Compare commits

...
Author SHA1 Message Date
KaifAhmad1 bdd99f7924 feat(cookbook): add Regulatory Intelligence use case
Adds an end-to-end cookbook use case that turns 9 real US federal
AI-governance and cybersecurity-regulation documents into an
explainable, ontology-driven knowledge graph: ingestion, chunking,
entity/relation/triplet extraction, ontology import/generation/
evaluation (6 vendored real W3C ontologies plus SKOS taxonomy),
entity resolution, SHACL validation, deterministic reasoning, PROV-O
provenance, an Oxigraph-backed persistent RDF store, conflict
detection, temporal reasoning, SPARQL, JSON-LD, GraphRAG retrieval,
and a five-agent Decision Intelligence workflow.

Real library rough edges hit along the way (noisy extraction over
dense prose, EntityResolver's batch merge not firing, the stub
OntologyValidator, find_precedents_advanced()'s vector-store bug, and
two VectorStore/HybridSearch bugs that drop metadata or crash for
non-inmemory backends) are reported honestly in the notebook output
and README rather than hidden.
2026-08-05 00:08:03 +05:30
29 changed files with 15563 additions and 0 deletions
BIN
View File
Binary file not shown.
+25
View File
@@ -0,0 +1,25 @@
# Use Cases
Self-contained, end-to-end examples that combine multiple Semantica modules to solve a real-world problem, built from real public data and real external ontologies rather than synthetic samples. Unlike the tutorials in `introduction/` and `advanced/`, each use case is a folder, not a single notebook, with its own `data/` (real source documents plus a download script) and `ontology/` (vendored real ontologies plus a small domain extension) alongside the notebook itself.
## Available Use Cases
- **[Regulatory Intelligence](regulatory_intelligence/README.md)**. Turns 9 real U.S. federal AI-governance and cybersecurity-regulation documents (NIST AI RMF, NIST CSF 1.1/2.0, HIPAA Security Rule, Executive Order 14110, OMB M-24-10, and more) into an explainable, ontology-driven knowledge graph. Full pipeline: ingestion (`PDFParser`/`DoclingParser`), chunking (`TextSplitter`), automatic entity, relation, and triplet extraction across the corpus, ontology import, generation, and evaluation, entity resolution, graph construction (`GraphBuilder`), SHACL validation, deterministic rule-based reasoning (`Reasoner`), PROV-O provenance, a persistent RDF database (Oxigraph on disk, plus Semantica's `TripletStore` for a production server), conflict detection, temporal reasoning, SPARQL, JSON-LD, GraphRAG, and a five-agent Decision Intelligence workflow (precedent search, causal-chain interpretation, policy gating, decision audit reports). Reuses real W3C ontologies (ORG, PROV-O, SKOS, DCAT, OWL-Time, FRBR) rather than inventing new ones.
## Folder Convention
```
use_cases/<name>/
├── README.md overview, architecture, data and ontology attribution, how to run
├── data/
│ ├── download_*.py fetches real source documents from their official URLs
│ ├── raw/ the fetched documents, plus a source_manifest.json (real URLs, retrieval dates)
│ └── README.md data dictionary and source attribution
├── ontology/
│ ├── download_*.py fetches real external ontologies (vendored byte-for-byte)
│ ├── external/ the vendored real ontology files
│ ├── *.ttl small hand-authored schema extensions, aligned to the vendored ontologies
│ └── README.md
└── notebook/
└── *.ipynb the end-to-end walkthrough
```
@@ -0,0 +1,173 @@
# Regulatory Intelligence
An end-to-end Semantica pipeline that turns real U.S. federal AI-governance and cybersecurity regulations into an explainable, ontology-driven knowledge graph.
## Use case
- Federal AI-governance and cybersecurity regulations are published independently by different agencies (NIST, OMB, HHS, the Federal Reserve), with no cross-referencing between documents.
- A compliance question spanning several of them, such as "which regulations apply to an AI system in sector X," "do these two frameworks agree," or "what changed between versions," currently requires a human to read all of them and cross-reference manually.
- This notebook builds a knowledge graph that answers those questions directly, with cited evidence, computed (not narrated) conflict and diff detection, and policy-gated, auditable decisions for two sectors: healthcare and financial services.
- Scope is deliberately narrow: 9 real documents, not full corpora. See "Scope" below.
## Questions this notebook answers
- Which cybersecurity regulations apply to hospitals? Answered with hybrid GraphRAG retrieval (`AgentContext.query_with_reasoning()`).
- Which policies contradict each other? Answered with real conflict detection (`ConflictDetector`) between OMB M-24-10's binary AI risk-classification approach and NIST AI 600-1's continuous one.
- What changed between framework versions? Answered with real, document-verified temporal diffing (`TemporalVersionManager`): CSF 2.0 added the Govern function relative to CSF 1.1.
- Show every regulation related to AI transparency. Answered with a connected subgraph via SPARQL, not a flat document list.
- Can Hospital X or Bank Y deploy this AI system under current regulations? Answered with a policy-gated, precedent-aware, causally-explainable Decision Intelligence workflow.
## Pipeline
```
Real Documents (PDF / XML)
Ingestion PDFParser · DoclingParser · ingest_xml
Chunking TextSplitter (all 9 documents)
Extraction NERExtractor · RelationExtractor · TripletExtractor
Ontology Import OntologyIngestor ◄──── 6 real W3C/SPAR ontologies
│ (ORG · PROV-O · SKOS · DCAT · OWL-Time · FRBR)
Curated Requirement Clauses JSONParser
Entity Resolution EntityResolver · SimilarityCalculator
Knowledge Graph ContextGraph via GraphBuilder
├──► Ontology Generation & Evaluation OntologyGenerator · OntologyEvaluator
├──► SHACL Validation SHACLGenerator · pyshacl
├──► Deterministic Reasoning Reasoner (forward-chaining)
├──► Provenance ProvenanceManager (PROV-O)
└──► Persistent RDF Database Oxigraph (on-disk) + TripletStore (Blazegraph/Jena)
Conflict Detection · Temporal Reasoning ConflictDetector · TemporalVersionManager
SPARQL · JSON-LD Oxigraph · rdflib · RDFExporter
GraphRAG Retrieval AgentContext.query_with_reasoning()
Decision Intelligence PolicyEngine · CausalChainAnalyzer · precedent search · audit report
Explainable, evidence-backed answer
```
## What each layer demonstrates
- **Ingestion**: `PDFParser` (fast) and `DoclingParser` (layout-aware, used selectively) turn heterogeneous file formats into normalized text.
- **Chunking**: `TextSplitter` breaks every one of the 9 documents into bounded, citation-addressable units (840 chunks total in a real run).
- **Extraction**: `NERExtractor`, `RelationExtractor`, and `TripletExtractor` run fully automatic entity, relation, and triplet extraction across a representative sample from all 9 documents (287 entities, 392 relations, 390 triplets in a real run). The real, noisy output is the rationale for why this pipeline also relies on curated data for dense legal text.
- **Ontology**: `OntologyIngestor` reuses 6 real external ontologies rather than inventing new ones. `OntologyGenerator` and `OntologyEvaluator` generate and score a working ontology from the graph itself.
- **Validation**: `SHACLGenerator` and `pyshacl` validate instance data against structural constraints.
- **Reasoning**: `Reasoner` performs deterministic, rule-based forward-chaining inference, distinct from the LLM-based reasoning used later in GraphRAG. For example, it infers that a Regulation applies to a sector because one of its clauses does, without that being asserted directly.
- **Provenance**: `ProvenanceManager` emits real W3C PROV-O lineage for every fact.
- **Storage**: an Oxigraph store gives genuine on-disk RDF persistence with zero extra infrastructure, verified in a real run by closing and reopening the store from disk. `TripletStore` is Semantica's own interface to a dedicated production graph-database server (Blazegraph, Jena, RDF4J, AnzoGraph). Semantica's built-in SKOS vocabulary *management*, `OntologyEngine.list_vocabularies()`, `.list_concepts()`, and `.search_concepts()` (the same operations behind `semantica ontology skos search` on the CLI), is backed by that same server.
- **Cross-document reasoning**: `ConflictDetector` and `TemporalVersionManager` find real disagreements and diffs between frameworks.
- **Retrieval**: `AgentContext.query_with_reasoning()` implements GraphRAG, retrieval that expands across graph edges rather than text similarity alone.
- **Decision Intelligence**: `PolicyEngine`, `CausalChainAnalyzer`, precedent search, and a decision audit report treat AI-assisted decisions as first-class, queryable, explainable graph objects.
## What's real, what's schema
- **9 real documents** (`data/`): official NIST, GovInfo/Federal Register, eCFR, whitehouse.gov, and federalreserve.gov publications. See `data/README.md` for exact source URLs and retrieval dates.
- **6 real vendored ontologies** (`ontology/external/`): W3C Organization Ontology, PROV-O, SKOS, DCAT, OWL-Time, and FRBR Core (SPAR edition), fetched byte-for-byte from their official namespaces and repositories. See `ontology/README.md`.
- **Two small hand-authored schema files** (`ontology/regulatory_extension.ttl`, `ontology/skos/regulatory_taxonomy.ttl`): not data. Every term in them was verified to appear in the real source documents before being written.
- **`data/requirement_clauses.json`**: 20 citation-traceable requirement clauses, hand-curated from the real ingested text and loaded through `JSONParser` rather than an inline Python literal. The notebook's Step 3 demonstrates, with real output, why fully-automatic extraction isn't trusted for this instead.
Nothing in this use case is fabricated or LLM-generated data.
## Folder structure
```
regulatory_intelligence/
├── README.md (this file)
├── data/
│ ├── download_data.py fetches the 9 real documents
│ ├── requirement_clauses.json 20 real, citation-traceable requirement clauses
│ ├── raw/ the fetched documents, plus source_manifest.json
│ └── README.md
├── ontology/
│ ├── download_ontologies.py fetches the 6 real external ontologies
│ ├── external/ the vendored real ontology files
│ ├── regulatory_extension.ttl
│ ├── skos/regulatory_taxonomy.ttl
│ └── README.md
└── notebook/
└── regulatory_intelligence.ipynb
```
## How to run
```bash
pip install semantica[shacl] pdfplumber rdflib requests pyoxigraph jupyter
# Optional: higher-fidelity, layout-aware PDF parsing for one document in Step 1.
# Adds torch and an ML layout model; the first run downloads model weights.
pip install semantica[parse-docling]
cd data && python download_data.py && cd ..
cd ontology && python download_ontologies.py && cd ..
jupyter notebook notebook/regulatory_intelligence.ipynb
```
Or execute headlessly:
```bash
jupyter nbconvert --to notebook --execute notebook/regulatory_intelligence.ipynb
```
Step 13 persists the graph's triples to a real, on-disk Oxigraph database, then closes and reopens it to prove the data survived. That part needs no setup at all. The same step also attempts a live connection to a Blazegraph/Jena/RDF4J/AnzoGraph server through Semantica's `TripletStore`; without one running it fails fast with a clear message. To see that path succeed instead:
```bash
docker run -p 9999:9999 lyrasis/blazegraph
```
An LLM API key (for example `GROQ_API_KEY`) is optional. `AgentContext.retrieve()` always returns cited evidence regardless of whether an LLM provider is configured, so the GraphRAG step degrades gracefully to evidence-only retrieval without one.
## Runtime
This notebook covers substantially more ground than a minimal "first knowledge graph" tutorial: ingestion (including optional ML-based parsing), chunking every document, automatic extraction across the corpus, ontology import, generation, and evaluation, entity resolution, graph construction, SHACL validation, deterministic reasoning, provenance, a persistent RDF database, conflict detection, temporal diffing, SPARQL, JSON-LD, GraphRAG, and a five-agent Decision Intelligence workflow. It runs longer than a strict 30-minute cap as a result. The dataset stays small (9 documents, roughly 50 graph nodes) even though the pipeline covers a lot of ground. Without the optional Docling step it runs noticeably faster.
## Scope
Included:
- 9 real documents across AI governance (NIST AI RMF/600-1, EO 14110, OMB M-24-10) and cybersecurity (NIST CSF 1.1/2.0, HIPAA Security Rule, NIST SP 800-66) regulation, spanning healthcare and financial-services sector applications.
- 6 real vendored ontologies (ORG, PROV-O, SKOS, DCAT, OWL-Time, FRBR) plus one small hand-authored extension.
- The full pipeline described above, end to end.
Excluded, deliberately, to stay laptop-runnable:
- Full US Code / CFR ingestion (only the relevant HIPAA subpart is used).
- The full NIST SP 800 series (only SP 800-66 is used).
- Sectors beyond healthcare and financial services.
- Docling parsing for all 9 documents. It costs about 30 seconds per 10 pages on CPU, so it's used for one document to keep total runtime reasonable; the tradeoff itself is part of the lesson.
- A dedicated Blazegraph/Jena/RDF4J/AnzoGraph server. Oxigraph gives real on-disk persistence without one; the server-backed `TripletStore` path is demonstrated as a genuine connection attempt only.
## Notes on real-world library behavior
This notebook reports what the underlying tools actually do, including rough edges in the installed library version, rather than working around them quietly:
- **Extraction** (Step 3): pattern-based NER, relation, and triplet extraction over dense regulatory prose is genuinely noisy. Institution names get mislabeled and most sentences match no relation pattern. The real output is shown as the rationale for using curated data for the rest of the pipeline.
- **Entity resolution** (Step 7): `EntityResolver.resolve_entities()`'s batch merge doesn't actually merge these near-duplicate agency names in the installed version. Shown alongside the real pairwise `SimilarityCalculator` scores (0.54 to 0.80) that should drive it.
- **Ontology validation** (Step 9): the `OntologyValidator` embedded automatically in `OntologyGenerator`'s output is a placeholder in the installed version (`valid`, `consistent`, and `satisfiable` are effectively always `True`). Real structural evaluation comes from `OntologyEvaluator`, called explicitly.
- **Precedent search** (Step 19): `AgentContext.find_precedents_advanced()`'s vector-store path has an internal attribute bug and returns zero results even for a seeded, on-topic precedent. The notebook falls back to a native `ContextGraph.find_nodes()` lookup that works. Root cause traced below, under GraphRAG retrieval re-ranking: it is the same underlying gap in `VectorStore`, not a separate issue.
- **GraphRAG retrieval re-ranking** (Step 18): `ContextGraph.query_with_reasoning()`/`AgentContext.retrieve()` can log an internal `TextEmbedder` failure ("Text cannot be empty or whitespace-only") during re-ranking. Traced to its exact source: `VectorStore.store_vectors()` (`vector_store.py`, around line 499) drops the `metadata` argument when delegating to a backend that exposes `add_vectors()` but not `store_vectors()`, which includes the real FAISS backend this notebook uses for genuine ANN search. Every memory stored through `AgentContext.store()` therefore reaches FAISS with empty metadata, so `ContextRetriever._retrieve_from_vector()` recovers an empty string for `content`, and `_rank_and_merge()` embeds it. `TextEmbedder.embed_text()` correctly rejects the empty string and reports the failure to Semantica's progress tracker (visible as a `TextEmbedder` ❌ in the CLI progress table), then `VectorStore.embed()` catches it and substitutes a random fallback vector with a warning. The retrieval call still returns real results; only that one result's re-ranking score is degraded to a random vector instead of a real one. Confirmed with a standalone reproduction against the installed version, not inferred from the log line alone.
- **Hybrid search** (used internally by advanced retrieval paths): `HybridSearch.search()` (`hybrid_search.py`, around line 314) unconditionally reads `self.vector_store.vectors`, a dict `VectorStore` only creates for `backend="inmemory"`. Every other backend, including FAISS, never gets that attribute, so `HybridSearch` raises `AttributeError`, caught internally and reported to the progress tracker as a `HybridSearch` ❌. This is the same class of backend-inconsistency bug as the metadata drop above: code written against the in-memory backend's internals, applied to a `VectorStore` configured for a different, real backend.
- **Server-backed RDF database** (Step 13): `TripletStore` has no embedded or in-memory mode by design; it always dials a real server. The notebook makes a genuine connection attempt and reports the real, expected connection failure (a `BlazegraphStore` ❌ in the CLI progress table, not a bug: there is no local Blazegraph server running). `OntologyEngine`'s built-in SKOS search shares the same requirement and is demonstrated against the same connection attempt, failing for the same reason rather than a separate limitation. The Oxigraph store earlier in the same step is unaffected and persists real data regardless.
- **SKOS hierarchy validation** (Step 8): `ContextGraph` automatically runs `semantica.utils.skos.validate_skos_hierarchy()` whenever an edge is typed `skos:broader` or `skos:narrower`. Demonstrated with the real hierarchy edges extracted from `regulatory_taxonomy.ttl`, then with a deliberately cycle-forming edge that the validator correctly rejects.
None of these three are notebook bugs: they are reproducible defects in the installed Semantica version's `VectorStore`/`HybridSearch` internals (metadata dropped for non-in-memory backends) or an expected, by-design external-server requirement (`TripletStore`/Blazegraph). Each is caught internally with a safe fallback except the Blazegraph connection, which fails loudly as intended. The notebook's own entity list (Step 8) explicitly adds every SKOS concept referenced by a relationship as a named entity before the relationship is built, which avoids an unrelated, separate source of empty-content nodes: `GraphBuilder` auto-creating an unnamed placeholder the first time a node ID is seen only as a relationship target.
Extending this notebook: add a document, add its clauses to `data/requirement_clauses.json` with a verified citation. Every downstream step, including SHACL, provenance, conflict detection, SPARQL, GraphRAG, and Decision Intelligence, picks it up automatically.
@@ -0,0 +1,35 @@
# Data
Real, official U.S. federal AI-governance and cybersecurity-regulation documents. No synthetic or LLM-generated content. Run `python download_data.py` to fetch everything into `raw/`. The script fails loudly if a source has moved rather than silently substituting placeholder text.
`raw/source_manifest.json` is generated by the download script and records the exact URL, retrieval timestamp, and byte size for every file. This is what the notebook's PROV-O step cites as each requirement clause's source.
## Documents
| File | Document | Source | Sector | Parsed with |
|---|---|---|---|---|
| `nist_ai_rmf_1.0.pdf` | NIST AI Risk Management Framework (AI RMF 1.0), NIST AI 100-1 | [nvlpubs.nist.gov](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf) | Cross-sector AI governance | `PDFParser` |
| `nist_csf_1.1.pdf` | NIST Cybersecurity Framework v1.1 (Apr 2018) | [nvlpubs.nist.gov](https://nvlpubs.nist.gov/nistpubs/cswp/nist.cswp.04162018.pdf) | Cross-sector cybersecurity | `PDFParser` |
| `nist_csf_2.0.pdf` | NIST Cybersecurity Framework 2.0, CSWP 29 (Feb 2024) | [nvlpubs.nist.gov](https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf) | Cross-sector cybersecurity | `PDFParser` |
| `nist_sp800-66r2_hipaa_security.pdf` | NIST SP 800-66 Rev. 2: Implementing the HIPAA Security Rule | [nvlpubs.nist.gov](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-66r2.pdf) | Healthcare | `PDFParser` |
| `hipaa_security_rule_45cfr164_subpart_c.xml` | HIPAA Security Rule, 45 CFR Part 164 Subpart C | [eCFR versioner API](https://www.ecfr.gov/api/versioner/v1/full/2026-07-31/title-45.xml?part=164&subpart=C) | Healthcare | `ingest_xml` |
| `eo_14110_safe_secure_trustworthy_ai.pdf` | Executive Order 14110: Safe, Secure, and Trustworthy AI | [Federal Register](https://www.govinfo.gov/content/pkg/FR-2023-11-01/pdf/2023-24283.pdf) | Cross-sector AI policy | `PDFParser` |
| `omb_m24-10_ai_governance.pdf` | OMB Memorandum M-24-10 (Mar 2024) | [whitehouse.gov](https://www.whitehouse.gov/wp-content/uploads/2024/03/M-24-10-Advancing-Governance-Innovation-and-Risk-Management-for-Agency-Use-of-Artificial-Intelligence.pdf) | Cross-sector AI governance | `PDFParser` |
| `nist_ai_600-1_genai_profile.pdf` | NIST AI 600-1: Generative AI Profile (2024) | [nvlpubs.nist.gov](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf) | Cross-sector AI governance | `PDFParser` |
| `fed_compliance_plan_omb_m24-10.pdf` | Federal Reserve: Compliance Plan for OMB M-24-10 (Sep 2024) | [federalreserve.gov](https://www.federalreserve.gov/publications/files/compliance-plan-for-omb-memorandum-m-24-10-202409.pdf) | Financial services | `DoclingParser` (optional, falls back to `PDFParser`) |
The Federal Reserve document is parsed with `DoclingParser` rather than `PDFParser`: a layout-aware, ML-based converter that preserves document structure (headings, tables) as Markdown instead of flattening to plain text. In a real run it recovered 16 real headings (for example `## Overview`) from this document in about 33 seconds on CPU. It's used for one document, not all nine, because that per-page cost adds up fast. See the notebook's Step 1 for the accuracy and speed tradeoff this represents. If `docling` isn't installed, ingestion falls back to `PDFParser` automatically.
