diff --git a/admin-compliance/app/sdk/advisory-board/page.tsx b/admin-compliance/app/sdk/advisory-board/page.tsx
index 367f387..57d6860 100644
--- a/admin-compliance/app/sdk/advisory-board/page.tsx
+++ b/admin-compliance/app/sdk/advisory-board/page.tsx
@@ -337,6 +337,25 @@ function AdvisoryBoardPageInner() {
employee_monitoring: false,
hr_decision_support: false,
works_council_consulted: false,
+ // Domain-specific contexts (Annex III)
+ hr_automated_screening: false,
+ hr_automated_rejection: false,
+ hr_candidate_ranking: false,
+ hr_bias_audits: false,
+ hr_agg_visible: false,
+ hr_human_review: false,
+ hr_performance_eval: false,
+ edu_grade_influence: false,
+ edu_exam_evaluation: false,
+ edu_student_selection: false,
+ edu_minors: false,
+ edu_teacher_review: false,
+ hc_diagnosis: false,
+ hc_treatment: false,
+ hc_triage: false,
+ hc_patient_data: false,
+ hc_medical_device: false,
+ hc_clinical_validation: false,
// Hosting (single-select tile)
hosting_provider: '' as string,
hosting_region: '' as string,
@@ -427,6 +446,31 @@ function AdvisoryBoardPageInner() {
employee_monitoring: form.employee_monitoring,
hr_decision_support: form.hr_decision_support,
works_council_consulted: form.works_council_consulted,
+ // Domain-specific contexts
+ hr_context: ['hr', 'recruiting'].includes(form.domain) ? {
+ automated_screening: form.hr_automated_screening,
+ automated_rejection: form.hr_automated_rejection,
+ candidate_ranking: form.hr_candidate_ranking,
+ bias_audits_done: form.hr_bias_audits,
+ agg_categories_visible: form.hr_agg_visible,
+ human_review_enforced: form.hr_human_review,
+ performance_evaluation: form.hr_performance_eval,
+ } : undefined,
+ education_context: ['education', 'higher_education', 'vocational_training', 'research'].includes(form.domain) ? {
+ grade_influence: form.edu_grade_influence,
+ exam_evaluation: form.edu_exam_evaluation,
+ student_selection: form.edu_student_selection,
+ minors_involved: form.edu_minors,
+ teacher_review_required: form.edu_teacher_review,
+ } : undefined,
+ healthcare_context: ['healthcare', 'medical_devices', 'pharma', 'elderly_care'].includes(form.domain) ? {
+ diagnosis_support: form.hc_diagnosis,
+ treatment_recommendation: form.hc_treatment,
+ triage_decision: form.hc_triage,
+ patient_data_processed: form.hc_patient_data,
+ medical_device: form.hc_medical_device,
+ clinical_validation: form.hc_clinical_validation,
+ } : undefined,
store_raw_text: true,
}
@@ -830,6 +874,104 @@ function AdvisoryBoardPageInner() {
+
+ {/* Domain-specific questions — HR/Recruiting */}
+ {['hr', 'recruiting'].includes(form.domain) && (
+
+
HR & Recruiting — Hochrisiko-Pruefung
+
AI Act Annex III Nr. 4 + AGG — Pflichtfragen bei KI im Personalbereich.
+
+
+ )}
+
+ {/* Domain-specific questions — Education */}
+ {['education', 'higher_education', 'vocational_training', 'research'].includes(form.domain) && (
+
+
Bildung — Hochrisiko-Pruefung
+
AI Act Annex III Nr. 3 — bei KI in Bildung und Ausbildung.
+
+
+ )}
+
+ {/* Domain-specific questions — Healthcare */}
+ {['healthcare', 'medical_devices', 'pharma', 'elderly_care'].includes(form.domain) && (
+
+
Gesundheitswesen — Hochrisiko-Pruefung
+
AI Act Annex III Nr. 5 + MDR (EU) 2017/745.
