compliance: EU AI Act conformance pass — Art. 15(5), Art. 27 FRIA, Digital Omnibus

[axdithyaxo]

Why

Full re-audit of src/lar/compliance/ against Regulation (EU) 2024/1689 as amended by the Digital Omnibus, Regulation (EU) 2026/1744 (in force 27 Jul 2026), cross-checked against EUR-Lex, artificialintelligenceact.eu, and the CEN-CENELEC JTC 21 work programme. The Aug-2025 citation pass fixed the code but never propagated to the docs, one systemic article-number error was still live, and the whole corpus pre-dates the Omnibus.

Framing throughout: "covered" = a runtime hook fires and/or an evidence artifact is produced. It is not a conformity assessment and does not by itself discharge the obligation. Lár is a component in the Art. 25 value chain, not the provider.

Citation fixes

• Cybersecurity is Art. 15(5), not 15(4). In the enacted text, 15(4) is robustness / error-resilience / feedback loops; 15(5) is cybersecurity (unauthorised third parties, data/model poisoning, adversarial examples). Corrected across credential_vault.py, manifest.py, backbone.py and ~10 doc files. prompt_injection_guard.py already had it right. BatchNode state-isolation in manifest.py deliberately stays at 15(4) — that one really is robustness. Least privilege reframed as a proportionate supporting measure (aligned with prEN 18282), not verbatim 15(5) text.
• Docs still said "Art. 9 FRIA" / "24h–72h incident deadlines" / "Recital 12" — synced to the code fixes and the enacted text.
• prEN numbers verified correct (18228 / 18286 / 18283 / 18284 / 18282 / 18229-1 / 18229-2 / ISO/IEC DIS 24970) — left as-is.

New capability — Article27FRIANode

The actual Article 27 deployer Fundamental Rights Impact Assessment (the named FRIA), distinct from FundamentalRightsImpactNode (the Art. 9(2)(a) runtime screen). Scope-gated on deployer_class (PUBLIC_BODY / PRIVATE_PUBLIC_SERVICE / CREDIT_SCORING = Annex III 5(b) / LIFE_HEALTH_INSURANCE = 5(c)); generates and completeness-checks the 27(1)(a)–(f) template, records the Art. 27(3) authority-notification duty and an Art. 27(4) DPIA cross-reference, and exports fria_art27.md via as_markdown(). The backbone wires it for FINANCE; run.py/showcase emit the artifact. Lár generates and checks the template — it does not perform the assessment.

Human oversight — no more structural rubber-stamp

• HumanJuryNode.human_decision_provider (additive): a real out-of-band decision (web form / Slack / API / resume_human_decision) that keeps the validated + AuthorityLedger path without needing a TTY.
• Backbone jury default flipped auto_first_choice → always_human. With no provider and no TTY the jury HALTS by design. The showcase's _mock_inputs now builds a simulated reviewer provider behind a loud DEMO banner, so the flagship artifact no longer demonstrates auto-approval.

Digital Omnibus (Reg (EU) 2026/1744)

• ProhibitedPracticeGuard: added NCII and CSAM heuristic categories (Art. 5, applicable 2 Dec 2026; include_omnibus_categories=False to disable).
• Timeline corrected repo-wide: standalone Annex III high-risk obligations apply from 2 Dec 2027 (deferred from 2 Aug 2026), Annex I embedded from 2 Aug 2028; Art. 5 / GPAI / Art. 50 unaffected. README badge "Ready Aug 2026" → "evidence infrastructure"; dropped the "First EU AI Act-Ready" tagline.
• New "Digital Omnibus" sections in paper-compliance-mapping.md and eu-ai-act-deep-dive.md.

Precision / downscoping

• SyntheticMarkerNode: METADATA = Art. 50(2) machine-readable; VISIBLE = Art. 50(1)/(4) human disclosure (was mis-lumped under 50(2)). Version string no longer hardcoded.
• IncidentReporterNode: HIGH no longer pinned to the 240h "death" deadline (a false legal classification); conservative 48h/360h ceiling plus art_73_legal_deadlines (all three paragraphs) and provider_must_confirm_applicable_paragraph on every record.
• BiasFilterNode → "runtime keyword gate; supports, does not satisfy, prEN 18283 / Art. 10(2)(f)-(g)". Manifest "Annex IV" → "Annex IV §2(b) components inventory". IncidentReporter "operationalises Art. 72" → "supports; the PMM plan is still a provider deliverable". SupplierAgreementRegistry gains the FOSS carve-out note (Lár itself — Apache-2.0, non-GPAI — is outside Art. 25(4)).

Showcase + tests

• examples/compliance/22_eu_ai_act_finance_showcase.py rewritten: 26 rows (added M = Art. 27 FRIA, N = NCII/CSAM, O = both Art. 50 markings), all citations corrected, Omnibus timeline panel, DEMO-mode note, LAR_SHOWCASE_MODEL env override (default ollama/phi4:latest).
• New tests/unit/test_compliance_conformance_fixes.py — 23 tests locking in 15(5), Article27FRIANode (scope / completeness / strict / markdown), human_decision_provider, NCII/CSAM, 50(2)-vs-50(1)/(4), and incident-deadline honesty.

Verification

• Showcase: 24 / 24 runtime checks pass (verified against a local model).
• Tests: the 188 that run against main + this branch all pass, including the 23 new ones.

Scope

This PR contains only the EU AI Act conformance work. The repo owner's in-progress checkpoint / executor / adaptive / logger changes on main are untouched and remain uncommitted there. src/lar/node.py here carries just the human_decision_provider addition.

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying lar with    Cloudflare Pages

Latest commit:	a7e95ee
Status:	✅  Deploy successful!
Preview URL:	https://12c7398c.lar-4v4.pages.dev
Branch Preview URL:	https://compliance-eu-ai-act-conform.lar-4v4.pages.dev

View logs