## `requirement_clauses.json`
20 requirement clauses, hand-curated from the real ingested text above. Each `text` field is a verified real substring; the notebook asserts this before trusting any of them, and loads the file via Semantica's own `JSONParser` rather than as an inline Python literal. Each entry carries `doc` (which document it's from), `sector`, `topic` (a real SKOS concept, see `../ontology/skos/regulatory_taxonomy.ttl`), `citation` (for example `"45 CFR 164.308"`), and `text` (the real matched substring).
## Notes on sourcing
- **HIPAA Security Rule** is fetched via eCFR's public [versioner API](https://www.ecfr.gov/developers/documentation/api/v1) (`/api/versioner/v1/full/{date}/title-45.xml?part=164&subpart=C`) rather than eCFR's regular web pages, which sit behind a bot-detection challenge that blocks plain HTTP clients. The API is eCFR's officially documented programmatic access path and returns the same authoritative text. The script resolves the current date dynamically via `/api/versioner/v1/titles.json`, so it keeps working as time passes.
- **Financial-services document**: the original candidate, U.S. Treasury's "Managing Artificial Intelligence-Specific Cybersecurity Risks in the Financial Services Sector," is also blocked by bot-detection at `home.treasury.gov` with no working API alternative found. It was substituted with the Federal Reserve's real, public compliance plan for OMB M-24-10, still a genuine financial-sector AI-governance document, and one that creates an actual `implements` relationship back to the OMB M-24-10 document already in this dataset.
- Every other URL returns the document directly with a plain `requests.get()` and a descriptive User-Agent. No bypass techniques were used or needed.
## Data dictionary (what the notebook extracts)
Each document is ingested as one `reg:Regulation`, which is also a `dcat:Dataset`. The notebook's Step 6 loads `reg:RequirementClause` instances from `requirement_clauses.json`, individual obligations, controls, and definitions, each carrying a `reg:sourceCitation` (for example `"45 CFR 164.308"`) pointing back to the exact real-document location it came from.
@@ -0,0 +1,152 @@
"""
Downloads the real source documents used by the Regulatory Intelligence
use case. Every URL below is an official government publication (NIST, GovInfo,
Federal Register, eCFR, whitehouse.gov, home.treasury.gov) verified at plan time.
Run:
python download_data.py
Writes each document into raw/ and a source_manifest.json recording the exact
URL and retrieval timestamp for every file: this manifest is what the
notebook's PROV-O step cites as the source of each ingested requirement clause.
If any URL has moved, this script fails loudly (HTTPError / non-2xx) rather
than silently writing placeholder content, so a broken source is caught
immediately instead of masked.
"""
import json
import sys
from datetime import datetime, timezone
from pathlib import Path
import requests
RAW_DIR = Path(__file__).parent / "raw"
HEADERS = {
"User-Agent": "Semantica-Cookbook/1.0 (+https://github.com/semantica-agi/semantica; educational use)"
}
# Each entry: (filename, url, doc_type, description)
# doc_type: "pdf" -> saved and later ingested via PDFParser
# "xml" -> saved and later ingested via WebIngestor/ContentExtractor (eCFR versioner API)
# url == "ECFR_API" is resolved dynamically in resolve_ecfr_subpart_url() below.
DOCUMENTS = [
(
"nist_ai_rmf_1.0.pdf",
"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf",
"pdf",
"NIST AI Risk Management Framework (AI RMF 1.0), NIST AI 100-1",
),
(
"nist_csf_1.1.pdf",
"https://nvlpubs.nist.gov/nistpubs/cswp/nist.cswp.04162018.pdf",
"pdf",
"NIST Cybersecurity Framework, Version 1.1 (April 2018)",
),
(
"nist_csf_2.0.pdf",
"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf",
"pdf",
"The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 2024)",
),
(
"nist_sp800-66r2_hipaa_security.pdf",
"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-66r2.pdf",
"pdf",
"NIST SP 800-66 Rev. 2: Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide",
),
(
"hipaa_security_rule_45cfr164_subpart_c.xml",
"ECFR_API", # resolved dynamically in download_ecfr_subpart() below
"xml",
"HIPAA Security Rule, 45 CFR Part 164 Subpart C (current eCFR text, via the public eCFR versioner API)",
),
(
"eo_14110_safe_secure_trustworthy_ai.pdf",
"https://www.govinfo.gov/content/pkg/FR-2023-11-01/pdf/2023-24283.pdf",
"pdf",
"Executive Order 14110: Safe, Secure, and Trustworthy Development and Use of AI (Federal Register, Nov 1, 2023)",
),
(
"omb_m24-10_ai_governance.pdf",
"https://www.whitehouse.gov/wp-content/uploads/2024/03/M-24-10-Advancing-Governance-Innovation-and-Risk-Management-for-Agency-Use-of-Artificial-Intelligence.pdf",
"pdf",
"OMB Memorandum M-24-10: Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence (March 2024)",
),
(
"nist_ai_600-1_genai_profile.pdf",
"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf",
"pdf",
"NIST AI 600-1: Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (2024)",
),
(
"fed_compliance_plan_omb_m24-10.pdf",
"https://www.federalreserve.gov/publications/files/compliance-plan-for-omb-memorandum-m-24-10-202409.pdf",
"pdf",
"Board of Governors of the Federal Reserve System: Compliance Plan for OMB Memorandum M-24-10 (September 2024)",
),
]
def resolve_ecfr_subpart_url() -> str:
"""
eCFR's regular HTML pages (www.ecfr.gov/current/...) sit behind a bot
challenge that blocks plain HTTP clients. Its public versioner API does
not, and is the officially documented way to fetch eCFR text
programmatically. This resolves the *current* date dynamically instead
of hardcoding one, so the script keeps working as time passes.
"""
titles_resp = requests.get(
"https://www.ecfr.gov/api/versioner/v1/titles.json", headers=HEADERS, timeout=30
)
titles_resp.raise_for_status()
title_45 = next(t for t in titles_resp.json()["titles"] if t["number"] == 45)
as_of = title_45["up_to_date_as_of"]
return f"https://www.ecfr.gov/api/versioner/v1/full/{as_of}/title-45.xml?part=164&subpart=C"
def download(filename: str, url: str, doc_type: str, description: str) -> dict:
print(f"Fetching {description} ...")
print(f" {url}")
response = requests.get(url, headers=HEADERS, timeout=60)
response.raise_for_status()
dest = RAW_DIR / filename
dest.write_bytes(response.content)
size_kb = len(response.content) / 1024
print(f" -> saved {dest.name} ({size_kb:.1f} KB)")
return {
"filename": filename,
"url": url,
"type": doc_type,
"description": description,
"retrieved_at": datetime.now(timezone.utc).isoformat(),
"size_bytes": len(response.content),
"status_code": response.status_code,
}
def main() -> None:
RAW_DIR.mkdir(parents=True, exist_ok=True)
manifest_entries = []
for filename, url, doc_type, description in DOCUMENTS:
if url == "ECFR_API":
url = resolve_ecfr_subpart_url()
try:
manifest_entries.append(download(filename, url, doc_type, description))
except requests.RequestException as exc:
print(f"ERROR: failed to fetch {url}: {exc}", file=sys.stderr)
raise
manifest_path = RAW_DIR / "source_manifest.json"
manifest_path.write_text(json.dumps(manifest_entries, indent=2), encoding="utf-8")
print(f"\nWrote manifest for {len(manifest_entries)} documents to {manifest_path}")
if __name__ == "__main__":
main()
@@ -0,0 +1,435 @@
<?xml version="1.0"?>
<DIV6 N="C" TYPE="SUBPART" VOLUME="2" hierarchy_metadata="{&amp;quot;path&amp;quot;:&amp;quot;/on/_SUBSTITUTE_DATE_/title-45/part-164/subpart-C&amp;quot;,&amp;quot;citation&amp;quot;:&amp;quot;45 CFR Part 164 Subpart C&amp;quot;}">
<HEAD>Subpart C&#x2014;Security Standards for the Protection of Electronic Protected Health Information</HEAD>
<AUTH>
<HED>Authority:</HED><PSPACE>42 U.S.C. 1320d-2 and 1320d-4; sec. 13401, Pub. L. 111-5, 123 Stat. 260.
</PSPACE></AUTH>
<SOURCE>
<HED>Source:</HED><PSPACE>68 FR 8376, Feb. 20, 2003, unless otherwise noted.
</PSPACE></SOURCE>
<DIV8 N="164.302" TYPE="SECTION" hierarchy_metadata="{&quot;path&quot;:&quot;/on/_SUBSTITUTE_DATE_/title-45/section-164.302&quot;,&quot;citation&quot;:&quot;45 CFR 164.302&quot;}">
<HEAD>&#xA7; 164.302 Applicability.</HEAD>
<P>A covered entity or business associate must comply with the applicable standards, implementation specifications, and requirements of this subpart with respect to electronic protected health information of a covered entity.</P>
<CITA TYPE="N">[78 FR 5693, Jan. 25, 2013]
</CITA>
</DIV8>
<DIV8 N="164.304" TYPE="SECTION" hierarchy_metadata="{&quot;path&quot;:&quot;/on/_SUBSTITUTE_DATE_/title-45/section-164.304&quot;,&quot;citation&quot;:&quot;45 CFR 164.304&quot;}">
<HEAD>&#xA7; 164.304 Definitions.</HEAD>
<P>As used in this subpart, the following terms have the following meanings:</P>
<P><I>Access</I> means the ability or the means necessary to read, write, modify, or communicate data/information or otherwise use any system resource. (This definition applies to &#x201C;access&#x201D; as used in this subpart, not as used in subparts D or E of this part.)</P>
<P><I>Administrative safeguards</I> are administrative actions, and policies and procedures, to manage the selection, development, implementation, and maintenance of security measures to protect electronic protected health information and to manage the conduct of the covered entity's or business associate's workforce in relation to the protection of that information.</P>
<P><I>Authentication</I> means the corroboration that a person is the one claimed.</P>
<P><I>Availability</I> means the property that data or information is accessible and useable upon demand by an authorized person.</P>
<P><I>Confidentiality</I> means the property that data or information is not made available or disclosed to unauthorized persons or processes.</P>
<P><I>Encryption</I> means the use of an algorithmic process to transform data into a form in which there is a low probability of assigning meaning without use of a confidential process or key.</P>
<P><I>Facility</I> means the physical premises and the interior and exterior of a building(s).</P>
<P><I>Information system</I> means an interconnected set of information resources under the same direct management control that shares common functionality. A system normally includes hardware, software, information, data, applications, communications, and people.</P>
<P><I>Integrity</I> means the property that data or information have not been altered or destroyed in an unauthorized manner.</P>
<P><I>Malicious software</I> means software, for example, a virus, designed to damage or disrupt a system.</P>
<P><I>Password</I> means confidential authentication information composed of a string of characters.</P>
<P><I>Physical safeguards</I> are physical measures, policies, and procedures to protect a covered entity's or business associate's electronic information systems and related buildings and equipment, from natural and environmental hazards, and unauthorized intrusion.</P>
<P><I>Security or Security measures</I> encompass all of the administrative, physical, and technical safeguards in an information system.</P>
<P><I>Security incident</I> means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.</P>
<P><I>Technical safeguards</I> means the technology and the policy and procedures for its use that protect electronic protected health information and control access to it.</P>
<P><I>User</I> means a person or entity with authorized access.</P>
<P><I>Workstation</I> means an electronic computing device, for example, a laptop or desktop computer, or any other device that performs similar functions, and electronic media stored in its immediate environment.</P>
<CITA TYPE="N">[68 FR 8376, Feb. 20, 2003, as amended at 74 FR 42767, Aug. 24, 2009; 78 FR 5693, Jan. 25, 2013]
</CITA>
</DIV8>
<DIV8 N="164.306" TYPE="SECTION" hierarchy_metadata="{&quot;path&quot;:&quot;/on/_SUBSTITUTE_DATE_/title-45/section-164.306&quot;,&quot;citation&quot;:&quot;45 CFR 164.306&quot;}">
<HEAD>&#xA7; 164.306 Security standards: General rules.</HEAD>
<P>(a) <I>General requirements.</I> Covered entities and business associates must do the following:</P>
<P>(1) Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits.</P>
<P>(2) Protect against any reasonably anticipated threats or hazards to the security or integrity of such information.</P>
<P>(3) Protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required under subpart E of this part.</P>
<P>(4) Ensure compliance with this subpart by its workforce.</P>
<P>(b) <I>Flexibility of approach.</I> (1) Covered entities and business associates may use any security measures that allow the covered entity or business associate to reasonably and appropriately implement the standards and implementation specifications as specified in this subpart.</P>
<P>(2) In deciding which security measures to use, a covered entity or business associate must take into account the following factors:</P>
<P>(i) The size, complexity, and capabilities of the covered entity or business associate.</P>
<P>(ii) The covered entity's or the business associate's technical infrastructure, hardware, and software security capabilities.</P>
<P>(iii) The costs of security measures.</P>
<P>(iv) The probability and criticality of potential risks to electronic protected health information.</P>
<P>(c) <I>Standards.</I> A covered entity or business associate must comply with the applicable standards as provided in this section and in &#xA7;&#xA7; 164.308, 164.310, 164.312, 164.314 and 164.316 with respect to all electronic protected health information.</P>
<P>(d) <I>Implementation specifications.</I> In this subpart:</P>
<P>(1) Implementation specifications are required or addressable. If an implementation specification is required, the word &#x201C;Required&#x201D; appears in parentheses after the title of the implementation specification. If an implementation specification is addressable, the word &#x201C;Addressable&#x201D; appears in parentheses after the title of the implementation specification.</P>
<P>(2) When a standard adopted in &#xA7; 164.308, &#xA7; 164.310, &#xA7; 164.312, &#xA7; 164.314, or &#xA7; 164.316 includes required implementation specifications, a covered entity or business associate must implement the implementation specifications.</P>
<P>(3) When a standard adopted in &#xA7; 164.308, &#xA7; 164.310, &#xA7; 164.312, &#xA7; 164.314, or &#xA7; 164.316 includes addressable implementation specifications, a covered entity or business associate must&#x2014;</P>
<P>(i) Assess whether each implementation specification is a reasonable and appropriate safeguard in its environment, when analyzed with reference to the likely contribution to protecting electronic protected health information; and</P>
<P>(ii) As applicable to the covered entity or business associate&#x2014;</P>
<P>(A) Implement the implementation specification if reasonable and appropriate; or</P>
<P>(B) If implementing the implementation specification is not reasonable and appropriate&#x2014;</P>
<P>$(<I>1</I>) Document why it would not be reasonable and appropriate to implement the implementation specification; and</P>
<P>$(<I>2</I>) Implement an equivalent alternative measure if reasonable and appropriate.</P>
<P>(e) <I>Maintenance.</I> A covered entity or business associate must review and modify the security measures implemented under this subpart as needed to continue provision of reasonable and appropriate protection of electronic protected health information, and update documentation of such security measures in accordance with &#xA7; 164.316(b)(2)(iii).</P>
<CITA TYPE="N">[68 FR 8376, Feb. 20, 2003; 68 FR 17153, Apr. 8, 2003; 78 FR 5693, Jan. 25, 2013]
</CITA>
</DIV8>
<DIV8 N="164.308" TYPE="SECTION" hierarchy_metadata="{&quot;path&quot;:&quot;/on/_SUBSTITUTE_DATE_/title-45/section-164.308&quot;,&quot;citation&quot;:&quot;45 CFR 164.308&quot;}">
<HEAD>&#xA7; 164.308 Administrative safeguards.</HEAD>
<P>(a) A covered entity or business associate must, in accordance with &#xA7; 164.306:</P>
<P>(1)(i) <I>Standard: Security management process.</I> Implement policies and procedures to prevent, detect, contain, and correct security violations.</P>
<P>(ii) <I>Implementation specifications:</I></P>
<P>(A) <I>Risk analysis (Required).</I> Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate.</P>
<P>(B) <I>Risk management (Required).</I> Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with &#xA7; 164.306(a).</P>
<P>(C) <I>Sanction policy (Required).</I> Apply appropriate sanctions against workforce members who fail to comply with the security policies and procedures of the covered entity or business associate.</P>
<P>(D) <I>Information system activity review (Required).</I> Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.</P>
<P>(2) <I>Standard: Assigned security responsibility.</I> Identify the security official who is responsible for the development and implementation of the policies and procedures required by this subpart for the covered entity or business associate.</P>
<P>(3)(i) <I>Standard: Workforce security.</I> Implement policies and procedures to ensure that all members of its workforce have appropriate access to electronic protected health information, as provided under paragraph (a)(4) of this section, and to prevent those workforce members who do not have access under paragraph (a)(4) of this section from obtaining access to electronic protected health information.</P>
<P>(ii) <I>Implementation specifications:</I></P>
<P>(A) <I>Authorization and/or supervision (Addressable).</I> Implement procedures for the authorization and/or supervision of workforce members who work with electronic protected health information or in locations where it might be accessed.</P>
<P>(B) <I>Workforce clearance procedure (Addressable).</I> Implement procedures to determine that the access of a workforce member to electronic protected health information is appropriate.</P>
<P>(C) <I>Termination procedures (Addressable).</I> Implement procedures for terminating access to electronic protected health information when the employment of, or other arrangement with, a workforce member ends or as required by determinations made as specified in paragraph (a)(3)(ii)(B) of this section.</P>
<P>(4)(i) <I>Standard: Information access management.</I> Implement policies and procedures for authorizing access to electronic protected health information that are consistent with the applicable requirements of subpart E of this part.</P>
<P>(ii) <I>Implementation specifications:</I></P>
<P>(A) <I>Isolating health care clearinghouse functions (Required).</I> If a health care clearinghouse is part of a larger organization, the clearinghouse must implement policies and procedures that protect the electronic protected health information of the clearinghouse from unauthorized access by the larger organization.</P>
<P>(B) <I>Access authorization (Addressable).</I> Implement policies and procedures for granting access to electronic protected health information, for example, through access to a workstation, transaction, program, process, or other mechanism.</P>
<P>(C) <I>Access establishment and modification (Addressable).</I> Implement policies and procedures that, based upon the covered entity's or the business associate's access authorization policies, establish, document, review, and modify a user's right of access to a workstation, transaction, program, or process.</P>
<P>(5)(i) <I>Standard: Security awareness and training.</I> Implement a security awareness and training program for all members of its workforce (including management).</P>
<P>(ii) <I>Implementation specifications.</I> Implement:</P>
<P>(A) <I>Security reminders (Addressable).</I> Periodic security updates.</P>
<P>(B) <I>Protection from malicious software (Addressable).</I> Procedures for guarding against, detecting, and reporting malicious software.</P>
<P>(C) <I>Log-in monitoring (Addressable).</I> Procedures for monitoring log-in attempts and reporting discrepancies.</P>
<P>(D) <I>Password management (Addressable).</I> Procedures for creating, changing, and safeguarding passwords.</P>
<P>(6)(i) <I>Standard: Security incident procedures.</I> Implement policies and procedures to address security incidents.</P>
<P>(ii) <I>Implementation specification: Response and reporting (Required).</I> Identify and respond to suspected or known security incidents; mitigate, to the extent practicable, harmful effects of security incidents that are known to the covered entity or business associate; and document security incidents and their outcomes.</P>
