feat: add legislation explainer app

Co-authored-by: Codex <codex@openai.com>

app.py

@@ -0,0 +1,933 @@
+"""Gradio entrypoint for the Legislation Explainer app."""
+
+from __future__ import annotations
+
+import html
+from pathlib import Path
+from uuid import uuid4
+from typing import Any
+
+import gradio as gr
+
+from config import APP_DESCRIPTION, APP_TITLE, DEFAULT_PROVIDER
+from services.example_bills import example_bill_titles, example_bill_urls_by_title
+from services import ingest
+from services.providers import get_default_api_key, instantiate_client, list_providers, validate_api_key
+from services.rag_pipeline import (
+    AnalysisResult,
+    answer_query,
+    answer_query_from_full_document,
+    build_cached_document_artifacts,
+    generate_analysis_progress,
+    get_precomputed_example_artifacts,
+    prepare_document_artifacts,
+    warm_embedding_stack,
+)
+
+
+def _provider_options() -> list[tuple[str, str, str]]:
+    return [(config.name, config.display_name, config.instructions) for config in list_providers()]
+
+
+PROVIDER_OPTIONS = _provider_options()
+PROVIDER_LABELS = [display for _, display, _ in PROVIDER_OPTIONS]
+PROVIDER_BY_LABEL = {display: name for name, display, _ in PROVIDER_OPTIONS}
+PROVIDER_DETAILS = {name: description for name, _, description in PROVIDER_OPTIONS}
+PROVIDER_LABEL_BY_NAME = {name: display for name, display, _ in PROVIDER_OPTIONS}
+ANALYSIS_PLACEHOLDER = "Run an analysis to populate this section."
+EXAMPLE_BILL_LABELS = example_bill_titles()
+EXAMPLE_BILL_URLS = example_bill_urls_by_title()
+APP_THEME = gr.themes.Soft(
+    primary_hue="sky",
+    secondary_hue="slate",
+    neutral_hue="stone",
+).set(
+    body_background_fill="linear-gradient(180deg, #f7fafc 0%, #edf4f7 100%)",
+    block_background_fill="rgba(255, 255, 255, 0.88)",
+    block_border_color="#d7e3ea",
+    block_shadow="0 18px 48px rgba(15, 23, 42, 0.06)",
+    button_primary_background_fill="linear-gradient(135deg, #7dd3fc 0%, #67e8f9 100%)",
+    button_primary_background_fill_hover="linear-gradient(135deg, #38bdf8 0%, #22d3ee 100%)",
+    button_primary_border_color="#7dd3fc",
+    button_secondary_background_fill="#f8fafc",
+    button_secondary_background_fill_hover="#eef6f8",
+)
+APP_HEAD = """
+<script>
+(() => {
+  function toggleSidebar() {
+    const sidebar = document.getElementById("sidebar-panel");
+    if (!sidebar) {
+      return;
+    }
+    const isHidden = sidebar.style.display === "none";
+    sidebar.style.display = isHidden ? "" : "none";
+  }
+
+  window.__toggleSidebar = toggleSidebar;
+})();
+</script>
+"""
+APP_CSS = """
+#app-shell {
+    background: transparent;
+}
+#layout-shell {
+    gap: 1.25rem;
+    align-items: flex-start;
+}
+#topbar-row {
+    justify-content: flex-start;
+    align-items: center;
+    margin-bottom: 0.75rem;
+}
+#sidebar-toggle-shell {
+    width: auto;
+}
+#sidebar-toggle-shell > div {
+    width: auto !important;
+}
+#sidebar-toggle-icon {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    width: 2.75rem;
+    height: 1.75rem;
+    border: 1px solid var(--button-secondary-border-color);
+    border-radius: 5px;
+    background: var(--button-secondary-background-fill);
+    cursor: pointer;
+    transition: background-color 0.2s ease, border-color 0.2s ease;
+}
+#sidebar-toggle-icon:hover {
+    background: var(--button-secondary-background-fill-hover);
+}
+#sidebar-toggle-icon svg {
+    width: 1.35rem;
+    height: 1.35rem;
+    stroke: #6b7280;
+}
+#sidebar-toggle {
+    display: none;
+}
+#sidebar-panel {
+    max-width: 360px;
+    position: sticky;
+    top: 1rem;
+    align-self: flex-start;
+    border-radius: 16px;
+    overflow: hidden;
+}
+#main-panel {
+    min-width: 0;
+}
+#analysis-panel,
+#chat-panel {
+    border: 1px solid var(--block-border-color);
+    border-radius: 16px;
+    padding: 1rem;
+    backdrop-filter: blur(12px);
+}
+#analysis-output {
+    min-height: 100px;
+}
+#status-output,
+#chat-status {
+    min-height: 1.5rem;
+}
+#view-document-shell {
+    margin-top: 0.5rem;
+}
+#view-document-shell .view-document-link,
+#view-document-shell .view-document-link-disabled {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    gap: 0.45rem;
+    width: 100%;
+    min-height: 2.75rem;
+    padding: 0.7rem 1rem;
+    border-radius: 0.6rem;
+    border: 1px solid var(--button-secondary-border-color);
+    font-weight: 600;
+    text-decoration: none;
+    box-sizing: border-box;
+}
+#view-document-shell .view-document-link {
+    color: inherit;
+    background: var(--button-secondary-background-fill);
+}
+#view-document-shell .view-document-link:hover {
+    background: var(--button-secondary-background-fill-hover);
+}
+#view-document-shell .view-document-link-disabled {
+    color: inherit;
+    background: var(--button-secondary-background-fill);
+    cursor: not-allowed;
+    pointer-events: none;
+}
+#view-document-shell .view-document-link-disabled svg {
+    opacity: 0.9;
+}
+#view-document-shell svg {
+    width: 0.95rem;
+    height: 0.95rem;
+    flex: 0 0 auto;
+}
+#example-bills-heading {
+    display: flex;
+    align-items: center;
+    gap: 0.35rem;
+    margin-bottom: 0.35rem;
+}
+#example-bills-heading p {
+    margin: 0;
+}
+#example-bills-info {
+    position: relative;
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    width: 1rem;
+    height: 1rem;
+    border: 1px solid #94a3b8;
+    border-radius: 999px;
+    color: #64748b;
+    font-size: 0.72rem;
+    font-weight: 700;
+    line-height: 1;
+    cursor: help;
+}
+#example-bills-info::after {
+    content: attr(data-tooltip);
+    position: absolute;
+    left: calc(100% + 0.45rem);
+    top: 50%;
+    transform: translateY(-50%);
+    width: 240px;
+    padding: 0.6rem 0.7rem;
+    border-radius: 0.6rem;
+    background: rgba(15, 23, 42, 0.96);
+    color: #f8fafc;
+    font-size: 0.78rem;
+    font-weight: 500;
+    line-height: 1.35;
+    opacity: 0;
+    visibility: hidden;
+    pointer-events: none;
+    box-shadow: 0 12px 28px rgba(15, 23, 42, 0.22);
+    transition: opacity 0.18s ease;
+    z-index: 10;
+}
+#example-bills-info:hover::after,
+#example-bills-info:focus-visible::after {
+    opacity: 1;
+    visibility: visible;
+}
+#app-shell .label-wrap,
+#app-shell .label-wrap > *,
+#app-shell label,
+#app-shell legend,
+#app-shell [data-testid="block-label"] {
+    background: transparent !important;
+    box-shadow: none !important;
+}
+"""
+
+_GRADIO_SESSION_CACHE: dict[str, dict[str, Any]] = {}
+
+
+def _empty_session() -> dict[str, Any]:
+    return {"session_id": uuid4().hex}
+
+
+def _session_record(session_state: dict[str, Any] | None) -> dict[str, Any]:
+    session_state = session_state or _empty_session()
+    session_id = session_state.get("session_id")
+    if not session_id:
+        session_id = uuid4().hex
+        session_state["session_id"] = session_id
+    return _GRADIO_SESSION_CACHE.setdefault(
+        session_id,
+        {
+            "api_config": None,
+            "analysis": None,
+            "vector_store": None,
+            "doc_text": None,
+            "chat_history": [],
+            "pending_deeper_question": None,
+            "source_url": None,
+        },
+    )
+
+
+def _resolve_provider(use_advanced: bool, provider_label: str | None) -> str:
+    return DEFAULT_PROVIDER
+    # Proposed future expansion: restore bring-your-own provider selection.
+    # if not use_advanced:
+    #     return DEFAULT_PROVIDER
+    # if not provider_label:
+    #     return DEFAULT_PROVIDER
+    # return PROVIDER_BY_LABEL.get(provider_label, DEFAULT_PROVIDER)
+
+
+def _resolve_api_key(provider: str, use_advanced: bool, qwen_key: str | None, custom_key: str | None) -> str | None:
+    return qwen_key or get_default_api_key(provider)
+    # Proposed future expansion: restore bring-your-own provider API keys.
+    # if not use_advanced and provider == DEFAULT_PROVIDER:
+    #     return qwen_key or get_default_api_key(provider)
+    # return custom_key or get_default_api_key(provider)
+
+
+def _ingest_sources(file_path: str | None, url: str | None) -> str:
+    chunks = []
+    if file_path:
+        path = Path(file_path)
+        chunks.append(ingest.ingest_file(path.name, path.read_bytes()))
+    if url and url.strip():
+        chunks.append(ingest.fetch_url_content(url.strip()))
+    if not chunks:
+        raise ingest.IngestionError("Provide a file or URL to analyze.")