+
+
+ )}
)}
diff --git a/ai-compliance-sdk/internal/ucca/json_regulation_module.go b/ai-compliance-sdk/internal/ucca/json_regulation_module.go
index d875170..0419f5c 100644
--- a/ai-compliance-sdk/internal/ucca/json_regulation_module.go
+++ b/ai-compliance-sdk/internal/ucca/json_regulation_module.go
@@ -58,6 +58,8 @@ func (m *JSONRegulationModule) defaultApplicability(facts *UnifiedFacts) bool {
return facts.Financial.DORAApplies || facts.Financial.IsRegulated
case "betrvg":
return facts.Organization.Country == "DE" && facts.Organization.EmployeeCount >= 5
+ case "agg":
+ return facts.Organization.Country == "DE"
default:
return true
}
diff --git a/ai-compliance-sdk/internal/ucca/models.go b/ai-compliance-sdk/internal/ucca/models.go
index 2427fc0..f48dfd0 100644
--- a/ai-compliance-sdk/internal/ucca/models.go
+++ b/ai-compliance-sdk/internal/ucca/models.go
@@ -222,10 +222,46 @@ type UseCaseIntake struct {
HRDecisionSupport bool `json:"hr_decision_support,omitempty"` // System supports HR decisions (hiring, evaluation, termination)
WorksCouncilConsulted bool `json:"works_council_consulted,omitempty"` // Works council has been consulted
+ // Domain-specific contexts (AI Act Annex III high-risk domains)
+ HRContext *HRContext `json:"hr_context,omitempty"`
+ EducationContext *EducationContext `json:"education_context,omitempty"`
+ HealthcareContext *HealthcareContext `json:"healthcare_context,omitempty"`
+
// Opt-in to store raw text (otherwise only hash)
StoreRawText bool `json:"store_raw_text,omitempty"`
}
+// HRContext captures HR/recruiting-specific compliance data (AI Act Annex III Nr. 4 + AGG)
+type HRContext struct {
+ AutomatedScreening bool `json:"automated_screening"` // KI sortiert Bewerber vor
+ AutomatedRejection bool `json:"automated_rejection"` // KI generiert Absagen
+ CandidateRanking bool `json:"candidate_ranking"` // KI erstellt Bewerber-Rankings
+ BiasAuditsDone bool `json:"bias_audits_done"` // Regelmaessige Bias-Audits
+ AGGCategoriesVisible bool `json:"agg_categories_visible"` // System kann Name/Foto/Alter erkennen
+ HumanReviewEnforced bool `json:"human_review_enforced"` // Mensch prueft jede KI-Empfehlung
+ PerformanceEvaluation bool `json:"performance_evaluation"` // KI bewertet Mitarbeiterleistung
+}
+
+// EducationContext captures education-specific compliance data (AI Act Annex III Nr. 3)
+type EducationContext struct {
+ GradeInfluence bool `json:"grade_influence"` // KI beeinflusst Noten
+ ExamEvaluation bool `json:"exam_evaluation"` // KI bewertet Pruefungen
+ StudentSelection bool `json:"student_selection"` // KI beeinflusst Zugang/Auswahl
+ MinorsInvolved bool `json:"minors_involved"` // Minderjaehrige betroffen
+ TeacherReviewRequired bool `json:"teacher_review_required"` // Lehrkraft prueft KI-Ergebnis
+ LearningAdaptation bool `json:"learning_adaptation"` // KI passt Lernpfade an
+}
+
+// HealthcareContext captures healthcare-specific compliance data (AI Act Annex III Nr. 5 + MDR)
+type HealthcareContext struct {
+ DiagnosisSupport bool `json:"diagnosis_support"` // KI unterstuetzt Diagnosen
+ TreatmentRecommend bool `json:"treatment_recommendation"` // KI empfiehlt Behandlungen
+ TriageDecision bool `json:"triage_decision"` // KI priorisiert Patienten
