feat(regulatory): add African regulatory compliance metadata for NDPA, POPIA, KDPA, Ghana DPA, and NFIU AML

[kingztech2019]

Description

Adds first-class support for African data protection and financial regulatory compliance metadata in generated AIBOMs. This is the first jurisdiction-specific regulatory extension for the project, establishing the `owasp:aibom:regulatory:` namespace and a pattern that future regional compliance modules (EU AI Act, APAC, LATAM) can follow.

Background

Africa is the fastest-growing AI deployment region in the world but is largely absent from AI transparency tooling. Six African data protection laws are now in force — Nigeria NDPA 2023, South Africa POPIA, Kenya KDPA 2019, Ghana DPA 2012, Rwanda DPA 2021, and Egypt PDPL 2020 — with more following the African Union Data Policy Framework. Teams deploying AI across these jurisdictions currently have no structured way to assert compliance in their AIBOMs. This PR adds support for all six.

Changes

`src/models/field_registry.json` — 9 new fields

Field	Tier	Jurisdiction / Scope
`africanDeploymentJurisdictions`	important	All — ISO 3166-1 alpha-2 list of African deployment jurisdictions
`ndpaCompliance`	supplementary	Nigeria Data Protection Act 2023 (NITDA §25, §32)
`nfiuAmlCompliance`	supplementary	Nigeria NFIU AML/CFT for CBN-licensed financial AI
`popiaCompliance`	supplementary	South Africa POPIA 2013 (Information Regulator, §11, §71)
`kdpaCompliance`	supplementary	Kenya Data Protection Act 2019 (ODPC registration)
`gdpaCompliance`	supplementary	Ghana Data Protection Act 2012 / Act 843
`rwandaDpaCompliance`	supplementary	Rwanda Law No. 058/2021 (NCSA registration, Article 12)
`egyptPdplCompliance`	supplementary	Egypt PDPL No. 151/2020 (PDPA registration, Article 23)
`regulatoryContactPoint`	supplementary	DPO contact — required under NDPA §31, POPIA §55, KDPA §24

`africanDeploymentJurisdictions` is tier `important` and added to the Advanced completeness profile, so any Advanced-scored AIBOM for an African-deployed model will surface it as missing. All eight jurisdiction fields include statutory citations in their `recommendation` text.

`src/models/service.py`

• New `_build_regulatory_properties(regulatory_metadata)` static method — maps snake_case input keys to `owasp:aibom:regulatory:*` CycloneDX properties; list values (e.g. `["NG", "ZA"]`) are joined as comma-separated strings
• `generate_aibom()` and `_create_aibom_structure()` accept a new `regulatory_metadata: Optional[Dict[str, Any]]` parameter
• Properties injected at `$.metadata.properties` (not `modelCard`) — compliance context is a BOM-level assertion, not a model card attribute

`src/models/schemas.py`

• `GenerateRequest.regulatory_metadata: Optional[Dict[str, Any]]` — API callers can pass compliance metadata alongside a generation request

`tests/test_regulatory_compliance.py` — 21 new tests

• `TestBuildRegulatoryProperties` (10) — property construction, namespace correctness, list joining, None/unknown key skipping, Rwanda and Egypt specific assertions
• `TestRegulatoryFieldRegistry` (4) — scoring impact, missing field reporting, field checklist presence for all 9 fields
• `TestRegulatoryMetadataInjection` (3) — end-to-end injection, clean baseline, full Nigerian fintech fixture
• `TestGenerateRequestSchema` (3) — schema validation

All 95 existing tests continue to pass.

Usage Example

```python
aibom = service.generate_aibom(
"org/fraud-detection-model",
regulatory_metadata={
"african_deployment_jurisdictions": ["NG", "ZA", "KE"],
"ndpa_compliance": "registered; nitda_reg=NITDA/REG/2025/001; lawful_basis=legitimate_interests_ndpa_s25; dpia=completed",
"nfiu_aml_compliance": "cbn_licensed; aml_assessed=true; explainability_review=completed",
"popia_compliance": "registered; information_officer=appointed",
"kdpa_compliance": "registered; odpc_registration=active",
"regulatory_contact_point": "dpo@example.com",
},
)

Properties appear at: aibom["metadata"]["properties"]

with names: owasp:aibom:regulatory:africanDeploymentJurisdictions, etc.

```

Type of Change

• New feature (non-breaking addition)

Packages / Files Affected

• `src/models/field_registry.json`
• `src/models/service.py`
• `src/models/schemas.py`
• `tests/test_regulatory_compliance.py` (new)

References

• Nigeria NDPA 2023: https://nitda.gov.ng/wp-content/uploads/2023/03/NigeriaDataProtectionAct2023.pdf
• South Africa POPIA: https://www.justice.gov.za/inforeg/legal.html
• Kenya KDPA 2019: https://www.odpc.go.ke/
• Ghana DPA 2012: https://www.dpc.gov.gh/
• Rwanda Law No. 058/2021: https://www.ncsa.rw/
• Egypt PDPL No. 151/2020: https://pdpa.gov.eg/
• AU Data Policy Framework: https://au.int/en/documents/20210309/african-union-data-policy-framework
• NFIU Regulations: https://nfiu.gov.ng/

AI Assistance

This contribution was developed with Claude (Anthropic) as a coding assistant. All code has been reviewed, tested, and is submitted under the Apache 2.0 license.