+    return ingest.combine_sources(chunks)
+
+
+def _escape_md_cell(value: str) -> str:
+    return str(value).replace("|", "\\|").replace("\n", " ").strip()
+
+
+def _markdown_bullets(items: list[str]) -> str:
+    if not items:
+        return "-"
+    return "\n".join(f"- {_escape_md_cell(item) or '—'}" for item in items)
+
+
+def _analysis_attr(analysis: AnalysisResult, field: str, default: Any) -> Any:
+    return getattr(analysis, field, default)
+
+
+def _swot_attr(analysis: AnalysisResult, field: str) -> list[str]:
+    swot = _analysis_attr(analysis, "swot", None)
+    return getattr(swot, field, []) if swot is not None else []
+
+
+def _format_table_rows(rows: list[list[str]], column_count: int) -> str:
+    if not rows:
+        return "| " + " | ".join(["—"] * column_count) + " |"
+    return "\n".join("| " + " | ".join(_escape_md_cell(cell) or "—" for cell in row) + " |" for row in rows)
+
+
+def _format_analysis(analysis: AnalysisResult | None) -> str:
+    if analysis is None:
+        return ANALYSIS_PLACEHOLDER
+
+    executive_summary = _escape_md_cell(_analysis_attr(analysis, "executive_summary", "")) or "No executive summary returned."
+    bill_summary = _markdown_bullets(_analysis_attr(analysis, "bill_summary", []))
+    implementation_rows = [
+        [
+            getattr(item, "stakeholder", ""),
+            getattr(item, "obligation", ""),
+            getattr(item, "implementation_burden", ""),
+            getattr(item, "risk_or_note", ""),
+        ]
+        for item in _analysis_attr(analysis, "implementation", [])
+    ]
+    critique_rows = [
+        [
+            getattr(item, "issue", ""),
+            getattr(item, "why_it_matters", ""),
+            getattr(item, "recommendation", ""),
+        ]
+        for item in _analysis_attr(analysis, "critique", [])
+    ]
+    strengths = _swot_attr(analysis, "strengths")
+    weaknesses = _swot_attr(analysis, "weaknesses")
+    opportunities = _swot_attr(analysis, "opportunities")
+    threats = _swot_attr(analysis, "threats")
+    swot_pair_rows = [
+        [strengths[idx] if idx < len(strengths) else "", weaknesses[idx] if idx < len(weaknesses) else ""]
+        for idx in range(max(len(strengths), len(weaknesses), 1))
+    ]
+    swot_risk_rows = [
+        [opportunities[idx] if idx < len(opportunities) else "", threats[idx] if idx < len(threats) else ""]
+        for idx in range(max(len(opportunities), len(threats), 1))
+    ]
+
+    return "\n\n".join(
+        [
+            "## Executive Summary\n" + executive_summary,
+            "## Summary of the Bill\n" + bill_summary,
+            "## Implementation Implications\n"
+            "| Stakeholder | Obligation | Burden | Risk / Note |\n"
+            "|---|---|---|---|\n"
+            + _format_table_rows(implementation_rows, 4),
+            "## Critique\n"
+            "| Issue | Why it matters | Recommendation |\n"
+            "|---|---|---|\n"
+            + _format_table_rows(critique_rows, 3),
+            "## SWOT Analysis\n"
+            "| Strengths | Weaknesses |\n"
+            "|---|---|\n"
+            + _format_table_rows(swot_pair_rows, 2)
+            + "\n\n"
+            + "| Opportunities | Threats |\n"
+            + "|---|---|\n"
+            + _format_table_rows(swot_risk_rows, 2),
+        ]
+    )
+
+
+def _format_chat_entry(answer_text: str, citations: list[dict[str, Any]], *, provenance: str = "analysis_based") -> str:
+    prefix = ""
+    if provenance == "analysis_based":
+        prefix = "_Based on the summary and analysis._\n\n"
+    elif provenance == "full_document":
+        prefix = "_Deeper full-document answer._\n\n"
+
+    if not citations:
+        return prefix + answer_text
+    citations_text = "\n".join(f"- [ref{item['ref_id']}] {item['snippet']}" for item in citations)
+    return f"{prefix}{answer_text}\n\nSupporting snippets:\n{citations_text}"
+
+
+def _deeper_answer_updates(visible: bool, label: str = "Run deeper full-document answer") -> gr.update:
+    return gr.update(visible=visible, value=label)
+
+
+# Proposed future expansion: restore bring-your-own provider help text and
+# controls when the app supports non-hackathon model/provider comparison again.
+# def _provider_help_text(provider_label: str | None, use_advanced: bool) -> str:
+#     provider = _resolve_provider(use_advanced, provider_label)
+#     return PROVIDER_DETAILS[provider]
+#
+#
+# def _toggle_provider_mode(use_advanced: bool) -> tuple[gr.update, gr.update, gr.update, gr.update]:
+#     provider_value = PROVIDER_LABEL_BY_NAME[DEFAULT_PROVIDER]
+#     return (
+#         gr.update(visible=not use_advanced),
+#         gr.update(visible=use_advanced),
+#         gr.update(visible=use_advanced),
+#         gr.update(value=_provider_help_text(provider_value, use_advanced)),
+#     )
+
+
+def _set_example_url(example_label: str | None) -> str:
+    if not example_label:
+        return ""
+    return EXAMPLE_BILL_URLS.get(example_label, "")
+
+
+def _render_document_link(url_value: str | None) -> str:
+    icon = (
+        '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" '
+        'stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">'
+        '<path d="M14 5h5v5"></path>'
+        '<path d="M10 14 19 5"></path>'
+        '<path d="M19 14v5h-14v-14h5"></path>'
+        "</svg>"
+    )
+    if not url_value or not url_value.strip():
+        return (
+            '<span class="view-document-link-disabled">'
+            f'<span>View source</span>{icon}'
+            "</span>"
+        )
+    safe_url = html.escape(url_value.strip(), quote=True)
+    return (
+        f'<a class="view-document-link" href="{safe_url}" target="_blank" rel="noopener noreferrer">'
+        f'<span>View source</span>{icon}'
+        "</a>"
+    )
+
+
+def _analysis_stage_message(stage: str) -> str:
+    return f"_Processing... {stage}_"
+
+
+def _show_warning(message: str) -> str:
+    gr.Warning(message)
+    return message
+
+
+def _show_error(message: str) -> str:
+    gr.Error(message)
+    return message
+
+
+def analyze_document(
+    uploaded_file: str | None,
+    url_value: str | None,
+    use_advanced: bool,
+    provider_label: str | None,
+    qwen_key: str | None,
+    custom_key: str | None,
+    session_state: dict[str, Any] | None,
+):
+    session_state = session_state or _empty_session()
+    record = _session_record(session_state)
+    provider = _resolve_provider(use_advanced, provider_label)
+    api_key = _resolve_api_key(provider, use_advanced, qwen_key, custom_key)
+    is_valid, error = validate_api_key(provider, api_key)
+    if not is_valid:
+        message = "Check the selected provider and API key, then try again."
+        _show_warning(message)
+        yield (
+            session_state,
+            message,
+            ANALYSIS_PLACEHOLDER,
+            [],
+            _deeper_answer_updates(False),
+            "",
+        )
+        return
+
+    precomputed = get_precomputed_example_artifacts(url_value)
+    if precomputed is not None:
+        record.clear()
+        record.update(
+            {
+                "api_config": {"provider": provider, "api_key": api_key},
+                "analysis": precomputed.analysis.model_dump(),
+                "vector_store": precomputed.vector_store,
+                "doc_text": precomputed.document_text,
+                "chat_history": [],
+                "pending_deeper_question": None,
+                "source_url": url_value,
+            }
+        )
+        yield (
+            session_state,
+            "Loaded precomputed analysis for this example bill.",
+            _format_analysis(precomputed.analysis),
+            [],
+            _deeper_answer_updates(False),
+            "",
+        )
+        return
+
+    yield (
+        session_state,
+        "Loading and parsing document...",
+        _analysis_stage_message("Loading and parsing document..."),
+        [],
+        _deeper_answer_updates(False),
+        "",
+    )
+
+    try:
+        document_text = _ingest_sources(uploaded_file, url_value)
+    except ingest.IngestionError as exc:
+        message = str(exc)
+        _show_warning(message)
+        yield (
+            session_state,
+            message,
+            ANALYSIS_PLACEHOLDER,
+            [],
+            _deeper_answer_updates(False),
+            "",
+        )
+        return
+    except Exception:  # noqa: BLE001
+        message = "We couldn't load that document. Check the link or upload the file directly and try again."
+        _show_error(message)
+        yield (
+            session_state,
+            message,
+            ANALYSIS_PLACEHOLDER,
+            [],
+            _deeper_answer_updates(False),
+            "",
+        )
+        return
+
+    yield (
+        session_state,
+        "Preparing chunks and provider client...",
+        _analysis_stage_message("Preparing chunks and provider client..."),
+        [],
+        _deeper_answer_updates(False),
+        "",
+    )
+
+    try:
+        provider_client = instantiate_client(provider, api_key or "")
+    except Exception:  # noqa: BLE001
+        message = "We couldn't connect to the selected model provider. Check your API key and settings, then try again."
+        _show_error(message)
+        yield (
+            session_state,
+            message,
+            ANALYSIS_PLACEHOLDER,
+            [],
+            _deeper_answer_updates(False),
+            "",
+        )
+        return
+
+    yield (
+        session_state,
+        "Building retrieval index...",
+        _analysis_stage_message("Building retrieval index..."),
+        [],
+        _deeper_answer_updates(False),
+        "",
+    )
+
+    try:
+        _, chunks, vector_store = prepare_document_artifacts(document_text)
+    except Exception:  # noqa: BLE001
+        message = "We couldn't prepare the document for analysis. Please try again."