+ PatientDataProcessed bool `json:"patient_data_processed"` // Gesundheitsdaten verarbeitet
+ MedicalDevice bool `json:"medical_device"` // System ist Medizinprodukt
+ ClinicalValidation bool `json:"clinical_validation"` // Klinisch validiert
+}
+
// DataTypes specifies what kinds of data are processed
type DataTypes struct {
PersonalData bool `json:"personal_data"`
@@ -388,6 +424,13 @@ type AssessmentResult struct {
Art22Risk bool `json:"art22_risk"` // Art. 22 GDPR automated decision risk
TrainingAllowed TrainingAllowed `json:"training_allowed"`
+ // BetrVG Conflict Score (0-100) — works council escalation risk
+ BetrvgConflictScore int `json:"betrvg_conflict_score"`
+ BetrvgConsultationRequired bool `json:"betrvg_consultation_required"`
+
+ // Input (needed for escalation logic)
+ Intake UseCaseIntake `json:"-"` // not serialized, internal use only
+
// Summary for humans
Summary string `json:"summary"`
Recommendation string `json:"recommendation"`
diff --git a/ai-compliance-sdk/policies/obligations/v2/_manifest.json b/ai-compliance-sdk/policies/obligations/v2/_manifest.json
index 6da9145..d548a06 100644
--- a/ai-compliance-sdk/policies/obligations/v2/_manifest.json
+++ b/ai-compliance-sdk/policies/obligations/v2/_manifest.json
@@ -60,8 +60,14 @@
"file": "betrvg_v2.json",
"version": "1.0",
"count": 12
+ },
+ {
+ "id": "agg",
+ "file": "agg_v2.json",
+ "version": "1.0",
+ "count": 8
}
],
"tom_mapping_file": "_tom_mapping.json",
- "total_obligations": 358
+ "total_obligations": 366
}
\ No newline at end of file
diff --git a/ai-compliance-sdk/policies/obligations/v2/agg_v2.json b/ai-compliance-sdk/policies/obligations/v2/agg_v2.json
new file mode 100644
index 0000000..af1d901
--- /dev/null
+++ b/ai-compliance-sdk/policies/obligations/v2/agg_v2.json
@@ -0,0 +1,140 @@
+{
+ "regulation": "agg",
+ "regulation_full_name": "Allgemeines Gleichbehandlungsgesetz (AGG)",
+ "version": "1.0",
+ "obligations": [
+ {
+ "id": "AGG-OBL-001",
+ "title": "Diskriminierungsfreie Gestaltung von KI-Auswahlverfahren",
+ "description": "KI-gestuetzte Auswahlverfahren (Recruiting, Befoerderung, Kuendigung) muessen so gestaltet sein, dass keine Benachteiligung nach § 1 AGG Merkmalen (Geschlecht, Alter, ethnische Herkunft, Religion, Behinderung, sexuelle Identitaet) erfolgt.",
+ "applies_when": "AI system used in employment decisions",
+ "applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "hr_context.automated_screening", "operator": "EQUALS", "value": true }] },
+ "legal_basis": [{ "norm": "AGG", "article": "§ 1, § 7", "title": "Benachteiligungsverbot" }, { "norm": "AGG", "article": "§ 11", "title": "Ausschreibung" }],
+ "sources": [{ "type": "national_law", "ref": "§ 1, § 7, § 11 AGG" }],
+ "category": "Governance",
+ "responsible": "HR / Compliance",
+ "deadline": { "type": "on_event", "event": "Vor Einsatz im Auswahlverfahren" },
+ "sanctions": { "description": "Schadensersatz bis 3 Monatsgehaelter (§ 15 AGG), Beweislastumkehr (§ 22 AGG)" },
+ "evidence": [{ "name": "Bias-Audit-Bericht", "required": true }, "AGG-Konformitaetspruefung"],
+ "priority": "kritisch",
+ "tom_control_ids": ["TOM.FAIR.01"],
+ "breakpilot_feature": "/sdk/use-cases",
+ "valid_from": "2006-08-18",
+ "valid_until": null,
+ "version": "1.0"
