feat: Domain-spezifische UCCA-Fragen (HR, Education, Healthcare) + AGG-Modul
1. Domain-Context Structs: HRContext (7 Felder), EducationContext (6), HealthcareContext (6) — nach FinancialContext-Pattern, optionale Structs in UseCaseIntake 2. AGG Obligations Modul: 8 Obligations (§1-§22 AGG) — Bias-Audit, Beweislastumkehr, Proxy-Merkmale, Beschwerdemechanismus — Applicability: domain=hr/recruiting, country=DE 3. Frontend: Conditional Domain-Fragen in Step 4 des UCCA-Wizard — HR: 6 Fragen (Screening, Absagen, AGG, Bias-Audit, Human Review) — Education: 5 Fragen (Noten, Pruefungen, Minderjaehrige, Lehrkraft-Review) — Healthcare: 6 Fragen (Diagnose, Triage, MDR, klinische Validierung) — Farbcodierung: rot=Risiko, gruen=Schutzmassnahme — Domain-Contexts im Submit-Payload gemappt Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Benjamin Admin
@@ -58,6 +58,8 @@ func (m *JSONRegulationModule) defaultApplicability(facts *UnifiedFacts) bool {
|
||||
return facts.Financial.DORAApplies || facts.Financial.IsRegulated
|
||||
case "betrvg":
|
||||
return facts.Organization.Country == "DE" && facts.Organization.EmployeeCount >= 5
|
||||
case "agg":
|
||||
return facts.Organization.Country == "DE"
|
||||
default:
|
||||
return true
|
||||
}
|
||||
|
||||
@@ -222,10 +222,46 @@ type UseCaseIntake struct {
|
||||
HRDecisionSupport bool `json:"hr_decision_support,omitempty"` // System supports HR decisions (hiring, evaluation, termination)
|
||||
WorksCouncilConsulted bool `json:"works_council_consulted,omitempty"` // Works council has been consulted
|
||||
|
||||
// Domain-specific contexts (AI Act Annex III high-risk domains)
|
||||
HRContext *HRContext `json:"hr_context,omitempty"`
|
||||
EducationContext *EducationContext `json:"education_context,omitempty"`
|
||||
HealthcareContext *HealthcareContext `json:"healthcare_context,omitempty"`
|
||||
|
||||
// Opt-in to store raw text (otherwise only hash)
|
||||
StoreRawText bool `json:"store_raw_text,omitempty"`
|
||||
}
|
||||
|
||||
// HRContext captures HR/recruiting-specific compliance data (AI Act Annex III Nr. 4 + AGG)
|
||||
type HRContext struct {
|
||||
AutomatedScreening bool `json:"automated_screening"` // KI sortiert Bewerber vor
|
||||
AutomatedRejection bool `json:"automated_rejection"` // KI generiert Absagen
|
||||
CandidateRanking bool `json:"candidate_ranking"` // KI erstellt Bewerber-Rankings
|
||||
BiasAuditsDone bool `json:"bias_audits_done"` // Regelmaessige Bias-Audits
|
||||
AGGCategoriesVisible bool `json:"agg_categories_visible"` // System kann Name/Foto/Alter erkennen
|
||||
HumanReviewEnforced bool `json:"human_review_enforced"` // Mensch prueft jede KI-Empfehlung
|
||||
PerformanceEvaluation bool `json:"performance_evaluation"` // KI bewertet Mitarbeiterleistung
|
||||
}
|
||||
|
||||
// EducationContext captures education-specific compliance data (AI Act Annex III Nr. 3)
|
||||
type EducationContext struct {
|
||||
GradeInfluence bool `json:"grade_influence"` // KI beeinflusst Noten
|
||||
ExamEvaluation bool `json:"exam_evaluation"` // KI bewertet Pruefungen
|
||||
StudentSelection bool `json:"student_selection"` // KI beeinflusst Zugang/Auswahl
|
||||
MinorsInvolved bool `json:"minors_involved"` // Minderjaehrige betroffen
|
||||
TeacherReviewRequired bool `json:"teacher_review_required"` // Lehrkraft prueft KI-Ergebnis
|
||||
LearningAdaptation bool `json:"learning_adaptation"` // KI passt Lernpfade an
|
||||
}
|
||||
|
||||
// HealthcareContext captures healthcare-specific compliance data (AI Act Annex III Nr. 5 + MDR)
