{
  "tool_id": "art-238-classify-annex3-decisioning-obligations",
  "note": "EXTENDS run_ai_act_highrisk_fit (art-64). Resolves FS-specific Art 12/26 obligations for Annex III 5(b) creditworthiness and 5(c) life/health insurance pricing. is_high_risk MUST come from art-64 first. Aug 2026 enforcement (orig); 2 Dec 2027 under Digital Omnibus (verify).",
  "vectors": [
    {
      "name": "5b_creditworthiness_all_obligations_met",
      "description": "Annex III 5(b) creditworthiness system, all obligations implemented (logging, FRIA, human oversight, DB registration). Known constant: scope_verdict=ANNEX3_5B_CREDITWORTHINESS; enforcement_readiness=READY.",
      "policy_parameters": {
        "is_high_risk": true,
        "annex3_category": "5b_creditworthiness",
        "deployer_role": "deployer",
        "has_human_oversight": true,
        "fria_completed": true,
        "db_registered": true,
        "logging_implemented": true
      },
      "output_payload": {
        "is_high_risk": true,
        "annex3_category": "5b_creditworthiness",
        "scope_verdict": "ANNEX3_5B_CREDITWORTHINESS",
        "is_5b_creditworthiness": true,
        "is_5c_life_health_insurance": false,
        "art12_logging_required": true,
        "fria_required": true,
        "db_registration_required": true,
        "art26_deployer_duties_apply": true,
        "obligations": [
          {
            "article": "Art 12(2)",
            "obligation": "Log inputs, outputs, timestamps, model version, override flags, natural-person-ID field. Retain >= 6 months.",
            "status": "IMPLEMENTED"
          },
          {
            "article": "Art 26(6)",
            "obligation": "Deployer: conduct FRIA before deployment for Annex III 5(b)/(5)(c) systems. Maintain human oversight mechanism.",
            "status": "IMPLEMENTED"
          },
          {
            "article": "Art 27(1)",
            "obligation": "Register creditworthiness AI system in EU AI Act public database before deployment.",
            "status": "IMPLEMENTED"
          }
        ],
        "compliance_gaps": [],
        "do_now": [],
        "all_obligations_met": true,
        "enforcement_readiness": "READY",
        "regulatory_basis": "EU AI Act (Reg. 2024/1689) Annex III 5(b), 5(c); Art 12(2) (decision logging); Art 26(6) (deployer duties + FRIA); Art 27(1) (EU database registration)",
        "extends_tool": "run_ai_act_highrisk_fit (art-64)",
        "extends_note": "This node extends run_ai_act_highrisk_fit with FS-specific Art 12 and Art 26 obligations. Run art-64 first to confirm is_high_risk=true.",
        "table_version": "EU-AIA-ANNEX3-FS-2024-1689-R1",
        "enforcement_dates": {
          "original": "2026-08-02",
          "digital_omnibus_proposed": "2027-12-02",
          "note": "Digital Omnibus (provisional agreement 7 May 2026) proposes Annex III high-risk obligations to 2 Dec 2027. Verify current AI Act status."
