regulatory_monitor.hpp

Go to the documentation of this file.

// SPDX-License-Identifier: AGPL-3.0-or-later
// Copyright 2026 Johnson Ogundeji
// See LICENSE_COMMERCIAL for full terms.
#pragma once
 
#if !defined(SIGNET_ENABLE_COMMERCIAL) || !SIGNET_ENABLE_COMMERCIAL
#error "signet/ai/regulatory_monitor.hpp requires SIGNET_ENABLE_COMMERCIAL=ON (AGPL-3.0 commercial tier). See LICENSE_COMMERCIAL."
#endif
 
// ---------------------------------------------------------------------------
// regulatory_monitor.hpp -- Regulatory Change Monitoring Framework
//
// Gap R-20: Regulatory change monitoring for compliance lifecycle management.
//
// Provides a structured registry for tracking regulatory changes and their
// impact on the system, conforming to:
//   - DORA Art.5(6): Ongoing regulatory landscape monitoring
//   - EU AI Act Art.61: Post-market monitoring obligations
//   - MiFID II Art.16(3): Organizational requirements — ongoing compliance
//   - ISO 27001 A.18.1: Identification of applicable legislation
//
// Components:
//   - RegulatoryChangeType / ImpactLevel / ComplianceStatus enums
//   - RegulatoryChange: individual change record
//   - RegulatoryChangeMonitor: registry + assessment tracker
//
// Header-only. Part of the signet::forge AI module.
// ---------------------------------------------------------------------------
 
#include "signet/error.hpp"
 
#include <cstdint>
#include <stdexcept>
#include <mutex>
#include <string>
#include <unordered_map>
#include <vector>
 
namespace signet::forge {
 
// ---------------------------------------------------------------------------
// Enumerations
// ---------------------------------------------------------------------------
 
enum class RegulatoryChangeType : int32_t {
    NEW_REGULATION    = 0,  
    AMENDMENT         = 1,  
    GUIDANCE          = 2,  
    TECHNICAL_STANDARD = 3, 
    ENFORCEMENT       = 4,  
    DEPRECATION       = 5   
};
 
enum class RegulatoryImpact : int32_t {
    NONE        = 0,  
    INFORMATIONAL = 1, 
    LOW         = 2,  
    MEDIUM      = 3,  
    HIGH        = 4,  
    CRITICAL    = 5   
};
 
enum class ChangeComplianceStatus : int32_t {
    NOT_ASSESSED     = 0,  
    ASSESSED         = 1,  
    IN_PROGRESS      = 2,  
    IMPLEMENTED      = 3,  
    VERIFIED         = 4,  
    NOT_APPLICABLE   = 5   
};
 
// ---------------------------------------------------------------------------
// RegulatoryChange
// ---------------------------------------------------------------------------
 
struct RegulatoryChange {
    std::string change_id;          
    std::string regulation;         
    std::string title;              
    std::string description;        
    RegulatoryChangeType type = RegulatoryChangeType::AMENDMENT;
    RegulatoryImpact impact   = RegulatoryImpact::NONE;
    ChangeComplianceStatus status = ChangeComplianceStatus::NOT_ASSESSED;
 
    std::string effective_date;     
    std::string assessment_date;    
    std::string completion_date;    
    std::string assessor;           
    std::string owner;              
 
    std::vector<std::string> affected_modules;   
    std::vector<std::string> action_items;        
    std::vector<std::string> references;          
};
 
// ---------------------------------------------------------------------------
// RegulatoryChangeMonitor
// ---------------------------------------------------------------------------
 
class RegulatoryChangeMonitor {
public:
    explicit RegulatoryChangeMonitor(const std::string& org_id = "")
        : org_id_(org_id) {
        auto gate = commercial::require_feature("RegulatoryChangeMonitor");
        if (!gate) throw std::runtime_error(gate.error().message);
    }
 
    RegulatoryChangeMonitor(RegulatoryChangeMonitor&& other) noexcept
        : org_id_(std::move(other.org_id_))
        , changes_(std::move(other.changes_)) {}
    RegulatoryChangeMonitor& operator=(RegulatoryChangeMonitor&& other) noexcept {
        if (this != &other) {
            org_id_ = std::move(other.org_id_);
            changes_ = std::move(other.changes_);
        }
        return *this;
    }
    RegulatoryChangeMonitor(const RegulatoryChangeMonitor&) = delete;
    RegulatoryChangeMonitor& operator=(const RegulatoryChangeMonitor&) = delete;
 
    void track_change(const RegulatoryChange& change) {
        std::lock_guard<std::mutex> lock(mutex_);
        changes_[change.change_id] = change;
    }
 
    [[nodiscard]] expected<void> update_status(
        const std::string& change_id,
        ChangeComplianceStatus new_status)
    {
        std::lock_guard<std::mutex> lock(mutex_);
        auto it = changes_.find(change_id);
        if (it == changes_.end()) {
            return Error{ErrorCode::INVALID_ARGUMENT,
                "Regulatory change not found: " + change_id};
        }
        it->second.status = new_status;
        return {};
    }
 
    [[nodiscard]] expected<void> assess_impact(
        const std::string& change_id,
        RegulatoryImpact impact,
        const std::string& assessor,
        const std::string& assessment_date)
    {
        std::lock_guard<std::mutex> lock(mutex_);
        auto it = changes_.find(change_id);
        if (it == changes_.end()) {
            return Error{ErrorCode::INVALID_ARGUMENT,
                "Regulatory change not found: " + change_id};
        }
        it->second.impact = impact;
        it->second.assessor = assessor;
        it->second.assessment_date = assessment_date;
        if (it->second.status == ChangeComplianceStatus::NOT_ASSESSED)
            it->second.status = ChangeComplianceStatus::ASSESSED;
        return {};
    }
 
