""" Conformity Assessment Report and Technical Documentation Package Generator. Produces human-readable Annex IV audit reports (Markdown/HTML) and JSON-LD digital certificates. """ from datetime import datetime, timezone import json from typing import Dict, Any from src.core.models import ConformityReport, ValidationViolation, ExtractedClaim class ConformityReportGenerator: def generate_markdown_report(self, report: ConformityReport) -> str: """Generates an official EU AI Act Annex IV Technical Documentation report.""" meta = report.system_metadata prov = report.provenance status_badge = "✅ CONFORMS (PASS)" if report.overall_conforms else "❌ NON-CONFORMANT (FAIL)" md = [] md.append(f"# EU AI Act Conformity Assessment Report (Annex IV)") md.append(f"**Verification Engine:** ReguAI Neuro-Symbolic Governance Core v0.1.0 ") md.append(f"**Assessment Date (UTC):** {report.generated_at_utc} ") md.append(f"**Certificate Token:** `{prov.digital_signature}` ") md.append(f"**Status:** {status_badge} ") md.append(f"**Conformity Index:** **{report.conformity_score:.1f}%** ({report.passed_requirements_count}/{report.total_requirements_evaluated} requirements satisfied)\n") md.append("---") # Executive Summary md.append("## 1. Executive Summary") md.append(report.executive_summary) md.append("") # Section 2: System Identification md.append("## 2. System Identification & Scope (Annex IV, Point 1)") md.append(f"- **System Name:** {meta.name}") md.append(f"- **System ID:** `{meta.system_id}`") md.append(f"- **Version:** {meta.version}") md.append(f"- **Developer:** {meta.developer_name}") md.append(f"- **Domain:** {meta.domain}") md.append(f"- **Intended Purpose:** {meta.intended_purpose}") md.append(f"- **EU AI Act Risk Classification:** **{meta.eu_risk_classification}**\n") # Section 3: Deterministic SHACL Verification Results md.append("## 3. Deterministic SHACL Normative Proofs (Chapter III)") if report.overall_conforms: md.append("All mandatory W3C SHACL shape constraints for Articles 9 through 15 were successfully satisfied with mathematical proof. No constraint violations found.\n") else: md.append(f"### Detected Legal Violations ({len(report.violations)})") md.append("| Legal Article | Normative Requirement | Severity | SHACL Path | Remediation Guidance |") md.append("|---|---|---|---|---|") for v in report.violations: md.append(f"| **{v.regulatory_article}** | {v.message} | `{v.severity}` | `{v.result_path}` | {v.remediation_guidance} |") md.append("") if report.warnings: md.append(f"### Advisory Warnings ({len(report.warnings)})") for w in report.warnings: md.append(f"- **{w.regulatory_article} ({w.source_constraint_component}):** {w.message}") md.append("") # Section 4: Regulatory Claim Inventory md.append("## 4. Extracted Regulatory Claims & Grounded Entities") md.append("| Claim ID | Entity Category | Assertion Status | Confidence | Legal Target | Evidence Span |") md.append("|---|---|---|---|---|---|") for c in report.claims_analyzed: status_emoji = "🟢" if c.assertion_status.value == "IMPLEMENTED" else ("🟡" if c.assertion_status.value == "PLANNED" else "🔴") md.append(f"| `{c.claim_id}` | `{c.category.value}` | {status_emoji} {c.assertion_status.value} | {c.confidence:.2f} | {c.normative_article} | *\"{c.evidence_quote[:75]}...\"* |") md.append("") # Section 5: Multi-Framework Regulatory Harmonization if report.harmonized_frameworks: md.append("## 5. Multi-Framework Regulatory Harmonization (NIST RMF / ISO 42001 / GDPR)") fw_data = report.harmonized_frameworks.get("frameworks", {}) for fw_name, fw_summary in fw_data.items(): pct = fw_summary.get("conformity_percentage", 100.0) sat = fw_summary.get("satisfied_controls_count", 0) tot = fw_summary.get("total_mapped_controls", 0) md.append(f"### {fw_name} (Alignment: {pct}% - {sat}/{tot} controls)") md.append("| Target Control | Control Name | Status | Linked AI Act Article | Audit Guidance |") md.append("|---|---|---|---|---|") for ctrl in fw_summary.get("controls", []): c_badge = "🟢 SATISFIED" if ctrl.get("status") == "SATISFIED" else "🔴 NON-COMPLIANT" md.append(f"| `{ctrl.get('control_id')}` | {ctrl.get('control_name')} | {c_badge} | **{ctrl.get('eu_ai_act_article')}** | {ctrl.get('audit_guidance')} |") md.append("") # Section 6: Statutory Fine Liability Analysis if report.fine_exposure: fine = report.fine_exposure md.append("## 6. Article 99 Statutory Fine & Financial Liability Audit") md.append(f"- **Highest Triggered Penalty Tier:** `{fine.get('highest_tier_triggered')}`") md.append(f"- **Legal Basis:** {fine.get('statutory_legal_basis')}") md.append(f"- **Maximum Statutory Ceiling:** **€{fine.get('applicable_ceiling_eur', 0):,.2f}**") md.append(f"- **Turnover Penalty Rate:** {fine.get('turnover_percentage', 0)}% of global annual turnover") md.append(f"- **SME Special Cap Applied:** {'Yes (Article 99(6))' if fine.get('is_sme_discount_applied') else 'No'}") md.append(f"- **Executive Liability Assessment:** {fine.get('executive_liability_summary')}\n") # Section 7: Cryptographic Provenance Ledger md.append("## 7. Cryptographic Provenance & Audit Ledger (W3C PROV-O)") md.append("Every artifact in this assessment is cryptographically anchored to prevent tampering and guarantee non-repudiation:") md.append(f"- **Source Specification SHA-256:** `{prov.input_doc_sha256}`") md.append(f"- **Normative RDF Knowledge Graph Canonical SHA-256:** `{prov.graph_triples_sha256}`") md.append(f"- **EU AI Act SHACL Ruleset SHA-256:** `{prov.ruleset_sha256}`") md.append(f"- **Conformity Certificate Digest:** `{prov.certificate_sha256}`") md.append(f"- **Immutable Token:** `{prov.digital_signature}`\n") md.append("### W3C PROV-O Turtle Graph") md.append("```turtle") md.append(prov.prov_o_rdf.strip()) md.append("```\n") return "\n".join(md) def generate_json_ld(self, report: ConformityReport) -> Dict[str, Any]: """Generates machine-readable JSON-LD conformity certificate.""" meta = report.system_metadata prov = report.provenance return { "@context": { "regu": "http://regu.ai/schema#", "eu": "http://data.europa.eu/eli/reg/2024/1689#", "prov": "http://www.w3.org/ns/prov#", "xsd": "http://www.w3.org/2001/XMLSchema#", }, "@id": f"http://regu.ai/certificates/{prov.digital_signature}", "@type": "regu:ConformityCertificate", "regu:systemId": meta.system_id, "regu:systemName": meta.name, "regu:conformityStatus": "PASS" if report.overall_conforms else "FAIL", "regu:conformityScore": report.conformity_score, "regu:timestampUtc": report.generated_at_utc, "regu:digitalSignature": prov.digital_signature, "regu:sourceDocHash": prov.input_doc_sha256, "regu:canonicalGraphHash": prov.graph_triples_sha256, "regu:violationsCount": len(report.violations), "regu:violations": [ { "article": v.regulatory_article, "message": v.message, "remediation": v.remediation_guidance, } for v in report.violations ], } def generate_html_certificate(self, report: ConformityReport) -> str: """Generates a formal, print-ready HTML Conformity Attestation Certificate.""" meta = report.system_metadata prov = report.provenance is_pass = report.overall_conforms badge_bg = "#10b981" if is_pass else "#ef4444" badge_text = "CONFORMANT (APPROVED)" if is_pass else "NON-CONFORMANT (REJECTED)" violations_rows = "" if report.violations: for v in report.violations: violations_rows += f""" {v.regulatory_article} {v.message} {v.remediation_guidance} """ else: violations_rows = """ ✓ Zero non-conformities identified. All W3C SHACL Chapter III constraints satisfied. """ fine_box_html = "" if report.fine_exposure: fine = report.fine_exposure ceiling = fine.get("applicable_ceiling_eur", 0.0) f_tier = fine.get("highest_tier_triggered", "NONE") f_color = "#15803d" if ceiling == 0.0 else ("#b91c1c" if "PROHIBITED" in f_tier else "#c2410c") f_bg = "#f0fdf4" if ceiling == 0.0 else "#fff7ed" f_border = "#bbf7d0" if ceiling == 0.0 else "#fed7aa" fine_box_html = f"""
Article 99 Statutory Fine Liability Exposure
€{ceiling:,.2f} ({f_tier})
{fine.get('executive_liability_summary', '')}
""" frameworks_html = "" if report.harmonized_frameworks: fw_data = report.harmonized_frameworks.get("frameworks", {}) fw_badges = "" for fw_name, fw_info in fw_data.items(): fw_pct = fw_info.get("conformity_percentage", 100.0) fw_sat = fw_info.get("satisfied_controls_count", 0) fw_tot = fw_info.get("total_mapped_controls", 0) b_color = "#15803d" if fw_pct == 100.0 else "#d97706" fw_badges += f"""
{fw_name}
{fw_pct}%
{fw_sat}/{fw_tot} controls compliant
""" frameworks_html = f"""

