Prohibited Practices:
  - Subliminal manipulation:
      Example: "AI systems that deploy subliminal techniques
               to distort behavior and cause harm"
 
  - Exploitation of vulnerabilities:
      Example: "AI targeting children or disabled persons
               to distort their behavior"
 
  - Social scoring:
      Example: "Public authority systems that evaluate or
               classify people based on social behavior"
 
  - Real-time biometric identification:
      Example: "Remote biometric identification in public
               spaces for law enforcement (with exceptions)"
 
  - Emotion recognition in workplace/education:
      Example: "Systems inferring emotions of employees
               or students (with exceptions)"
 
  - Biometric categorization:
      Example: "Categorizing people by race, political
               opinions, or sexual orientation"
 
  - Facial recognition database scraping:
      Example: "Creating facial recognition databases
               through untargeted internet scraping"

High-Risk Categories:
 
  Critical Infrastructure:
    - Management of water, gas, heating, electricity
    - Road traffic and transportation
 
  Education:
    - AI determining access to education
    - Evaluation of learning outcomes
    - Assessment of appropriate education level
 
  Employment:
    - Recruitment and candidate filtering
    - Promotion and termination decisions
    - Task allocation based on personality traits
    - Performance monitoring
 
  Essential Services:
    - Credit scoring and loan decisions
    - Emergency services dispatch prioritization
    - Health and life insurance risk assessment
 
  Law Enforcement:
    - Individual risk assessments
    - Lie detectors and emotion detection
    - Evidence reliability evaluation
    - Crime prediction (profiling)
 
  Migration and Border Control:
    - Visa application processing
    - Asylum application evaluation
    - Risk assessment at borders
 
  Justice and Democracy:
    - Assisting judges in legal research
    - Influencing election outcomes

class AIRiskManagementSystem:
    """
    Article 9: Risk Management Requirements
    """
 
    def __init__(self, ai_system_id: str):
        self.system_id = ai_system_id
        self.risk_register = []
        self.mitigation_measures = []
 
    def identify_risks(self) -> list:
        """
        Identify and analyze known and foreseeable risks
        throughout the AI system lifecycle.
        """
        risk_categories = [
            'safety_risks',           # Physical harm potential
            'fundamental_rights',      # Impact on rights
            'bias_discrimination',     # Unfair outcomes
            'security_vulnerabilities', # Attack vectors
            'misuse_potential',        # Foreseeable misuse
            'environmental_impact',    # Resource consumption
        ]
 
        identified_risks = []
        for category in risk_categories:
            risks = self._analyze_risk_category(category)
            identified_risks.extend(risks)
 
        return identified_risks
 
    def implement_mitigations(self, risks: list) -> dict:
        """
        Implement measures to mitigate identified risks.
        Must reduce risk to acceptable level considering
        state of the art.
        """
        mitigations = {}
        for risk in risks:
            mitigation = {
                'risk_id': risk['id'],
                'measure': self._design_mitigation(risk),
                'residual_risk': self._calculate_residual_risk(risk),
                'review_schedule': self._set_review_schedule(risk),
            }
            mitigations[risk['id']] = mitigation
 
        return mitigations
 
    def continuous_monitoring(self):
        """
        Risk management must be continuous throughout
        the AI system's lifecycle.
        """
        monitoring_plan = {
            'frequency': 'continuous',
            'metrics': self._define_risk_metrics(),
            'thresholds': self._define_alert_thresholds(),
            'escalation': self._define_escalation_procedures(),
        }
        return monitoring_plan

class DataGovernanceFramework:
    """
    Article 10: Data and Data Governance
    """
 
    def validate_training_data(self, dataset: Dataset) -> dict:
        """
        Training, validation, and testing datasets must
        meet quality criteria.
        """
        validation_results = {
            'relevance': self._check_relevance(dataset),
            'representativeness': self._check_representativeness(dataset),
            'completeness': self._check_completeness(dataset),
            'bias_assessment': self._assess_bias(dataset),
            'error_rate': self._calculate_error_rate(dataset),
        }
 
