Python으로 조화된 표준 준수 상태를 추적하고 적합성 추정을 관리하는 시스템입니다.
from dataclasses import dataclass, field
from datetime import date, datetime
from enum import Enum
from typing import Optional
import hashlib
class StandardizationBody(Enum):
"""유럽 표준화 기구"""
CEN = "European Committee for Standardization"
CENELEC = "European Committee for Electrotechnical Standardization"
ETSI = "European Telecommunications Standards Institute"
ISO = "International Organization for Standardization"
IEC = "International Electrotechnical Commission"
class StandardStatus(Enum):
"""표준 상태"""
DRAFT = "draft"
PUBLISHED = "published"
HARMONISED = "harmonised_oj_published" # EU 관보 게재
WITHDRAWN = "withdrawn"
SUPERSEDED = "superseded"
class AIActRequirement(Enum):
"""EU AI Act 필수 요건 (고위험 AI)"""
RISK_MANAGEMENT = "Art.9 - Risk management system"
DATA_GOVERNANCE = "Art.10 - Data and data governance"
TECHNICAL_DOCUMENTATION = "Art.11 - Technical documentation"
RECORD_KEEPING = "Art.12 - Record-keeping (logging)"
TRANSPARENCY = "Art.13 - Transparency and provision of information"
HUMAN_OVERSIGHT = "Art.14 - Human oversight"
ACCURACY_ROBUSTNESS = "Art.15 - Accuracy, robustness and cybersecurity"
@dataclass
class HarmonisedStandard:
"""조화된 표준"""
reference: str # 예: "EN ISO/IEC 23894:2024"
title: str
body: StandardizationBody
status: StandardStatus
ai_act_requirements: list[AIActRequirement]
oj_publication_date: Optional[date] = None # EU 관보 게재일
withdrawal_date: Optional[date] = None
superseded_by: Optional[str] = None
iso_iec_base: Optional[str] = None # 기반 국제 표준
def provides_presumption(self) -> bool:
"""적합성 추정 효력 여부"""
if self.status != StandardStatus.HARMONISED:
return False
if self.oj_publication_date is None:
return False
if self.withdrawal_date and date.today() >= self.withdrawal_date:
return False
return True
def get_covered_requirements(self) -> list[str]:
"""표준이 커버하는 AI Act 요건 목록"""
return [req.value for req in self.ai_act_requirements]
@dataclass
class ComplianceRecord:
"""표준 준수 기록"""
standard_ref: str
ai_system_id: str
compliance_date: date
evidence_documents: list[str] = field(default_factory=list)
assessment_body: Optional[str] = None # 제3자 평가기관
certificate_number: Optional[str] = None
valid_until: Optional[date] = None
def generate_record_hash(self) -> str:
"""기록 무결성 해시"""
content = f"{self.standard_ref}|{self.ai_system_id}|{self.compliance_date}"
return hashlib.sha256(content.encode()).hexdigest()[:16]
class HarmonisedStandardsRegistry:
"""조화된 표준 등록 및 추적 시스템"""
# EU AI Act용 주요 조화된 표준 (예시)
AI_ACT_STANDARDS = {
"EN ISO/IEC 23894": {
"title": "AI Risk Management",
"requirements": [AIActRequirement.RISK_MANAGEMENT],
"iso_base": "ISO/IEC 23894:2023"
},
"EN ISO/IEC 25059": {
"title": "AI Quality Model",
"requirements": [AIActRequirement.ACCURACY_ROBUSTNESS],
"iso_base": "ISO/IEC 25059:2023"
},
"EN ISO/IEC 42001": {
"title": "AI Management System",
"requirements": [
AIActRequirement.RISK_MANAGEMENT,
AIActRequirement.DATA_GOVERNANCE,
AIActRequirement.RECORD_KEEPING
],
"iso_base": "ISO/IEC 42001:2023"
}
}
def __init__(self):
self.standards: dict[str, HarmonisedStandard] = {}
self.compliance_records: list[ComplianceRecord] = []
def register_standard(self, standard: HarmonisedStandard) -> str:
"""표준 등록"""
self.standards[standard.reference] = standard
return standard.reference
def check_presumption_of_conformity(
self,
ai_system_id: str,
