AI 事件法律考量

"""
AI 事件的證據保管鏈追蹤。
 
維持從採集、分析到儲存的法律上可辯護的證據處理紀錄。
"""
import hashlib
import json
import time
from dataclasses import dataclass, field
from pathlib import Path
 
@dataclass
class CustodyTransfer:
    """單次證據保管轉移的記錄。"""
    timestamp: float
    from_person: str
    to_person: str
    reason: str
    location: str
    evidence_condition: str  # "sealed", "opened for analysis", etc.
    integrity_hash_verified: bool
 
@dataclass
class EvidenceItem:
    """含保管鏈的單件數位證據。"""
    evidence_id: str
    description: str
    collection_timestamp: float
    collected_by: str
    collection_method: str
    original_location: str
    integrity_hash_sha256: str
    file_size_bytes: int
    custody_chain: list[CustodyTransfer] = field(default_factory=list)
    analysis_notes: list[dict] = field(default_factory=list)
    storage_location: str = ""
 
    def add_custody_transfer(
        self,
        from_person: str,
        to_person: str,
        reason: str,
        location: str,
        condition: str = "sealed",
    ) -> None:
        self.custody_chain.append(CustodyTransfer(
            timestamp=time.time(),
            from_person=from_person,
            to_person=to_person,
            reason=reason,
            location=location,
            evidence_condition=condition,
            integrity_hash_verified=True,  # 應於轉移時驗證
        ))
 
    def verify_integrity(self, current_file_path: str) -> dict:
        """對照已儲存的雜湊值驗證證據檔案完整性。"""
        file_path = Path(current_file_path)
        if not file_path.exists():
            return {"status": "FILE_NOT_FOUND", "verified": False}
 
        current_hash = hashlib.sha256(file_path.read_bytes()).hexdigest()
        matches = current_hash == self.integrity_hash_sha256
 
        return {
            "status": "MATCH" if matches else "MISMATCH",
            "verified": matches,
            "expected_hash": self.integrity_hash_sha256,
            "current_hash": current_hash,
        }
 
class EvidenceManager:
    """
    以法律上可辯護的保管鏈追蹤,管理 AI 事件的數位證據。
    """
 
    def __init__(self, evidence_dir: str):
        self.evidence_dir = Path(evidence_dir)
        self.evidence_dir.mkdir(parents=True, exist_ok=True)
        self.registry: dict[str, EvidenceItem] = {}
 
    def collect_evidence(
        self,
        evidence_id: str,
        source_path: str,
        description: str,
        collected_by: str,
        collection_method: str,
    ) -> EvidenceItem:
        """
        以適當文件採集一件數位證據。
 
        建立鑑識副本、計算完整性雜湊值,並初始化保管鏈追蹤。
        """
        source = Path(source_path)
        if not source.exists():
            raise FileNotFoundError(f"Evidence source not found: {source_path}")
 
        # 讀取來源並計算雜湊值
        content = source.read_bytes()
        integrity_hash = hashlib.sha256(content).hexdigest()
 
        # 儲存證據副本
        evidence_path = self.evidence_dir / f"{evidence_id}_{source.name}"
        evidence_path.write_bytes(content)
 
        item = EvidenceItem(
            evidence_id=evidence_id,
            description=description,
            collection_timestamp=time.time(),
            collected_by=collected_by,
            collection_method=collection_method,
            original_location=source_path,
            integrity_hash_sha256=integrity_hash,
            file_size_bytes=len(content),
            storage_location=str(evidence_path),
        )
 
        self.registry[evidence_id] = item
 
        # 儲存登錄表
        self._save_registry()
 
        return item
 
    def _save_registry(self) -> None:
        from dataclasses import asdict
        registry_path = self.evidence_dir / "evidence_registry.json"
        data = {
            eid: asdict(item)
            for eid, item in self.registry.items()
        }
        registry_path.write_text(json.dumps(data, default=str, indent=2))

def assess_notification_obligations(
    incident: dict,
    jurisdictions: list[str],
    data_types_affected: list[str],
    system_classification: str,
) -> dict:
    """
    評估 AI 事件的法規通報義務。
 
    這是決策輔助工具,並非法律意見。所有通報決定應由
    法律顧問審閱。
 
    Args:
        incident: 含 'type'、'severity'、'data_exposed'、
                 'users_affected'、'harm_type' 等鍵的字典
        jurisdictions: 適用司法轄區清單(例如 ["EU", "US_CA", "US_NY"])
        data_types_affected: 涉及的資料類型(例如 ["PII", "PHI", "financial"])
        system_classification: AI Act 分類("high_risk"、"limited_risk"、"minimal_risk")
    """
    obligations = []
 
    # EU AI Act - 第 62 條
    if "EU" in jurisdictions and system_classification == "high_risk":
        if incident.get("severity") in ("HIGH", "CRITICAL"):
            obligations.append({
                "regulation": "EU AI Act Article 62",
                "obligation": "Report serious incident to market surveillance authority",
                "deadline": "15 days from awareness",
                "authority": "Member State market surveillance authority",
                "required": incident.get("harm_type") in (
                    "death", "health_damage", "fundamental_rights", "infrastructure"
                ),
            })
 
    # GDPR - 第 33 與 34 條
    if "EU" in jurisdictions and "PII" in data_types_affected:
        if incident.get("data_exposed", False):
            obligations.append({
                "regulation": "GDPR Article 33",
                "obligation": "Notify supervisory authority of personal data breach",
                "deadline": "72 hours from awareness",
                "authority": "Data Protection Authority",
                "required": True,
            })
            if incident.get("users_affected", 0) > 0:
                obligations.append({
                    "regulation": "GDPR Article 34",
                    "obligation": "Notify affected data subjects",
                    "deadline": "Without undue delay",
                    "authority": "Direct to affected individuals",
                    "required": incident.get("severity") in ("HIGH", "CRITICAL"),
                })
 
    # 美國 SEC 規則
    if any(j.startswith("US") for j in jurisdictions):
        if incident.get("severity") == "CRITICAL":
            obligations.append({
                "regulation": "SEC Cybersecurity Disclosure Rules",
                "obligation": "File Form 8-K for material cybersecurity incident",
                "deadline": "4 business days from materiality determination",
                "authority": "SEC",
                "required": "Materiality assessment needed",
            })
 
    # 美國州級外洩通報(範例:加州)
    if "US_CA" in jurisdictions and "PII" in data_types_affected:
        if incident.get("data_exposed", False):
            obligations.append({
                "regulation": "California Civil Code 1798.82",
                "obligation": "Notify California residents of data breach",
                "deadline": "Without unreasonable delay (interpreted as ~45 days)",
                "authority": "California AG if >500 residents",
                "required": True,
            })
 
    return {
        "total_obligations": len(obligations),
        "obligations": obligations,
        "earliest_deadline": min(
            (o["deadline"] for o in obligations),
            default="N/A",
        ),
        "legal_review_required": len(obligations) > 0,
    }