Close three EU AI Act regulatory gaps (art. 5 carve-outs, art. 27 FRIA, art. 25 flip)

[abk1969]

Closes three regulatory gaps in computeCategory surfaced by the 2026-05-15 audit against Reg. (EU) 2024/1689.

Feature A — art. 5(2)–(5) carve-outs (prohibitions h/f/g)

• Export ART5_CARVEOUTS metadata (3 entries: art. 5(2)-(3) law-enforcement RBI carve-out; art. 5(1)(f) medical/safety; art. 5(1)(g) law-enforcement / legally-acquired-dataset).
• computeCategory now partitions selected prohibitions into carved-out vs un-carved-out; INTERDIT short-circuit fires only if at least one prohibition has no valid carve-out claim.
• Carve-out justification refs flow through to clipboard/PDF report via the existing justifications-rendering path.
• UI: optional carve-out sub-question appears inline on the prohibitions step.
• Stale-state cleanup: deselecting a prohibition strips its carve-out claim.

Feature C — art. 27(1) FRIA applicability gating

• New pure function computeRoleNotes(answers, role, lang) → { friaRequired, friaReason } implementing art. 27(1)(a) (public-body / private-public-service deployer + Annex III ≠ §2) and art. 27(1)(b) (Annex III §5 pathway).
• FRIA quickwin in QUICKWINS.HAUT_RISQUE_ANNEXE_III is now hidden (screen, clipboard, PDF) unless actually required.
• isFriaItem helper deduplicates the filter predicate across screen/clipboard/print paths.
• UI: deployer-kind sub-question (public_body / private_public_service / private_other) added to the role step; deployerKind cleared on role switch.

Feature D — art. 25 substantial-modification provider flip

• computeCategory detects systeme_sur_gpai + substantialModification === 'oui' and reclassifies the integrator as a GPAI (or GPAI_RS) provider.
• isGPAI_RS definition broadened to cover both native GPAI providers and flipped integrators.
• art. 25 flip justification emitted in flip path; art. 53–55 obligations called out.
• French label uses fournisseur (official AI Act terminology), not "provider".
• UI: yes/no substantial-modification sub-question appears inline on the nature step with recital 84/109 guidance; substantialModification cleared on nature switch.

Tests

• 68 tests pass (61 in classify.test.js, 7 in i18n.test.js).
• +25 new tests across 4 new describe blocks.
• 100% statement/line/function coverage on classify.js; 96.3% branch.
• Coverage on all new logic includes a negative-flip invariant test (native GPAI provider does NOT emit art. 25 flip justification).

Regulatory citations verified

• art. 5(1)(f)/(g)/(h), art. 5(2)-(3) (carve-outs for h)
• art. 25, art. 25 + art. 53 (integrator note vs flip note)
• art. 27(1)(a), art. 27(1)(b) (FRIA paths)
• art. 53–55 (GPAI obligations referenced in flip label)

Deferred follow-up

Reg. 2024/1689 art. 27(1)(b) specifically names Annex III §5(b) credit-scoring and §5(c) life/health insurance. The current UI exposes Annex III §5 as a single bucket without sub-items (a)/(b)/(c)/(d), so computeRoleNotes triggers FRIA on any §5 selection — conservative (false-positive) but not strictly precise. Splitting §5 into sub-items requires UI + data changes worth a separate PR.

Test plan

• Selecting prohibition (h) without a carve-out claim → INTERDIT
• Selecting prohibition (h) + claiming the art. 5(2)-(3) carve-out → not INTERDIT; carve-out ref present in justifications
• Provider + Annex III §3 (education) → FRIA quickwin NOT shown
• Public-body deployer + Annex III §3 → FRIA quickwin shown with art. 27(1)(a) reason
• Private-other deployer + Annex III §5 → FRIA quickwin shown with art. 27(1)(b) reason
• Integrator + substantial modification = oui + systemic risk = oui → primary = GPAI_RS, art. 25 flip note in justifications
• Integrator + substantial modification = non → primary = RISQUE_MINIMAL, art. 25 + art. 53 integrator note present (no flip)
• Deselecting a prohibition after claiming its carve-out → re-selecting does not pre-fill the carve-out
• PDF export includes carve-out / FRIA / art. 25 flip refs in the justification section

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ai_act_compass	Ready	Preview, Comment	May 15, 2026 9:08am