+        _show_error(message)
+        yield (
+            session_state,
+            message,
+            ANALYSIS_PLACEHOLDER,
+            [],
+            _deeper_answer_updates(False),
+            "",
+        )
+        return
+
+    try:
+        analysis = AnalysisResult()
+        for stage_message, partial in generate_analysis_progress(provider_client, document_text):
+            analysis = partial
+            yield (
+                session_state,
+                stage_message,
+                _format_analysis(partial),
+                [],
+                _deeper_answer_updates(False),
+                "",
+            )
+    except Exception:  # noqa: BLE001
+        message = "We couldn't generate the bill analysis right now. Please try again."
+        _show_error(message)
+        yield (
+            session_state,
+            message,
+            ANALYSIS_PLACEHOLDER,
+            [],
+            _deeper_answer_updates(False),
+            "",
+        )
+        return
+
+    build_cached_document_artifacts(
+        document_text=document_text,
+        chunks=chunks,
+        analysis=analysis,
+        vector_store=vector_store,
+        source_url=url_value,
+    )
+    record.clear()
+    record.update(
+        {
+            "api_config": {"provider": provider, "api_key": api_key},
+            "analysis": analysis.model_dump(),
+            "vector_store": vector_store,
+            "doc_text": document_text,
+            "chat_history": [],
+            "pending_deeper_question": None,
+            "source_url": url_value,
+        }
+    )
+    analysis_output = _format_analysis(analysis)
+    yield session_state, "", analysis_output, [], _deeper_answer_updates(False), ""
+
+
+def ask_question(
+    question: str | None,
+    session_state: dict[str, Any] | None,
+    chat_history: list[dict[str, str]] | None,
+):
+    session_state = session_state or _empty_session()
+    record = _session_record(session_state)
+    chat_history = chat_history or []
+    if (not record.get("doc_text") and not record.get("vector_store")) or not record.get("api_config"):
+        yield chat_history, session_state, "Analyze a document before asking questions.", _deeper_answer_updates(False), ""
+        return
+    if not question or not question.strip():
+        yield chat_history, session_state, "", _deeper_answer_updates(False), ""
+        return
+
+    question_text = question.strip()
+    yield chat_history, session_state, "Searching analysis for an answer...", _deeper_answer_updates(False), ""
+
+    try:
+        provider_client = instantiate_client(
+            record["api_config"]["provider"],
+            record["api_config"]["api_key"],
+        )
+        yield chat_history, session_state, "Searching analysis for an answer...", _deeper_answer_updates(False), ""
+        answer = answer_query(
+            provider_client,
+            AnalysisResult.model_validate(record["analysis"]) if record.get("analysis") else None,
+            record.get("vector_store"),
+            question_text,
+            doc_text=record.get("doc_text"),
+        )
+    except Exception:  # noqa: BLE001
+        message = "We couldn't answer that question right now. Please try again."
+        _show_error(message)
+        yield chat_history, session_state, message, _deeper_answer_updates(False), ""
+        return
+
+    citations = [citation.model_dump() for citation in answer.citations]
+    chat_history = chat_history + [
+        {"role": "user", "content": question_text},
+        {"role": "assistant", "content": _format_chat_entry(answer.answer, citations, provenance=answer.provenance)},
+    ]
+    record["chat_history"] = chat_history
+    record["pending_deeper_question"] = question_text if answer.deeper_answer_available else None
+    deeper_hint = answer.consent_prompt if answer.deeper_answer_available else ""
+    yield chat_history, session_state, "", _deeper_answer_updates(answer.deeper_answer_available), deeper_hint
+
+
+def run_deeper_answer(
+    session_state: dict[str, Any] | None,
+    chat_history: list[dict[str, str]] | None,
+):
+    session_state = session_state or _empty_session()
+    record = _session_record(session_state)
+    chat_history = chat_history or []
+    question_text = record.get("pending_deeper_question")
+    if not question_text:
+        yield chat_history, session_state, "No pending question for deeper analysis.", _deeper_answer_updates(False), ""
+        return
+
+    yield chat_history, session_state, "Reading the full document for a deeper answer...", _deeper_answer_updates(False), ""
+
+    try:
+        provider_client = instantiate_client(
+            record["api_config"]["provider"],
+            record["api_config"]["api_key"],
+        )
+        answer = answer_query_from_full_document(
+            provider_client,
+            record.get("vector_store"),
+            question_text,
+            doc_text=record.get("doc_text"),
+        )
+    except Exception:  # noqa: BLE001
+        message = "We couldn't generate the deeper full-document answer right now. Please try again."
+        _show_error(message)
+        yield chat_history, session_state, message, _deeper_answer_updates(True), "A deeper full-document answer is still available."
+        return
+
+    citations = [citation.model_dump() for citation in answer.citations]
+    chat_history = chat_history + [
+        {"role": "assistant", "content": _format_chat_entry(answer.answer, citations, provenance=answer.provenance)},
+    ]
+    record["chat_history"] = chat_history
+    record["pending_deeper_question"] = None
+    yield chat_history, session_state, "", _deeper_answer_updates(False), ""
+
+
+def reset_session(session_state: dict[str, Any] | None):
+    if session_state and session_state.get("session_id"):
+        _GRADIO_SESSION_CACHE.pop(session_state["session_id"], None)
+    empty = _empty_session()
+    return empty, None, None, "", _render_document_link(""), ANALYSIS_PLACEHOLDER, [], "", "", _deeper_answer_updates(False), ""
+
+
+def build_app() -> gr.Blocks:
+    with gr.Blocks(title=APP_TITLE, css=APP_CSS, theme=APP_THEME, elem_id="app-shell", head=APP_HEAD) as demo:
+        session_state = gr.State(_empty_session())
+
+        gr.Markdown(f"# {APP_TITLE}")
+        gr.Markdown(APP_DESCRIPTION)
+        with gr.Row(elem_id="topbar-row"):
+            gr.HTML(
+                """
+                <div id="sidebar-toggle-shell">
+                  <div
+                    id="sidebar-toggle-icon"
+                    role="button"
+                    aria-label="Toggle sidebar"
+                    tabindex="0"
+                    onclick="window.__toggleSidebar && window.__toggleSidebar()"
+                    onkeydown="if (event.key === 'Enter' || event.key === ' ') { event.preventDefault(); window.__toggleSidebar && window.__toggleSidebar(); }"
+                  >
+                    <svg viewBox="0 0 24 24" fill="none" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
+                      <rect x="3" y="4" width="18" height="16" rx="3"></rect>
+                      <path d="M9 4v16"></path>
+                      <path d="M6.5 9h.01"></path>
+                      <path d="M6.5 12h.01"></path>
+                      <path d="M6.5 15h.01"></path>
+                    </svg>
+                  </div>
+                </div>
+                """
+            )
+
+        with gr.Row(elem_id="layout-shell"):
+            with gr.Column(scale=1, elem_id="sidebar-panel"):
+                gr.Markdown("## Document Source")
+                gr.Markdown("Upload PDF, DOCX, TXT, or MD")
+                uploaded_file = gr.File(label="Upload PDF, DOCX, TXT, or MD", type="filepath", show_label=False)
+                gr.HTML(
+                    """
+                    <div id="example-bills-heading">
+                      <p>Example bills</p>
+                      <span
+                        id="example-bills-info"
+                        tabindex="0"
+                        aria-label="Example bills information"
+                        data-tooltip="The Ghana Innovation and Start-Up Bill, 2025 was omitted because a verifiable source could not be found."
+                      >
+                        i
+                      </span>
+                    </div>
+                    """
+                )
+                example_selector = gr.Dropdown(
+                    label="Example bills",
+                    choices=EXAMPLE_BILL_LABELS,
+                    value=None,
+                    show_label=False,
+                )
+                gr.Markdown("Document URL")
+                url_value = gr.Textbox(label="Document URL", placeholder="https://example.com/bill", show_label=False)
+                analyze_button = gr.Button("Run analysis", variant="primary")
+                view_document_link = gr.HTML(_render_document_link(""), elem_id="view-document-shell")
+                reset_button = gr.Button("Reset session")
+                status_output = gr.Markdown(elem_id="status-output")
+                use_advanced = gr.State(False)
+                provider_label = gr.State(PROVIDER_LABEL_BY_NAME[DEFAULT_PROVIDER])
+                qwen_key = gr.State(None)
+                custom_key = gr.State(None)
+
+                # Proposed future expansion: restore the sidebar Model Settings
+                # section after the hackathon build is no longer pinned to Qwen.