        # Document any gaps and measures taken
        if not all(validation_results.values()):
            validation_results['gaps'] = self._identify_gaps(validation_results)
            validation_results['mitigation'] = self._document_mitigations()
 
        return validation_results
 
    def document_data_provenance(self, dataset: Dataset) -> dict:
        """
        Full documentation of data origin, collection,
        and processing required.
        """
        provenance = {
            'origin': dataset.source,
            'collection_date': dataset.collection_date,
            'collection_method': dataset.collection_method,
            'processing_operations': dataset.processing_log,
            'data_subjects': self._identify_data_subjects(dataset),
            'legal_basis': self._document_legal_basis(dataset),
            'retention_period': dataset.retention_policy,
        }
        return provenance
 
    def assess_bias(self, dataset: Dataset) -> dict:
        """
        Examine datasets for possible biases that could
        lead to discrimination.
        """
        bias_assessment = {
            'demographic_analysis': self._analyze_demographics(dataset),
            'representation_gaps': self._find_representation_gaps(dataset),
            'historical_bias': self._detect_historical_bias(dataset),
            'measurement_bias': self._detect_measurement_bias(dataset),
            'mitigation_applied': self._document_bias_mitigation(),
        }
        return bias_assessment

# Required Technical Documentation
 
## 1. General Description
- Intended purpose and functionality
- Developer/provider identification
- Version and date of AI system
- How AI system interacts with hardware/software
 
## 2. Design Specifications
- System architecture and design choices
- Main algorithms and their logic
- Key design choices and rationale
- Computational requirements
 
## 3. Development Process
- Development methodologies used
- Data requirements and sources
- Training procedures and parameters
- Validation and testing procedures
 
## 4. Monitoring and Performance
- Performance metrics and benchmarks
- Known limitations and conditions
- Logging capabilities
- Human oversight measures
 
## 5. Risk Assessment
- Risk management process
- Identified risks and mitigations
- Foreseeable misuse scenarios
- Residual risks after mitigation
 
## 6. Change Management
- Version control procedures
- Update and modification tracking
- Impact assessment process

class AISystemLogger:
    """
    Article 12: Record-Keeping Requirements
    """
 
    def __init__(self, system_id: str, retention_period_years: int = 10):
        self.system_id = system_id
        self.retention_period = retention_period_years
 
    def log_operation(self, operation: dict) -> str:
        """
        Log all operations for traceability.
        Logs must enable monitoring throughout lifecycle.
        """
        log_entry = {
            'log_id': self._generate_log_id(),
            'timestamp': datetime.utcnow().isoformat(),
            'system_id': self.system_id,
            'operation_type': operation['type'],
            'input_data_reference': operation.get('input_ref'),
            'output_data_reference': operation.get('output_ref'),
            'user_id': operation.get('user_id'),
            'duration_ms': operation.get('duration'),
            'resource_usage': operation.get('resources'),
            'errors': operation.get('errors', []),
        }
 
        self._store_log(log_entry)
        return log_entry['log_id']
 
    def enable_audit_trail(self) -> dict:
        """
        Logs must support post-market monitoring
        and incident investigation.
        """
        audit_config = {
            'automatic_logging': True,
            'immutable_logs': True,
            'log_integrity_verification': True,
            'access_logging': True,
            'retention_policy': f'{self.retention_period} years',
            'deletion_protection': True,
        }
        return audit_config

class TransparencyRequirements:
    """
    Article 13: Transparency and Provision of Information
    """
 
    def generate_user_documentation(self, ai_system: AISystem) -> dict:
        """
        Clear, comprehensive information for deployers.
        """
        documentation = {
            'provider_info': {
                'name': ai_system.provider_name,
                'contact': ai_system.provider_contact,
                'address': ai_system.provider_address,
            },
 
            'system_description': {
                'intended_purpose': ai_system.intended_purpose,
                'capabilities': ai_system.capabilities,
                'limitations': ai_system.known_limitations,
                'performance_levels': ai_system.performance_metrics,
            },
 
            'usage_instructions': {
                'intended_use': ai_system.intended_use_cases,
                'prohibited_use': ai_system.prohibited_uses,
                'input_requirements': ai_system.input_specifications,
                'output_interpretation': ai_system.output_guidelines,
            },
 
            'human_oversight': {
                'oversight_measures': ai_system.oversight_requirements,
                'intervention_points': ai_system.intervention_mechanisms,
                'override_procedures': ai_system.override_instructions,
            },
 
            'maintenance': {
                'update_procedures': ai_system.update_process,
                'technical_support': ai_system.support_contact,
                'expected_lifetime': ai_system.expected_lifetime,
            }
        }
        return documentation

class HumanOversightMeasures:
    """
    Article 14: Human Oversight Requirements
    """
 
    def design_oversight_interface(self, ai_system: AISystem) -> dict:
        """
        Systems must be designed for effective human oversight.
        """
        oversight_design = {
            'interpretability': {
                'explanation_available': True,
                'confidence_scores': True,
                'key_factors_displayed': True,
            },
 
            'intervention_capabilities': {
                'can_override_decisions': True,
                'can_halt_operation': True,
                'can_request_human_review': True,
                'override_mechanism': 'physical_button_and_software',
            },
 