    [[nodiscard]] expected<RegulatoryChange> lookup(const std::string& change_id) const {
        std::lock_guard<std::mutex> lock(mutex_);
        auto it = changes_.find(change_id);
        if (it == changes_.end()) {
            return Error{ErrorCode::INVALID_ARGUMENT,
                "Regulatory change not found: " + change_id};
        }
        return it->second;
    }
 
    [[nodiscard]] std::vector<RegulatoryChange> all_changes() const {
        std::lock_guard<std::mutex> lock(mutex_);
        std::vector<RegulatoryChange> out;
        out.reserve(changes_.size());
        for (const auto& [_, c] : changes_) out.push_back(c);
        return out;
    }
 
    [[nodiscard]] std::vector<RegulatoryChange> changes_for_regulation(
        const std::string& regulation) const
    {
        std::lock_guard<std::mutex> lock(mutex_);
        std::vector<RegulatoryChange> out;
        for (const auto& [_, c] : changes_) {
            if (c.regulation == regulation) out.push_back(c);
        }
        return out;
    }
 
    [[nodiscard]] std::vector<RegulatoryChange> pending_changes() const {
        std::lock_guard<std::mutex> lock(mutex_);
        std::vector<RegulatoryChange> out;
        for (const auto& [_, c] : changes_) {
            if (c.status != ChangeComplianceStatus::VERIFIED &&
                c.status != ChangeComplianceStatus::NOT_APPLICABLE) {
                out.push_back(c);
            }
        }
        return out;
    }
 
    [[nodiscard]] std::vector<RegulatoryChange> changes_above_impact(
        RegulatoryImpact threshold) const
    {
        std::lock_guard<std::mutex> lock(mutex_);
        std::vector<RegulatoryChange> out;
        for (const auto& [_, c] : changes_) {
            if (c.impact >= threshold) out.push_back(c);
        }
        return out;
    }
 
    [[nodiscard]] size_t size() const {
        std::lock_guard<std::mutex> lock(mutex_);
        return changes_.size();
    }
 
    [[nodiscard]] size_t pending_count() const {
        std::lock_guard<std::mutex> lock(mutex_);
        size_t n = 0;
        for (const auto& [_, c] : changes_) {
            if (c.status != ChangeComplianceStatus::VERIFIED &&
                c.status != ChangeComplianceStatus::NOT_APPLICABLE) {
                ++n;
            }
        }
        return n;
    }
 
    [[nodiscard]] const std::string& org_id() const { return org_id_; }
 
    [[nodiscard]] static RegulatoryChangeMonitor signet_defaults(
        const std::string& org_id = "SIGNET")
    {
        RegulatoryChangeMonitor mon(org_id);
 
        // DORA — effective January 17, 2025
        mon.track_change(RegulatoryChange{
            "RC-DORA-2025", "DORA",
            "Digital Operational Resilience Act enters into force",
            "Regulation (EU) 2022/2554 — ICT risk management, incident reporting, "
            "resilience testing, third-party risk management for financial entities.",
            RegulatoryChangeType::NEW_REGULATION,
            RegulatoryImpact::HIGH,
            ChangeComplianceStatus::VERIFIED,
            "2025-01-17", "2024-06-01", "2025-12-01", "Security Team", "Engineering",
            {"ai/compliance/", "ai/incident_response.hpp", "ai/human_oversight.hpp"},
            {"Implement DORA Art.5-19 compliance modules",
             "ICT incident management", "Resilience testing framework"},
            {"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R2554"}
        });
 
        // EU AI Act — phased effective dates 2024-2027
        mon.track_change(RegulatoryChange{
            "RC-EUAIA-2024", "EU AI Act",
            "EU Artificial Intelligence Act phased implementation",
            "Regulation (EU) 2024/1689 — risk-based AI regulation. "
            "Art.6 high-risk classification, Art.9 risk management, "
            "Art.11 technical documentation, Art.12 record-keeping, "
            "Art.13 transparency, Art.14 human oversight, Art.62 incident reporting.",
            RegulatoryChangeType::NEW_REGULATION,
            RegulatoryImpact::HIGH,
            ChangeComplianceStatus::VERIFIED,
            "2026-08-02", "2024-08-01", "2026-01-15", "Compliance", "Engineering",
            {"ai/compliance/eu_ai_act_reporter.hpp", "ai/human_oversight.hpp",
             "ai/decision_log.hpp", "ai/inference_log.hpp"},
            {"Implement Art.12/13/19 compliance reporters",
             "Human oversight with stop button (Art.14)",
             "Training data provenance logging"},
            {"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689"}
        });
 
        // NIST SP 800-227 — finalized 2025
        mon.track_change(RegulatoryChange{
            "RC-NIST-800-227", "NIST SP 800-227",
            "NIST SP 800-227 recommendations for Parquet encryption",
            "Recommendations for key management in column-oriented data formats. "
            "Covers AES-256-GCM, key hierarchy (DEK/KEK), rotation schedules.",
            RegulatoryChangeType::TECHNICAL_STANDARD,
            RegulatoryImpact::MEDIUM,
            ChangeComplianceStatus::VERIFIED,
            "2025-03-15", "2025-04-01", "2025-11-01", "Crypto Team", "Engineering",
            {"crypto/pme.hpp", "crypto/key_metadata.hpp", "crypto/aes_gcm.hpp"},
            {"Verify AES-256-GCM compliance", "Document key hierarchy"},
            {"NIST SP 800-227"}
        });
 
        return mon;
    }
 
private:
    std::string org_id_;
    std::unordered_map<std::string, RegulatoryChange> changes_;
    mutable std::mutex mutex_;
};
 
} // namespace signet::forge