+                # with gr.Accordion("Model Settings", open=False):
+                #     provider_help = gr.Markdown(PROVIDER_DETAILS[DEFAULT_PROVIDER])
+                #     gr.Markdown("Hugging Face Token")
+                #     qwen_key = gr.Textbox(
+                #         label="Hugging Face Token",
+                #         type="password",
+                #         placeholder="Leave blank to use HF_TOKEN",
+                #         visible=True,
+                #         show_label=False,
+                #     )
+                #     use_advanced = gr.Checkbox(label="Bring your own provider", value=False)
+                #     gr.Markdown("Model Provider")
+                #     provider_label = gr.Dropdown(
+                #         label="Model Provider",
+                #         choices=PROVIDER_LABELS,
+                #         value=PROVIDER_LABEL_BY_NAME[DEFAULT_PROVIDER],
+                #         visible=False,
+                #         show_label=False,
+                #     )
+                #     gr.Markdown("API Key")
+                #     custom_key = gr.Textbox(
+                #         label="API Key",
+                #         type="password",
+                #         placeholder="Leave blank to use provider env var",
+                #         visible=False,
+                #         show_label=False,
+                #     )
+
+            with gr.Column(scale=2, elem_id="main-panel"):
+                with gr.Group(elem_id="analysis-panel"):
+                    gr.Markdown("# Summary Highlights")
+                    analysis_output = gr.Markdown(ANALYSIS_PLACEHOLDER, elem_id="analysis-output")
+
+                with gr.Group(elem_id="chat-panel"):
+                    gr.Markdown("## Ask Further Questions")
+                    chatbot = gr.Chatbot(type="messages", show_label=False)
+                    with gr.Row():
+                        with gr.Column(scale=6, min_width=0):
+                            gr.Markdown("Question")
+                            question_input = gr.Textbox(
+                                label="Question",
+                                placeholder="What would you like to know?",
+                                show_label=False,
+                            )
+                        ask_button = gr.Button("Ask", scale=1, variant="primary")
+                    chat_status = gr.Markdown(elem_id="chat-status")
+                    deeper_answer_button = gr.Button("Run deeper full-document answer", visible=False)
+                    deeper_answer_hint = gr.Markdown("")
+
+        # Proposed future expansion: restore bring-your-own provider event wiring
+        # when alternate provider controls are re-enabled.
+        # use_advanced.change(
+        #     _toggle_provider_mode,
+        #     inputs=[use_advanced],
+        #     outputs=[qwen_key, provider_label, custom_key, provider_help],
+        # )
+        # provider_label.change(
+        #     _provider_help_text,
+        #     inputs=[provider_label, use_advanced],
+        #     outputs=[provider_help],
+        # )
+        example_selector.change(
+            lambda example_label: (
+                _set_example_url(example_label),
+                _render_document_link(_set_example_url(example_label)),
+            ),
+            inputs=[example_selector],
+            outputs=[url_value, view_document_link],
+        )
+        url_value.input(_render_document_link, inputs=[url_value], outputs=[view_document_link])
+        url_value.change(_render_document_link, inputs=[url_value], outputs=[view_document_link])
+        analyze_button.click(
+            analyze_document,
+            inputs=[uploaded_file, url_value, use_advanced, provider_label, qwen_key, custom_key, session_state],
+            outputs=[
+                session_state,
+                status_output,
+                analysis_output,
+                chatbot,
+                deeper_answer_button,
+                deeper_answer_hint,
+            ],
+        )
+        ask_button.click(
+            ask_question,
+            inputs=[question_input, session_state, chatbot],
+            outputs=[chatbot, session_state, chat_status, deeper_answer_button, deeper_answer_hint],
+        ).then(lambda: "", outputs=[question_input])
+        question_input.submit(
+            ask_question,
+            inputs=[question_input, session_state, chatbot],
+            outputs=[chatbot, session_state, chat_status, deeper_answer_button, deeper_answer_hint],
+        ).then(lambda: "", outputs=[question_input])
+        deeper_answer_button.click(
+            run_deeper_answer,
+            inputs=[session_state, chatbot],
+            outputs=[chatbot, session_state, chat_status, deeper_answer_button, deeper_answer_hint],
+        )
+        reset_button.click(
+            reset_session,
+            inputs=[session_state],
+            outputs=[
+                session_state,
+                uploaded_file,
+                example_selector,
+                url_value,
+                view_document_link,
+                analysis_output,
+                chatbot,
+                status_output,
+                chat_status,
+                deeper_answer_button,
+                deeper_answer_hint,
+            ],
+        )
+
+    demo.queue()
+    return demo
+
+
+if gr.NO_RELOAD:
+    warm_embedding_stack()
+
+
+# Expose the default `demo` symbol so Hugging Face Spaces can launch app.py.
+demo = build_app()
+app = demo
+
+
+if __name__ == "__main__":
+    app.launch()

assets/example_bills/cybersecurity-amendment-bill-2025/analysis.json

@@ -0,0 +1,136 @@
+{
+  "executive_summary": "The Cybersecurity (Amendment) Bill, 2025 expands the powers and responsibilities of Ghana's Cyber Security Authority (CSA) to investigate and prosecute cybercrime, regulate emerging technologies, and strengthen cybersecurity governance. Key changes include granting the CSA prosecutorial authority under the Attorney-General's oversight, establishing standards for AI, IoT, and blockchain, and enhancing enforcement mechanisms. The bill also introduces stricter penalties for non-compliance, mandates registration of critical infrastructure, and creates a cybersecurity fund. These amendments aim to bolster national digital security, protect vulnerable groups, and align Ghana with global cybersecurity practices.",
+  "bill_summary": [
+    "Amends Section 3 to expand the CSA's objects to include investigating/prosecuting cybercrime, regulating emerging technologies, and protecting vulnerable populations.",
+    "Inserts Section 4A to grant the CSA authority to investigate/prosecute cybercrime under the Attorney-General's direction and set security standards for AI, IoT, and blockchain.",
+    "Amends Section 13 to include representatives from the Data Protection Commission, National Intelligence Bureau, and National Signals Bureau in the Joint Cybersecurity Committee.",
+    "Amends Section 35 to clarify criteria for designating critical information infrastructure (CII) and mandates sector-specific regulations.",
+    "Amends Section 36 to require CII owners to register with the CSA, nominate a point of contact, and pay annual fees, with penalties for non-compliance.",
+    "Inserts Section 59A to empower the CSA with criminal and administrative enforcement tools, including fines, injunctions, and asset confiscation.",
+    "Inserts Section 59B to grant the CSA jurisdiction to prosecute cybercrimes under the Electronic Transactions Act, 2008 (Act 772) and recover proceeds.",
+    "Amends Section 31 to establish a cybersecurity fund financed by fines, taxes, and fees, with 30% of certification revenue allocated to the fund.",
+    "Inserts Section 57A-57C to create a cyber hygiene certification scheme for professionals and service providers, with standardized fees and audits.",
+    "Amends Section 49 to require licenses/accreditations for cybersecurity service providers and practitioners, with penalties for unlicensed activity.",
+    "Inserts Section 59C to authorize the CSA to request information from CII owners and third parties during investigations, with court-ordered disclosure if necessary.",
+    "Amends Section 47 to mandate Sectoral Computer Emergency Response Teams to report cybersecurity incidents to the National CERT within 24 hours.",
+    "Amends Section 20A to ensure CSA staff receive terms/conditions comparable to security/intelligence agencies and legal officers of the Attorney-General.",
+    "Inserts Section 20B to grant CSA officers police-like powers (arrest, search, seizure) under specified laws.",
+    "Amends Section 57 to require accreditation for cybersecurity professionals/practitioners, with penalties for unaccredited practice."
+  ],
+  "implementation": [
+    {
+      "stakeholder": "Critical Information Infrastructure (CII) Owners",
+      "obligation": "Register designated CII with the Cyber Security Authority (CSA) and submit verified details, nominate a point of contact, and notify the CSA of ownership changes within seven days.",
+      "implementation_burden": "Administrative and compliance costs for registration, documentation, and ongoing reporting requirements.",
+      "risk_or_note": "Non-compliance risks administrative penalties (Second Schedule) and potential legal exposure for unregistered infrastructure."
+    },
+    {
+      "stakeholder": "Cybersecurity Service Providers",
+      "obligation": "Obtain a license from the CSA to provide cybersecurity services for profit or accreditation for not-for-profit services.",
+      "implementation_burden": "Costs and time associated with applying for licenses/accreditations and meeting CSA standards.",
+      "risk_or_note": "Unlicensed or unaccredited providers face penalties (up to 100,000 penalty units) and potential criminal liability."
+    },
+    {
+      "stakeholder": "Cybersecurity Professionals/Practitioners",
+      "obligation": "Obtain CSA accreditation to practice, and adhere to cyber hygiene certification schemes.",
+      "implementation_burden": "Training, certification costs, and compliance with periodic audits.",
+      "risk_or_note": "Unaccredited individuals face penalties (250\u201320,000 penalty units) and criminal liability for non-compliance."
+    },
+    {
+      "stakeholder": "Cyber Security Authority (CSA)",
+      "obligation": "Establish mechanisms for investigating/prosecuting cybercrime, certifying emerging technologies, and enforcing compliance via audits, penalties, and legal actions.",
+      "implementation_burden": "Resource allocation for expanded investigative, prosecutorial, and regulatory functions.",
+      "risk_or_note": "Potential operational strain from increased responsibilities and reliance on inter-agency coordination."
+    },
+    {
+      "stakeholder": "Law Enforcement and Judicial Bodies",
+      "obligation": "Process production orders for computer data, confirm property freezes, and adjudicate cybercrime cases under CSA jurisdiction.",
+      "implementation_burden": "Training on new procedures and handling of technical evidence.",
+      "risk_or_note": "Increased caseloads and potential delays in resolving cybercrime cases."
+    },
+    {
+      "stakeholder": "Private Sector Entities (Non-CII)",
+      "obligation": "Comply with CSA directives on cybersecurity standards and cooperate in investigations (e.g., furnishing information).",
+      "implementation_burden": "Adapting internal policies and systems to meet CSA requirements.",
+      "risk_or_note": "Non-compliance risks administrative penalties or legal action under Section 59A."
+    },
+    {
+      "stakeholder": "Non-Profit Cybersecurity Institutions",
+      "obligation": "Seek CSA accreditation to operate legally.",
+      "implementation_burden": "Meeting CSA-defined criteria for accreditation.",
+      "risk_or_note": "Unaccredited institutions face penalties and operational restrictions."
