Refine art. 27(1)(b) FRIA gating to Annex III §5(b)/§5(c)

[abk1969]

Summary

Stacks on top of #3. Closes the deferred follow-up from #3's review: precise art. 27(1)(b) FRIA gating per Reg. (EU) 2024/1689.

The earlier computeRoleNotes triggered FRIA via path (b) for any Annex III §5 selection, but the regulation names only §5(b) credit-scoring and §5(c) life and health insurance. Items §5(a) (public benefits eligibility) and §5(d) (emergency dispatch / triage) are still high-risk but should NOT trigger path (b) — they fall back to path (a)'s deployerKind requirement.

Changes

• ANNEX_III_5_SUBITEMS exported from classify.js — 4 sub-items (a/b/c/d) with bilingual ref (Annex III §5(x) / Annexe III §5(x)), label, and desc.
• computeRoleNotes path (b) refined: replaces inAnnexIII5 = areas.includes(5) with inAnnexIII5bOr5c = areas.includes(5) && annexIII5Subitems.some(s => s === 'b' || s === 'c'). Path (a) is unchanged — a public-body deployer of §5(d) still gets FRIA via art. 27(1)(a).
• friaB label now explicitly cites §5(b)/§5(c) instead of generic §5.
• UI: Step 5 surfaces a multi-select sub-question (4 OptionCards) when the user ticks the §5 Annex III area. Tailwind/structure parallel to existing sub-questions (deployer-kind, substantial-modification, art. 5 carve-outs). Sub-items are cleared when §5 is deselected.

Tests

• 74 tests pass (+6 new in Annex III §5 sub-items — art. 27(1)(b) refinement block; 2 pre-existing §5 tests updated to include annexIII5Subitems).
• Coverage matrix:
  • §5(b) alone → path (b) triggers
  • §5(c) alone → path (b) triggers
  • §5(a) alone + private_other → no FRIA (correctly falls back to path (a) which fails the deployerKind gate)
  • §5(d) alone + public_body → FRIA via path (a) (art. 27(1)(a))
  • §5 selected without sub-items → no FRIA via path (b) (conservative — user must declare a sub-item)
  • Mixed ['a','b'] → still triggers path (b)

Regulatory citations

• Reg. 2024/1689 Annex III §5(a)/(b)/(c)/(d) — verified against the OJEU consolidated text
• art. 27(1)(b) — specifically points 5(b) and (c) of Annex III

Stacking note

This PR targets feat/classify-regulatory-gaps (#3) as its base. When #3 merges to main, GitHub will auto-rebase this PR's base to main. If you prefer to merge #3 first and then open this against main directly, close this PR and re-create.

Test plan

• Select Annex III §5 alone (no sub-item) as a public-body deployer → FRIA NOT shown via art. 27(1)(b) (would show via art. 27(1)(a) only if the implementation routes correctly — verify in UI)
• Select §5 + tick §5(b) as private_other deployer → FRIA shown with art. 27(1)(b) reason
• Select §5 + tick §5(d) only as public_body deployer → FRIA shown with art. 27(1)(a) reason
• Deselect §5 after picking sub-items → sub-items cleared in state; re-selecting §5 starts blank
• French UI: sub-item refs read "Annexe III §5(x)" not "Annex III §5(x)"
• French FRIA label cites "§5(b) scoring de crédit ou §5(c) assurance vie/santé"

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ai_act_compass	Ready	Preview, Comment	May 15, 2026 9:48am