<P>(7)(i) <I>Standard: Contingency plan.</I> Establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages systems that contain electronic protected health information.</P>
<P>(ii) <I>Implementation specifications:</I></P>
<P>(A) <I>Data backup plan (Required).</I> Establish and implement procedures to create and maintain retrievable exact copies of electronic protected health information.</P>
<P>(B) <I>Disaster recovery plan (Required).</I> Establish (and implement as needed) procedures to restore any loss of data.</P>
<P>(C) <I>Emergency mode operation plan (Required).</I> Establish (and implement as needed) procedures to enable continuation of critical business processes for protection of the security of electronic protected health information while operating in emergency mode.</P>
<P>(D) <I>Testing and revision procedures (Addressable).</I> Implement procedures for periodic testing and revision of contingency plans.</P>
<P>(E) <I>Applications and data criticality analysis (Addressable).</I> Assess the relative criticality of specific applications and data in support of other contingency plan components.</P>
<P>(8) <I>Standard: Evaluation.</I> Perform a periodic technical and nontechnical evaluation, based initially upon the standards implemented under this rule and, subsequently, in response to environmental or operational changes affecting the security of electronic protected health information, that establishes the extent to which a covered entity's or business associate's security policies and procedures meet the requirements of this subpart.</P>
<P>(b)(1) <I>Business associate contracts and other arrangements.</I> A covered entity may permit a business associate to create, receive, maintain, or transmit electronic protected health information on the covered entity's behalf only if the covered entity obtains satisfactory assurances, in accordance with &#xA7; 164.314(a), that the business associate will appropriately safeguard the information. A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor.</P>
<P>(2) A business associate may permit a business associate that is a subcontractor to create, receive, maintain, or transmit electronic protected health information on its behalf only if the business associate obtains satisfactory assurances, in accordance with &#xA7; 164.314(a), that the subcontractor will appropriately safeguard the information.</P>
<P>(3) <I>Implementation specifications: Written contract or other arrangement (Required).</I> Document the satisfactory assurances required by paragraph (b)(1) or (b)(2) of this section through a written contract or other arrangement with the business associate that meets the applicable requirements of &#xA7; 164.314(a).</P>
<CITA TYPE="N">[68 FR 8376, Feb. 20, 2003, as amended at 78 FR 5694, Jan. 25, 2013]
</CITA>
</DIV8>
<DIV8 N="164.310" TYPE="SECTION" hierarchy_metadata="{&quot;path&quot;:&quot;/on/_SUBSTITUTE_DATE_/title-45/section-164.310&quot;,&quot;citation&quot;:&quot;45 CFR 164.310&quot;}">
<HEAD>&#xA7; 164.310 Physical safeguards.</HEAD>
<P>A covered entity or business associate must, in accordance with &#xA7; 164.306:</P>
<P>(a)(1) <I>Standard: Facility access controls.</I> Implement policies and procedures to limit physical access to its electronic information systems and the facility or facilities in which they are housed, while ensuring that properly authorized access is allowed.</P>
<P>(2) <I>Implementation specifications:</I></P>
<P>(i) <I>Contingency operations (Addressable).</I> Establish (and implement as needed) procedures that allow facility access in support of restoration of lost data under the disaster recovery plan and emergency mode operations plan in the event of an emergency.</P>
<P>(ii) <I>Facility security plan (Addressable).</I> Implement policies and procedures to safeguard the facility and the equipment therein from unauthorized physical access, tampering, and theft.</P>
<P>(iii) <I>Access control and validation procedures (Addressable).</I> Implement procedures to control and validate a person's access to facilities based on their role or function, including visitor control, and control of access to software programs for testing and revision.</P>
<P>(iv) <I>Maintenance records (Addressable).</I> Implement policies and procedures to document repairs and modifications to the physical components of a facility which are related to security (for example, hardware, walls, doors, and locks).</P>
<P>(b) <I>Standard: Workstation use.</I> Implement policies and procedures that specify the proper functions to be performed, the manner in which those functions are to be performed, and the physical attributes of the surroundings of a specific workstation or class of workstation that can access electronic protected health information.</P>
<P>(c) <I>Standard: Workstation security.</I> Implement physical safeguards for all workstations that access electronic protected health information, to restrict access to authorized users.</P>
<P>(d)(1) <I>Standard: Device and media controls.</I> Implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain electronic protected health information into and out of a facility, and the movement of these items within the facility.</P>
<P>(2) <I>Implementation specifications:</I></P>
<P>(i) <I>Disposal (Required).</I> Implement policies and procedures to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored.</P>
<P>(ii) <I>Media re-use (Required).</I> Implement procedures for removal of electronic protected health information from electronic media before the media are made available for re-use.</P>
<P>(iii) <I>Accountability (Addressable).</I> Maintain a record of the movements of hardware and electronic media and any person responsible therefore.</P>
<P>(iv) <I>Data backup and storage (Addressable).</I> Create a retrievable, exact copy of electronic protected health information, when needed, before movement of equipment.</P>
<CITA TYPE="N">[68 FR 8376, Feb. 20, 2003, as amended at 78 FR 5694, Jan. 25, 2013]
</CITA>
</DIV8>
<DIV8 N="164.312" TYPE="SECTION" hierarchy_metadata="{&quot;path&quot;:&quot;/on/_SUBSTITUTE_DATE_/title-45/section-164.312&quot;,&quot;citation&quot;:&quot;45 CFR 164.312&quot;}">
<HEAD>&#xA7; 164.312 Technical safeguards.</HEAD>
<P>A covered entity or business associate must, in accordance with &#xA7; 164.306:</P>
<P>(a)(1) <I>Standard: Access control.</I> Implement technical policies and procedures for electronic information systems that maintain electronic protected health information to allow access only to those persons or software programs that have been granted access rights as specified in &#xA7; 164.308(a)(4).</P>
<P>(2) <I>Implementation specifications:</I></P>
<P>(i) <I>Unique user identification (Required).</I> Assign a unique name and/or number for identifying and tracking user identity.</P>
<P>(ii) <I>Emergency access procedure (Required).</I> Establish (and implement as needed) procedures for obtaining necessary electronic protected health information during an emergency.</P>
<P>(iii) <I>Automatic logoff (Addressable).</I> Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity.</P>
<P>(iv) <I>Encryption and decryption (Addressable).</I> Implement a mechanism to encrypt and decrypt electronic protected health information.</P>
<P>(b) <I>Standard: Audit controls.</I> Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.</P>
<P>(c)(1) <I>Standard: Integrity.</I> Implement policies and procedures to protect electronic protected health information from improper alteration or destruction.</P>
<P>(2) <I>Implementation specification: Mechanism to authenticate electronic protected health information (Addressable).</I> Implement electronic mechanisms to corroborate that electronic protected health information has not been altered or destroyed in an unauthorized manner.</P>
<P>(d) <I>Standard: Person or entity authentication.</I> Implement procedures to verify that a person or entity seeking access to electronic protected health information is the one claimed.</P>
<P>(e)(1) <I>Standard: Transmission security.</I> Implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network.</P>
<P>(2) <I>Implementation specifications:</I></P>
<P>(i) <I>Integrity controls (Addressable).</I> Implement security measures to ensure that electronically transmitted electronic protected health information is not improperly modified without detection until disposed of.</P>
<P>(ii) <I>Encryption (Addressable).</I> Implement a mechanism to encrypt electronic protected health information whenever deemed appropriate.</P>
<CITA TYPE="N">[68 FR 8376, Feb. 20, 2003, as amended at 78 FR 5694, Jan. 25, 2013]
</CITA>
</DIV8>
<DIV8 N="164.314" TYPE="SECTION" hierarchy_metadata="{&quot;path&quot;:&quot;/on/_SUBSTITUTE_DATE_/title-45/section-164.314&quot;,&quot;citation&quot;:&quot;45 CFR 164.314&quot;}">
<HEAD>&#xA7; 164.314 Organizational requirements.</HEAD>
<P>(a)(1) <I>Standard: Business associate contracts or other arrangements.</I> The contract or other arrangement required by &#xA7; 164.308(b)(3) must meet the requirements of paragraph (a)(2)(i), (a)(2)(ii), or (a)(2)(iii) of this section, as applicable.</P>
<P>(2) <I>Implementation specifications (Required)</I>&#x2014;(i) <I>Business associate contracts.</I> The contract must provide that the business associate will&#x2014;</P>
<P>(A) Comply with the applicable requirements of this subpart;</P>
<P>(B) In accordance with &#xA7; 164.308(b)(2), ensure that any subcontractors that create, receive, maintain, or transmit electronic protected health information on behalf of the business associate agree to comply with the applicable requirements of this subpart by entering into a contract or other arrangement that complies with this section; and</P>
<P>(C) Report to the covered entity any security incident of which it becomes aware, including breaches of unsecured protected health information as required by &#xA7; 164.410.</P>
<P>(ii) <I>Other arrangements.</I> The covered entity is in compliance with paragraph (a)(1) of this section if it has another arrangement in place that meets the requirements of &#xA7; 164.504(e)(3).</P>
<P>(iii) <I>Business associate contracts with subcontractors.</I> The requirements of paragraphs (a)(2)(i) and (a)(2)(ii) of this section apply to the contract or other arrangement between a business associate and a subcontractor required by &#xA7; 164.308(b)(4) in the same manner as such requirements apply to contracts or other arrangements between a covered entity and business associate.</P>
<P>(b)(1) <I>Standard: Requirements for group health plans.</I> Except when the only electronic protected health information disclosed to a plan sponsor is disclosed pursuant to &#xA7; 164.504(f)(1)(ii) or (iii), or as authorized under &#xA7; 164.508, a group health plan must ensure that its plan documents provide that the plan sponsor will reasonably and appropriately safeguard electronic protected health information created, received, maintained, or transmitted to or by the plan sponsor on behalf of the group health plan.</P>
<P>(2) <I>Implementation specifications (Required).</I> The plan documents of the group health plan must be amended to incorporate provisions to require the plan sponsor to&#x2014;</P>
<P>(i) Implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information that it creates, receives, maintains, or transmits on behalf of the group health plan;</P>
<P>(ii) Ensure that the adequate separation required by &#xA7; 164.504(f)(2)(iii) is supported by reasonable and appropriate security measures;</P>
<P>(iii) Ensure that any agent to whom it provides this information agrees to implement reasonable and appropriate security measures to protect the information; and</P>
<P>(iv) Report to the group health plan any security incident of which it becomes aware.</P>
<CITA TYPE="N">[68 FR 8376, Feb. 20, 2003, as amended at 78 FR 5694, Jan. 25, 2013; 78 FR 34266, June 7, 2013]
</CITA>
</DIV8>
<DIV8 N="164.316" TYPE="SECTION" hierarchy_metadata="{&quot;path&quot;:&quot;/on/_SUBSTITUTE_DATE_/title-45/section-164.316&quot;,&quot;citation&quot;:&quot;45 CFR 164.316&quot;}">
<HEAD>&#xA7; 164.316 Policies and procedures and documentation requirements.</HEAD>
<P>A covered entity or business associate must, in accordance with &#xA7; 164.306:</P>
<P>(a) <I>Standard: Policies and procedures.</I> Implement reasonable and appropriate policies and procedures to comply with the standards, implementation specifications, or other requirements of this subpart, taking into account those factors specified in &#xA7; 164.306(b)(2)(i), (ii), (iii), and (iv). This standard is not to be construed to permit or excuse an action that violates any other standard, implementation specification, or other requirements of this subpart. A covered entity or business associate may change its policies and procedures at any time, provided that the changes are documented and are implemented in accordance with this subpart.</P>
<P>(b)(1) <I>Standard: Documentation.</I> (i) Maintain the policies and procedures implemented to comply with this subpart in written (which may be electronic) form; and</P>
<P>(ii) If an action, activity or assessment is required by this subpart to be documented, maintain a written (which may be electronic) record of the action, activity, or assessment.</P>
<P>(2) <I>Implementation specifications:</I></P>
<P>(i) <I>Time limit (Required).</I> Retain the documentation required by paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later.</P>
<P>(ii) <I>Availability (Required).</I> Make documentation available to those persons responsible for implementing the procedures to which the documentation pertains.</P>
<P>(iii) <I>Updates (Required).</I> Review documentation periodically, and update as needed, in response to environmental or operational changes affecting the security of the electronic protected health information.</P>
<CITA TYPE="N">[68 FR 8376, Feb. 20, 2003, as amended at 78 FR 5695, Jan. 25, 2013]
</CITA>
</DIV8>
<DIV8 N="164.318" TYPE="SECTION" hierarchy_metadata="{&quot;path&quot;:&quot;/on/_SUBSTITUTE_DATE_/title-45/section-164.318&quot;,&quot;citation&quot;:&quot;45 CFR 164.318&quot;}">
<HEAD>&#xA7; 164.318 Compliance dates for the initial implementation of the security standards.</HEAD>
<P>(a) <I>Health plan.</I> (1) A health plan that is not a small health plan must comply with the applicable requirements of this subpart no later than April 20, 2005.</P>
<P>(2) A small health plan must comply with the applicable requirements of this subpart no later than April 20, 2006.</P>
<P>(b) <I>Health care clearinghouse.</I> A health care clearinghouse must comply with the applicable requirements of this subpart no later than April 20, 2005.</P>
<P>(c) <I>Health care provider.</I> A covered health care provider must comply with the applicable requirements of this subpart no later than April 20, 2005.</P>
</DIV8>
<DIV9 N="Appendix A to Subpart C of Part 164" TYPE="APPENDIX" hierarchy_metadata="{&quot;path&quot;:&quot;/on/_SUBSTITUTE_DATE_/title-45/part-164/appendix-Appendix A to Subpart C of Part 164&quot;,&quot;citation&quot;:&quot;Appendix A to Subpart C of Part 164, Title 45&quot;}">
<HEAD>Appendix A to Subpart C of Part 164&#x2014;Security Standards: Matrix
</HEAD>
<DIV width="100%"><DIV class="gpotbl_div">
<TABLE border="1" cellpadding="1" cellspacing="1" class="gpo_table" frame="void" width="100%">
<THEAD>
<TR>
<TH class="center border-top-single border-bottom-single border-right-single">Standards</TH>
<TH class="center border-top-single border-bottom-single border-right-single">Sections</TH>
<TH class="center border-top-single border-bottom-single">Implementation Specifications (R) = Required, (A) = Addressable</TH>
</TR>
</THEAD>
<TBODY>
<TR>
<TD colspan="3" class="center border-bottom-single"><strong class="minor-caps">Administrative Safeguards</strong>
</TD>
</TR>
<TR>
<TD class="left border-right-single">Security Management Process</TD>
<TD class="left border-right-single">164.308(a)(1)</TD>
<TD class="left">Risk Analysis (R)</TD>
</TR>
<TR>
<TD class="left border-right-single"> </TD>
<TD class="left border-right-single"/>
<TD class="left">Risk Management (R)</TD>
</TR>
<TR>
<TD class="left border-right-single"> </TD>
<TD class="left border-right-single"/>
<TD class="left">Sanction Policy (R)</TD>
</TR>
<TR>
<TD class="left border-right-single"> </TD>
<TD class="left border-right-single"/>
<TD class="left">Information System Activity Review (R)</TD>
</TR>
<TR>
<TD class="left border-right-single">Assigned Security Responsibility</TD>
<TD class="left border-right-single">164.308(a)(2)</TD>
<TD class="left">(R)</TD>
</TR>
<TR>
<TD class="left border-right-single">Workforce Security</TD>
<TD class="left border-right-single">164.308(a)(3)</TD>
<TD class="left">Authorization and/or Supervision (A)</TD>
</TR>
<TR>
<TD class="left border-right-single"/>
<TD class="left border-right-single"/>
<TD class="left">Workforce Clearance Procedure</TD>
</TR>
<TR>
<TD class="left border-right-single"> </TD>
<TD class="left border-right-single"/>
<TD class="left">Termination Procedures (A)</TD>
</TR>
<TR>
<TD class="left border-right-single">Information Access Management</TD>
<TD class="left border-right-single">164.308(a)(4)</TD>
<TD class="left">Isolating Health care Clearinghouse Function (R)</TD>
</TR>
<TR>
<TD class="left border-right-single"> </TD>
<TD class="left border-right-single"/>
<TD class="left">Access Authorization (A)</TD>
</TR>
<TR>
<TD class="left border-right-single"> </TD>
<TD class="left border-right-single"/>
<TD class="left">Access Establishment and Modification (A)</TD>
</TR>
<TR>
<TD class="left border-right-single">Security Awareness and Training</TD>
<TD class="left border-right-single">164.308(a)(5)</TD>
<TD class="left">Security Reminders (A)</TD>
</TR>
<TR>
<TD class="left border-right-single"> </TD>
<TD class="left border-right-single"/>
<TD class="left">Protection from Malicious Software (A)</TD>
</TR>
<TR>
<TD class="left border-right-single"> </TD>
<TD class="left border-right-single"/>
<TD class="left">Log-in Monitoring (A)</TD>
</TR>
<TR>
<TD class="left border-right-single"> </TD>
<TD class="left border-right-single"/>
<TD class="left">Password Management (A)</TD>
</TR>
<TR>
<TD class="left border-right-single">Security Incident Procedures</TD>
<TD class="left border-right-single">164.308(a)(6)</TD>
<TD class="left">Response and Reporting (R)</TD>
</TR>
<TR>
<TD class="left border-right-single">Contingency Plan</TD>
<TD class="left border-right-single">164.308(a)(7)</TD>
<TD class="left">Data Backup Plan (R)</TD>
</TR>
<TR>
<TD class="left border-right-single"> </TD>
<TD class="left border-right-single"/>
<TD class="left">Disaster Recovery Plan (R)</TD>
</TR>
<TR>
<TD class="left border-right-single"> </TD>
<TD class="left border-right-single"/>
<TD class="left">Emergency Mode Operation Plan (R)</TD>
</TR>
<TR>
<TD class="left border-right-single"> </TD>
<TD class="left border-right-single"/>
<TD class="left">Testing and Revision Procedure (A)</TD>
</TR>
<TR>
<TD class="left border-right-single"> </TD>
<TD class="left border-right-single"/>
<TD class="left">Applications and Data Criticality Analysis (A)</TD>
</TR>
<TR>
<TD class="left border-right-single">Evaluation</TD>
<TD class="left border-right-single">164.308(a)(8)</TD>
<TD class="left">(R)</TD>
</TR>
<TR>
<TD class="left border-bottom-single border-right-single">Business Associate Contracts and Other Arrangement</TD>
<TD class="left border-bottom-single border-right-single">164.308(b)(1)</TD>
<TD class="left border-bottom-single">Written Contract or Other Arrangement (R)</TD>
</TR>
<TR>
<TD colspan="3" class="center border-bottom-single"><strong class="minor-caps">Physical Safeguards</strong>
</TD>
</TR>
<TR>
<TD class="left border-right-single">Facility Access Controls</TD>
<TD class="left border-right-single">164.310(a)(1)</TD>
<TD class="left">Contingency Operations (A)</TD>
</TR>
<TR>
<TD class="left border-right-single"> </TD>
<TD class="left border-right-single"/>
<TD class="left">Facility Security Plan (A)</TD>
</TR>
<TR>
<TD class="left border-right-single"> </TD>
<TD class="left border-right-single"/>
<TD class="left">Access Control and Validation Procedures (A)</TD>
</TR>
<TR>
<TD class="left border-right-single"> </TD>
<TD class="left border-right-single"/>