|
||||
type HealthcareContext struct {
|
||||
DiagnosisSupport bool `json:"diagnosis_support"` // KI unterstuetzt Diagnosen
|
||||
TreatmentRecommend bool `json:"treatment_recommendation"` // KI empfiehlt Behandlungen
|
||||
TriageDecision bool `json:"triage_decision"` // KI priorisiert Patienten
|
||||
PatientDataProcessed bool `json:"patient_data_processed"` // Gesundheitsdaten verarbeitet
|
||||
MedicalDevice bool `json:"medical_device"` // System ist Medizinprodukt
|
||||
ClinicalValidation bool `json:"clinical_validation"` // Klinisch validiert
|
||||
}
|
||||
|
||||
// DataTypes specifies what kinds of data are processed
|
||||
type DataTypes struct {
|
||||
PersonalData bool `json:"personal_data"`
|
||||
@@ -388,6 +424,13 @@ type AssessmentResult struct {
|
||||
Art22Risk bool `json:"art22_risk"` // Art. 22 GDPR automated decision risk
|
||||
TrainingAllowed TrainingAllowed `json:"training_allowed"`
|
||||
|
||||
// BetrVG Conflict Score (0-100) — works council escalation risk
|
||||
BetrvgConflictScore int `json:"betrvg_conflict_score"`
|
||||
BetrvgConsultationRequired bool `json:"betrvg_consultation_required"`
|
||||
|
||||
// Input (needed for escalation logic)
|
||||
Intake UseCaseIntake `json:"-"` // not serialized, internal use only
|
||||
|
||||
// Summary for humans
|
||||
Summary string `json:"summary"`
|
||||
Recommendation string `json:"recommendation"`
|
||||
|
||||
@@ -60,8 +60,14 @@
|
||||
"file": "betrvg_v2.json",
|
||||
"version": "1.0",
|
||||
"count": 12
|
||||
},
|
||||
{
|
||||
"id": "agg",
|
||||
"file": "agg_v2.json",
|
||||
"version": "1.0",
|
||||
"count": 8
|
||||
}
|
||||
],
|
||||
"tom_mapping_file": "_tom_mapping.json",
|
||||
"total_obligations": 358
|
||||
"total_obligations": 366
|
||||
}
|
||||
140
ai-compliance-sdk/policies/obligations/v2/agg_v2.json
Normal file
140
ai-compliance-sdk/policies/obligations/v2/agg_v2.json
Normal file
@@ -0,0 +1,140 @@
|
||||
{
|
||||
"regulation": "agg",
|
||||
"regulation_full_name": "Allgemeines Gleichbehandlungsgesetz (AGG)",
|
||||
"version": "1.0",
|
||||
"obligations": [
|
||||
{
|
||||
"id": "AGG-OBL-001",
|
||||
"title": "Diskriminierungsfreie Gestaltung von KI-Auswahlverfahren",
|
||||
"description": "KI-gestuetzte Auswahlverfahren (Recruiting, Befoerderung, Kuendigung) muessen so gestaltet sein, dass keine Benachteiligung nach § 1 AGG Merkmalen (Geschlecht, Alter, ethnische Herkunft, Religion, Behinderung, sexuelle Identitaet) erfolgt.",
|
||||
"applies_when": "AI system used in employment decisions",
|
||||
"applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "hr_context.automated_screening", "operator": "EQUALS", "value": true }] },
|
||||
"legal_basis": [{ "norm": "AGG", "article": "§ 1, § 7", "title": "Benachteiligungsverbot" }, { "norm": "AGG", "article": "§ 11", "title": "Ausschreibung" }],
|
||||
"sources": [{ "type": "national_law", "ref": "§ 1, § 7, § 11 AGG" }],
|
||||
"category": "Governance",
|
||||
"responsible": "HR / Compliance",
|
||||
"deadline": { "type": "on_event", "event": "Vor Einsatz im Auswahlverfahren" },
|
||||
"sanctions": { "description": "Schadensersatz bis 3 Monatsgehaelter (§ 15 AGG), Beweislastumkehr (§ 22 AGG)" },
|
||||
"evidence": [{ "name": "Bias-Audit-Bericht", "required": true }, "AGG-Konformitaetspruefung"],
|
||||
"priority": "kritisch",
|
||||
"tom_control_ids": ["TOM.FAIR.01"],
|
||||
"breakpilot_feature": "/sdk/use-cases",
|
||||
"valid_from": "2006-08-18",
|
||||
"valid_until": null,
|
||||
"version": "1.0"
|
||||
},
|
||||
{
|
||||