            'monitoring_tools': {
                'real_time_dashboard': True,
                'anomaly_alerts': True,
                'performance_degradation_alerts': True,
            },
 
            'competency_requirements': {
                'training_required': True,
                'certification_needed': ai_system.risk_level == 'high',
                'regular_refresher': 'annual',
            }
        }
        return oversight_design
 
    def ensure_not_over_reliance(self) -> list:
        """
        Prevent automation bias and over-reliance on AI.
        """
        measures = [
            'Display confidence levels with all outputs',
            'Require human confirmation for high-stakes decisions',
            'Regular accuracy audits comparing AI vs human decisions',
            'Training on AI limitations and failure modes',
            'Periodic manual processing to maintain human skills',
            'Clear escalation paths for uncertain cases',
        ]
        return measures

class TechnicalRequirements:
    """
    Article 15: Accuracy, Robustness, and Cybersecurity
    """
 
    def accuracy_requirements(self, ai_system: AISystem) -> dict:
        """
        AI systems must achieve appropriate accuracy levels.
        """
        return {
            'accuracy_metrics': ai_system.defined_metrics,
            'accuracy_targets': ai_system.accuracy_thresholds,
            'measurement_methodology': ai_system.evaluation_procedure,
            'conditions_for_accuracy': ai_system.operating_conditions,
            'accuracy_communication': 'Clearly stated in documentation',
        }
 
    def robustness_requirements(self, ai_system: AISystem) -> dict:
        """
        AI systems must be resilient to errors, faults, and
        attempts to alter use or performance.
        """
        return {
            'error_handling': {
                'graceful_degradation': True,
                'fallback_mechanisms': ai_system.fallback_procedures,
                'error_notification': True,
            },
            'fault_tolerance': {
                'redundancy_measures': ai_system.redundancy_design,
                'self_healing_capabilities': ai_system.recovery_mechanisms,
            },
            'adversarial_robustness': {
                'attack_resistance_tested': True,
                'adversarial_training_applied': ai_system.uses_adversarial_training,
                'known_vulnerabilities_addressed': True,
            },
        }
 
    def cybersecurity_requirements(self, ai_system: AISystem) -> dict:
        """
        AI systems must be resilient against unauthorized access
        and manipulation.
        """
        return {
            'access_control': {
                'authentication_required': True,
                'authorization_model': 'role_based',
                'audit_logging': True,
            },
            'data_protection': {
                'encryption_at_rest': True,
                'encryption_in_transit': True,
                'secure_key_management': True,
            },
            'integrity_protection': {
                'model_integrity_verification': True,
                'data_integrity_checks': True,
                'tamper_detection': True,
            },
            'vulnerability_management': {
                'regular_security_testing': 'quarterly',
                'penetration_testing': 'annual',
                'patch_management_process': True,
            },
        }

Phase 1 - February 2, 2025:
  Status: ACTIVE
  Requirements:
    - AI literacy obligations for staff
    - Prohibited practices take effect
 
Phase 2 - August 2, 2025:
  Status: APPROACHING
  Requirements:
    - GPAI model requirements
    - Governance structure requirements
    - Penalties applicable
    - Notified body designation
 
Phase 3 - August 2, 2026:
  Status: FUTURE
  Requirements:
    - High-risk AI system requirements (Annex III)
    - Conformity assessment procedures
    - Quality management systems
    - Registration requirements
 
Phase 4 - August 2, 2027:
  Status: FUTURE
  Requirements:
    - High-risk requirements for Annex I systems
    - Full enforcement

# AI Act Compliance Checklist
 
## Immediate Actions (by Feb 2025)
- [ ] Inventory all AI systems in use
- [ ] Classify each system by risk level
- [ ] Identify any prohibited practices
- [ ] Begin AI literacy training program
- [ ] Establish AI governance committee
 
## Short-term Actions (by Aug 2025)
- [ ] Complete risk classifications
- [ ] Document GPAI models in use
- [ ] Establish quality management system
- [ ] Assign AI compliance officer
- [ ] Create incident response procedures
 
## Medium-term Actions (by Aug 2026)
- [ ] Complete technical documentation
- [ ] Implement logging systems
- [ ] Conduct conformity assessments
- [ ] Register high-risk AI systems
- [ ] Implement human oversight measures
- [ ] Complete bias and fairness audits
 
## Ongoing Requirements
- [ ] Continuous risk monitoring
- [ ] Regular accuracy assessments
- [ ] Periodic security testing
- [ ] Update documentation for changes
- [ ] Maintain training records
- [ ] Report serious incidents