+    }
+  ],
+  "critique": [
+    {
+      "issue": "Expanded investigative and prosecutorial powers of the Cyber Security Authority (CSA) without clear safeguards",
+      "why_it_matters": "Section 59B grants the CSA authority to investigate and prosecute cybercrime independently, including freezing property and confiscating proceeds. This risks overreach and potential misuse of power without explicit judicial oversight or procedural safeguards to protect individual rights.",
+      "recommendation": "Introduce mandatory judicial review for property freezes and asset confiscation orders, and establish an independent oversight body to monitor CSA investigations."
+    },
+    {
+      "issue": "Ambiguity in 'critical information infrastructure' designation criteria",
+      "why_it_matters": "Section 35 allows the Minister to designate systems as critical based on vague factors like 'national security' or 'economic well-being.' This could lead to arbitrary designations, imposing compliance burdens on businesses without clear justification.",
+      "recommendation": "Define specific, measurable criteria for designation and require public consultation or parliamentary approval for such designations."
+    },
+    {
+      "issue": "Mandatory accreditation and licensing for cybersecurity professionals and services",
+      "why_it_matters": "Sections 57 and 49 require accreditation/licenses for cybersecurity work, which may stifle innovation and exclude small providers or startups unable to meet bureaucratic hurdles, reducing competition and access to services.",
+      "recommendation": "Create tiered accreditation levels with exemptions for low-risk services and provide financial or technical support for SMEs to meet requirements."
+    },
+    {
+      "issue": "Broad administrative penalties without proportionality",
+      "why_it_matters": "Penalties in Sections 59A and 59C range from 250 to 100,000 penalty units without clear proportionality to the severity of violations. This risks punitive overreach, especially for minor infractions.",
+      "recommendation": "Establish a graduated penalty system tied to specific offense categories and provide a right to appeal administrative penalties."
+    },
+    {
+      "issue": "Mandatory cyber hygiene certification for emerging technologies",
+      "why_it_matters": "Section 57A requires certification for AI, blockchain, and other technologies, which could delay innovation and create compliance costs for developers. The CSA may lack expertise to evaluate rapidly evolving fields.",
+      "recommendation": "Adopt a risk-based approach to certification, with exemptions for low-risk or experimental technologies, and establish a dedicated technical advisory panel."
+    },
+    {
+      "issue": "Increased funding obligations for businesses and public services",
+      "why_it_matters": "Section 31 mandates 12% of communications taxes and 9% of corporate taxes to fund cybersecurity, potentially burdening SMEs and public institutions. The CSA's fee-setting power (Section 57C) could further strain budgets.",
+      "recommendation": "Cap mandatory contributions and require cost-benefit analyses for new fees to ensure affordability for small businesses and public services."
+    },
+    {
+      "issue": "Lack of clarity on cross-sector coordination in the Joint Cybersecurity Committee (JCC)",
+      "why_it_matters": "Section 14 mandates JCC collaboration but does not define decision-making processes or conflict resolution mechanisms, risking inefficiency and duplication of efforts.",
+      "recommendation": "Establish clear protocols for JCC operations, including timelines for consensus-building and a chairperson with binding authority in deadlocks."
+    },
+    {
+      "issue": "Potential privacy risks from production orders for computer data",
+      "why_it_matters": "Section 59D allows ex-parte court applications for data production orders, which could enable surveillance without prior notice or defense. The 'reasonable grounds' standard is subjectively interpreted.",
+      "recommendation": "Require dual judicial approval for production orders and mandate post-issuance review to assess proportionality and necessity."
+    }
+  ],
+  "swot": {
+    "strengths": [
+      "Expands the Cyber Security Authority's (CSA) powers to investigate and prosecute cybercrime independently, enhancing response speed and reducing reliance on external agencies.",
+      "Introduces mandatory accreditation and certification for cybersecurity professionals, service providers, and emerging technologies, raising industry standards and trust.",
+      "Establishes a dedicated cybersecurity fund with multiple revenue streams (fines, taxes, fees), ensuring sustainable financing for operations and infrastructure.",
+      "Mandates cross-sector collaboration through the Joint Cybersecurity Committee (JCC), improving coordination between public and private entities for threat mitigation.",
+      "Enhances protection for vulnerable groups (women, elderly, persons with disabilities) through explicit provisions for online safety and digital rights promotion."
+    ],
+    "weaknesses": [
+      "Broad investigative and enforcement powers for the CSA without explicit oversight mechanisms risk potential overreach or misuse, particularly in data access and asset freezes.",
+      "Mandatory registration and certification requirements for critical infrastructure and cybersecurity professionals could create compliance burdens for small and medium enterprises (SMEs).",
+      "High administrative penalties (e.g., 50,000\u2013100,000 penalty units for unlicensed services) may disproportionately impact startups and informal operators.",
+      "The CSA's expanded role in prosecuting cybercrime under the Electronic Transactions Act, 2008 (Act 772) may lead to jurisdictional conflicts with existing law enforcement agencies.",
+      "Lack of detailed timelines or performance metrics for the CSA's new functions (e.g., certification of AI/quantum tech) risks delays or inconsistent implementation."
+    ],
+    "opportunities": [
+      "Standardization of cybersecurity practices for emerging technologies (AI, IoT, blockchain) positions Ghana as a regional leader in tech governance and innovation.",
+      "The cyber hygiene certification scheme creates a formal pathway for local professionals to gain international recognition, boosting employment and exports.",
+      "Mandatory incident reporting (24-hour window for Sectoral CERTs) improves threat intelligence sharing, enabling proactive defense against cross-sector attacks.",
+      "Integration of cybersecurity into national critical infrastructure (e.g., banking, utilities) strengthens economic resilience against disruptive cyber incidents.",
+      "The 30% revenue-sharing model for the cybersecurity fund incentivizes certified professionals and institutions to maintain compliance and quality."
+    ],
+    "threats": [
+      "Overly prescriptive standards for emerging technologies (e.g., AI, quantum computing) could stifle innovation by imposing rigid compliance requirements on nascent industries.",
+      "The CSA's authority to freeze assets during investigations may deter foreign investment if perceived as a risk to property rights without judicial oversight.",
+      "Mandatory accreditation for non-profit cybersecurity institutions could exclude grassroots organizations, limiting public access to affordable security services.",
+      "High compliance costs for critical infrastructure owners (registration fees, audits) may force smaller operators out of the market, reducing competition.",
+      "The bill's focus on criminal enforcement (e.g., imprisonment for non-compliance) risks prioritizing punitive measures over education and capacity-building for vulnerable groups."
+    ]
+  }
+}

assets/example_bills/cybersecurity-amendment-bill-2025/chunks.json

@@ -0,0 +1,47 @@
+[
+  "CYBERSECURITY (AMENDMENT) BILL, 2025\n1 ARRANGEMENT OF SECTIONS\nSection\n1. Section 3 of Act 1038 Amended\n2. Section 4A inserted\n3. Section 5 of Act 1038 amended\n4. Section 13 of Act 1038 amended\n5. Section 14 of Act 1038 amended\n6. Section 15A inserted\n7. Section 20A inserted\n8. Section 20B inserted\n9. Section 31 of Act 1038 amended\n10. Section 35 of Act 1038 amended\n11. Section 36 of Act 1038 amended\n12. Section 37 of Act 1038 amended\n13. Section 40 of Act 1038 amended\n14. Section 47 of  Act 1038 amended\n15. Section 49 of Act 1038 amended\n16. Section 57 of Act 1038 amended\n17. Section 57A inserted\n18. Section 57B inserted\n19. Section 57C inserted\n20. Section 58A inserted\n21. Section 58B inserted\n22. Section 59 of Act 1038 amended\n23. Section 59A inserted\n24. Section 59B inserted\n25. Section 59C inserted\n26. Section 59D inserted\n27. Section 59E inserted\n28. Section 59F inserted\n29. Section 59G inserted\n30. Section 59H inserted\n31. Section 59I inserted\n32. Section 59J inserted\n33. Section 59K inserted\n34. Section 67 of Act 1038 amended\n35. Section 67A inserted\n36. Section 67B inserted\n37. Section 68 of Act 1038 amended\n38. Section 83 of Act 1038 amended\n39. Section 90 of Act 1038 amended\n40. Section 91 of Act 1038 amended\n41. Section 92 of Act 1038 amended\n42. Section 94 of Act 1038 amended\n43. Section 94A inserted\nCYBERSECURITY (AMENDMENT) BILL, 2025",
+  "39. Section 90 of Act 1038 amended\n40. Section 91 of Act 1038 amended\n41. Section 92 of Act 1038 amended\n42. Section 94 of Act 1038 amended\n43. Section 94A inserted\nCYBERSECURITY (AMENDMENT) BILL, 2025\n2 44. Section 94B inserted\n45. Section 97 of Act 1038 amended\n46. Section 98 of Act 1058 amended\n47. Section 99 of Act 1038 amended\n48. First Schedule to Act 1038 amended\n49. Second schedule to Act 1038 amended\n50. Third schedule to Act 1038 amended\nCYBERSECURITY (AMENDMENT) BILL, 2025\n3 A\nBILL\nENTITLED\nCYBERSECURITY (AMENDMENT)  BILL, 2025\nAN ACT  to amend the Cybersecurity Act, 2020 (Act 1038) to  confer powers on the Cyber\nSecurity Authority  to investigate  and prosecute cybercrime on the authority of the\nAttorney -General  and recover proceeds of cyber crime ; to revise  the object  and\nfunctions of the Cyber Security Authority;  to revise the governance and\nadministration of the Cyber Security Authority ;  to revise the enforcement powers of\nthe Cyber Security Authority  and to provide for related matters.\nSection 3 of Act 10 38 Amended\n1. The Cybersecurity Act, 2020 (Act 1038) referred to in the Act as the \u201cprincipal\nenactment\u201d is amended by substitution for section 3, of\n\u201cObjects of the Authority\n3. The objects of the Authority are to:\n(a) regulate cybersecurity activities in the country;\n(b) prevent, manage and respond to cybersecurity threats and\ncybersecurity incidents ;\n(c) regulate owners of critical information infrastructure in respect of",