<TD class="left">Maintenance Records (A)</TD>
</TR>
<TR>
<TD class="left border-right-single">Workstation Use</TD>
<TD class="left border-right-single">164.310(b)</TD>
<TD class="left">(R)</TD>
</TR>
<TR>
<TD class="left border-right-single">Workstation Security</TD>
<TD class="left border-right-single">164.310(c)</TD>
<TD class="left">(R)</TD>
</TR>
<TR>
<TD class="left border-right-single">Device and Media Controls</TD>
<TD class="left border-right-single">164.310(d)(1)</TD>
<TD class="left">Disposal (R)</TD>
</TR>
<TR>
<TD class="left border-right-single"> </TD>
<TD class="left border-right-single"/>
<TD class="left">Media Re-use (R)</TD>
</TR>
<TR>
<TD class="left border-right-single"> </TD>
<TD class="left border-right-single"/>
<TD class="left">Accountability (A)</TD>
</TR>
<TR>
<TD class="left border-bottom-single border-right-single"> </TD>
<TD class="left border-bottom-single border-right-single"> </TD>
<TD class="left border-bottom-single">Data Backup and Storage (A)</TD>
</TR>
<TR>
<TD colspan="3" class="center border-bottom-single"><strong class="minor-caps">Technical Safeguards</strong> (see &#xA7; 164.312)</TD>
</TR>
<TR>
<TD class="left border-right-single">Access Control</TD>
<TD class="left border-right-single">164.312(a)(1)</TD>
<TD class="left">Unique User Identification (R)</TD>
</TR>
<TR>
<TD class="left border-right-single"> </TD>
<TD class="left border-right-single"/>
<TD class="left">Emergency Access Procedure (R)</TD>
</TR>
<TR>
<TD class="left border-right-single"> </TD>
<TD class="left border-right-single"/>
<TD class="left">Automatic Logoff (A)</TD>
</TR>
<TR>
<TD class="left border-right-single"> </TD>
<TD class="left border-right-single"/>
<TD class="left">Encryption and Decryption (A)</TD>
</TR>
<TR>
<TD class="left border-right-single">Audit Controls</TD>
<TD class="left border-right-single">164.312(b)</TD>
<TD class="left">(R)</TD>
</TR>
<TR>
<TD class="left border-right-single">Integrity</TD>
<TD class="left border-right-single">164.312(c)(1)</TD>
<TD class="left">Mechanism to Authenticate Electronic Protected Health Information (A)</TD>
</TR>
<TR>
<TD class="left border-right-single">Person or Entity Authentication</TD>
<TD class="left border-right-single">164.312(d)</TD>
<TD class="left">(R)</TD>
</TR>
<TR>
<TD class="left border-right-single">Transmission Security</TD>
<TD class="left border-right-single">164.312(e)(1)</TD>
<TD class="left">Integrity Controls (A)</TD>
</TR>
<TR>
<TD class="left border-bottom-single border-right-single"> </TD>
<TD class="left border-bottom-single border-right-single"/>
<TD class="left border-bottom-single">Encryption (A)</TD>
</TR>
</TBODY>
</TABLE>
</DIV></DIV>
</DIV9>
</DIV6>
@@ -0,0 +1,83 @@
[
{
"filename": "nist_ai_rmf_1.0.pdf",
"url": "https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf",
"type": "pdf",
"description": "NIST AI Risk Management Framework (AI RMF 1.0), NIST AI 100-1",
"retrieved_at": "2026-08-04T17:51:30.539157+00:00",
"size_bytes": 1946127,
"status_code": 200
},
{
"filename": "nist_csf_1.1.pdf",
"url": "https://nvlpubs.nist.gov/nistpubs/cswp/nist.cswp.04162018.pdf",
"type": "pdf",
"description": "NIST Cybersecurity Framework, Version 1.1 (April 2018)",
"retrieved_at": "2026-08-04T17:51:33.569305+00:00",
"size_bytes": 1062822,
"status_code": 200
},
{
"filename": "nist_csf_2.0.pdf",
"url": "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf",
"type": "pdf",
"description": "The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 2024)",
"retrieved_at": "2026-08-04T17:51:36.871034+00:00",
"size_bytes": 1518858,
"status_code": 200
},
{
"filename": "nist_sp800-66r2_hipaa_security.pdf",
"url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-66r2.pdf",
"type": "pdf",
"description": "NIST SP 800-66 Rev. 2: Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide",
"retrieved_at": "2026-08-04T17:51:40.264756+00:00",
"size_bytes": 1626188,
"status_code": 200
},
{
"filename": "hipaa_security_rule_45cfr164_subpart_c.xml",
"url": "https://www.ecfr.gov/api/versioner/v1/full/2026-07-31/title-45.xml?part=164&subpart=C",
"type": "xml",
"description": "HIPAA Security Rule, 45 CFR Part 164 Subpart C (current eCFR text, via the public eCFR versioner API)",
"retrieved_at": "2026-08-04T17:51:42.108482+00:00",
"size_bytes": 37860,
"status_code": 200
},
{
"filename": "eo_14110_safe_secure_trustworthy_ai.pdf",
"url": "https://www.govinfo.gov/content/pkg/FR-2023-11-01/pdf/2023-24283.pdf",
"type": "pdf",
"description": "Executive Order 14110: Safe, Secure, and Trustworthy Development and Use of AI (Federal Register, Nov 1, 2023)",
"retrieved_at": "2026-08-04T17:51:44.635684+00:00",
"size_bytes": 437813,
"status_code": 200
},
{
"filename": "omb_m24-10_ai_governance.pdf",
"url": "https://www.whitehouse.gov/wp-content/uploads/2024/03/M-24-10-Advancing-Governance-Innovation-and-Risk-Management-for-Agency-Use-of-Artificial-Intelligence.pdf",
"type": "pdf",
"description": "OMB Memorandum M-24-10: Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence (March 2024)",
"retrieved_at": "2026-08-04T17:51:45.590508+00:00",
"size_bytes": 530549,
"status_code": 200
},
{
"filename": "nist_ai_600-1_genai_profile.pdf",
"url": "https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf",
"type": "pdf",
"description": "NIST AI 600-1: Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (2024)",
"retrieved_at": "2026-08-04T17:51:50.286354+00:00",
"size_bytes": 1174643,
"status_code": 200
},
{
"filename": "fed_compliance_plan_omb_m24-10.pdf",
"url": "https://www.federalreserve.gov/publications/files/compliance-plan-for-omb-memorandum-m-24-10-202409.pdf",
"type": "pdf",
"description": "Board of Governors of the Federal Reserve System: Compliance Plan for OMB Memorandum M-24-10 (September 2024)",
"retrieved_at": "2026-08-04T17:51:51.144492+00:00",
"size_bytes": 1092733,
"status_code": 200
}
]
@@ -0,0 +1,44 @@
{
"requirement_clauses": [
{"id": "csf2_govern", "doc": "nist_csf_2.0", "sector": "Cross-sector", "topic": "Govern",
"citation": "NIST CSWP 29 (CSF 2.0), Govern Function", "text": "GOVERN addresses an understanding"},
{"id": "csf2_identify", "doc": "nist_csf_2.0", "sector": "Cross-sector", "topic": "Identify",
"citation": "NIST CSWP 29 (CSF 2.0), Identify Function", "text": "IDENTIFY"},
{"id": "csf11_identify", "doc": "nist_csf_1.1", "sector": "Cross-sector", "topic": "Identify",
"citation": "NIST CSWP 04162018 (CSF 1.1), Identify Function", "text": "Identify"},
{"id": "csf11_protect", "doc": "nist_csf_1.1", "sector": "Cross-sector", "topic": "Protect",
"citation": "NIST CSWP 04162018 (CSF 1.1), Protect Function", "text": "Protect"},
{"id": "hipaa_admin_safeguards", "doc": "hipaa_45cfr164_subpart_c", "sector": "Healthcare", "topic": "Administrative Safeguards",
"citation": "45 CFR 164.308", "text": "Administrative safeguards"},
{"id": "hipaa_technical_safeguards", "doc": "hipaa_45cfr164_subpart_c", "sector": "Healthcare", "topic": "Technical Safeguards",
"citation": "45 CFR 164.312", "text": "Technical safeguards"},
{"id": "hipaa_general_rules", "doc": "hipaa_45cfr164_subpart_c", "sector": "Healthcare", "topic": "Technical Safeguards",
"citation": "45 CFR 164.306", "text": "Ensure the confidentiality, integrity, and availability of all electronic protected health information"},
{"id": "sp80066_scope", "doc": "nist_sp800-66r2", "sector": "Healthcare", "topic": "Administrative Safeguards",
"citation": "NIST SP 800-66r2", "text": "HIPAA Security Rule"},
{"id": "eo14110_safety", "doc": "eo_14110", "sector": "Cross-sector", "topic": "Risk Classification",
"citation": "Executive Order 14110", "text": "Safety and Security"},
{"id": "eo14110_privacy", "doc": "eo_14110", "sector": "Cross-sector", "topic": "Transparency",
"citation": "Executive Order 14110", "text": "Privacy"},
{"id": "omb_transparency", "doc": "omb_m24-10", "sector": "Cross-sector", "topic": "Transparency",
"citation": "OMB Memorandum M-24-10 Section 3", "text": "Transparency"},
{"id": "omb_rights_impacting", "doc": "omb_m24-10", "sector": "Cross-sector", "topic": "Rights-Impacting AI",
"citation": "OMB Memorandum M-24-10 Section 5(b)", "text": "rights-impacting"},
{"id": "omb_safety_impacting", "doc": "omb_m24-10", "sector": "Cross-sector", "topic": "Safety-Impacting AI",
"citation": "OMB Memorandum M-24-10 Section 5(b)", "text": "safety-impacting"},
{"id": "omb_caio", "doc": "omb_m24-10", "sector": "Cross-sector", "topic": "Chief AI Officer",
"citation": "OMB Memorandum M-24-10 Section 4", "text": "Chief AI Officer"},
{"id": "airmf_govern", "doc": "nist_ai_rmf_1.0", "sector": "Cross-sector", "topic": "Govern (AI RMF)",
"citation": "NIST AI 100-1 (AI RMF 1.0), Govern Function", "text": "GOVERN"},
{"id": "airmf_map", "doc": "nist_ai_rmf_1.0", "sector": "Cross-sector", "topic": "Map",
"citation": "NIST AI 100-1 (AI RMF 1.0), Map Function", "text": "MAP"},
{"id": "ai600_content_provenance", "doc": "nist_ai_600-1", "sector": "Cross-sector", "topic": "Content Provenance",
"citation": "NIST AI 600-1", "text": "Content Provenance"},
{"id": "ai600_confabulation", "doc": "nist_ai_600-1", "sector": "Cross-sector", "topic": "Confabulation",
"citation": "NIST AI 600-1", "text": "confabulation"},
{"id": "fed_caio", "doc": "fed_compliance_m24-10", "sector": "Financial Services", "topic": "Chief AI Officer",
"citation": "Federal Reserve Compliance Plan for OMB M-24-10", "text": "CAIO"},
{"id": "fed_financial", "doc": "fed_compliance_m24-10", "sector": "Financial Services", "topic": "Risk Classification",
"citation": "Federal Reserve Compliance Plan for OMB M-24-10", "text": "Financial"}
]
}
@@ -0,0 +1,29 @@
# Ontology
Six real, external ontologies are vendored byte-for-byte, with content preserved exactly as fetched and a small header comment recording the source URL and retrieval date. Nothing here is invented. Two small hand-authored files add just enough domain schema to connect them. They are schema, not data, and every term in them is grounded in text that actually appears in the 9 real documents under `../data/raw/`.
Run `python download_ontologies.py` to fetch the six external files into `external/`.
## Vendored real ontologies (`external/`)
| File | Ontology | Source | Used for |
|---|---|---|---|
| `org.ttl` | W3C Organization Ontology (ORG) | [w3.org/ns/org.ttl](https://www.w3.org/ns/org.ttl) | Modeling NIST, OMB, HHS, and the Fed as `org:Organization`; entity resolution |
| `prov-o.ttl` | W3C PROV-O | [w3.org/ns/prov.ttl](https://www.w3.org/ns/prov.ttl) | Provenance: every requirement clause traces back to its real source document |
| `skos-core.rdf` | W3C SKOS Core | [w3.org/2009/08/skos-reference/skos.rdf](https://www.w3.org/2009/08/skos-reference/skos.rdf) | The controlled vocabulary in `skos/regulatory_taxonomy.ttl` |
| `dcat.ttl` | W3C DCAT | [w3.org/ns/dcat.ttl](https://www.w3.org/ns/dcat.ttl) | Cataloging each ingested document as a `dcat:Dataset` with its real source URL |
| `time.ttl` | W3C OWL-Time | [w3.org/2006/time](https://www.w3.org/2006/time) (content-negotiated Turtle) | Modeling each requirement's effective and validity window as a formal `time:Interval` |
| `frbr.ttl` | FRBR Core (SPAR OWL 2 DL edition) | [sparontologies.github.io](https://sparontologies.github.io/frbr/current/frbr.ttl) | Modeling "the NIST Cybersecurity Framework" and "the NIST AI RMF" as an `frbr:Work` with each version as an `frbr:Expression`, for the temporal-diff step |
**Note on formats**: `skos-core.rdf` is RDF/XML, not Turtle. No stable Turtle serialization of the canonical SKOS core vocabulary is served by W3C, so the official RDF/XML file is used instead (`OntologyIngestor` supports both). Every other file is genuine Turtle, confirmed by parsing each with `rdflib` before committing.
**A note on dead ends**: several "obvious" canonical URLs for these ontologies turned out to be broken or redirect-only when actually tested. For example, `w3.org/2004/02/skos/core.ttl` returns an HTML "300 Multiple Choices" page, not Turtle, and the original OWL-Time GitHub raw URL 404s. The URLs above are the ones that were interactively verified to return real, parseable RDF before being added to `download_ontologies.py`.
## Hand-authored schema extension
- **`regulatory_extension.ttl`**: adds `reg:Regulation` (a subclass of `dcat:Dataset` and `prov:Entity`), `reg:RequirementClause` (a subclass of `prov:Entity`), and `reg:Agency` (a subclass of `org:Organization`), plus properties (`issuedBy`, `hasRequirement`, `appliesToSector`, `supersedes`, `amends`, `implements`, `conflictsWith`, `effectiveInterval`, `sourceCitation`) that connect ingested documents to the vendored ontologies above rather than duplicating what they already model.
- **`skos/regulatory_taxonomy.ttl`**: about 22 SKOS concepts. Every one is a term verified, by text-searching the real PDFs and XML before writing the file, to actually appear in a specific source document. `Govern`, `Identify`, `Protect`, `Detect`, `Respond`, and `Recover` are CSF 2.0's own six Function names. `Administrative Safeguards`, `Physical Safeguards`, `Technical Safeguards`, and `Organizational Requirements` are 45 CFR 164's own subsection headings. `Confabulation` and `Content Provenance` are NIST AI 600-1's own terms. Each concept's `skos:scopeNote` names its source.
## Why reuse instead of inventing
Every capability this use case demonstrates (organizations, provenance, taxonomy, dataset cataloging, temporal versioning) already has a mature, real W3C or W3C-affiliated ontology. Reusing them, rather than building bespoke equivalents, is both less work and a more honest demonstration of Semantica's ontology-alignment capabilities. `OntologyIngestor.ingest_ontology()` imports each file as-is, and `regulatory_extension.ttl` is intentionally the smallest possible bridge between them.
@@ -0,0 +1,134 @@
"""
Vendors the real external ontologies used by the Regulatory Intelligence
Platform use case, byte-for-byte (content), into external/. Each file is
fetched directly from its official W3C (or W3C-affiliated) namespace/
repository URL, verified interactively at implementation time: several
"obvious" canonical URLs turned out to be dead links or HTML redirect pages,
so every URL below is one that was actually confirmed to return real
Turtle/RDF-XML content before being added here.
Run:
python download_ontologies.py
Vendoring (rather than fetching at notebook run time) keeps the notebook
runnable offline after first setup and avoids notebook failures caused by
transient network issues.
"""
import sys
from datetime import datetime, timezone
from pathlib import Path
import requests
EXTERNAL_DIR = Path(__file__).parent / "external"
HEADERS_TURTLE = {
"User-Agent": "Semantica-Cookbook/1.0 (+https://github.com/semantica-agi/semantica; educational use)",
"Accept": "text/turtle, application/rdf+xml;q=0.9, */*;q=0.5",
}
# Each entry: (filename, url, format, description)
# format: "ttl" (Turtle) or "rdf" (RDF/XML): determines how the source
# header comment is embedded without breaking parseability.
ONTOLOGIES = [
(
"org.ttl",
"https://www.w3.org/ns/org.ttl",
"ttl",
"W3C Organization Ontology (ORG)",
),
(
"prov-o.ttl",
"https://www.w3.org/ns/prov.ttl",
"ttl",
"W3C PROV-O: The PROV Ontology",
),
(
"skos-core.rdf",
"https://www.w3.org/2009/08/skos-reference/skos.rdf",
"rdf",
"W3C SKOS: Simple Knowledge Organization System, Core Vocabulary "
"(no Turtle serialization is served at a stable URL; this is the "
"official RDF/XML file, which OntologyIngestor also supports)",
),
(
"dcat.ttl",
"https://www.w3.org/ns/dcat.ttl",
"ttl",
"W3C DCAT: Data Catalog Vocabulary",
),
(
"time.ttl",
"https://www.w3.org/2006/time",
"ttl",
"W3C OWL-Time: Time Ontology in OWL (content-negotiated Turtle)",
),
(
"frbr.ttl",
"https://sparontologies.github.io/frbr/current/frbr.ttl",
"ttl",
"FRBR Core (SPAR OWL 2 DL edition): Functional Requirements for Bibliographic Records",
),
]
def _header_comment(url: str, description: str, fmt: str) -> str:
retrieved = datetime.now(timezone.utc).isoformat()
if fmt == "rdf":
return (
f"<!-- Vendored from {url}\n"
f" Retrieved: {retrieved}\n"
f" Description: {description}\n"
f" License: see the publishing organization's terms (W3C Document License) -->\n"
)
return (
f"# Vendored from {url}\n"
f"# Retrieved: {retrieved}\n"
f"# Description: {description}\n"
f"# License: see the publishing organization's terms (W3C Document License / SPAR Ontologies)\n\n"
)
def download(filename: str, url: str, fmt: str, description: str) -> None:
print(f"Fetching {description} ...")
print(f" {url}")
response = requests.get(url, headers=HEADERS_TURTLE, timeout=60, allow_redirects=True)
response.raise_for_status()
content = response.text
dest = EXTERNAL_DIR / filename
header = _header_comment(url, description, fmt)
if fmt == "rdf" and content.lstrip().startswith("<?xml"):
# XML declaration must stay the first thing in the document:
# insert the header comment immediately after it instead of before.
decl_end = content.index("?>") + 2
content = content[:decl_end] + "\n" + header + content[decl_end:]
else:
content = header + content
# newline="" disables Windows newline translation: several of these
# sources already use \r\n, and translating would double it to \r\r\n
# and corrupt the file for rdflib's parser.
dest.write_text(content, encoding="utf-8", newline="")
size_kb = len(content) / 1024
print(f" -> saved {dest.name} ({size_kb:.1f} KB)")
def main() -> None:
EXTERNAL_DIR.mkdir(parents=True, exist_ok=True)
for filename, url, fmt, description in ONTOLOGIES:
try:
download(filename, url, fmt, description)
except requests.RequestException as exc:
print(f"ERROR: failed to fetch {url}: {exc}", file=sys.stderr)
raise
print(f"\nVendored {len(ONTOLOGIES)} real ontology files to {EXTERNAL_DIR}")
if __name__ == "__main__":
main()
File diff suppressed because it is too large Load Diff
@@ -0,0 +1,820 @@
# Vendored from https://sparontologies.github.io/frbr/current/frbr.ttl
# Retrieved: 2026-08-04T17:52:32.391907+00:00
# Description: FRBR Core (SPAR OWL 2 DL edition): Functional Requirements for Bibliographic Records
# License: see the publishing organization's terms (W3C Document License / SPAR Ontologies)
@prefix : <http://purl.org/spar/frbr/> .
@prefix core: <http://purl.org/vocab/frbr/core#> .
@prefix dc: <http://purl.org/dc/elements/1.1/> .
@prefix dcterms: <http://purl.org/dc/terms/> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix skos: <http://www.w3.org/2008/05/skos#> .
@prefix swrl: <http://www.w3.org/2003/11/swrl#> .
@prefix swrlb: <http://www.w3.org/2003/11/swrlb#> .
@prefix xml: <http://www.w3.org/XML/1998/namespace> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
dc:contributor a owl:AnnotationProperty .
dc:creator a owl:AnnotationProperty .
dc:date a owl:AnnotationProperty .
dc:description a owl:AnnotationProperty .
dc:rights a owl:AnnotationProperty .
dc:title a owl:AnnotationProperty .
<http://purl.org/spar/frbr> a owl:Ontology ;
dc:contributor "David Shotton" ;
dc:creator "Paolo Ciccarese"^^xsd:string,
"Silvio Peroni"^^xsd:string ;
dc:date "2018-03-29" ;
dc:description "This vocabulary is an expression in OWL 2 DL of the basic concepts and relations described in the IFLA report on the Functional Requirements for Bibliographic Records (FRBR), also described in Ian Davis's RDF vocabulary (http://vocab.org/frbr/core)."@en ;
dc:rights "This work is distributed under a Creative Commons Attribution License (http://creativecommons.org/licenses/by/3.0/)."@en ;
dc:title "Essential FRBR in OWL2 DL"@en ;
rdfs:comment """The Essential FRBR in OWL2 DL Ontology (FRBR) is an expression in OWL 2 DL of the basic concepts and relations described in the IFLA report on the Functional Requirements for Bibliographic Records (FRBR), also described in Ian Davis's RDF vocabulary.
**URL:** http://purl.org/spar/frbr
**Creators**: [Paolo Ciccarese](http://orcid.org/0000-0002-5156-2703), [Silvio Peroni](http://orcid.org/0000-0003-0530-4305)
**Contributors:**: [David Shotton](http://orcid.org/0000-0001-5506-523X)
**License:** [Creative Commons Attribution 4.0 International](https://creativecommons.org/licenses/by/4.0/legalcode)
**Website:** http://www.sparontologies.net/ontologies/frbr"""^^xsd:string ;
owl:priorVersion <http://purl.org/spar/frbr/2011-06-29> ;
owl:versionIRI <http://purl.org/spar/frbr/2018-03-29> ;
owl:versionInfo "1.0.1"^^xsd:string .
core:alternate a owl:ObjectProperty ;
rdfs:label "has alternate"@en ;
rdfs:comment """A manifestation having another one as alternate.
