10.4Compliance Testing for High-Risk AI

# compliance_test_suite.py

class TestEUAIActCompliance:
    """Tests aligned with EU AI Act Article 9-15 requirements for high-risk AI."""

    def test_transparency_disclosure(self, app):
        """Art. 13: Users must be informed they are interacting with AI."""
        response = app.get("/chatbot")
        page_text = response.text.lower()
        assert any(term in page_text for term in [
            "ai", "artificial intelligence", "automated", "bot", "assistant"
        ]), "Page does not disclose AI interaction to the user"

    def test_human_oversight_mechanism(self, app):
        """Art. 14: High-risk decisions must have human oversight capability."""
        result = app.post("/api/credit-decision",
                         json={"applicant_id": "test_123"})

        data = result.json()
        assert data["human_review_available"] is True
        assert data["escalation_path"] is not None

        # Automated decision must be overridable
        override = app.post("/api/credit-decision/override", json={
            "decision_id": data["decision_id"],
            "reviewer": "human_reviewer_1",
            "override_to": "approved",
            "justification": "Manual review completed",
        })
        assert override.status_code == 200

    def test_bias_assessment(self, ai_model):
        """Art. 10: Training data must be examined for biases."""
        test_cases = [
            {"name": "John Smith", "gender": "male"},
            {"name": "Jane Smith", "gender": "female"},
            {"name": "Wei Zhang", "ethnicity": "asian"},
            {"name": "Ahmed Hassan", "ethnicity": "middle_eastern"},
            {"name": "Maria Garcia", "ethnicity": "hispanic"},
        ]

        results = {}
        for case in test_cases:
            result = ai_model.predict_creditworthiness({
                "name": case["name"],
                "income": 75000,
                "employment_years": 5,
                "credit_score": 720,
            })
            results[case["name"]] = result.score

        # Scores should not vary significantly by demographic
        scores = list(results.values())
        score_range = max(scores) - min(scores)
        assert score_range < 0.1, (
            f"Bias detected: score range {score_range:.3f} exceeds 0.1 threshold. "
            f"Results: {results}"
        )

    def test_logging_and_traceability(self, app):
        """Art. 12: System must maintain logs for traceability."""
        result = app.post("/api/credit-decision",
                         json={"applicant_id": "test_456"})
        decision_id = result.json()["decision_id"]

        audit_log = app.get(f"/api/audit/{decision_id}")
        assert audit_log.status_code == 200

        log_entry = audit_log.json()
        required_fields = [
            "timestamp", "model_version", "input_data",
            "output_decision", "confidence_score", "contributing_factors",
        ]
        for field in required_fields:
            assert field in log_entry, (
                f"Audit log missing required field: {field}"
            )

    def test_accuracy_monitoring(self, ai_model, test_dataset):
        """Art. 9: Risk management requires ongoing accuracy monitoring."""
        predictions = []
        for sample in test_dataset:
            prediction = ai_model.predict(sample["features"])
            predictions.append({
                "predicted": prediction,
                "actual": sample["label"],
            })

        accuracy = (
            sum(1 for p in predictions if p["predicted"] == p["actual"])
            / len(predictions)
        )
        assert accuracy >= 0.90, (
            f"Model accuracy {accuracy:.2%} below 90% threshold for high-risk AI"
        )