+  "3. The objects of the Authority are to:\n(a) regulate cybersecurity activities in the country;\n(b) prevent, manage and respond to cybersecurity threats and\ncybersecurity incidents ;\n(c) regulate owners of critical information infrastructure in respect of\ncybersecurity activities, cybersecurity service providers , cybersecurity\nprofessionals and practitioners, and cybersecurity establishments in\nthe country;\n(d) promote the development of cybersecurity in the country to ensure a\nsecured and resilient digital ecosystem;\n(e) prevent and detect cybercrime;\n(f) to facilitate the confiscation of proceeds of cybercrime;\n(g) establish a platform for cross -sector engagement on matters of\ncybersecurity for effective co -ordination and co -operation between\nkey public institutions and the private sector;\n(h) create awareness of cybersecurity matters; an d\n(i) collaborate  with States, inter -governmental bodies, international\norganisations and international agencies to promote the cybersecurity\nof the country .\u201d.\nSection 4A inserted\n2. The principal enactment  is amended by the insertion after section 4, of\n\u201cFurther  Functions of the Authority\nCYBERSECURITY (AMENDMENT) BILL, 2025\n4 4A. The Authority , shall in addition to the functions in section 4, carry out the\nfollowing functions:\n(a) subject to article 88 of the Constitution,  to investigate and on the\nauthority of the Attorney -General , prosecute cybercrime  under this\nAct;\n(b) establish standards for certifying the security of innovative  products ,\nArtificial Intelligence, cloud technology, quantum computing, big",
+  "following functions:\n(a) subject to article 88 of the Constitution,  to investigate and on the\nauthority of the Attorney -General , prosecute cybercrime  under this\nAct;\n(b) establish standards for certifying the security of innovative  products ,\nArtificial Intelligence, cloud technology, quantum computing, big\ndata, Internet of Things (IoT) , blockchain -based technology  and any\nother emerging technologies ;\n(c) certify the security of innovative  products   Artificial Intelligence,\ncloud technology, quantum computing, big data, Internet of Things\n(IoT) , blockchain -based technology  and any other emerging\ntechnologies , in accordance with the standards established pursuant\nto paragraph ( b);\n(d) accredit the cybersecurity establishments of critical information\ninfrastructure  owners, cybersecurity service providers, cybersecurity\npractitioners and professionals  and other relevant person s or\ninstitutions ;\n(e) accredit non -profit cybersecurity institutions  and cybersecurity\nprofessional bodies ;\n(f) promote the online protection of women, elderly , persons with\ndisabilities  and underserved populations ;\n(g) collaborate with relevant institutions to develop mechanisms\nincluding technical security solutions and guidelines on the usage of\nsmart technology  and other emerging technologies ; and\n(h) promote the protection of digital right s as it relates to cyber security. \u201d.\nSection 5 of Act 10 38 amended\n3.  The principal enactment is amended in section 5 by the addition after subparagraph\n(iv) of paragraph (a) of subsection (1), of\n\u201c(v) Foreign Affairs and Regional Integration ; and\n(vi)  Gender, Children and Social Protection .\u201d.\nSection 13 of Act 10 38 amended\n4. The principal enactment is amended in section 13  by:",
+  "(iv) of paragraph (a) of subsection (1), of\n\u201c(v) Foreign Affairs and Regional Integration ; and\n(vi)  Gender, Children and Social Protection .\u201d.\nSection 13 of Act 10 38 amended\n4. The principal enactment is amended in section 13  by:\n(a)  the substitution for paragraph (d) of subsection (2), of\n\u201c(d)  the Executive Director of the Data Protection Commission or any\nsuccessor official or entity by whatever name designated, or a\nrepresentative of the Executive Director with the requisite\nknowledge and skills in cybercrime and cybersecurity matters,\nnominated by the Executive Director ;\u201d;\nCYBERSECURITY (AMENDMENT) BILL, 2025\n5 (b) the substitution for paragraph (g) and (k) respectively of subsection (2), of\n\u201c(g) the Director of the National Intelligence Bureau  or any successor\nofficial or entity by whatever name designated, or a representative of\nthe Director with the requisite knowledge and skills in cybercrime ,\nand cybersecurity matters, nominated by the Director;\n(k) the Director General of National Signals Bureau or any successor\nofficial or entity by whatever name designated, or a representative of\nthe Director with the requisite knowledge and skills in cybercrime and\ncybersecurity matters, nominated by the Director; \u201d;\n(c)  the addition after paragraph (r) of subsection (2), o f\n\u201c(s)  Any other person the Minister may nominate, on the advice of the\nAuthority. \u201d.\n(d) the addition after subsection (13), of\n\u201c(14)  A member of the JCC who is absent from three consecutive meetings",
+  "\u201c(s)  Any other person the Minister may nominate, on the advice of the\nAuthority. \u201d.\n(d) the addition after subsection (13), of\n\u201c(14)  A member of the JCC who is absent from three consecutive meetings\nwithout sufficient cause ceases to be a member of the JCC .\n(15) Where there is a vacancy, the Minister shall notify the President of\nthe vacancy , and the President shall appoint a person to fill the v acancy for\nthe unexpired term. \u201d.\nSection 1 4 of Act 10 38 amended\n5. The principal enactment is amended  in section 14 by the substitution for subsection\n(1), of\n\u201c14     (1).  The Joint Cybersecurity Committee shall collaborate with the Authority and\nthe sectors or institutions represented on the Committee for the implementation of\nrelevant cybersecurity  measures  including but not limited to the following ways:\n(a) identification of cybersecurity risks that may affect critical information\ninfrastructure or the overall cybersecurity of the country ;\n(b) development of cybersecurity policies and guidelines based on identified\nrisks, best practices and international standards to mitigate cybersecurity\nrisks;\n(c) coordination of cybersecurity activities between sectors and entities to\nensure that all cybersecurity efforts are aligned to prevent overlap and gaps;\n(d) facilitate the sharing of information between sectors and entities in a secure\nmanner and in compliance with relevant data protection laws ;\n(e) collaboration with sectors or institutions to tackle cybercrime including the\nprovision of a platform for incidence sharing and incidence response\nmechanisms to facilitate ;\nCYBERSECURITY (AMENDMENT) BILL, 2025",
+  "manner and in compliance with relevant data protection laws ;\n(e) collaboration with sectors or institutions to tackle cybercrime including the\nprovision of a platform for incidence sharing and incidence response\nmechanisms to facilitate ;\nCYBERSECURITY (AMENDMENT) BILL, 2025\n6 (f) evaluation of the effectiveness of implemented cybersecurity measures based\non established metrics with a view to continuously improve the cybersecurity\nmeasures ; and\n(g) collaboration with the Authority to educate the public on matters related to\ncybercrime and cybersecurity. \u201d.\nSection 15 A inserted\n6. The principal enactment is amended by the insertion after section 15, of\n\u201cAppointment of Deputy -Director s General\n15A. (1)  The President shall in accordance with article 195  of the Constitution\nappoint such Deputy Directors -General as are necessary for the performance of the\nfunctions of the Authority.\n(2)  The Deputy Directors -General shall hold office on the terms and\nconditions specified in the letters of appointment.\n(3)  The Deputy Directors -General shall act in the absence of the\nDirector -General and perform any other functions as determined by the  Board.\n(4)  The Deputy Directors -General shall, subject to the provisions of this\nAct:\n(a) assist the Director -General in the discharge of his functions and\nperform such other functions as the Director -General or the Board\nmay delegate to him;\n(b) perform functions related to the object and functions of the\nAuthority on the direction or authority of the Director -General  or\nthe Board ; and\n(c) be responsible for the direction of the Authority when the Director -\nGeneral is absent from Ghana or is otherwise unable to perform his\nfunctions. \u201d.\nSection 20A inserted",
+  "Authority on the direction or authority of the Director -General  or\nthe Board ; and\n(c) be responsible for the direction of the Authority when the Director -\nGeneral is absent from Ghana or is otherwise unable to perform his\nfunctions. \u201d.\nSection 20A inserted\n7. The principal enactment is amended by the insertion after section 20, of\n\u201cTerms and Conditions of Service of Staff of the Authority\n20A. (1) The terms and conditions of service of the staff of the Authority shall\nnot be less favourable than the staff of the security and intelligence agencies .\nCYBERSECURITY (AMENDMENT) BILL, 2025\n7 (2) The conditions of service attached to posts of legal officers of the\nAuthority shall not be less than that of the posts attached to that of legal officers of\nthe Attorney -General of the same rank.\n(3) Staff shall, in addition to monthly salaries, be eligible for the payment\nof any gratuity, allowance, pension, subsidy or benefit to members in respect of\ntheir service  or resignation or retirement .\u201d.\nSection 20B inserted\n8. The principal enactment is amended by the insertion after section 20, of\n\u201cPowers of police\n20B. (1) The Director -General, Deputy Director -General and other\nauthorised officers shall exercise the powers  of a Police Officer, including the\npowers of arrest, search and seizure  and have the  same rights, protections\nimmunities conferred on a Police officer in the Criminal and Other Offences\n(Procedure) Act, 1960 (Act 30), the Police Service Act, 1970 (Act 350) and any other\nlaw related to a Police officer  in the performance of their functions under the Act. \u201d.\nSection 31 of Act 10 38 amended",