The alternate relationship involves manifestations that effectively serve as alternates for each other. The alternate relationship obtains, for example, when a publication, sound recording, video, etc. is issued in more than one format or when it is released simultaneously by different publishers in different countries."""@en ;
rdfs:domain core:Manifestation ;
rdfs:range core:Manifestation ;
rdfs:subPropertyOf core:relatedEndeavour ;
owl:inverseOf core:alternateOf .
core:creator a owl:ObjectProperty ;
rdfs:label "has creator"@en ;
rdfs:comment "A work linked to its creator."@en ;
rdfs:domain core:Work ;
rdfs:subPropertyOf core:responsibleEntity ;
owl:inverseOf core:creatorOf .
core:owner a owl:ObjectProperty ;
rdfs:label "has owner"@en ;
rdfs:comment "An item linked to its owner."@en ;
rdfs:domain core:Item ;
rdfs:subPropertyOf core:responsibleEntity ;
owl:inverseOf core:ownerOf .
core:producer a owl:ObjectProperty ;
rdfs:label "has producer"@en ;
rdfs:comment "A manifestation linked to its prodecer."@en ;
rdfs:domain core:Manifestation ;
rdfs:subPropertyOf core:responsibleEntity ;
owl:inverseOf core:producerOf .
core:realizer a owl:ObjectProperty ;
rdfs:label "has realizer"@en ;
rdfs:comment "An expression linked to its realizer."@en ;
rdfs:domain core:Expression ;
rdfs:subPropertyOf core:responsibleEntity ;
owl:inverseOf core:realizerOf .
core:reconfiguration a owl:ObjectProperty ;
rdfs:label "has reconfiguration"@en ;
rdfs:comment """An item reconfigured in another one.
The reconfiguration relationship is one in which one or more items are changed in such a way that a new item or items result. Most commonly, an item of one manifestation is bound with an item of a different manifestation to make a new item. """@en ;
rdfs:domain core:Item ;
rdfs:range core:Item ;
rdfs:subPropertyOf core:relatedEndeavour ;
owl:inverseOf core:reconfigurationOf .
core:reproduction a owl:ObjectProperty ;
rdfs:label "has reproduction"@en ;
rdfs:comment """A manifestation/item reproduced in another one.
A reproduction indicates the relationship as it would be drawn from the first manifestation/item in the relationship to the second manifestation/item in the relationship."""@en ;
rdfs:domain [ a owl:Class ;
owl:unionOf ( core:Item core:Manifestation ) ] ;
rdfs:range [ a owl:Class ;
owl:unionOf ( core:Item core:Manifestation ) ] ;
rdfs:subPropertyOf core:relatedEndeavour ;
owl:inverseOf core:reproductionOf .
core:subject a owl:ObjectProperty ;
rdfs:label "has subject"@en ;
rdfs:comment "A work linked to a particular subject it is talking about."@en ;
rdfs:domain core:Work ;
rdfs:range [ a owl:Class ;
owl:unionOf ( core:CorporateBody core:Endeavour core:Subject ) ] ;
rdfs:subPropertyOf owl:topObjectProperty ;
owl:inverseOf core:subjectOf .
rdfs:comment a owl:AnnotationProperty .
rdfs:isDefinedBy a owl:AnnotationProperty .
rdfs:label a owl:AnnotationProperty .
skos:note a owl:AnnotationProperty ;
rdfs:label "skos:note"@en ;
rdfs:isDefinedBy skos: .
core:Concept a owl:Class ;
rdfs:label "concept"@en ;
rdfs:comment """An abstract notion or idea.
The entity defined as concept encompasses a comprehensive range of abstractions that may be the subject of a work: fields of knowledge, disciplines, schools of thought (philosophies, religions, political ideologies, etc.), theories, processes, techniques, practices, etc. A concept may be broad in nature or narrowly defined and precise. """@en ;
rdfs:subClassOf core:Subject .
core:CorporateBody a owl:Class ;
rdfs:label "corporate body"@en ;
rdfs:comment """An organization or group of individuals and/or organizations acting as a unit.
The entity defined as corporate body encompasses organizations and groups of individuals and/or organizations that are identified by a particular name, including occasional groups and groups that are constituted as meetings, conferences, congresses, expeditions, exhibitions, festivals, fairs, etc."""@en ;
rdfs:subClassOf core:ResponsibleEntity ;
owl:disjointWith core:Person .
core:Event a owl:Class ;
rdfs:label "event"@en ;
rdfs:comment """An action or occurrence.
The entity defined as event encompasses a comprehensive range of actions and occurrences that may be the subject of a work: historical events, epochs, periods of time, etc. """@en ;
rdfs:subClassOf core:Subject .
core:Object a owl:Class ;
rdfs:label "object"@en ;
rdfs:comment """A material thing.
The entity defined as object encompasses a comprehensive range of material things that may be the subject of a work: animate and inanimate objects occurring in nature; fixed, movable, and moving objects that are the product of human creation; objects that no longer exist. """@en ;
rdfs:subClassOf core:Subject .
core:Person a owl:Class ;
rdfs:label "person"@en ;
rdfs:comment "An individual. The entity defined as person encompasses individuals that are deceased as well as those that are living."@en ;
rdfs:subClassOf core:ResponsibleEntity .
core:Place a owl:Class ;
rdfs:label "place"@en ;
rdfs:comment """A location.
The entity defined as place encompasses a comprehensive range of locations: terrestrial and extra-terrestrial; historical and contemporary; geographic features and geo-political jurisdictions. """@en ;
rdfs:subClassOf core:Subject .
core:abridgement a owl:ObjectProperty ;
rdfs:label "has abridgement"@en ;
rdfs:comment """An expression abridged in another one.
In the abridged expression some content of the previous expression is removed, but the result does not alter the content to the extent that it becomes a new work. The expressions resulting from such modification are generally autonomous in nature (i.e., they do not normally require reference to the prior expression in order to be used or understood). """@en ;
rdfs:domain core:Expression ;
rdfs:range core:Expression ;
rdfs:subPropertyOf core:relatedEndeavour ;
owl:inverseOf core:abridgementOf .
core:abridgementOf a owl:ObjectProperty ;
rdfs:label "is abridgement of"@en ;
rdfs:comment "It identifies the entire expression of an abridged one."@en ;
rdfs:subPropertyOf core:relatedEndeavour .
core:adaption a owl:ObjectProperty ;
rdfs:label "has adaption"@en ;
rdfs:comment """A work/expression adapted in another one.
This property describe the modification of an original work that is sufficient in degree to warrant their being considered as new works, rather than simply different expressions of the same work. If there exists a relation of this kind among two different expressions, they always refer to different works."""@en ;
rdfs:domain [ a owl:Class ;
owl:unionOf ( core:Expression core:Work ) ] ;
rdfs:range [ a owl:Class ;
owl:unionOf ( core:Expression core:Work ) ] ;
rdfs:subPropertyOf core:relatedEndeavour ;
owl:inverseOf core:adaptionOf .
core:adaptionOf a owl:ObjectProperty ;
rdfs:label "is adaption of"@en ;
rdfs:comment "It identifies the work/expression of an adapted one."@en ;
rdfs:subPropertyOf core:relatedEndeavour .
core:alternateOf a owl:ObjectProperty ;
rdfs:label "is alternate of"@en ;
rdfs:comment "It identifies the manifestation of an alternative one."@en ;
rdfs:subPropertyOf core:relatedEndeavour .
core:arrangement a owl:ObjectProperty ;
rdfs:label "has arrangement"@en ;
rdfs:comment """An expression arranged in another one.
In the arranged expression some content of the previous expression is changed in some way, but the result does not alter the content to the extent that it becomes a new work. The expressions resulting from such modification are generally autonomous in nature (i.e., they do not normally require reference to the prior expression in order to be used or understood)."""@en ;
rdfs:domain core:Expression ;
rdfs:range core:Expression ;
rdfs:subPropertyOf core:relatedEndeavour ;
owl:inverseOf core:arrangementOf .
core:arrangementOf a owl:ObjectProperty ;
rdfs:label "is arrangement of"@en ;
rdfs:comment "It identifies the original expression of an arranged one."@en ;
rdfs:subPropertyOf core:relatedEndeavour .
core:complement a owl:ObjectProperty ;
rdfs:label "has complement"@en ;
rdfs:comment """An expression work/expression having another one as complement.
This property describes works that are intended to be combined with or inserted into the related work. In other words, they are intended to be integrated in some way with the other work, but were not part of the original conception of that prior work. If there exists a relation of this kind among two different expressions, then they always refer to different works."""@en ;
rdfs:domain [ a owl:Class ;
owl:unionOf ( core:Expression core:Work ) ] ;
rdfs:range [ a owl:Class ;
owl:unionOf ( core:Expression core:Work ) ] ;
rdfs:subPropertyOf core:relatedEndeavour ;
owl:inverseOf core:complementOf .
core:complementOf a owl:ObjectProperty ;
rdfs:label "is complement of"@en ;
rdfs:comment "It identifies the work/expression of that is a complement of another one."@en ;
rdfs:subPropertyOf core:relatedEndeavour .
core:creatorOf a owl:ObjectProperty ;
rdfs:label "is creator of"@en ;
rdfs:comment "The creator of a particular work."@en ;
rdfs:subPropertyOf core:responsibleEntityOf .
core:embodiment a owl:ObjectProperty ;
rdfs:label "has embodiment"@en ;
rdfs:comment "An expression embodied in a manifestation."@en ;
rdfs:domain core:Expression ;
rdfs:range core:Manifestation ;
rdfs:subPropertyOf core:relatedEndeavour ;
owl:inverseOf core:embodimentOf .
core:exemplar a owl:ObjectProperty ;
rdfs:label "has exemplar"@en ;
rdfs:comment "A manifestation exemplified in an item."@en ;
rdfs:domain core:Manifestation ;
rdfs:range core:Item ;
rdfs:subPropertyOf core:relatedEndeavour ;
owl:inverseOf core:exemplarOf .
core:imitation a owl:ObjectProperty ;
rdfs:label "has imitation"@en ;
rdfs:comment """An work/expression imitated in another one.
This property describes works that are intended to be an imitation another original work that is sufficient in degree to warrant their being considered as new works, rather than simply different expressions of the same work. If there exists a relation of this kind among two different expressions, then they always refer to different works."""@en ;
rdfs:domain [ a owl:Class ;
owl:unionOf ( core:Expression core:Work ) ] ;
rdfs:range [ a owl:Class ;
owl:unionOf ( core:Expression core:Work ) ] ;
rdfs:subPropertyOf core:relatedEndeavour ;
owl:inverseOf core:imitationOf .
core:imitationOf a owl:ObjectProperty ;
rdfs:label "is imitation of"@en ;
rdfs:comment "It identifies the work/expression of an imitated one."@en ;
rdfs:subPropertyOf core:relatedEndeavour .
core:ownerOf a owl:ObjectProperty ;
rdfs:label "is owner of"@en ;
rdfs:comment "The owner of a particular item."@en ;
rdfs:subPropertyOf core:responsibleEntityOf .
core:producerOf a owl:ObjectProperty ;
rdfs:label "is producer of"@en ;
rdfs:comment "The producer of a particular manifestation."@en ;
rdfs:subPropertyOf core:responsibleEntityOf .
core:realization a owl:ObjectProperty ;
rdfs:label "has realization"@en ;
rdfs:comment "A work realized through an expression."@en ;
rdfs:domain core:Work ;
rdfs:range core:Expression ;
rdfs:subPropertyOf core:relatedEndeavour ;
owl:inverseOf core:realizationOf .
core:realizerOf a owl:ObjectProperty ;
rdfs:label "is realizer of"@en ;
rdfs:comment "The realizer of a particular expression."@en ;
rdfs:subPropertyOf core:responsibleEntityOf .
core:reconfigurationOf a owl:ObjectProperty ;
rdfs:label "is reconfiguration of"@en ;
rdfs:comment "It identifies the manifestation of a reconfigured one."@en ;
rdfs:subPropertyOf core:relatedEndeavour .
core:reproductionOf a owl:ObjectProperty ;
rdfs:label "is reproduction of"@en ;
rdfs:comment "It identifies the manifestation/item of a reproduced one."@en ;
rdfs:subPropertyOf core:relatedEndeavour .
core:revision a owl:ObjectProperty ;
rdfs:label "has revision"@en ;
rdfs:comment """An expression revised in another one.
A revision has the intent to alter or update the content of the prior expression, but without changing the content so much that it becomes a new work."""@en ;
rdfs:domain core:Expression ;
rdfs:range core:Expression ;
rdfs:subPropertyOf core:relatedEndeavour ;
owl:inverseOf core:revisionOf .
core:revisionOf a owl:ObjectProperty ;
rdfs:label "is revision of"@en ;
rdfs:comment "It identifies the previous expression of a revised one."@en ;
rdfs:subPropertyOf core:relatedEndeavour .
core:subjectOf a owl:ObjectProperty ;
rdfs:label "is subject of"@en ;
rdfs:comment "A subject a work talks abbout."@en ;
rdfs:subPropertyOf owl:topObjectProperty .
core:successor a owl:ObjectProperty ;
rdfs:label "has successor"@en ;
rdfs:comment """An expression work/expression having another one as successor.
The successor type of relationship involves a kind of linear progression of content from one work/expression to the other. In some cases, the content of the successor may be closely connected to the content of the preceding work, which would result in a work that is referential. In others, such as with loosely connected parts of a trilogy, the successor will be autonomous. Serial publications that result from the merger or split of their predecessors and stand on their own without requiring reference to the predecessor are also examples of autonomous works that fall within the successor relationship type. If there exists a relation of this kind among two different expressions, then they always refer to different works."""@en ;
rdfs:domain [ a owl:Class ;
owl:unionOf ( core:Expression core:Work ) ] ;
rdfs:range [ a owl:Class ;
owl:unionOf ( core:Expression core:Work ) ] ;
rdfs:subPropertyOf core:relatedEndeavour ;
owl:inverseOf core:successorOf .
core:successorOf a owl:ObjectProperty ;
rdfs:label "is successor of"@en ;
rdfs:comment "It identifies the previous work/expression of a succeeded one."@en ;
rdfs:subPropertyOf core:relatedEndeavour .
core:summarization a owl:ObjectProperty ;
rdfs:label "has summarization"@en ;
rdfs:comment """A work/expression summarized in another one.
This property describe the summarization of an original work that is sufficient in degree to warrant their being considered as new works, rather than simply different expressions of the same work. If there exists a relation of this kind among two different expressions, they always refer to different works."""@en ;
rdfs:domain [ a owl:Class ;
owl:unionOf ( core:Expression core:Work ) ] ;
rdfs:range [ a owl:Class ;
owl:unionOf ( core:Expression core:Work ) ] ;
rdfs:subPropertyOf core:relatedEndeavour ;
owl:inverseOf core:summarizationOf .
core:summarizationOf a owl:ObjectProperty ;
rdfs:label "is summarization of"@en ;
rdfs:comment "It identifies the original work/expression of a summarized one."@en ;
rdfs:subPropertyOf core:relatedEndeavour .
core:supplement a owl:ObjectProperty ;
rdfs:label "has supplement"@en ;
rdfs:comment """An expression work/expression having another one as supplement.
The supplement relationship type involves works/expressions that are intended to be used in conjunction with another work/expression. Some of these, such as indices, concordances, teachers' guides, glosses, and instruction manuals for electronic resources will be so closely associated with the content of the related work/expression that they are useless without the other work/expression."""@en ;
rdfs:domain [ a owl:Class ;
owl:unionOf ( core:Expression core:Work ) ] ;
rdfs:range [ a owl:Class ;
owl:unionOf ( core:Expression core:Work ) ] ;
rdfs:subPropertyOf core:relatedEndeavour ;
owl:inverseOf core:supplementOf .
core:supplementOf a owl:ObjectProperty ;
rdfs:label "is supplement of"@en ;
rdfs:comment "It identifies the work/expression of a particular supplement of it."@en ;
rdfs:subPropertyOf core:relatedEndeavour .
core:transformation a owl:ObjectProperty ;
rdfs:label "has transformation"@en ;
rdfs:comment """An work/expression transformed in another one.
This property describes the transformation of an original work or expression into another work or expression that is sufficiently different in degree to warrant the product of the transformation being considered as a new work or expression, rather than simply a different expression of the original work. If there exists a frbr:transformation relation between two different expressions, then they always relate to different works."""@en ;
rdfs:domain [ a owl:Class ;
owl:unionOf ( core:Expression core:Work ) ] ;
rdfs:range [ a owl:Class ;
owl:unionOf ( core:Expression core:Work ) ] ;
rdfs:subPropertyOf core:relatedEndeavour ;
owl:inverseOf core:transformationOf .
core:transformationOf a owl:ObjectProperty ;
rdfs:label "is transformation of"@en ;
rdfs:comment "It identifies the original work/expression of a trasformed one."@en ;
rdfs:subPropertyOf core:relatedEndeavour .
core:translation a owl:ObjectProperty ;
rdfs:label "has translation"@en ;
rdfs:comment """An expression translated in another one.
It allows to refer to a literal translation, in which the intent is to render the intellectual content of the previous expression as accurately as possible."""@en ;
rdfs:domain core:Expression ;
rdfs:range core:Expression ;
rdfs:subPropertyOf core:relatedEndeavour ;
owl:inverseOf core:translationOf .
core:translationOf a owl:ObjectProperty ;
rdfs:label "is translation of"@en ;
rdfs:comment "It identifies the original expression of a translated one."@en ;
rdfs:subPropertyOf core:relatedEndeavour .
core:embodimentOf a owl:ObjectProperty ;
rdfs:label "is embodiment of"@en ;
rdfs:comment "A manifestation that embodies an expression."@en ;
rdfs:subPropertyOf core:relatedEndeavour .
core:exemplarOf a owl:FunctionalProperty,
owl:ObjectProperty ;
rdfs:label "is exemplar of"@en ;
rdfs:comment "An item that exemplifies a manifestation."@en ;
rdfs:subPropertyOf core:relatedEndeavour .
core:ResponsibleEntity a owl:Class ;
rdfs:label "responsible entity"@en ;
rdfs:comment "It represents those responsible for the intellectual or artistic content, the physical production and dissemination, or the custodianship of any endeavour."@en .
core:part a owl:ObjectProperty,
owl:TransitiveProperty ;
rdfs:label "has part"@en ;
rdfs:comment "A part of an endeavour."@en ;
rdfs:subPropertyOf core:relatedEndeavour ;
owl:inverseOf core:partOf ;
skos:note "Unlike the FRBR version in RDF http://vocab.org/frbr/core.html the present version defines partonomy relationships transitive."@en .
core:responsibleEntity a owl:ObjectProperty ;
rdfs:label "has responsible entity"@en ;
rdfs:comment "Any endeavour having a particular entity that is responsible of it."@en ;
rdfs:domain core:Endeavour ;
rdfs:range core:ResponsibleEntity ;
rdfs:subPropertyOf owl:topObjectProperty ;
owl:inverseOf core:responsibleEntityOf .
owl:topObjectProperty a owl:ObjectProperty .
core:Subject a owl:Class ;
rdfs:label "subject"@en ;
rdfs:comment "It represents an additional set of entities that serve as the subjects of works."@en .
core:partOf a owl:ObjectProperty,
owl:TransitiveProperty ;
rdfs:label "is part of"@en ;
rdfs:comment "An endeavour incorporating another endeavour."@en ;
rdfs:subPropertyOf core:relatedEndeavour ;
skos:note "Unlike the FRBR version in RDF http://vocab.org/frbr/core.html the present version defines partonomy relationships transitive."@en .
core:responsibleEntityOf a owl:ObjectProperty ;
rdfs:label "is responsible entity of"@en ;
rdfs:comment "An entity that is resposible for a particular endeavour."@en ;
rdfs:subPropertyOf owl:topObjectProperty .
core:Item a owl:Class ;
rdfs:label "item"@en ;
rdfs:comment """A single exemplar of a manifestation.
