Introduction to Responsible AI & ISO 42001

# ─── 1. AI Impact Assessment Scoring Tool ────────────────────
from dataclasses import dataclass, field
from typing import List
from enum import Enum

class Severity(Enum):
    NEGLIGIBLE = 1
    MINOR = 2
    MODERATE = 3
    MAJOR = 4
    CRITICAL = 5

class Likelihood(Enum):
    RARE = 1
    UNLIKELY = 2
    POSSIBLE = 3
    LIKELY = 4
    ALMOST_CERTAIN = 5

@dataclass
class AIImpact:
    impact_id: str
    description: str
    affected_parties: List[str]
    severity: Severity
    likelihood: Likelihood
    current_controls: List[str] = field(default_factory=list)
    additional_controls: List[str] = field(default_factory=list)

    @property
    def risk_score(self) -> int:
        return self.severity.value * self.likelihood.value

    @property
    def risk_level(self) -> str:
        score = self.risk_score
        if score >= 16: return "CRITICAL"
        elif score >= 9: return "HIGH"
        elif score >= 4: return "MEDIUM"
        else: return "LOW"

@dataclass
class AIImpactAssessment:
    system_name: str
    system_version: str
    use_case: str
    eu_ai_act_risk_class: str
    iso_42001_controls: List[str]
    impacts: List[AIImpact] = field(default_factory=list)

    def add_impact(self, impact: AIImpact):
        self.impacts.append(impact)

    def risk_summary(self):
        levels = {"CRITICAL": 0, "HIGH": 0, "MEDIUM": 0, "LOW": 0}
        for imp in self.impacts:
            levels[imp.risk_level] += 1
        return levels

    def print_report(self):
        print(f"\n{'='*60}")
        print(f"AI IMPACT ASSESSMENT: {self.system_name} v{self.system_version}")
        print(f"Use Case: {self.use_case}")
        print(f"EU AI Act Classification: {self.eu_ai_act_risk_class}")
        print(f"{'='*60}")
        for imp in sorted(self.impacts, key=lambda x: -x.risk_score):
            print(f"\n  [{imp.risk_level:8}] (score={imp.risk_score:2}) {imp.impact_id}")
            print(f"    Description: {imp.description}")
            print(f"    Affected: {', '.join(imp.affected_parties)}")
            if imp.current_controls:
                print(f"    Controls in place: {', '.join(imp.current_controls)}")
            if imp.additional_controls:
                print(f"    Additional controls needed: {', '.join(imp.additional_controls)}")
        print(f"\nRisk Summary: {self.risk_summary()}")

# Example: Loan Approval AI System
assessment = AIImpactAssessment(
    system_name="LoanScoreAI",
    system_version="2.1.0",
    use_case="Automated credit risk scoring for consumer loan applications",
    eu_ai_act_risk_class="HIGH RISK (financial services, life-affecting decisions)",
    iso_42001_controls=["A.5.2", "A.6.2.3", "A.7.3", "A.8.2"],
)

assessment.add_impact(AIImpact(
    impact_id="BIAS-001",
    description="Model may produce biased outcomes against protected groups due to historical data patterns",
    affected_parties=["Loan applicants", "Minority communities"],
    severity=Severity.MAJOR,
    likelihood=Likelihood.LIKELY,
    current_controls=["Annual fairness audit"],
    additional_controls=["Quarterly disparate impact testing", "Adversarial debiasing", "Fairness constraint in model training"],
))
assessment.add_impact(AIImpact(
    impact_id="PRIV-001",
    description="Sensitive financial and personal data processed; risk of data breach",
    affected_parties=["Loan applicants"],
    severity=Severity.CRITICAL,
    likelihood=Likelihood.UNLIKELY,
    current_controls=["AES-256 encryption at rest", "TLS in transit", "Role-based access control"],
    additional_controls=["Differential privacy for model training", "Data minimization review"],
))
assessment.add_impact(AIImpact(
    impact_id="EXPL-001",
    description="Applicants cannot understand why they were rejected (GDPR Art.22 right to explanation)",
    affected_parties=["Loan applicants", "Legal/compliance team"],
    severity=Severity.MAJOR,
    likelihood=Likelihood.ALMOST_CERTAIN,
    current_controls=[],
    additional_controls=["SHAP-based explanation API", "Human-readable adverse action notices", "Appeals process"],
))
assessment.add_impact(AIImpact(
    impact_id="RELY-001",
    description="Model performance degrades on out-of-distribution inputs (economic crisis scenarios)",
    affected_parties=["Business", "Applicants"],
    severity=Severity.MODERATE,
    likelihood=Likelihood.POSSIBLE,
    current_controls=["Monthly performance monitoring"],
    additional_controls=["Drift detection alerts", "Stress testing quarterly", "Human review fallback"],
))

assessment.print_report()

# ─── 2. ISO 42001 Control Checklist ──────────────────────────
class ControlStatus(Enum):
    NOT_IMPLEMENTED = "Not Implemented"
    PARTIAL = "Partial"
    IMPLEMENTED = "Implemented"
    NOT_APPLICABLE = "N/A"

iso_42001_controls = {
    "A.2.2": ("AI policy documented and approved", ControlStatus.IMPLEMENTED),
    "A.3.2": ("AI roles and responsibilities defined", ControlStatus.PARTIAL),
    "A.3.3": ("AI ethics board or committee established", ControlStatus.NOT_IMPLEMENTED),
    "A.5.2": ("AI impact assessment conducted", ControlStatus.IMPLEMENTED),
    "A.6.2.3": ("Fairness and bias testing performed", ControlStatus.PARTIAL),
    "A.7.2": ("Data quality assessment completed", ControlStatus.IMPLEMENTED),
    "A.7.3": ("Data bias assessment performed", ControlStatus.PARTIAL),
    "A.8.2": ("User transparency documentation provided", ControlStatus.NOT_IMPLEMENTED),
    "A.9.4": ("Misuse prevention controls in place", ControlStatus.PARTIAL),
    "A.10.5": ("Third-party AI supplier assessment done", ControlStatus.NOT_IMPLEMENTED),
}

print("\n\nISO 42001 Control Status:")
print(f"{'Control':<8} {'Status':<20} {'Description'}")
print("-" * 70)
for ctrl_id, (desc, status) in iso_42001_controls.items():
    flag = "✓" if status == ControlStatus.IMPLEMENTED else            "~" if status == ControlStatus.PARTIAL else            "✗" if status == ControlStatus.NOT_IMPLEMENTED else "-"
    print(f"  {flag} {ctrl_id:<6} {status.value:<20} {desc}")

implemented = sum(1 for _, (_, s) in iso_42001_controls.items() if s == ControlStatus.IMPLEMENTED)
total = sum(1 for _, (_, s) in iso_42001_controls.items() if s != ControlStatus.NOT_APPLICABLE)
print(f"\nCompliance: {implemented}/{total} controls implemented ({100*implemented//total}%)")