Fine Liability Exposure</div>
+                <div style="font-size: 18px; font-weight: 800; color: {f_color}; margin: 2px 0;">
+                    €{ceiling:,.2f} <span style="font-size: 12px; font-weight: 500; color: #64748b;">({f_tier})</span>
+                </div>
+                <div style="font-size: 12px; color: #475569;">
+                    {fine.get('executive_liability_summary', '')}
+                </div>
+            </div>
+            """
+
+        frameworks_html = ""
+        if report.harmonized_frameworks:
+            fw_data = report.harmonized_frameworks.get("frameworks", {})
+            fw_badges = ""
+            for fw_name, fw_info in fw_data.items():
+                fw_pct = fw_info.get("conformity_percentage", 100.0)
+                fw_sat = fw_info.get("satisfied_controls_count", 0)
+                fw_tot = fw_info.get("total_mapped_controls", 0)
+                b_color = "#15803d" if fw_pct == 100.0 else "#d97706"
+                fw_badges += f"""
+                <div style="background: #f8fafc; border: 1px solid #e2e8f0; padding: 10px; border-radius: 6px; flex: 1;">
+                    <div style="font-size: 11px; font-weight: 700; color: #64748b;">{fw_name}</div>
+                    <div style="font-size: 16px; font-weight: 800; color: {b_color};">{fw_pct}%</div>
+                    <div style="font-size: 11px; color: #94a3b8;">{fw_sat}/{fw_tot} controls compliant</div>
+                </div>
+                """
+            frameworks_html = f"""
+            <h3 style="font-size: 14px; text-transform: uppercase; margin: 20px 0 8px 0;">Multi-Framework Harmonization Crosswalk</h3>
+            <div style="display: flex; gap: 10px; margin-bottom: 20px;">
+                {fw_badges}
+            </div>
+            """
+
         html = f"""<!DOCTYPE html>
 <html>
 <head>
@@ -284,6 +355,8 @@ class ConformityReportGenerator:
             <div class="info-item"><strong>Conformity Score</strong> {report.conformity_score:.1f}% ({report.passed_requirements_count}/{report.total_requirements_evaluated} requirements passed)</div>
         </div>
 
+        {fine_box_html}
+
         <h3 style="font-size: 14px; text-transform: uppercase; margin-bottom: 8px;">Deterministic Normative Evaluation Matrix</h3>
         <table>
             <thead>
@@ -298,6 +371,8 @@ class ConformityReportGenerator:
             </tbody>
         </table>
 
+        {frameworks_html}
+
         <div class="crypto-block">
             <strong>CRYPTOGRAPHIC PROVENANCE LEDGER (W3C PROV-O)</strong><br>
             Certificate Token: {prov.digital_signature}<br>

tests/test_api.py

@@ -36,12 +36,47 @@ def test_api_evaluate_endpoint():
     assert result["overall_conforms"] is True
     assert result["conformity_score"] == 100.0
     assert result["certificate_token"].startswith("REGU-")
+    assert "fine_exposure" in result
+    assert "harmonized_frameworks" in result
 
 
 def test_api_certificate_html():
     response = client.get("/api/v1/certificates/REGU-DEMO-TEST/html")
     assert response.status_code == 200
     assert "EU AI Act Conformity Attestation" in response.text
+    assert "Article 99 Statutory Fine Liability Exposure" in response.text
+
+
+def test_api_framework_crosswalk():
+    response = client.get("/api/v1/frameworks/crosswalk")
+    assert response.status_code == 200
+    data = response.json()
+    assert data["total_mappings"] >= 20
+    assert any(m["target_framework"] == "NIST AI RMF 1.0" for m in data["mappings"])
+    assert any(m["target_framework"] == "ISO/IEC 42001:2023" for m in data["mappings"])
+    assert any("GDPR" in m["target_framework"] for m in data["mappings"])
+
+
+def test_api_penalties_calculate():
+    # Test Tier 1 Prohibited practice penalty
+    response = client.post(
+        "/api/v1/penalties/calculate",
+        json={"violations": ["Article 5(1)(c)"], "annual_turnover_eur": 500_000_000, "is_sme": False},
+    )
+    assert response.status_code == 200
+    data = response.json()
+    assert data["highest_tier_triggered"] == "TIER_1_PROHIBITED_AI"
+    assert data["applicable_ceiling_eur"] == 35_000_000.0  # 7% of 500M is 35M
+
+    # Test SME cap
+    sme_res = client.post(
+        "/api/v1/penalties/calculate",
+        json={"violations": ["Article 14"], "annual_turnover_eur": 10_000_000, "is_sme": True},
+    )
+    assert sme_res.status_code == 200
+    sme_data = sme_res.json()
+    assert sme_data["is_sme_discount_applied"] is True
+    assert sme_data["applicable_ceiling_eur"] == 300_000.0  # min(15M, 3% of 10M = 300k)
 
 
 def test_api_triage_feedback():