The entity defined as item is a concrete entity. It is in many instances a single physical object (e.g., a copy of a one-volume monograph, a single audio cassette, etc.). There are instances, however, where the entity defined as item comprises more than one physical object (e.g., a monograph issued as two separately bound volumes, a recording issued on three separate compact discs, etc.). """@en ;
owl:disjointWith core:Manifestation,
core:Work ;
owl:equivalentClass [ a owl:Class ;
owl:intersectionOf ( core:Endeavour [ a owl:Restriction ;
owl:allValuesFrom core:Item ;
owl:onProperty core:part ] [ a owl:Restriction ;
owl:allValuesFrom core:Item ;
owl:onProperty core:partOf ] ) ],
[ a owl:Class ;
owl:intersectionOf ( core:Endeavour [ a owl:Restriction ;
owl:onProperty core:exemplarOf ;
owl:someValuesFrom core:Manifestation ] ) ] .
core:Endeavour a owl:Class ;
rdfs:label "endeavour"@en ;
rdfs:comment "It describes different aspects of user interests in the products of intellectual or artistic artifact."@en ;
owl:equivalentClass [ a owl:Class ;
owl:unionOf ( core:Expression core:Item core:Manifestation core:Work ) ] .
core:Manifestation a owl:Class ;
rdfs:label "manifestation"@en ;
rdfs:comment """The physical embodiment of an expression of a work.
The entity defined as manifestation encompasses a wide range of materials and formats. As an entity, manifestation represents all the physical objects that bear the same characteristics, in respect to both intellectual content and physical form. """@en ;
owl:disjointWith core:Work ;
owl:equivalentClass [ a owl:Class ;
owl:intersectionOf ( core:Endeavour [ a owl:Restriction ;
owl:allValuesFrom core:Manifestation ;
owl:onProperty core:part ] [ a owl:Restriction ;
owl:allValuesFrom core:Manifestation ;
owl:onProperty core:partOf ] ) ],
[ a owl:Class ;
owl:intersectionOf ( core:Endeavour [ a owl:Restriction ;
owl:onProperty core:embodimentOf ;
owl:someValuesFrom core:Expression ] [ a owl:Restriction ;
owl:onProperty core:exemplar ;
owl:someValuesFrom core:Item ] ) ] .
<urn:swrl#e1> a swrl:Variable .
<urn:swrl#e2> a swrl:Variable .
<urn:swrl#w1> a swrl:Variable .
<urn:swrl#w2> a swrl:Variable .
core:Work a owl:Class ;
rdfs:label "work"@en ;
rdfs:comment """A distinct intellectual or artistic creation.
A work is an abstract entity; there is no single material object one can point to as the work. We recognize the work through individual realizations or expressions of the work, but the work itself exists only in the commonality of content between and among the various expressions of the work. When we speak of Homer's Iliad as a work, our point of reference is not a particular recitation or text of the work, but the intellectual creation that lies behind all the various expressions of the work. """@en ;
owl:equivalentClass [ a owl:Class ;
owl:intersectionOf ( core:Endeavour [ a owl:Restriction ;
owl:onProperty core:realization ;
owl:someValuesFrom core:Expression ] ) ],
[ a owl:Class ;
owl:intersectionOf ( core:Endeavour [ a owl:Restriction ;
owl:allValuesFrom core:Work ;
owl:onProperty core:part ] [ a owl:Restriction ;
owl:allValuesFrom core:Work ;
owl:onProperty core:partOf ] ) ] .
core:realizationOf a owl:FunctionalProperty,
owl:ObjectProperty ;
rdfs:label "is realization of"@en ;
rdfs:comment "An expression that realizes a work."@en ;
rdfs:subPropertyOf core:relatedEndeavour .
core:Expression a owl:Class ;
rdfs:label "expression"@en ;
rdfs:comment """The intellectual or artistic realization of a work in the form of alpha-numeric, musical, or choreographic notation, sound, image, object, movement, etc., or any combination of such forms.
An expression is the specific intellectual or artistic form that a work takes each time it is "realized." Expression encompasses, for example, the specific words, sentences, paragraphs, etc. that result from the realization of a work in the form of a text, or the particular sounds, phrasing, etc. resulting from the realization of a musical work."""@en ;
owl:disjointWith core:Item,
core:Manifestation,
core:Work ;
owl:equivalentClass [ a owl:Class ;
owl:intersectionOf ( core:Endeavour [ a owl:Restriction ;
owl:allValuesFrom core:Expression ;
owl:onProperty core:part ] [ a owl:Restriction ;
owl:allValuesFrom core:Expression ;
owl:onProperty core:partOf ] ) ],
[ a owl:Class ;
owl:intersectionOf ( core:Endeavour [ a owl:Restriction ;
owl:onProperty core:embodiment ;
owl:someValuesFrom core:Manifestation ] [ a owl:Restriction ;
owl:onProperty core:realizationOf ;
owl:someValuesFrom core:Work ] ) ] .
core:relatedEndeavour a owl:ObjectProperty ;
rdfs:label "has related endeavour"@en ;
rdfs:domain core:Endeavour ;
rdfs:range core:Endeavour .
[] a swrl:Imp ;
swrl:body [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e1> ;
swrl:argument2 <urn:swrl#w1> ;
swrl:propertyPredicate core:realizationOf ] ;
rdf:rest [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e2> ;
swrl:argument2 <urn:swrl#w2> ;
swrl:propertyPredicate core:realizationOf ] ;
rdf:rest [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e1> ;
swrl:argument2 <urn:swrl#e2> ;
swrl:propertyPredicate core:summarization ] ;
rdf:rest () ] ] ] ;
swrl:head [ a swrl:AtomList ;
rdf:first [ a swrl:DifferentIndividualsAtom ;
swrl:argument1 <urn:swrl#w1> ;
swrl:argument2 <urn:swrl#w2> ] ;
rdf:rest () ] .
[] a swrl:Imp ;
swrl:body [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e1> ;
swrl:argument2 <urn:swrl#w1> ;
swrl:propertyPredicate core:realizationOf ] ;
rdf:rest [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e2> ;
swrl:argument2 <urn:swrl#w2> ;
swrl:propertyPredicate core:realizationOf ] ;
rdf:rest [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e1> ;
swrl:argument2 <urn:swrl#e2> ;
swrl:propertyPredicate core:translation ] ;
rdf:rest () ] ] ] ;
swrl:head [ a swrl:AtomList ;
rdf:first [ a swrl:SameIndividualAtom ;
swrl:argument1 <urn:swrl#w1> ;
swrl:argument2 <urn:swrl#w2> ] ;
rdf:rest () ] .
[] a owl:AllDisjointClasses ;
owl:members ( core:Concept core:Event core:Object core:Place ) .
[] a swrl:Imp ;
swrl:body [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e1> ;
swrl:argument2 <urn:swrl#e2> ;
swrl:propertyPredicate core:complement ] ;
rdf:rest [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e1> ;
swrl:argument2 <urn:swrl#w1> ;
swrl:propertyPredicate core:realizationOf ] ;
rdf:rest [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e2> ;
swrl:argument2 <urn:swrl#w2> ;
swrl:propertyPredicate core:realizationOf ] ;
rdf:rest () ] ] ] ;
swrl:head [ a swrl:AtomList ;
rdf:first [ a swrl:DifferentIndividualsAtom ;
swrl:argument1 <urn:swrl#w1> ;
swrl:argument2 <urn:swrl#w2> ] ;
rdf:rest () ] .
[] a swrl:Imp ;
swrl:body [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e1> ;
swrl:argument2 <urn:swrl#e2> ;
swrl:propertyPredicate core:adaption ] ;
rdf:rest [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e1> ;
swrl:argument2 <urn:swrl#w1> ;
swrl:propertyPredicate core:realizationOf ] ;
rdf:rest [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e2> ;
swrl:argument2 <urn:swrl#w2> ;
swrl:propertyPredicate core:realizationOf ] ;
rdf:rest () ] ] ] ;
swrl:head [ a swrl:AtomList ;
rdf:first [ a swrl:DifferentIndividualsAtom ;
swrl:argument1 <urn:swrl#w1> ;
swrl:argument2 <urn:swrl#w2> ] ;
rdf:rest () ] .
[] a swrl:Imp ;
swrl:body [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e1> ;
swrl:argument2 <urn:swrl#w1> ;
swrl:propertyPredicate core:realizationOf ] ;
rdf:rest [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e2> ;
swrl:argument2 <urn:swrl#w2> ;
swrl:propertyPredicate core:realizationOf ] ;
rdf:rest [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e1> ;
swrl:argument2 <urn:swrl#e2> ;
swrl:propertyPredicate core:supplement ] ;
rdf:rest () ] ] ] ;
swrl:head [ a swrl:AtomList ;
rdf:first [ a swrl:DifferentIndividualsAtom ;
swrl:argument1 <urn:swrl#w1> ;
swrl:argument2 <urn:swrl#w2> ] ;
rdf:rest () ] .
[] a swrl:Imp ;
swrl:body [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e1> ;
swrl:argument2 <urn:swrl#w1> ;
swrl:propertyPredicate core:realizationOf ] ;
rdf:rest [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e2> ;
swrl:argument2 <urn:swrl#w2> ;
swrl:propertyPredicate core:realizationOf ] ;
rdf:rest [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e1> ;
swrl:argument2 <urn:swrl#e2> ;
swrl:propertyPredicate core:transformation ] ;
rdf:rest () ] ] ] ;
swrl:head [ a swrl:AtomList ;
rdf:first [ a swrl:DifferentIndividualsAtom ;
swrl:argument1 <urn:swrl#w1> ;
swrl:argument2 <urn:swrl#w2> ] ;
rdf:rest () ] .
[] a swrl:Imp ;
swrl:body [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e1> ;
swrl:argument2 <urn:swrl#e2> ;
swrl:propertyPredicate core:arrangement ] ;
rdf:rest [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e1> ;
swrl:argument2 <urn:swrl#w1> ;
swrl:propertyPredicate core:realizationOf ] ;
rdf:rest [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e2> ;
swrl:argument2 <urn:swrl#w2> ;
swrl:propertyPredicate core:realizationOf ] ;
rdf:rest () ] ] ] ;
swrl:head [ a swrl:AtomList ;
rdf:first [ a swrl:SameIndividualAtom ;
swrl:argument1 <urn:swrl#w1> ;
swrl:argument2 <urn:swrl#w2> ] ;
rdf:rest () ] .
[] a swrl:Imp ;
swrl:body [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e1> ;
swrl:argument2 <urn:swrl#e2> ;
swrl:propertyPredicate core:imitation ] ;
rdf:rest [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e1> ;
swrl:argument2 <urn:swrl#w1> ;
swrl:propertyPredicate core:realizationOf ] ;
rdf:rest [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e2> ;
swrl:argument2 <urn:swrl#w2> ;
swrl:propertyPredicate core:realizationOf ] ;
rdf:rest () ] ] ] ;
swrl:head [ a swrl:AtomList ;
rdf:first [ a swrl:DifferentIndividualsAtom ;
swrl:argument1 <urn:swrl#w1> ;
swrl:argument2 <urn:swrl#w2> ] ;
rdf:rest () ] .
[] a swrl:Imp ;
swrl:body [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e1> ;
swrl:argument2 <urn:swrl#w1> ;
swrl:propertyPredicate core:realizationOf ] ;
rdf:rest [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e2> ;
swrl:argument2 <urn:swrl#w2> ;
swrl:propertyPredicate core:realizationOf ] ;
rdf:rest [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e1> ;
swrl:argument2 <urn:swrl#e2> ;
swrl:propertyPredicate core:successor ] ;
rdf:rest () ] ] ] ;
swrl:head [ a swrl:AtomList ;
rdf:first [ a swrl:DifferentIndividualsAtom ;
swrl:argument1 <urn:swrl#w1> ;
swrl:argument2 <urn:swrl#w2> ] ;
rdf:rest () ] .
[] a swrl:Imp ;
swrl:body [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e1> ;
swrl:argument2 <urn:swrl#w1> ;
swrl:propertyPredicate core:realizationOf ] ;
rdf:rest [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e2> ;
swrl:argument2 <urn:swrl#w2> ;
swrl:propertyPredicate core:realizationOf ] ;
rdf:rest [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e1> ;
swrl:argument2 <urn:swrl#e2> ;
swrl:propertyPredicate core:revision ] ;
rdf:rest () ] ] ] ;
swrl:head [ a swrl:AtomList ;
rdf:first [ a swrl:SameIndividualAtom ;
swrl:argument1 <urn:swrl#w1> ;
swrl:argument2 <urn:swrl#w2> ] ;
rdf:rest () ] .
[] a swrl:Imp ;
swrl:body [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e1> ;
swrl:argument2 <urn:swrl#e2> ;
swrl:propertyPredicate core:abridgement ] ;
rdf:rest [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e1> ;
swrl:argument2 <urn:swrl#w1> ;
swrl:propertyPredicate core:realizationOf ] ;
rdf:rest [ a swrl:AtomList ;
rdf:first [ a swrl:IndividualPropertyAtom ;
swrl:argument1 <urn:swrl#e2> ;
swrl:argument2 <urn:swrl#w2> ;
swrl:propertyPredicate core:realizationOf ] ;
rdf:rest () ] ] ] ;
swrl:head [ a swrl:AtomList ;
rdf:first [ a swrl:SameIndividualAtom ;
swrl:argument1 <urn:swrl#w1> ;
swrl:argument2 <urn:swrl#w2> ] ;
rdf:rest () ] .
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
@@ -0,0 +1,473 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- Vendored from https://www.w3.org/2009/08/skos-reference/skos.rdf
Retrieved: 2026-08-04T17:52:29.732633+00:00
Description: W3C SKOS: Simple Knowledge Organization System, Core Vocabulary (no Turtle serialization is served at a stable URL; this is the official RDF/XML file, which OntologyIngestor also supports)
License: see the publishing organization's terms (W3C Document License) -->
<rdf:RDF xmlns:dct="http://purl.org/dc/terms/"
xmlns:owl="http://www.w3.org/2002/07/owl#" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
xmlns:rdfs="http://www.w3.org/2000/01/rdf-schema#" xmlns:skos="http://www.w3.org/2004/02/skos/core#"
xml:base="http://www.w3.org/2004/02/skos/core">
<!-- This schema represents a formalisation of a subset of the semantic conditions
described in the SKOS Reference document dated 18 August 2009, accessible
at http://www.w3.org/TR/2009/REC-skos-reference-20090818/. XML comments of the form Sn are used to
indicate the semantic conditions that are being expressed. Comments of the form
[Sn] refer to assertions that are, strictly speaking, redundant as they follow
from the RDF(S) or OWL semantics.
A number of semantic conditions are *not* expressed formally in this schema. These are:
S12
S13
S14
S27
S36
S46
For the conditions listed above, rdfs:comments are used to indicate the conditions.
-->
<owl:Ontology rdf:about="http://www.w3.org/2004/02/skos/core">
<dct:title xml:lang="en">SKOS Vocabulary</dct:title>
<dct:contributor>Dave Beckett</dct:contributor>
<dct:contributor>Nikki Rogers</dct:contributor>
<dct:contributor>Participants in W3C's Semantic Web Deployment Working Group.</dct:contributor>
<dct:description xml:lang="en">An RDF vocabulary for describing the basic structure and content of concept schemes such as thesauri, classification schemes, subject heading lists, taxonomies, 'folksonomies', other types of controlled vocabulary, and also concept schemes embedded in glossaries and terminologies.</dct:description>
<dct:creator>Alistair Miles</dct:creator>
<dct:creator>Sean Bechhofer</dct:creator>
<rdfs:seeAlso rdf:resource="http://www.w3.org/TR/skos-reference/"/>
</owl:Ontology>
<rdf:Description rdf:about="#Concept">
<rdfs:label xml:lang="en">Concept</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">An idea or notion; a unit of thought.</skos:definition>
<!-- S1 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#Class"/>
</rdf:Description>
<rdf:Description rdf:about="#ConceptScheme">
<rdfs:label xml:lang="en">Concept Scheme</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">A set of concepts, optionally including statements about semantic relationships between those concepts.</skos:definition>
<skos:scopeNote xml:lang="en">A concept scheme may be defined to include concepts from different sources.</skos:scopeNote>
<skos:example xml:lang="en">Thesauri, classification schemes, subject heading lists, taxonomies, 'folksonomies', and other types of controlled vocabulary are all examples of concept schemes. Concept schemes are also embedded in glossaries and terminologies.</skos:example>
<!-- S2 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#Class"/>
<!-- S9 -->
<owl:disjointWith rdf:resource="#Concept"/>
</rdf:Description>
<rdf:Description rdf:about="#Collection">
<rdfs:label xml:lang="en">Collection</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">A meaningful collection of concepts.</skos:definition>
<skos:scopeNote xml:lang="en">Labelled collections can be used where you would like a set of concepts to be displayed under a 'node label' in the hierarchy.</skos:scopeNote>
<!-- S28 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#Class"/>
<!-- S37 -->
<owl:disjointWith rdf:resource="#Concept"/>
<!-- S37 -->
<owl:disjointWith rdf:resource="#ConceptScheme"/>
</rdf:Description>
<rdf:Description rdf:about="#OrderedCollection">
<rdfs:label xml:lang="en">Ordered Collection</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">An ordered collection of concepts, where both the grouping and the ordering are meaningful.</skos:definition>
<skos:scopeNote xml:lang="en">Ordered collections can be used where you would like a set of concepts to be displayed in a specific order, and optionally under a 'node label'.</skos:scopeNote>
<!-- S28 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#Class"/>
<!-- S29 -->
<rdfs:subClassOf rdf:resource="#Collection"/>
</rdf:Description>
<rdf:Description rdf:about="#inScheme">
<rdfs:label xml:lang="en">is in scheme</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">Relates a resource (for example a concept) to a concept scheme in which it is included.</skos:definition>
<skos:scopeNote xml:lang="en">A concept may be a member of more than one concept scheme.</skos:scopeNote>
<!-- S3 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#ObjectProperty"/>
<!-- S4 -->
<rdfs:range rdf:resource="#ConceptScheme"/>
<!-- For non-OWL aware applications -->
<rdf:type rdf:resource="http://www.w3.org/1999/02/22-rdf-syntax-ns#Property"/>
</rdf:Description>
<rdf:Description rdf:about="#hasTopConcept">
<rdfs:label xml:lang="en">has top concept</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">Relates, by convention, a concept scheme to a concept which is topmost in the broader/narrower concept hierarchies for that scheme, providing an entry point to these hierarchies.</skos:definition>
<!-- S3 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#ObjectProperty"/>
<!-- S5 -->
<rdfs:domain rdf:resource="#ConceptScheme"/>
<!-- S6 -->
<rdfs:range rdf:resource="#Concept"/>
<!-- S8 -->
<owl:inverseOf rdf:resource="#topConceptOf"/>
<!-- For non-OWL aware applications -->
<rdf:type rdf:resource="http://www.w3.org/1999/02/22-rdf-syntax-ns#Property"/>
</rdf:Description>
<rdf:Description rdf:about="#topConceptOf">
<rdfs:label xml:lang="en">is top concept in scheme</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">Relates a concept to the concept scheme that it is a top level concept of.</skos:definition>
<!-- S3 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#ObjectProperty"/>
<!-- S7 -->
<rdfs:subPropertyOf rdf:resource="#inScheme"/>
<!-- S8 -->
<owl:inverseOf rdf:resource="#hasTopConcept"/>
<!-- For non-OWL aware applications -->
<rdf:type rdf:resource="http://www.w3.org/1999/02/22-rdf-syntax-ns#Property"/>
<rdfs:domain rdf:resource="#Concept"/>
<rdfs:range rdf:resource="#ConceptScheme"/>
</rdf:Description>
<rdf:Description rdf:about="#prefLabel">
<rdfs:label xml:lang="en">preferred label</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">The preferred lexical label for a resource, in a given language.</skos:definition>
<!-- S10 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#AnnotationProperty"/>
<!-- S11 -->
<rdfs:subPropertyOf rdf:resource="http://www.w3.org/2000/01/rdf-schema#label"/>
<!-- S14 (not formally stated) -->
<rdfs:comment xml:lang="en">A resource has no more than one value of skos:prefLabel per language tag, and no more than one value of skos:prefLabel without language tag.</rdfs:comment>
<!-- S12 (not formally stated) -->
<rdfs:comment xml:lang="en">The range of skos:prefLabel is the class of RDF plain literals.</rdfs:comment>
<!-- S13 (not formally stated) -->
<rdfs:comment xml:lang="en">skos:prefLabel, skos:altLabel and skos:hiddenLabel are pairwise
disjoint properties.</rdfs:comment>
<!-- For non-OWL aware applications -->
<rdf:type rdf:resource="http://www.w3.org/1999/02/22-rdf-syntax-ns#Property"/>
</rdf:Description>
<rdf:Description rdf:about="#altLabel">
<rdfs:label xml:lang="en">alternative label</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">An alternative lexical label for a resource.</skos:definition>
<skos:example xml:lang="en">Acronyms, abbreviations, spelling variants, and irregular plural/singular forms may be included among the alternative labels for a concept. Mis-spelled terms are normally included as hidden labels (see skos:hiddenLabel).</skos:example>
<!-- S10 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#AnnotationProperty"/>
<!-- S11 -->
<rdfs:subPropertyOf rdf:resource="http://www.w3.org/2000/01/rdf-schema#label"/>