Multi-Framework Harmonization Crosswalk

{fw_badges}
""" html = f""" EU AI Act Conformity Attestation - {meta.name}
🇪🇺 ★★★★★

EU AI Act Conformity Attestation

Formal Verification under Regulation (EU) 2024/1689 (Annex IV & Annex VII)

{badge_text}
AI System Name {meta.name} (v{meta.version})
Developer / Provider {meta.developer_name}
Risk Classification {meta.eu_risk_classification}
Application Domain {meta.domain}
Intended Purpose {meta.intended_purpose}
Verification Method Formal W3C SHACL Symbolic Constraint Solver
Conformity Score {report.conformity_score:.1f}% ({report.passed_requirements_count}/{report.total_requirements_evaluated} requirements passed)
{fine_box_html}

Deterministic Normative Evaluation Matrix

{violations_rows}
Legal Article Normative SHACL Constraint Remediation / Status
{frameworks_html}
CRYPTOGRAPHIC PROVENANCE LEDGER (W3C PROV-O)
Certificate Token: {prov.digital_signature}
Source Document Digest: {prov.input_doc_sha256}
Normative Graph Digest: {prov.graph_triples_sha256}
SHACL Ruleset Digest: {prov.ruleset_sha256}
Assessment Timestamp: {report.generated_at_utc}
Attesting Audit Agent: ReguAI Symbolic Governance Core v0.1.0
Automated Mathematical Attestation
Lead Compliance Officer: Verified Human-in-the-Loop Sign-off
Authorized Signature & Date
""" return html def generate_cyclonedx_bom(self, report: ConformityReport) -> Dict[str, Any]: """Generates an official CycloneDX 1.6 AI Bill of Materials (AIBOM) dictionary.""" from src.triage.bom_generator import AIBOMGenerator return AIBOMGenerator.generate_bom(report)