+ },
+ {
+ "id": "AGG-OBL-002",
+ "title": "Keine Nutzung von Proxy-Merkmalen fuer Diskriminierung",
+ "description": "Das KI-System darf keine Proxy-Merkmale verwenden, die indirekt auf geschuetzte Kategorien schliessen lassen (z.B. Name → Herkunft, Foto → Alter/Geschlecht, PLZ → sozialer Hintergrund).",
+ "applies_when": "AI processes applicant data with identifiable features",
+ "applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "hr_context.agg_categories_visible", "operator": "EQUALS", "value": true }] },
+ "legal_basis": [{ "norm": "AGG", "article": "§ 3 Abs. 2", "title": "Mittelbare Benachteiligung" }],
+ "sources": [{ "type": "national_law", "ref": "§ 3 Abs. 2 AGG" }],
+ "category": "Technisch",
+ "responsible": "Data Science / Compliance",
+ "priority": "kritisch",
+ "evidence": [{ "name": "Feature-Analyse-Dokumentation (keine Proxy-Merkmale)", "required": true }],
+ "tom_control_ids": ["TOM.FAIR.01"],
+ "valid_from": "2006-08-18",
+ "version": "1.0"
+ },
+ {
+ "id": "AGG-OBL-003",
+ "title": "Beweislast-Dokumentation fuehren (§ 22 AGG)",
+ "description": "Bei Indizien fuer eine Benachteiligung kehrt sich die Beweislast um (§ 22 AGG). Der Arbeitgeber muss beweisen, dass KEINE Diskriminierung vorliegt. Daher ist lueckenlose Dokumentation der KI-Entscheidungslogik zwingend.",
+ "applies_when": "AI supports employment decisions in Germany",
+ "applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "data_types.employee_data", "operator": "EQUALS", "value": true }] },
+ "legal_basis": [{ "norm": "AGG", "article": "§ 22", "title": "Beweislast" }],
+ "sources": [{ "type": "national_law", "ref": "§ 22 AGG" }],
+ "category": "Governance",
+ "responsible": "HR / Legal",
+ "priority": "kritisch",
+ "deadline": { "type": "recurring", "interval": "laufend" },
+ "sanctions": { "description": "Ohne Dokumentation kann Beweislastumkehr nicht abgewehrt werden — Schadensersatz nach § 15 AGG" },
+ "evidence": [{ "name": "Entscheidungsprotokoll mit KI-Begruendung", "required": true }, "Audit-Trail aller KI-Bewertungen"],
+ "tom_control_ids": ["TOM.LOG.01", "TOM.GOV.01"],
+ "valid_from": "2006-08-18",
+ "version": "1.0"
+ },
+ {
+ "id": "AGG-OBL-004",
+ "title": "Regelmaessige Bias-Audits bei KI-gestuetzter Personalauswahl",
+ "description": "KI-Systeme im Recruiting muessen regelmaessig auf Bias geprueft werden: statistische Analyse der Ergebnisse nach Geschlecht, Altersgruppen und soweit zulaessig nach Herkunft.",
+ "applies_when": "AI ranks or scores candidates",
+ "applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "hr_context.candidate_ranking", "operator": "EQUALS", "value": true }] },
+ "legal_basis": [{ "norm": "AGG", "article": "§ 1, § 3", "title": "Unmittelbare und mittelbare Benachteiligung" }],
+ "category": "Technisch",
+ "responsible": "Data Science",
+ "priority": "hoch",
+ "deadline": { "type": "recurring", "interval": "quartalsweise" },
+ "evidence": [{ "name": "Bias-Audit-Ergebnis (letzte 3 Monate)", "required": true }],
+ "tom_control_ids": ["TOM.FAIR.01"],
+ "valid_from": "2006-08-18",
+ "version": "1.0"
+ },
+ {
+ "id": "AGG-OBL-005",
+ "title": "Schulung der HR-Entscheider ueber KI-Grenzen",