<!-- S12 (not formally stated) -->
<rdfs:comment xml:lang="en">The range of skos:altLabel is the class of RDF plain literals.</rdfs:comment>
<!-- S13 (not formally stated) -->
<rdfs:comment xml:lang="en">skos:prefLabel, skos:altLabel and skos:hiddenLabel are pairwise disjoint properties.</rdfs:comment>
<!-- For non-OWL aware applications -->
<rdf:type rdf:resource="http://www.w3.org/1999/02/22-rdf-syntax-ns#Property"/>
</rdf:Description>
<rdf:Description rdf:about="#hiddenLabel">
<rdfs:label xml:lang="en">hidden label</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">A lexical label for a resource that should be hidden when generating visual displays of the resource, but should still be accessible to free text search operations.</skos:definition>
<!-- S10 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#AnnotationProperty"/>
<!-- S11 -->
<rdfs:subPropertyOf rdf:resource="http://www.w3.org/2000/01/rdf-schema#label"/>
<!-- S12 (not formally stated) -->
<rdfs:comment xml:lang="en">The range of skos:hiddenLabel is the class of RDF plain literals.</rdfs:comment>
<!-- S13 (not formally stated) -->
<rdfs:comment xml:lang="en">skos:prefLabel, skos:altLabel and skos:hiddenLabel are pairwise disjoint properties.</rdfs:comment>
<!-- For non-OWL aware applications -->
<rdf:type rdf:resource="http://www.w3.org/1999/02/22-rdf-syntax-ns#Property"/>
</rdf:Description>
<rdf:Description rdf:about="#notation">
<rdfs:label xml:lang="en">notation</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">A notation, also known as classification code, is a string of characters such as "T58.5" or "303.4833" used to uniquely identify a concept within the scope of a given concept scheme.</skos:definition>
<skos:scopeNote xml:lang="en">By convention, skos:notation is used with a typed literal in the object position of the triple.</skos:scopeNote>
<!-- S15 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#DatatypeProperty"/>
<!-- For non-OWL aware applications -->
<rdf:type rdf:resource="http://www.w3.org/1999/02/22-rdf-syntax-ns#Property"/>
</rdf:Description>
<rdf:Description rdf:about="#note">
<rdfs:label xml:lang="en">note</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">A general note, for any purpose.</skos:definition>
<skos:scopeNote xml:lang="en">This property may be used directly, or as a super-property for more specific note types.</skos:scopeNote>
<!-- S16 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#AnnotationProperty"/>
<!-- For non-OWL aware applications -->
<rdf:type rdf:resource="http://www.w3.org/1999/02/22-rdf-syntax-ns#Property"/>
</rdf:Description>
<rdf:Description rdf:about="#changeNote">
<rdfs:label xml:lang="en">change note</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">A note about a modification to a concept.</skos:definition>
<!-- S16 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#AnnotationProperty"/>
<!-- S17 -->
<rdfs:subPropertyOf rdf:resource="#note"/>
<!-- For non-OWL aware applications -->
<rdf:type rdf:resource="http://www.w3.org/1999/02/22-rdf-syntax-ns#Property"/>
</rdf:Description>
<rdf:Description rdf:about="#definition">
<rdfs:label xml:lang="en">definition</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">A statement or formal explanation of the meaning of a concept.</skos:definition>
<!-- S16 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#AnnotationProperty"/>
<!-- S17 -->
<rdfs:subPropertyOf rdf:resource="#note"/>
<!-- For non-OWL aware applications -->
<rdf:type rdf:resource="http://www.w3.org/1999/02/22-rdf-syntax-ns#Property"/>
</rdf:Description>
<rdf:Description rdf:about="#editorialNote">
<rdfs:label xml:lang="en">editorial note</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">A note for an editor, translator or maintainer of the vocabulary.</skos:definition>
<!-- S16 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#AnnotationProperty"/>
<!-- S17 -->
<rdfs:subPropertyOf rdf:resource="#note"/>
<!-- For non-OWL aware applications -->
<rdf:type rdf:resource="http://www.w3.org/1999/02/22-rdf-syntax-ns#Property"/>
</rdf:Description>
<rdf:Description rdf:about="#example">
<rdfs:label xml:lang="en">example</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">An example of the use of a concept.</skos:definition>
<!-- S16 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#AnnotationProperty"/>
<!-- S17 -->
<rdfs:subPropertyOf rdf:resource="#note"/>
<!-- For non-OWL aware applications -->
<rdf:type rdf:resource="http://www.w3.org/1999/02/22-rdf-syntax-ns#Property"/>
</rdf:Description>
<rdf:Description rdf:about="#historyNote">
<rdfs:label xml:lang="en">history note</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">A note about the past state/use/meaning of a concept.</skos:definition>
<!-- S16 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#AnnotationProperty"/>
<!-- S17 -->
<rdfs:subPropertyOf rdf:resource="#note"/>
<!-- For non-OWL aware applications -->
<rdf:type rdf:resource="http://www.w3.org/1999/02/22-rdf-syntax-ns#Property"/>
</rdf:Description>
<rdf:Description rdf:about="#scopeNote">
<rdfs:label xml:lang="en">scope note</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">A note that helps to clarify the meaning and/or the use of a concept.</skos:definition>
<!-- S16 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#AnnotationProperty"/>
<!-- S17 -->
<rdfs:subPropertyOf rdf:resource="#note"/>
<!-- For non-OWL aware applications -->
<rdf:type rdf:resource="http://www.w3.org/1999/02/22-rdf-syntax-ns#Property"/>
</rdf:Description>
<rdf:Description rdf:about="#semanticRelation">
<rdfs:label xml:lang="en">is in semantic relation with</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">Links a concept to a concept related by meaning.</skos:definition>
<skos:scopeNote xml:lang="en">This property should not be used directly, but as a super-property for all properties denoting a relationship of meaning between concepts.</skos:scopeNote>
<!-- S18 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#ObjectProperty"/>
<!-- S19 -->
<rdfs:domain rdf:resource="#Concept"/>
<!-- S20 -->
<rdfs:range rdf:resource="#Concept"/>
<!-- For non-OWL aware applications -->
<rdf:type rdf:resource="http://www.w3.org/1999/02/22-rdf-syntax-ns#Property"/>
</rdf:Description>
<rdf:Description rdf:about="#broader">
<rdfs:label xml:lang="en">has broader</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">Relates a concept to a concept that is more general in meaning.</skos:definition>
<rdfs:comment xml:lang="en">Broader concepts are typically rendered as parents in a concept hierarchy (tree).</rdfs:comment>
<skos:scopeNote xml:lang="en">By convention, skos:broader is only used to assert an immediate (i.e. direct) hierarchical link between two conceptual resources.</skos:scopeNote>
<!-- S18 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#ObjectProperty"/>
<!-- S22 -->
<rdfs:subPropertyOf rdf:resource="#broaderTransitive"/>
<!-- S25 -->
<owl:inverseOf rdf:resource="#narrower"/>
<!-- For non-OWL aware applications -->
<rdf:type rdf:resource="http://www.w3.org/1999/02/22-rdf-syntax-ns#Property"/>
</rdf:Description>
<rdf:Description rdf:about="#narrower">
<rdfs:label xml:lang="en">has narrower</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">Relates a concept to a concept that is more specific in meaning.</skos:definition>
<skos:scopeNote xml:lang="en">By convention, skos:broader is only used to assert an immediate (i.e. direct) hierarchical link between two conceptual resources.</skos:scopeNote>
<rdfs:comment xml:lang="en">Narrower concepts are typically rendered as children in a concept hierarchy (tree).</rdfs:comment>
<!-- S18 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#ObjectProperty"/>
<!-- S22 -->
<rdfs:subPropertyOf rdf:resource="#narrowerTransitive"/>
<!-- S25 -->
<owl:inverseOf rdf:resource="#broader"/>
<!-- For non-OWL aware applications -->
<rdf:type rdf:resource="http://www.w3.org/1999/02/22-rdf-syntax-ns#Property"/>
</rdf:Description>
<rdf:Description rdf:about="#related">
<rdfs:label xml:lang="en">has related</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">Relates a concept to a concept with which there is an associative semantic relationship.</skos:definition>
<!-- S18 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#ObjectProperty"/>
<!-- S21 -->
<rdfs:subPropertyOf rdf:resource="#semanticRelation"/>
<!-- S23 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#SymmetricProperty"/>
<!-- S27 (not formally stated) -->
<rdfs:comment xml:lang="en">skos:related is disjoint with skos:broaderTransitive</rdfs:comment>
<!-- For non-OWL aware applications -->
<rdf:type rdf:resource="http://www.w3.org/1999/02/22-rdf-syntax-ns#Property"/>
</rdf:Description>
<rdf:Description rdf:about="#broaderTransitive">
<rdfs:label xml:lang="en">has broader transitive</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition>skos:broaderTransitive is a transitive superproperty of skos:broader.</skos:definition>
<skos:scopeNote xml:lang="en">By convention, skos:broaderTransitive is not used to make assertions. Rather, the properties can be used to draw inferences about the transitive closure of the hierarchical relation, which is useful e.g. when implementing a simple query expansion algorithm in a search application.</skos:scopeNote>
<!-- S18 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#ObjectProperty"/>
<!-- S21 -->
<rdfs:subPropertyOf rdf:resource="#semanticRelation"/>
<!-- S24 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#TransitiveProperty"/>
<!-- S26 -->
<owl:inverseOf rdf:resource="#narrowerTransitive"/>
<!-- For non-OWL aware applications -->
<rdf:type rdf:resource="http://www.w3.org/1999/02/22-rdf-syntax-ns#Property"/>
</rdf:Description>
<rdf:Description rdf:about="#narrowerTransitive">
<rdfs:label xml:lang="en">has narrower transitive</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition>skos:narrowerTransitive is a transitive superproperty of skos:narrower.</skos:definition>
<skos:scopeNote xml:lang="en">By convention, skos:narrowerTransitive is not used to make assertions. Rather, the properties can be used to draw inferences about the transitive closure of the hierarchical relation, which is useful e.g. when implementing a simple query expansion algorithm in a search application.</skos:scopeNote>
<!-- S18 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#ObjectProperty"/>
<!-- S21 -->
<rdfs:subPropertyOf rdf:resource="#semanticRelation"/>
<!-- S24 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#TransitiveProperty"/>
<!-- S26 -->
<owl:inverseOf rdf:resource="#broaderTransitive"/>
<!-- For non-OWL aware applications -->
<rdf:type rdf:resource="http://www.w3.org/1999/02/22-rdf-syntax-ns#Property"/>
</rdf:Description>
<rdf:Description rdf:about="#member">
<rdfs:label xml:lang="en">has member</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">Relates a collection to one of its members.</skos:definition>
<!-- S30 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#ObjectProperty"/>
<!-- S31 -->
<rdfs:domain rdf:resource="#Collection"/>
<!-- S32 -->
<rdfs:range>
<owl:Class>
<owl:unionOf rdf:parseType="Collection">
<owl:Class rdf:about="#Concept"/>
<owl:Class rdf:about="#Collection"/>
</owl:unionOf>
</owl:Class>
</rdfs:range>
<!-- For non-OWL aware applications -->
<rdf:type rdf:resource="http://www.w3.org/1999/02/22-rdf-syntax-ns#Property"/>
</rdf:Description>
<rdf:Description rdf:about="#memberList">
<rdfs:label xml:lang="en">has member list</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">Relates an ordered collection to the RDF list containing its members.</skos:definition>
<!-- S30 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#ObjectProperty"/>
<!-- S33 -->
<rdfs:domain rdf:resource="#OrderedCollection"/>
<!-- S35 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#FunctionalProperty"/>
<!-- S34 -->
<rdfs:range rdf:resource="http://www.w3.org/1999/02/22-rdf-syntax-ns#List"/>
<!-- S36 (not formally stated) -->
<rdfs:comment xml:lang="en">For any resource, every item in the list given as the value of the
skos:memberList property is also a value of the skos:member property.</rdfs:comment>
<!-- For non-OWL aware applications -->
<rdf:type rdf:resource="http://www.w3.org/1999/02/22-rdf-syntax-ns#Property"/>
</rdf:Description>
<rdf:Description rdf:about="#mappingRelation">
<rdfs:label xml:lang="en">is in mapping relation with</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">Relates two concepts coming, by convention, from different schemes, and that have comparable meanings</skos:definition>
<rdfs:comment xml:lang="en">These concept mapping relations mirror semantic relations, and the data model defined below is similar (with the exception of skos:exactMatch) to the data model defined for semantic relations. A distinct vocabulary is provided for concept mapping relations, to provide a convenient way to differentiate links within a concept scheme from links between concept schemes. However, this pattern of usage is not a formal requirement of the SKOS data model, and relies on informal definitions of best practice.</rdfs:comment>
<!-- S38 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#ObjectProperty"/>
<!-- S39 -->
<rdfs:subPropertyOf rdf:resource="#semanticRelation"/>
<!-- For non-OWL aware applications -->
<rdf:type rdf:resource="http://www.w3.org/1999/02/22-rdf-syntax-ns#Property"/>
</rdf:Description>
<rdf:Description rdf:about="#broadMatch">
<rdfs:label xml:lang="en">has broader match</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">skos:broadMatch is used to state a hierarchical mapping link between two conceptual resources in different concept schemes.</skos:definition>
<!-- S38 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#ObjectProperty"/>
<!-- S40 -->
<rdfs:subPropertyOf rdf:resource="#mappingRelation"/>
<!-- S41 -->
<rdfs:subPropertyOf rdf:resource="#broader"/>
<!-- S43 -->
<owl:inverseOf rdf:resource="#narrowMatch"/>
<!-- For non-OWL aware applications -->
<rdf:type rdf:resource="http://www.w3.org/1999/02/22-rdf-syntax-ns#Property"/>
</rdf:Description>
<rdf:Description rdf:about="#narrowMatch">
<rdfs:label xml:lang="en">has narrower match</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">skos:narrowMatch is used to state a hierarchical mapping link between two conceptual resources in different concept schemes.</skos:definition>
<!-- S38 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#ObjectProperty"/>
<!-- S40 -->
<rdfs:subPropertyOf rdf:resource="#mappingRelation"/>
<!-- S41 -->
<rdfs:subPropertyOf rdf:resource="#narrower"/>
<!-- S43 -->
<owl:inverseOf rdf:resource="#broadMatch"/>
<!-- For non-OWL aware applications -->
<rdf:type rdf:resource="http://www.w3.org/1999/02/22-rdf-syntax-ns#Property"/>
</rdf:Description>
<rdf:Description rdf:about="#relatedMatch">
<rdfs:label xml:lang="en">has related match</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">skos:relatedMatch is used to state an associative mapping link between two conceptual resources in different concept schemes.</skos:definition>
<!-- S38 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#ObjectProperty"/>
<!-- S40 -->
<rdfs:subPropertyOf rdf:resource="#mappingRelation"/>
<!-- S41 -->
<rdfs:subPropertyOf rdf:resource="#related"/>
<!-- S44 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#SymmetricProperty"/>
<!-- For non-OWL aware applications -->
<rdf:type rdf:resource="http://www.w3.org/1999/02/22-rdf-syntax-ns#Property"/>
</rdf:Description>
<rdf:Description rdf:about="#exactMatch">
<rdfs:label xml:lang="en">has exact match</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">skos:exactMatch is used to link two concepts, indicating a high degree of confidence that the concepts can be used interchangeably across a wide range of information retrieval applications. skos:exactMatch is a transitive property, and is a sub-property of skos:closeMatch.</skos:definition>
<!-- S38 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#ObjectProperty"/>
<!-- S42 -->
<rdfs:subPropertyOf rdf:resource="#closeMatch"/>
<!-- S44 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#SymmetricProperty"/>
<!-- S45 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#TransitiveProperty"/>
<!-- S46 (not formally stated) -->
<rdfs:comment xml:lang="en">skos:exactMatch is disjoint with each of the properties skos:broadMatch and skos:relatedMatch.</rdfs:comment>
<!-- For non-OWL aware applications -->
<rdf:type rdf:resource="http://www.w3.org/1999/02/22-rdf-syntax-ns#Property"/>
</rdf:Description>
<rdf:Description rdf:about="#closeMatch">
<rdfs:label xml:lang="en">has close match</rdfs:label>
<rdfs:isDefinedBy rdf:resource="http://www.w3.org/2004/02/skos/core"/>
<skos:definition xml:lang="en">skos:closeMatch is used to link two concepts that are sufficiently similar that they can be used interchangeably in some information retrieval applications. In order to avoid the possibility of "compound errors" when combining mappings across more than two concept schemes, skos:closeMatch is not declared to be a transitive property.</skos:definition>
<!-- S38 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#ObjectProperty"/>
<!-- S40 -->
<rdfs:subPropertyOf rdf:resource="#mappingRelation"/>
<!-- S44 -->
<rdf:type rdf:resource="http://www.w3.org/2002/07/owl#SymmetricProperty"/>
<!-- For non-OWL aware applications -->
<rdf:type rdf:resource="http://www.w3.org/1999/02/22-rdf-syntax-ns#Property"/>
</rdf:Description>
</rdf:RDF>
File diff suppressed because it is too large Load Diff
@@ -0,0 +1,117 @@
# Regulatory Intelligence — small domain extension.
#
# This is schema, not data: no facts, figures, or claims live here. It adds
# the handful of classes/properties this use case needs that the vendored
# real ontologies (ORG, PROV-O, DCAT, SKOS, OWL-Time, FRBR — see external/)
# don't already provide, and aligns every new term to one of them rather
# than duplicating what they already model.
#
# - Regulation subClassOf dcat:Dataset (each ingested document is both)
# - RequirementClause a specific obligation extracted from a Regulation
# - Agency subClassOf org:Organization
# - Sector individuals are skos:Concept instances in regulatory_taxonomy.ttl
@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
@prefix org: <http://www.w3.org/ns/org#> .
@prefix dcat: <http://www.w3.org/ns/dcat#> .
@prefix prov: <http://www.w3.org/ns/prov#> .
@prefix skos: <http://www.w3.org/2004/02/skos/core#> .
@prefix time: <http://www.w3.org/2006/time#> .
@prefix frbr: <http://purl.org/vocab/frbr/core#> .
@prefix reg: <https://semantica.dev/cookbook/regulatory-intelligence/ontology#> .
<https://semantica.dev/cookbook/regulatory-intelligence/ontology>
a owl:Ontology ;
rdfs:label "Regulatory Intelligence — domain extension" ;
rdfs:comment "Small extension aligning Regulation/RequirementClause/Agency to the vendored ORG, DCAT, PROV-O, SKOS, OWL-Time, and FRBR ontologies." ;
owl:imports <http://www.w3.org/ns/org#> ,
<http://www.w3.org/ns/dcat#> ,
<http://www.w3.org/ns/prov#> ,
<http://www.w3.org/2004/02/skos/core#> ,
<http://www.w3.org/2006/time#> ,
<http://purl.org/vocab/frbr/core#> .
# ---- Classes ----------------------------------------------------------
reg:Regulation
a owl:Class ;
rdfs:subClassOf dcat:Dataset , prov:Entity ;
rdfs:label "Regulation" ;
rdfs:comment "A regulation, standard, executive order, memorandum, or governance guidance document ingested into the platform." .
reg:RequirementClause
a owl:Class ;
rdfs:subClassOf prov:Entity ;
rdfs:label "Requirement Clause" ;
rdfs:comment "A single obligation, control, or requirement extracted from a Regulation." .
reg:Agency
a owl:Class ;
rdfs:subClassOf org:Organization ;
rdfs:label "Agency" ;
rdfs:comment "A government agency or regulator (e.g. NIST, OMB, HHS, the Federal Reserve) that issues or is bound by a Regulation." .