"id": "AGG-OBL-002",
|
||||
"title": "Keine Nutzung von Proxy-Merkmalen fuer Diskriminierung",
|
||||
"description": "Das KI-System darf keine Proxy-Merkmale verwenden, die indirekt auf geschuetzte Kategorien schliessen lassen (z.B. Name → Herkunft, Foto → Alter/Geschlecht, PLZ → sozialer Hintergrund).",
|
||||
"applies_when": "AI processes applicant data with identifiable features",
|
||||
"applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "hr_context.agg_categories_visible", "operator": "EQUALS", "value": true }] },
|
||||
"legal_basis": [{ "norm": "AGG", "article": "§ 3 Abs. 2", "title": "Mittelbare Benachteiligung" }],
|
||||
"sources": [{ "type": "national_law", "ref": "§ 3 Abs. 2 AGG" }],
|
||||
"category": "Technisch",
|
||||
"responsible": "Data Science / Compliance",
|
||||
"priority": "kritisch",
|
||||
"evidence": [{ "name": "Feature-Analyse-Dokumentation (keine Proxy-Merkmale)", "required": true }],
|
||||
"tom_control_ids": ["TOM.FAIR.01"],
|
||||
"valid_from": "2006-08-18",
|
||||
"version": "1.0"
|
||||
},
|
||||
{
|
||||
"id": "AGG-OBL-003",
|
||||
"title": "Beweislast-Dokumentation fuehren (§ 22 AGG)",
|
||||
"description": "Bei Indizien fuer eine Benachteiligung kehrt sich die Beweislast um (§ 22 AGG). Der Arbeitgeber muss beweisen, dass KEINE Diskriminierung vorliegt. Daher ist lueckenlose Dokumentation der KI-Entscheidungslogik zwingend.",
|
||||
"applies_when": "AI supports employment decisions in Germany",
|
||||
"applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "data_types.employee_data", "operator": "EQUALS", "value": true }] },
|
||||
"legal_basis": [{ "norm": "AGG", "article": "§ 22", "title": "Beweislast" }],
|
||||
"sources": [{ "type": "national_law", "ref": "§ 22 AGG" }],
|
||||
"category": "Governance",
|
||||
"responsible": "HR / Legal",
|
||||
"priority": "kritisch",
|
||||
"deadline": { "type": "recurring", "interval": "laufend" },
|
||||
"sanctions": { "description": "Ohne Dokumentation kann Beweislastumkehr nicht abgewehrt werden — Schadensersatz nach § 15 AGG" },
|
||||
"evidence": [{ "name": "Entscheidungsprotokoll mit KI-Begruendung", "required": true }, "Audit-Trail aller KI-Bewertungen"],
|
||||
"tom_control_ids": ["TOM.LOG.01", "TOM.GOV.01"],
|
||||
"valid_from": "2006-08-18",
|
||||
"version": "1.0"
|
||||
},
|
||||
{
|
||||
"id": "AGG-OBL-004",
|
||||
"title": "Regelmaessige Bias-Audits bei KI-gestuetzter Personalauswahl",
|
||||
"description": "KI-Systeme im Recruiting muessen regelmaessig auf Bias geprueft werden: statistische Analyse der Ergebnisse nach Geschlecht, Altersgruppen und soweit zulaessig nach Herkunft.",
|
||||
"applies_when": "AI ranks or scores candidates",
|
||||
"applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "hr_context.candidate_ranking", "operator": "EQUALS", "value": true }] },
|
||||
"legal_basis": [{ "norm": "AGG", "article": "§ 1, § 3", "title": "Unmittelbare und mittelbare Benachteiligung" }],
|
||||
"category": "Technisch",
|
||||
"responsible": "Data Science",
|
||||
"priority": "hoch",
|
||||
"deadline": { "type": "recurring", "interval": "quartalsweise" },
|
||||
"evidence": [{ "name": "Bias-Audit-Ergebnis (letzte 3 Monate)", "required": true }],
|
||||
"tom_control_ids": ["TOM.FAIR.01"],
|
||||
"valid_from": "2006-08-18",
|
||||
"version": "1.0"
|
||||
},
|
||||
{
|
||||
"id": "AGG-OBL-005",
|
||||
"title": "Schulung der HR-Entscheider ueber KI-Grenzen",
|
||||
"description": "Personen, die KI-gestuetzte Empfehlungen im Personalbereich nutzen, muessen ueber Systemgrenzen, Bias-Risiken und ihre Pflicht zur eigenstaendigen Pruefung geschult werden.",