+  "(Procedure) Act, 1960 (Act 30), the Police Service Act, 1970 (Act 350) and any other\nlaw related to a Police officer  in the performance of their functions under the Act. \u201d.\nSection 31 of Act 10 38 amended\n9. The principal enactment is amended by substitution for section 31, of :\n\u201cSources of money for the Fund\n31. The sources of moneys for the Fund include:\n(a)  seed money approved by Parliament;\n(b)  moneys which may become lawfully payable to the Authority for the\nFund;\n(c) 50% of all fines arising from criminal penalties under th e Act;\n(f) grants, gifts, donations and other voluntary contributions;\n(g) 12% of the communications service tax for the Fund per annum;\n(h) 9 % corporate tax for the Fund per annum;\n(i) a charge determined by the Authority in accordance with the Fees\nand Charges  (Miscellaneous Provisions) Act, 2018 (Act 983) and\nlevied on persons licensed by the Bank  of Ghana to carry on business;\n(j)  a proportion of the fees charged on all government e lectronic\nservices determined by the  Authority ; and\n(h) any other moneys approved by Parliament for the Fund. \u201d.\nSection 35 of Act 10 38 amended\n10. The principal enactment is amended  by substitution for section 35, of\n\u201cDesignation of critical information infrastructure\nCYBERSECURITY (AMENDMENT) BILL, 2025\n8 35. (1)  The Minister may, on the advice of the Authority, designate a\ncomputer system or computer network as a critical information infrastructure if the\nMinister considers that the computer system or computer network is essential for\n(a)  national security,",
+  "CYBERSECURITY (AMENDMENT) BILL, 2025\n8 35. (1)  The Minister may, on the advice of the Authority, designate a\ncomputer system or computer network as a critical information infrastructure if the\nMinister considers that the computer system or computer network is essential for\n(a)  national security,\n(b)  the economic and social well -being of citizens , or\n(c)  public health and safety.\n(2) Where the Minister designates a computer system or computer\nnetwork as a critical information infrastructure, the Minister shall publish the sector of the\ndesignated critical information infrastructure in the Gazette  and, the owner of the Critical\nInformation Infrastructure shall be notified of the designation.\n(3)  The Minister shall, in making a determination under subsection (1),\nconsider if the  computer system or computer network is necessary for :\n(a)  the security, defence or international relations of the country;\n(b)  the production, preservation or identity of a confidential source of\ninformation related to  the enforcement of criminal law;\n(c)  the provision of services directly related to\n(i)  communications and telecommunications infrastructure;\n(ii)  banking and financial services;\n(iii)  public utilities\n(iv)  public transportation; and\n(v)  public key infrastructure;\n(d)  the protection of public safety and public health, including\nsystems related to essential  emergency services;\n(e)  an international business or communication affecting a citizen of\nGhana or any other  international business in which a citizen of\nGhana or the Government has an interest;\n(f)  the Legislature, Executive, Judiciary, Public Services or security\nagencies ; or\n(g)  digital services;\n(h)  services related to the supply chain in the critical information\ninfrastructure ecosystem; and",
+  "Ghana or any other  international business in which a citizen of\nGhana or the Government has an interest;\n(f)  the Legislature, Executive, Judiciary, Public Services or security\nagencies ; or\n(g)  digital services;\n(h)  services related to the supply chain in the critical information\ninfrastructure ecosystem; and\n(i)  any other services determined by the Minister, on the advice of the\nAuthority .\n(4)  The Minister shall, by publication in the Gazette , estab lish the\nprocedure for the  regulation of a critical information infrastructure. \u201d.\nSection 36 of Act 10 38 amended\n11. The principal enactment is amended by substitution for section 3 6, of\n\u201cRegistration of critical information in frastructure\nCYBERSECURITY (AMENDMENT) BILL, 2025\n9 36. (1)  The Owner of the designated critical information infrastructure shall\nregister their critical information infrastructure with the Authority , and shall pay the\nprescribed annual registration and designation  fee as determined by the Authority\nor stipulated in  a legislative instrument .\n(2) For compliance purposes, the owner of an unregistered critical\ninformation infrastructure shall receive a notification of registration letter from the\nAuthority to comply with the Act.\n(3)  During registration, the owner of a critical information infrastructure\nshall nominate a point of contact and submit details of the nominee to the\nAuthority.\n(4) The owner of a critical information infrastructure shall submit to the\nAuthority, verified details of critical information infrastructure, through the\nchannels and modalities determined by the Authority.\n(5) The Authority shall validate the information submitted by the owner\nof  a critical information infrastructure, and the owner shall receive a Certificate of\nRegistration upon completion of registration requirements.\n(6) The Authority shall  through the issuance of  guidelines or directives\ndetermine :",
+  "(5) The Authority shall validate the information submitted by the owner\nof  a critical information infrastructure, and the owner shall receive a Certificate of\nRegistration upon completion of registration requirements.\n(6) The Authority shall  through the issuance of  guidelines or directives\ndetermine :\n(a)  further requirements for the registration of a critical information\ninfrastructure ;\n(b)  the procedure for the registration of a critical information\ninfrastructure; and\n(c)  any other matter relating to the registration of a critical information\ninfrastructure.\n(7)  Where there is any change in the legal ownership of a designated\ncritical information infrastructure, the owner of the designated critical information\ninfrastructure shall , within  seven days after the change, inform the Authority of the\nchange in ownership.\n(8) An owner of a designated  critical information infrastructure who\ncontravenes subsectio n (1) and  (3) is liable to pay to the Authority the administrative\npenalty specified in the Second  Schedule. \u201d.\nSection 37 of Act 10 38 amended\n12. The principal enactment is amended by substitution for section 37 , of\n\u201cWithdrawal of designation of critical information infrastructure\n\u201c37. (1) The Minister may, on the advice of the Authority, withdraw the\ndesignation of a  critical information infrastructure at any time if the Minister considers that\nCYBERSECURITY (AMENDMENT) BILL, 2025\n10 the computer or computer network no longer satisfies the criteria of a critical information\ninfrastructure .\n(2) The Minister may  publish the withdrawal of critical information\ninfrastructure sector in the Gazette .\n(3) The owner of a designated critical information infrastructure shall\nreceive notification of the withdrawal of the designation  by letter from the Minister. \u201d.\nSection 40 of Act 10 38 amended\n13.  The principal enactment is amended in section 40 by substitution for subsection",
+  "infrastructure sector in the Gazette .\n(3) The owner of a designated critical information infrastructure shall\nreceive notification of the withdrawal of the designation  by letter from the Minister. \u201d.\nSection 40 of Act 10 38 amended\n13.  The principal enactment is amended in section 40 by substitution for subsection\n(2), of\n\u201c(2) A person who contravenes subsection (1) commits an offence and is liable\non summary conviction to a fine of not less than four thousand penalty units and not more\nthan twenty -five thousand penalty units , or both .\u201d.\nSection 47 of Act 10 38 Amended\n14. The principal enactment is amended in section 47 by:\n(a) the addition after subsection (6), of\n\u201c(7) A Sectoral Computer Emergency Response Team shall within twenty -four\nhours after receiving a report of a cybersecurity incident from the owner of a designated\ncritical information infrastructure, a service provider, a licensee or any relevant person\nreport  the cybersecurity incident to the National Computer Emergency Response Team.\u201d.\n(b) the addition after subsection (7), of\n\u201c(8) A Sectoral Computer Emergency Response Team who contravenes\nsubsection (7) is liable to pay to the Authority the administrative penalty specified in the\nSecond Schedule.\u201d.\nSection 49 of Act 1038 Amended\n15.  The principal enactment is amended in section 49 by\n(a) the substitution for subsection (1), of\n\u201c(1)  A person shall not provide a cybersecurity service for a reward unless that\nperson obtains a licence issued by the Authority in accordance with the Act.\u201d.\n(b) the substitution for subsection (2), of",
+  "\u201c(1)  A person shall not provide a cybersecurity service for a reward unless that\nperson obtains a licence issued by the Authority in accordance with the Act.\u201d.\n(b) the substitution for subsection (2), of\nCYBERSECURITY (AMENDMENT) BILL, 2025\n11  \u201c(2) A person shall not provide a cybersecurity service on a not -for-profit basis\nunless that person obtains an accreditation issued by the Authority in accordance with the\nAct.\u201d.\n(c) addition after subsection (2), of\n\u201c(3) A person who contravenes subsection (1) and (2) is liable to pay to the\nAuthority the administrative penalty the equivalent to the cost of damage caused and value\nof the financial gain made , or an administrative penalty of not less than fifty thousand\npenalty units and not more than one hundred thousand penalty units. \u201d.\nSection 57 of Act 1038 Amended\n16. The principal enactment is amended by the substitution for section 57, of\n(1) The Authority shall establish a mechanism for the accreditation of\ncybersecurity professionals and practitioners.\n(2) An individual shall not practise  as a cybersecurity professional or\ncybersecurity practitioner unless that individual has been accredited by the Authority;\n(3) A person shall not knowingly engage the services of a cybersecurity\nprofessional or cybersecurity practitioner who has not been accredited by the Authorit y;\n(4) A person who contravenes subsection (2) or (3)  is liable to pay to the\nAuthority an administrative penalty of not less than two hundred and fifty penalty units\nand not more than twenty thousand penalty units .\nSection 57A inserted",
