fix(ms-ai-architect): RX-REG² nudifiers/CSAM Art. 5-forbud — caveatet KB-tillegg (verifisert, avventer OJ) [skip-docs]

Digital Omnibus legger til nytt Art. 5-forbud mot AI som genererer/manipulerer
NCII eller CSAM (nudifier-apper), anvendelse 2026-12-02. Substans + dato verifisert
mot EU-rådet 2026-06-29 + Gibson Dunn/Freshfields-analyser. Eksakt underpunkt +
boetenivaa kan ikke pinnes foer OJ — caveatet «avventer OJ», ingen fabrikkert (i)/figur.

- classification-methodology: caveat-notis under Art. 5-forbudstabellen
- ai-act-assessor: «8 forbudte praksiser» → «8 i kraft + nudifiers/CSAM avventer OJ»
- reg-lint seksjon #11 (2 tester): preventiv mekanisme (gap-disiplin)

tests/kb-update/test-governance-refs-reg-lint.test.mjs

@@ -310,3 +310,39 @@ test('provider-obligations: extended log retention cites arkivlovgivning, not «
     'retention follows arkivlovgivning (arkivlova/bevaringsforskrifta), not forvaltningsloven');
   assert.ok(/arkivlova/i.test(md), 'arkivlova cited as the retention basis');
 });
+
+// --- 11. RX-REG² — new Art. 5 nudifiers/NCII/CSAM prohibition (Digital Omnibus,
+//         adopted, PENDING OJ; verified 2026-07-15 against the EU Council
+//         2026-06-29 final-green-light press release + Gibson Dunn / Freshfields
+//         Omnibus analyses) ---
+// Ground truth this session: the Digital Omnibus adds a new Art. 5 prohibited
+// practice against AI that generates or manipulates non-consensual intimate
+// imagery (NCII) or child sexual abuse material (CSAM) — "nudifier" apps. Both
+// placing on market AND use are banned; for providers it extends to reasonably
+// foreseeable, reproducible generation without significant technical modification
+// where adequate safeguards are absent. Safe harbour for effective preventive
+// safeguards, consent-based intimate content, lawful CSAM detection/moderation,
+// and underlying-capability development. Application from 2026-12-02.
+// The EXACT Art. 5 subparagraph AND the fine tier cannot be pinned pre-OJ — the
+// KB must caveat them («avventer OJ»), never fabricate a letter or a figure.
+// Canonical machine note: scripts/kb-update/data/ai-act-deadlines.json (pending_oj).
+
+test('classification-methodology: carries the Omnibus nudifiers/NCII/CSAM Art. 5 prohibition, correctly caveated', () => {
+  const md = read('ai-act-classification-methodology.md');
+  assert.ok(/nudifier/i.test(md), 'nudifier apps named');
+  assert.ok(/NCII|ikke-samtykkebasert intimt innhold/i.test(md), 'NCII / non-consensual intimate content present');
+  assert.ok(/CSAM/.test(md), 'CSAM present');
+  assert.ok(/markedsplassering og bruk/.test(md), 'both placing-on-market and use are banned');
+  assert.ok(/2\. desember 2026/.test(md), 'application date 2026-12-02 present');
+  assert.ok(/avventer OJ|bekreftes mot OJ/i.test(md), 'exact subparagraph + fine tier caveated pending OJ');
+  // Pre-OJ we must NOT fabricate the final subparagraph letter or a fine figure.
+  assert.ok(!/Art\. 5\(1\)\(i\)/.test(md), 'exact Art. 5 subparagraph is pending OJ — do not assert (i)');
+});
+
+test('ai-act-assessor: Art. 5 check reflects the pending-OJ nudifiers prohibition, not a closed «8»', () => {
+  const md = readFileSync(new URL('agents/ai-act-assessor.md', pluginRoot), 'utf8');
+  assert.ok(!/de 8 forbudte praksisene/.test(md),
+    'Art. 5 list = 8 in-force + nudifiers/CSAM pending OJ — not a closed «8 forbudte praksiser»');
+  assert.ok(/nudifiers|CSAM/i.test(md), 'assessor names the pending-OJ prohibition');
+  assert.ok(/avventer OJ/i.test(md), 'assessor caveats it as pending OJ');
+});