|
||||
"applies_when": "AI provides recommendations for HR decisions",
|
||||
"applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "data_types.employee_data", "operator": "EQUALS", "value": true }] },
|
||||
"legal_basis": [{ "norm": "AGG", "article": "§ 12 Abs. 2", "title": "Pflicht des Arbeitgebers zu Schutzmassnahmen" }],
|
||||
"category": "Organisatorisch",
|
||||
"responsible": "HR / Training",
|
||||
"priority": "hoch",
|
||||
"deadline": { "type": "recurring", "interval": "jaehrlich" },
|
||||
"evidence": [{ "name": "Schulungsnachweis AGG + KI-Kompetenz", "required": true }],
|
||||
"tom_control_ids": [],
|
||||
"valid_from": "2006-08-18",
|
||||
"version": "1.0"
|
||||
},
|
||||
{
|
||||
"id": "AGG-OBL-006",
|
||||
"title": "Beschwerdemechanismus fuer abgelehnte Bewerber",
|
||||
"description": "Bewerber muessen die Moeglichkeit haben, sich ueber KI-gestuetzte Auswahlentscheidungen zu beschweren. Die zustaendige Stelle (§ 13 AGG) muss benannt sein.",
|
||||
"applies_when": "AI used in applicant selection process",
|
||||
"applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "hr_context.automated_screening", "operator": "EQUALS", "value": true }] },
|
||||
"legal_basis": [{ "norm": "AGG", "article": "§ 13", "title": "Beschwerderecht" }],
|
||||
"category": "Organisatorisch",
|
||||
"responsible": "HR",
|
||||
"priority": "hoch",
|
||||
"evidence": [{ "name": "Dokumentierter Beschwerdemechanismus", "required": true }],
|
||||
"tom_control_ids": [],
|
||||
"valid_from": "2006-08-18",
|
||||
"version": "1.0"
|
||||
},
|
||||
{
|
||||
"id": "AGG-OBL-007",
|
||||
"title": "Schadensersatzrisiko dokumentieren und versichern",
|
||||
"description": "Das Schadensersatzrisiko bei AGG-Verstoessen (bis 3 Monatsgehaelter pro Fall, § 15 AGG) muss bewertet und dokumentiert werden. Bei hohem Bewerbungsvolumen kann das kumulierte Risiko erheblich sein.",
|
||||
"applies_when": "AI processes high volume of applications",
|
||||
"applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "hr_context.automated_screening", "operator": "EQUALS", "value": true }] },
|
||||
"legal_basis": [{ "norm": "AGG", "article": "§ 15", "title": "Entschaedigung und Schadensersatz" }],
|
||||
"category": "Governance",
|
||||
"responsible": "Legal / Finance",
|
||||
"priority": "hoch",
|
||||
"evidence": [{ "name": "Risikobewertung AGG-Schadensersatz", "required": false }],
|
||||
"tom_control_ids": [],
|
||||
"valid_from": "2006-08-18",
|
||||
"version": "1.0"
|
||||
},
|
||||
{
|
||||
"id": "AGG-OBL-008",
|
||||
"title": "KI-Stellenausschreibungen AGG-konform gestalten",
|
||||
"description": "Wenn KI bei der Erstellung oder Optimierung von Stellenausschreibungen eingesetzt wird, muss sichergestellt sein, dass die Ausschreibungen keine diskriminierenden Formulierungen enthalten (§ 11 AGG).",
|
||||
"applies_when": "AI generates or optimizes job postings",
|
||||
"applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }] },
|
||||
"legal_basis": [{ "norm": "AGG", "article": "§ 11", "title": "Ausschreibung" }],
|
||||
"category": "Organisatorisch",
|
||||
"responsible": "HR / Marketing",
|
||||
"priority": "hoch",
|
||||
"evidence": [{ "name": "Pruefprotokoll Stellenausschreibung auf AGG-Konformitaet", "required": false }],
|
||||
"tom_control_ids": [],
|
||||
"valid_from": "2006-08-18",
|
||||
"version": "1.0"
|
||||
}
|
||||
],
|
||||
"controls": [],
|
||||
"incident_deadlines": []
|
||||
}
|
||||
Reference in New Issue
Block a user