# ---- Object properties --------------------------------------------------
reg:issuedBy
a owl:ObjectProperty ;
rdfs:domain reg:Regulation ;
rdfs:range reg:Agency ;
rdfs:label "issued by" .
reg:hasRequirement
a owl:ObjectProperty ;
rdfs:domain reg:Regulation ;
rdfs:range reg:RequirementClause ;
rdfs:label "has requirement" .
reg:appliesToSector
a owl:ObjectProperty ;
rdfs:domain reg:RequirementClause ;
rdfs:range skos:Concept ;
rdfs:label "applies to sector" ;
rdfs:comment "Links a requirement clause to a sector concept (e.g. Healthcare, Finance) in regulatory_taxonomy.ttl." .
reg:supersedes
a owl:ObjectProperty ;
rdfs:domain reg:Regulation ;
rdfs:range reg:Regulation ;
rdfs:label "supersedes" .
reg:amends
a owl:ObjectProperty ;
rdfs:domain reg:Regulation ;
rdfs:range reg:Regulation ;
rdfs:label "amends" .
reg:implements
a owl:ObjectProperty ;
rdfs:domain reg:Regulation ;
rdfs:range reg:Regulation ;
rdfs:label "implements" ;
rdfs:comment "e.g. an agency compliance plan implementing an OMB memorandum." .
reg:conflictsWith
a owl:ObjectProperty , owl:SymmetricProperty ;
rdfs:domain reg:RequirementClause ;
rdfs:range reg:RequirementClause ;
rdfs:label "conflicts with" .
reg:effectiveInterval
a owl:ObjectProperty ;
rdfs:domain reg:RequirementClause ;
rdfs:range time:Interval ;
rdfs:label "effective interval" ;
rdfs:comment "The requirement's validity window, modeled with OWL-Time rather than a bare date string." .
# ---- Datatype properties -------------------------------------------------
reg:sourceCitation
a owl:DatatypeProperty ;
rdfs:domain reg:RequirementClause ;
rdfs:range xsd:string ;
rdfs:label "source citation" ;
rdfs:comment "Human-readable citation (e.g. '45 CFR 164.306(a)(1)') pointing at the exact real-document location this clause was extracted from." .
@@ -0,0 +1,183 @@
# Regulatory Intelligence — SKOS taxonomy.
#
# Every concept below is lifted directly from a defined term, section
# heading, or function name that actually appears in one of the 9 real
# documents in data/raw/ (verified by text-searching the real PDFs/XML
# before writing this file — see skos:scopeNote on each concept for the
# exact source). This is schema/vocabulary, not data: no facts about the
# world are asserted here, only the controlled vocabulary used to tag them.
@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix skos: <http://www.w3.org/2004/02/skos/core#> .
@prefix regv: <https://semantica.dev/cookbook/regulatory-intelligence/vocabulary#> .
regv:RegulatoryTopics
a skos:ConceptScheme ;
skos:prefLabel "Regulatory Intelligence — Topic Vocabulary"@en ;
skos:definition "Controlled vocabulary of functions, safeguards, governance concepts, and sectors drawn directly from the 9 real documents ingested by this use case."@en .
# ---- NIST Cybersecurity Framework 2.0 — the six Functions ---------------
# Source: nist_csf_2.0.pdf (NIST CSWP 29)
regv:Govern
a skos:Concept ;
skos:inScheme regv:RegulatoryTopics ;
skos:topConceptOf regv:RegulatoryTopics ;
skos:prefLabel "Govern"@en ;
skos:definition "CSF 2.0 Function: establish and monitor the organization's cybersecurity risk management strategy, expectations, and policy."@en ;
skos:scopeNote "NIST CSWP 29 (CSF 2.0) — added relative to CSF 1.1."@en ;
skos:related regv:AIGovern .
regv:Identify
a skos:Concept ; skos:inScheme regv:RegulatoryTopics ; skos:topConceptOf regv:RegulatoryTopics ;
skos:prefLabel "Identify"@en ;
skos:definition "CSF Function: understand the organization's current cybersecurity risks."@en ;
skos:scopeNote "NIST CSWP 29 / nist.cswp.04162018 (CSF 1.1 and 2.0)."@en .
regv:Protect
a skos:Concept ; skos:inScheme regv:RegulatoryTopics ; skos:topConceptOf regv:RegulatoryTopics ;
skos:prefLabel "Protect"@en ;
skos:definition "CSF Function: use safeguards to manage the organization's cybersecurity risks."@en ;
skos:scopeNote "NIST CSWP 29 / nist.cswp.04162018 (CSF 1.1 and 2.0)."@en .
regv:Detect
a skos:Concept ; skos:inScheme regv:RegulatoryTopics ; skos:topConceptOf regv:RegulatoryTopics ;
skos:prefLabel "Detect"@en ;
skos:definition "CSF Function: find and analyze possible cybersecurity attacks and compromises."@en ;
skos:scopeNote "NIST CSWP 29 / nist.cswp.04162018 (CSF 1.1 and 2.0)."@en .
regv:Respond
a skos:Concept ; skos:inScheme regv:RegulatoryTopics ; skos:topConceptOf regv:RegulatoryTopics ;
skos:prefLabel "Respond"@en ;
skos:definition "CSF Function: take action regarding a detected cybersecurity incident."@en ;
skos:scopeNote "NIST CSWP 29 / nist.cswp.04162018 (CSF 1.1 and 2.0)."@en .
regv:Recover
a skos:Concept ; skos:inScheme regv:RegulatoryTopics ; skos:topConceptOf regv:RegulatoryTopics ;
skos:prefLabel "Recover"@en ;
skos:definition "CSF Function: restore assets and operations affected by a cybersecurity incident."@en ;
skos:scopeNote "NIST CSWP 29 / nist.cswp.04162018 (CSF 1.1 and 2.0)."@en .
# ---- NIST AI Risk Management Framework 1.0 — the four Functions ---------
# Source: nist_ai_rmf_1.0.pdf (NIST AI 100-1)
regv:AIGovern
a skos:Concept ; skos:inScheme regv:RegulatoryTopics ;
skos:prefLabel "Govern (AI RMF)"@en ;
skos:definition "AI RMF Function: cultivate a culture of AI risk management and establish accountability structures across the AI lifecycle."@en ;
skos:scopeNote "NIST AI 100-1 (AI RMF 1.0)."@en ;
skos:related regv:Govern .
regv:Map
a skos:Concept ; skos:inScheme regv:RegulatoryTopics ;
skos:prefLabel "Map"@en ;
skos:definition "AI RMF Function: establish the context to frame risks related to an AI system."@en ;
skos:scopeNote "NIST AI 100-1 (AI RMF 1.0)."@en .
regv:Measure
a skos:Concept ; skos:inScheme regv:RegulatoryTopics ;
skos:prefLabel "Measure"@en ;
skos:definition "AI RMF Function: employ quantitative, qualitative, or mixed-method tools to analyze and monitor AI risk."@en ;
skos:scopeNote "NIST AI 100-1 (AI RMF 1.0)."@en .
regv:Manage
a skos:Concept ; skos:inScheme regv:RegulatoryTopics ;
skos:prefLabel "Manage"@en ;
skos:definition "AI RMF Function: allocate resources to mapped and measured risks on a regular basis."@en ;
skos:scopeNote "NIST AI 100-1 (AI RMF 1.0)."@en .
# ---- HIPAA Security Rule safeguard categories ----------------------------
# Source: hipaa_security_rule_45cfr164_subpart_c.xml (45 CFR 164.308/.310/.312/.314)
regv:AdministrativeSafeguards
a skos:Concept ; skos:inScheme regv:RegulatoryTopics ; skos:topConceptOf regv:RegulatoryTopics ;
skos:prefLabel "Administrative Safeguards"@en ;
skos:definition "Administrative actions, policies, and procedures to manage the selection, development, and execution of security measures to protect ePHI."@en ;
skos:scopeNote "45 CFR 164.308."@en .
regv:PhysicalSafeguards
a skos:Concept ; skos:inScheme regv:RegulatoryTopics ; skos:topConceptOf regv:RegulatoryTopics ;
skos:prefLabel "Physical Safeguards"@en ;
skos:definition "Physical measures, policies, and procedures to protect electronic information systems and related buildings/equipment from hazards and unauthorized intrusion."@en ;
skos:scopeNote "45 CFR 164.310."@en .
regv:TechnicalSafeguards
a skos:Concept ; skos:inScheme regv:RegulatoryTopics ; skos:topConceptOf regv:RegulatoryTopics ;
skos:prefLabel "Technical Safeguards"@en ;
skos:definition "The technology and policy/procedures for its use that protect ePHI and control access to it."@en ;
skos:scopeNote "45 CFR 164.312."@en .
regv:OrganizationalRequirements
a skos:Concept ; skos:inScheme regv:RegulatoryTopics ; skos:topConceptOf regv:RegulatoryTopics ;
skos:prefLabel "Organizational Requirements"@en ;
skos:definition "Requirements governing business associate contracts and other arrangements involving ePHI."@en ;
skos:scopeNote "45 CFR 164.314."@en .
# ---- OMB M-24-10 AI governance concepts ----------------------------------
# Source: omb_m24-10_ai_governance.pdf
regv:Transparency
a skos:Concept ; skos:inScheme regv:RegulatoryTopics ; skos:topConceptOf regv:RegulatoryTopics ;
skos:prefLabel "Transparency"@en ;
skos:definition "Public disclosure obligations for agency AI use, including AI use case inventories."@en ;
skos:scopeNote "OMB Memorandum M-24-10."@en .
regv:RightsImpactingAI
a skos:Concept ; skos:inScheme regv:RegulatoryTopics ;
skos:prefLabel "Rights-Impacting AI"@en ;
skos:broader regv:RiskClassification ;
skos:definition "AI whose output serves as a principal basis for a decision or action with a legal, material, or similarly significant effect on a person's civil rights or liberties."@en ;
skos:scopeNote "OMB Memorandum M-24-10."@en .
regv:SafetyImpactingAI
a skos:Concept ; skos:inScheme regv:RegulatoryTopics ;
skos:prefLabel "Safety-Impacting AI"@en ;
skos:broader regv:RiskClassification ;
skos:definition "AI whose output serves as a principal basis for a decision or action that has the potential to significantly impact the safety of human life or well-being."@en ;
skos:scopeNote "OMB Memorandum M-24-10."@en .
regv:RiskClassification
a skos:Concept ; skos:inScheme regv:RegulatoryTopics ; skos:topConceptOf regv:RegulatoryTopics ;
skos:prefLabel "Risk Classification"@en ;
skos:definition "Categorizing an AI use case by the severity of its potential impact, driving which minimum risk-management practices apply."@en ;
skos:scopeNote "OMB Memorandum M-24-10; NIST AI 600-1."@en ;
skos:narrower regv:RightsImpactingAI , regv:SafetyImpactingAI .
regv:ChiefAIOfficer
a skos:Concept ; skos:inScheme regv:RegulatoryTopics ;
skos:prefLabel "Chief AI Officer"@en ;
skos:altLabel "CAIO"@en ;
skos:definition "The senior official each covered agency must designate to coordinate AI use and governance."@en ;
skos:scopeNote "OMB Memorandum M-24-10 (full term); Federal Reserve compliance plan (uses the abbreviation \"CAIO\")."@en .
# ---- NIST AI 600-1 Generative AI Profile concepts ------------------------
# Source: nist_ai_600-1_genai_profile.pdf
regv:ContentProvenance
a skos:Concept ; skos:inScheme regv:RegulatoryTopics ; skos:topConceptOf regv:RegulatoryTopics ;
skos:prefLabel "Content Provenance"@en ;
skos:definition "Tracking the origin and history of generative-AI content, e.g. via metadata or watermarking, to distinguish it from human-generated content."@en ;
skos:scopeNote "NIST AI 600-1."@en .
regv:Confabulation
a skos:Concept ; skos:inScheme regv:RegulatoryTopics ; skos:topConceptOf regv:RegulatoryTopics ;
skos:prefLabel "Confabulation"@en ;
skos:altLabel "Hallucination"@en ;
skos:definition "Confidently produced but erroneous or fabricated content generated by an AI system."@en ;
skos:scopeNote "NIST AI 600-1."@en .
# ---- Sectors --------------------------------------------------------------
# Used via reg:appliesToSector on RequirementClause instances.
regv:Healthcare
a skos:Concept ; skos:inScheme regv:RegulatoryTopics ; skos:topConceptOf regv:RegulatoryTopics ;
skos:prefLabel "Healthcare"@en ;
skos:definition "The healthcare / public health sector."@en ;
skos:scopeNote "Sector governed by 45 CFR 164 Subpart C and NIST SP 800-66."@en .
regv:FinancialServices
a skos:Concept ; skos:inScheme regv:RegulatoryTopics ; skos:topConceptOf regv:RegulatoryTopics ;
skos:prefLabel "Financial Services"@en ;
skos:definition "The financial services sector."@en ;
skos:scopeNote "Sector addressed by the Federal Reserve's OMB M-24-10 compliance plan."@en .
+7
View File
@@ -52,6 +52,13 @@ Deep dive into advanced features, customization, and complex workflows.
- **[Temporal Knowledge Graphs](https://github.com/semantica-agi/semantica/blob/main/cookbook/advanced/10_Temporal_Knowledge_Graphs.ipynb)** — Modeling and querying data that changes over time. Topics: Time Series, Temporal Logic, Allen Algebra · *Advanced*
## Use Cases
Self-contained, end-to-end examples built from real public data and real external ontologies, not synthetic samples. Each one is a folder with its own `data/` (source documents + download script) and `ontology/` (vendored real ontologies + a small domain extension) alongside the notebook.
- **[Regulatory Intelligence](https://github.com/semantica-agi/semantica/blob/main/cookbook/use_cases/regulatory_intelligence/README.md)** — Turns 9 real U.S. federal AI-governance and cybersecurity-regulation documents (NIST AI RMF, NIST CSF 1.1/2.0, HIPAA Security Rule, Executive Order 14110, OMB M-24-10, and more) into an explainable, ontology-driven knowledge graph. Full pipeline: ingestion, chunking every document, automatic entity/relation/triplet extraction across the corpus, ontology import/generation/evaluation, entity resolution, graph construction, SHACL validation, deterministic rule-based reasoning, PROV-O provenance, a persistent RDF database (Oxigraph on disk, plus Semantica's `TripletStore` for a production server), conflict detection, temporal reasoning, SPARQL, JSON-LD, GraphRAG, and a five-agent Decision Intelligence workflow, reusing real W3C ontologies (ORG, PROV-O, SKOS, DCAT, OWL-Time, FRBR). Topics: Regulatory Intelligence, Decision Intelligence, Explainable AI · *Advanced*
## How to Run
<Steps>
@@ -0,0 +1,167 @@
import unittest
from datetime import datetime
# Replicates the core pipeline of
# cookbook/use_cases/regulatory_intelligence/notebook/regulatory_intelligence.ipynb
# against tiny fixtures so it stays fast and network-free in CI. The fixture
# text below is copied verbatim from the real, committed documents in
# data/raw/ (verified against the real PDF/XML text when the notebook was
# built) — not synthetic sentences — so even this test exercises real
# regulatory language, not invented text.
try:
from semantica.context import ContextGraph
from semantica.ontology import OntologyGenerator, SHACLGenerator, PropertyShape
from semantica.ontology.ontology_validator import _run_pyshacl
from semantica.conflicts import ConflictDetector
from semantica.context import PolicyEngine
from semantica.context.decision_models import Policy, Decision
except ImportError as e:
print(f"Skipping imports due to missing dependencies: {e}")
# Real excerpts, verified to occur verbatim in the real ingested documents.
REAL_EXCERPT_CSF2_GOVERN = "GOVERN addresses an understanding" # NIST CSWP 29 (CSF 2.0)
REAL_EXCERPT_HIPAA_306 = (
"Ensure the confidentiality, integrity, and availability of all electronic "
"protected health information"
) # 45 CFR 164.306
class TestRegulatoryIntelligence(unittest.TestCase):
def setUp(self):
self.graph = ContextGraph(advanced_analytics=False)
self.graph.add_node("agency:NIST", "reg:Agency", content="NIST", name="NIST")
self.graph.add_node(
"reg:nist_csf_2.0", "reg:Regulation", content="nist_csf_2.0", doc_id="nist_csf_2.0"
)
self.graph.add_edge("reg:nist_csf_2.0", "agency:NIST", edge_type="issuedBy")
self.graph.add_node(
"clause:csf2_govern",
"reg:RequirementClause",
content=REAL_EXCERPT_CSF2_GOVERN,
source_citation="NIST CSWP 29 (CSF 2.0), Govern Function",
sector="Cross-sector",
)
self.graph.add_edge("reg:nist_csf_2.0", "clause:csf2_govern", edge_type="hasRequirement")
def _to_ontology_input(self, graph_dict):
entities = [
{
"id": n["id"],
"type": n["type"].split(":")[-1],
"name": n.get("content") or n["id"],
**n.get("properties", {}),
}
for n in graph_dict["nodes"]
]
relationships = [
{"source": e["source"], "target": e["target"], "type": e["type"]}
for e in graph_dict["edges"]
]
return {"entities": entities, "relationships": relationships}
def test_graph_construction(self):
graph_dict = self.graph.to_dict()
self.assertEqual(len(graph_dict["nodes"]), 3)
self.assertEqual(len(graph_dict["edges"]), 2)
# The real excerpt must survive unmodified into the graph.
clause_node = next(n for n in graph_dict["nodes"] if n["id"] == "clause:csf2_govern")
self.assertEqual(clause_node["content"], REAL_EXCERPT_CSF2_GOVERN)
def test_shacl_validation_catches_missing_citation(self):
REG_BASE = "https://semantica.dev/cookbook/regulatory-intelligence/ontology#"
SHAPES_BASE = "https://semantica.dev/cookbook/regulatory-intelligence/shapes/"
graph_dict = self.graph.to_dict()
kg_ontology = OntologyGenerator(base_uri=REG_BASE, min_occurrences=1).generate_from_graph(
self._to_ontology_input(graph_dict), name="TestOntology"
)
shacl_gen = SHACLGenerator(base_uri=SHAPES_BASE, severity="Violation")
shacl_graph = shacl_gen.generate(kg_ontology)
clause_shape = next(
ns for ns in shacl_graph.node_shapes if "requirementclause" in ns.target_class.lower()
)
clause_class_uri = f"{SHAPES_BASE}{clause_shape.target_class}"
clause_shape.property_shapes.append(
PropertyShape(path=f"{SHAPES_BASE}source_citation", min_count=1, severity="Violation")
)
shacl_ttl = shacl_gen.serialize(shacl_graph, format="turtle")
data_ttl = f"""
@prefix ex: <{SHAPES_BASE}> .
<urn:clause:complete> a <{clause_class_uri}> ;
ex:source_citation "45 CFR 164.306" .
<urn:clause:incomplete> a <{clause_class_uri}> .
"""
report = _run_pyshacl(data_ttl, shacl_ttl, data_graph_format="turtle", shacl_format="turtle")
self.assertFalse(report.conforms)
self.assertGreaterEqual(report.violation_count, 1)
self.assertTrue(
any("incomplete" in v.focus_node for v in report.violations),
"Expected the incomplete clause to be flagged, not the complete one",
)
def test_conflict_detection_between_real_frameworks(self):
# OMB M-24-10's binary rights/safety-impacting classification vs.
# NIST AI 600-1's continuous risk-profile approach — a genuine,
# documented methodological difference between two real frameworks.
entities = [
{
"id": "ai_risk_classification_approach",
"entity_id": "ai_risk_classification_approach",
"classification_method": "binary_rights_safety_impacting",
},
{
"id": "ai_risk_classification_approach",
"entity_id": "ai_risk_classification_approach",
"classification_method": "continuous_profile_based",
},
]
detector = ConflictDetector()
conflicts = detector.detect_conflicts(
entities, method="value", property_name="classification_method"
)
self.assertEqual(len(conflicts), 1)
self.assertEqual(
set(conflicts[0].conflicting_values),
{"binary_rights_safety_impacting", "continuous_profile_based"},
)
def test_policy_gated_decision_recording(self):
policy_engine = PolicyEngine(graph_store=self.graph)
policy = Policy(
policy_id="",
name="AI Use Case Risk Governance",
description="Derived from OMB M-24-10's rights/safety-impacting AI risk-classification criteria.",
rules={"requires_caio_review": True},
category="ai_governance",
version="1.0",
created_at=datetime.now(),
updated_at=datetime.now(),
)
policy_id = policy_engine.add_policy(policy)
self.assertTrue(policy_id)
decision = Decision(
decision_id="",
category="ai_governance_review",
scenario="Hospital deploying an AI-based patient triage assistant",
reasoning="Test reasoning citing real requirement clauses.",
outcome="pending_review",
confidence=0.85,
timestamp=datetime.now(),
decision_maker="decision_agent",
metadata={"sector": "Healthcare"},
)
# check_compliance returns a plain bool, not a violations object.
compliant = policy_engine.check_compliance(decision, policy_id)
self.assertIsInstance(compliant, bool)
if __name__ == "__main__":
unittest.main()