requirement: AIActRequirement
) -> dict:
"""특정 요건에 대한 적합성 추정 확인"""
# 해당 요건을 커버하는 조화된 표준 찾기
covering_standards = [
std for std in self.standards.values()
if requirement in std.ai_act_requirements and std.provides_presumption()
]
if not covering_standards:
return {
"has_presumption": False,
"reason": "No harmonised standard with OJ publication covers this requirement",
"alternative": "Third-party conformity assessment required (Art.43)"
}
# AI 시스템의 준수 기록 확인
relevant_records = [
rec for rec in self.compliance_records
if rec.ai_system_id == ai_system_id
and rec.standard_ref in [s.reference for s in covering_standards]
]
if relevant_records:
record = relevant_records[0]
return {
"has_presumption": True,
"standard": record.standard_ref,
"compliance_date": record.compliance_date.isoformat(),
"certificate": record.certificate_number,
"legal_basis": "EU AI Act Article 40 - Presumption of conformity"
}
return {
"has_presumption": False,
"reason": "AI system has not demonstrated compliance with harmonised standard",
"available_standards": [s.reference for s in covering_standards]
}
def get_gap_analysis(self, ai_system_id: str) -> dict:
"""AI 시스템의 표준 준수 갭 분석"""
all_requirements = list(AIActRequirement)
compliant = []
gaps = []
for req in all_requirements:
result = self.check_presumption_of_conformity(ai_system_id, req)
if result["has_presumption"]:
compliant.append({
"requirement": req.value,
"standard": result["standard"]
})
else:
gaps.append({
"requirement": req.value,
"status": "Gap identified",
"recommendation": result.get("available_standards",
["Custom technical solution required"])
})
return {
"ai_system_id": ai_system_id,
"analysis_date": datetime.now().isoformat(),
"total_requirements": len(all_requirements),
"compliant_count": len(compliant),
"gap_count": len(gaps),
"compliant_requirements": compliant,
"gaps": gaps,
"overall_presumption_coverage": f"{len(compliant)/len(all_requirements)*100:.1f}%"
}
def record_compliance(
self,
standard_ref: str,
ai_system_id: str,
evidence_docs: list[str],
assessment_body: Optional[str] = None
) -> ComplianceRecord:
"""표준 준수 기록"""
if standard_ref not in self.standards:
raise ValueError(f"Standard {standard_ref} not registered")
record = ComplianceRecord(
standard_ref=standard_ref,
ai_system_id=ai_system_id,
compliance_date=date.today(),
evidence_documents=evidence_docs,
assessment_body=assessment_body,
certificate_number=f"CERT-{record.generate_record_hash()}" if assessment_body else None
)
self.compliance_records.append(record)
return record
# 사용 예시
if __name__ == "__main__":
registry = HarmonisedStandardsRegistry()
# 조화된 표준 등록
risk_std = HarmonisedStandard(
reference="EN ISO/IEC 23894:2024",
title="Information technology - AI Risk Management",
body=StandardizationBody.CEN,
status=StandardStatus.HARMONISED,
ai_act_requirements=[AIActRequirement.RISK_MANAGEMENT],
oj_publication_date=date(2025, 3, 15),
iso_iec_base="ISO/IEC 23894:2023"
)
registry.register_standard(risk_std)
# AI 시스템 준수 기록
registry.record_compliance(
standard_ref="EN ISO/IEC 23894:2024",
ai_system_id="AI-HR-RECRUIT-001",
evidence_docs=["risk_assessment_v2.pdf", "mitigation_plan.pdf"],
assessment_body="TUV Rheinland"
)
# 갭 분석 실행
analysis = registry.get_gap_analysis("AI-HR-RECRUIT-001")
print(f"적합성 추정 커버리지: {analysis['overall_presumption_coverage']}")
print(f"갭 수: {analysis['gap_count']}")