+ "description": "Personen, die KI-gestuetzte Empfehlungen im Personalbereich nutzen, muessen ueber Systemgrenzen, Bias-Risiken und ihre Pflicht zur eigenstaendigen Pruefung geschult werden.",
+ "applies_when": "AI provides recommendations for HR decisions",
+ "applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "data_types.employee_data", "operator": "EQUALS", "value": true }] },
+ "legal_basis": [{ "norm": "AGG", "article": "§ 12 Abs. 2", "title": "Pflicht des Arbeitgebers zu Schutzmassnahmen" }],
+ "category": "Organisatorisch",
+ "responsible": "HR / Training",
+ "priority": "hoch",
+ "deadline": { "type": "recurring", "interval": "jaehrlich" },
+ "evidence": [{ "name": "Schulungsnachweis AGG + KI-Kompetenz", "required": true }],
+ "tom_control_ids": [],
+ "valid_from": "2006-08-18",
+ "version": "1.0"
+ },
+ {
+ "id": "AGG-OBL-006",
+ "title": "Beschwerdemechanismus fuer abgelehnte Bewerber",
+ "description": "Bewerber muessen die Moeglichkeit haben, sich ueber KI-gestuetzte Auswahlentscheidungen zu beschweren. Die zustaendige Stelle (§ 13 AGG) muss benannt sein.",
+ "applies_when": "AI used in applicant selection process",
+ "applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "hr_context.automated_screening", "operator": "EQUALS", "value": true }] },
+ "legal_basis": [{ "norm": "AGG", "article": "§ 13", "title": "Beschwerderecht" }],
+ "category": "Organisatorisch",
+ "responsible": "HR",
+ "priority": "hoch",
+ "evidence": [{ "name": "Dokumentierter Beschwerdemechanismus", "required": true }],
+ "tom_control_ids": [],
+ "valid_from": "2006-08-18",
+ "version": "1.0"
+ },
+ {
+ "id": "AGG-OBL-007",
+ "title": "Schadensersatzrisiko dokumentieren und versichern",
+ "description": "Das Schadensersatzrisiko bei AGG-Verstoessen (bis 3 Monatsgehaelter pro Fall, § 15 AGG) muss bewertet und dokumentiert werden. Bei hohem Bewerbungsvolumen kann das kumulierte Risiko erheblich sein.",
+ "applies_when": "AI processes high volume of applications",
+ "applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "hr_context.automated_screening", "operator": "EQUALS", "value": true }] },
+ "legal_basis": [{ "norm": "AGG", "article": "§ 15", "title": "Entschaedigung und Schadensersatz" }],
+ "category": "Governance",
+ "responsible": "Legal / Finance",
+ "priority": "hoch",
+ "evidence": [{ "name": "Risikobewertung AGG-Schadensersatz", "required": false }],
+ "tom_control_ids": [],
+ "valid_from": "2006-08-18",
+ "version": "1.0"
+ },
+ {
+ "id": "AGG-OBL-008",
+ "title": "KI-Stellenausschreibungen AGG-konform gestalten",
+ "description": "Wenn KI bei der Erstellung oder Optimierung von Stellenausschreibungen eingesetzt wird, muss sichergestellt sein, dass die Ausschreibungen keine diskriminierenden Formulierungen enthalten (§ 11 AGG).",
+ "applies_when": "AI generates or optimizes job postings",
+ "applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }] },
+ "legal_basis": [{ "norm": "AGG", "article": "§ 11", "title": "Ausschreibung" }],
+ "category": "Organisatorisch",
+ "responsible": "HR / Marketing",
+ "priority": "hoch",
+ "evidence": [{ "name": "Pruefprotokoll Stellenausschreibung auf AGG-Konformitaet", "required": false }],
+ "tom_control_ids": [],
+ "valid_from": "2006-08-18",
+ "version": "1.0"
+ }
+ ],
+ "controls": [],
+ "incident_deadlines": []
+}