        }
      },
      "golden_hash": "8ea07497ce85706248a3de6f6711878601f4822546b6c06273c3cf1a4cc20a8e"
    },
    {
      "name": "5c_insurance_all_gaps_remediation_required",
      "description": "Annex III 5(c) life/health insurance pricing, all obligations missing. Known: scope_verdict=ANNEX3_5C_LIFE_HEALTH_INSURANCE; enforcement_readiness=NOT_READY; 4 compliance gaps.",
      "policy_parameters": {
        "is_high_risk": true,
        "annex3_category": "5c_life_health_insurance_pricing",
        "deployer_role": "deployer",
        "has_human_oversight": false,
        "fria_completed": false,
        "db_registered": false,
        "logging_implemented": false
      },
      "output_payload": {
        "is_high_risk": true,
        "annex3_category": "5c_life_health_insurance_pricing",
        "scope_verdict": "ANNEX3_5C_LIFE_HEALTH_INSURANCE",
        "is_5b_creditworthiness": false,
        "is_5c_life_health_insurance": true,
        "art12_logging_required": true,
        "fria_required": true,
        "db_registration_required": true,
        "art26_deployer_duties_apply": true,
        "obligations": [
          {
            "article": "Art 12(2)",
            "obligation": "Log inputs, outputs, timestamps, model version, override flags, natural-person-ID field. Retain >= 6 months.",
            "status": "REQUIRED"
          },
          {
            "article": "Art 26(6)",
            "obligation": "Deployer: conduct FRIA before deployment for Annex III 5(b)/(5)(c) systems. Maintain human oversight mechanism.",
            "status": "REQUIRED"
          },
          {
            "article": "Art 27(1)",
            "obligation": "Register life/health insurance pricing AI system in EU AI Act public database before deployment.",
            "status": "REQUIRED"
          }
        ],
        "compliance_gaps": [
          "Art 12(2): logging not yet implemented",
          "Art 26(6): FRIA not completed",
          "Art 26(6): human oversight mechanism not in place",
          "Art 27(1): EU AI Act database registration not completed"
        ],
        "do_now": [
          "Implement Art 12-conformant decision log records (use build_ai_decision_log_record).",
          "Complete Fundamental Rights Impact Assessment (FRIA) before deployment.",
          "Implement human oversight mechanism (Art 26(6)) — must be present at deployment.",
          "Register in EU AI Act public database at https://database.ai.ec.europa.eu before deployment."
        ],
        "all_obligations_met": false,
        "enforcement_readiness": "NOT_READY",
        "regulatory_basis": "EU AI Act (Reg. 2024/1689) Annex III 5(b), 5(c); Art 12(2) (decision logging); Art 26(6) (deployer duties + FRIA); Art 27(1) (EU database registration)",
        "extends_tool": "run_ai_act_highrisk_fit (art-64)",
        "extends_note": "This node extends run_ai_act_highrisk_fit with FS-specific Art 12 and Art 26 obligations. Run art-64 first to confirm is_high_risk=true.",
        "table_version": "EU-AIA-ANNEX3-FS-2024-1689-R1",
        "enforcement_dates": {
          "original": "2026-08-02",
          "digital_omnibus_proposed": "2027-12-02",
          "note": "Digital Omnibus (provisional agreement 7 May 2026) proposes Annex III high-risk obligations to 2 Dec 2027. Verify current AI Act status."
        }
      },
      "golden_hash": "dde5c8387867c70b4fe4011e3059fdf661cf4c183eb2b0db9c071c4a053e8086"
    },
    {
      "name": "empty_input_finite_out_of_scope",
      "description": "Empty inputs (is_high_risk=false/undefined) returns OUT_OF_SCOPE sentinel with finite zero-state. Gate downstream on /is_high_risk eq true.",
      "policy_parameters": {},
      "output_payload": {
        "is_high_risk": false,
        "annex3_category": "unknown",
        "scope_verdict": "OUT_OF_SCOPE",
        "scope_note": "System classified as NOT high-risk by run_ai_act_highrisk_fit (art-64). Art 12 logging and Art 26 deployer obligations do not apply to this system. Re-run base classification if use case changes.",
        "obligations": [],
        "art12_logging_required": false,
        "fria_required": false,
        "db_registration_required": false,
        "art26_deployer_duties_apply": false,
        "compliance_gaps": [],
        "do_now": [],
        "regulatory_basis": "EU AI Act (Reg. 2024/1689) Annex III 5(b), 5(c); Art 12(2); Art 26(6)",
        "table_version": "EU-AIA-ANNEX3-FS-2024-1689-R1",
        "enforcement_dates": {
          "original": "2026-08-02",
          "digital_omnibus_proposed": "2027-12-02",
          "note": "Digital Omnibus (provisional agreement 7 May 2026) proposes Annex III high-risk obligations to 2 Dec 2027. Verify current AI Act status."
        }
      },
      "golden_hash": "1e48a4a735ea5d98de577729939db288a9f9c0bf4300370c25b309f073f0c39b"
    }
  ]
}