+  "(4) A person who contravenes subsection (2) or (3)  is liable to pay to the\nAuthority an administrative penalty of not less than two hundred and fifty penalty units\nand not more than twenty thousand penalty units .\nSection 57A inserted\n17. The principal enactment is amended by the insertion after section 57, of\n\u201cCyber hygiene certification scheme\n57B. (1) The Authority shall establish a scheme for the certification of cybersecurity\nprofessionals and practitioners, and cybersecurity service providers who will be entrusted\nto perform cyber hygiene certification service as an alternative to other international best\npractice security frameworks.\n(2)  The Cyber Security Authority shall conduct periodic audits to ensure\ncompliance with the cyber hygiene certification scheme and associated prescribed fees.\n(3) Any complaints regarding non -compliance  shall be investigated, and\nappropriate enforcement actions shall be taken. \u201d.\nSection 57B inserted\nCYBERSECURITY (AMENDMENT) BILL, 2025\n12 18. The principal enactment is amended by the insertion after section 58A, of\n\u201cApplication for certification to provide the Cyber hygiene certification services\n57B.  (1) A licensed  cybersecurity service provider or accredited CP who seeks to\nprovide the Authority\u2019s  cyber hygiene certification service shall apply in writing to the\nAuthority.\n(2) The application shall be made in the prescribed form and accompanied by\nthe:\n(a) supporting documentation, and\n(b) prescribed fee  that the Authority may determine .\u201d.\nSection 57C inserted\n19. The principal enactment is amended by the insertion after section 58B, of\n\u201cStandardised , Review and Administration of Fees for Cyber Hygiene Certification\nService\n57C.   (1)  A certified cybersecurity professional or practitioner or cybersecurity service",
+  "Section 57C inserted\n19. The principal enactment is amended by the insertion after section 58B, of\n\u201cStandardised , Review and Administration of Fees for Cyber Hygiene Certification\nService\n57C.   (1)  A certified cybersecurity professional or practitioner or cybersecurity service\nprovider  shall charge a fee for cyber hygiene certification services as determined by the\nCyber Security Authority.\n(2) A certified cybersecurity professional or practitioner or cybersecurity service\nprovide r shall not charge fees exceeding the approved flat rate for cyber hygiene\ncertification services.\n(3) A certified cybersecurity professional or practitioner or cybersecurity service\nprovider who fails to comply wit h subsection (2) shall be  liable to pay to the Authority an\nadministrative penalty specified in the Second Schedule (not less than two hundred and\nfifty penalty units and not more than five thousand penalty units)\n(4) 30% of the revenue generated by a certified cybersecurity professional or\npractitioner or cybersecurity service provider  under the scheme shall be paid into the\ncybersecurity fund.\n(5) The Cyber Security Authority shall,  by notice published in the Gazette,\ndetermine the applicable flat rate for cyber hygiene certification services.\n(6) The flat rate shall be reviewed periodically based on, industry trends, and the\naffordability needs of stakeholders. \u201d.\nSection 58A inserted\n20. The principal enactment is amended by the insertion after section 5 8, of\nCYBERSECURITY (AMENDMENT) BILL, 2025\n13 \u201cCertification of the security of innovative and emerging technologies.\n58A. The Authority shall establish a mechanism for the certification of the security of\ninnovative and emerging technologies. \u201d.\nSection 58B inserted",
+  "CYBERSECURITY (AMENDMENT) BILL, 2025\n13 \u201cCertification of the security of innovative and emerging technologies.\n58A. The Authority shall establish a mechanism for the certification of the security of\ninnovative and emerging technologies. \u201d.\nSection 58B inserted\n21. The principal enactment is amended by the insertion after section 58A, of\n\u201cAccreditation of non -profit cybersecurity institutions\n58B.  The Authority shall establish a mechanism for the accreditation of non -profit\ncybersecurity institutions .\u201d.\nSection 59 of Act 10 38 Amended\n22. The principal enactment is amended  in section 59 by the addition after paragraph\n(e) of subsection (1), of\n\u201c(g) certif ication of  the security of innovative and emerging technologies including\nArtificial Intelligence, cloud technology, quantum computing, big data, and blockchain -\nbased technology. \u201d.\nSection 59A inserted\n23. The principal enactment is amended by the insertion after section 59, of\n\u201cEnforcement powers\n59A.  (1) A person who:\n(a)  knowingly fails to comply with or acts in contravention of this Act,\nregulations or directives issued under this Act ;\n(b)  knowingly fails to comply with prescribed cybersecurity standards and\nrequirements ;\n(c)  provides cybersecurity services without a licence or acts as a cybersecurity\nprofessional or practitioner without accreditation ;\n(d)  willfully obstructs, hinders, molests or assaults personnel of the Authority\nduly engaged in the exercise of power conferred on the Authority under this\nAct.\ncommits an offence and is liable on summary conviction to a term of imprisonment\nof not more than five years or to a fine of not more than twenty thousand penalty",
+  "duly engaged in the exercise of power conferred on the Authority under this\nAct.\ncommits an offence and is liable on summary conviction to a term of imprisonment\nof not more than five years or to a fine of not more than twenty thousand penalty\nunits, or to both.\nCYBERSECURITY (AMENDMENT) BILL, 2025\n14 (1) Where an offence is committed by a corporate entity, that entity is liable to\na fine of not more than twenty  thousand penalty units and each director of\nthat entity shall be deemed to have committed the offence.\n(2) Despite subsection (1), the Authority may, where a person has breached this\nAct, Regulations or directives or where a licensee, an accreditation holder\nhas breached a condition contained in its licence or accreditation :\n(a)  warn the person, licensee, or accreditation holder,\n(b)  issue a cease -and-desist order,\n(c)  apply to the High Court for\n(i)  an injunction to restrain the person, licensee, or accreditation\nholder from continuing the breach, or\n(ii)  other  appropriate order to enforce compliance with this Act,\n(d) propose amendments to the licence or accreditation in accordance\nwith this Act or Regulations\n(e) suspend or terminate the licence or accreditation in accordance with\nthis Act, or\n(f) impose administrative penalties in accordance with the second\nschedule of the Act\n(g) or take any other action that it considers appropriate and that is not\ncontrary to this Act.\n(4)  Nothing shall prevent the Authority from pursuing only criminal\nenforcement actions under subsection (1) or only administration\nenforcement actions under subsection (2), or a combination of\nboth. \u201d.\nSection 59B inserted",
+  "contrary to this Act.\n(4)  Nothing shall prevent the Authority from pursuing only criminal\nenforcement actions under subsection (1) or only administration\nenforcement actions under subsection (2), or a combination of\nboth. \u201d.\nSection 59B inserted\n24. The principal enactment is amended by the insertion after section 59A, of\n\u201cPower to conduct investigations  and to prosecute cybercrime \u201d\n59B.  (1) The Authority shall upon the occurrence of a cybersecurity incident or a\ncybercrime conduct criminal investigations  and prosecute same .\u201d\n(2)  The Authority shall have the jurisdiction  to prosecute all offences under the\nElectronic Transactions Act, 2008 (Act 772).\n(3) Where a person is convicted of a cybercrime under this Act, the Authority\nmay apply to the Court for an order to confiscate moneys, proceeds, benefits, properties\nand assets purchased by a person with proceeds derived from or in the commission of the\ncybercrime.\nCYBERSECURITY (AMENDMENT) BILL, 2025\n15\n(4) Despite subsection (5), nothing shall prevent the Authority from instituting\na civil action independently or at the same time as the prosecution to recover moneys,\nproceeds, benefits, properties and assets purchased by a person with proceeds derived from\nor in the commission of the cybercrime.\n(5) In relation to subsection (6) if criminal prosecution fails, civil asset recovery\nshould still proceed, and confiscation orders should have the effect of a civil judgment\nappealable from the High Court to the Court of Appeal. \u201d.\n(6) Where the Authority considers that freezing of property is necessary to\nfacilitate an investigation or prosecution, the Authority shall in writing direct the freezing",
+  "should still proceed, and confiscation orders should have the effect of a civil judgment\nappealable from the High Court to the Court of Appeal. \u201d.\n(6) Where the Authority considers that freezing of property is necessary to\nfacilitate an investigation or prosecution, the Authority shall in writing direct the freezing\nof:\n(a)  the property of a person or entity  being investigated; or\n(b)  specified property held by a person or entity other than the person\nor entity being investigated or prosecuted.\n(7) The Authority shall within 14 days after the freezing of the property apply\nto the Court for a confirmation of the freezing.\nSection 59 C inserted\n25. The principal enactment is amended by the insertion after section 59 B, of\n\u201cPower to request for information\n59C.  (1) The Authority may, for the purposes of carrying out an investigation in\nrespect of a contravention of the Act, Regulations or any other relevant enactment by the\nowner of a critical information infrastructure, a licensee, a service provider or any other\nperson, by notice in writing, require a person to :\n(a) attend at a time and place specified in the notice; and\n(b) furnish the Authority with information related to a matter relevant to the\ninvestigation.\n(2)   A notice under subsection (1) shall indicate the subject matter and purpose\nof the request. \u201d.\n(3) Where a person required to furnish the Authority with an information is\nunder an obligation not to disclose, or asserts a right not to disclose, the Authority shall\napply to the High Court for an order for the production of the information.\n(4)  Where an information is furnished to the Authority, the Authority shall\nmake copie s or extract from the Information and request the person",
+  "apply to the High Court for an order for the production of the information.\n(4)  Where an information is furnished to the Authority, the Authority shall\nmake copie s or extract from the Information and request the person\nCYBERSECURITY (AMENDMENT) BILL, 2025\n16 producing the information to provide an ex planation on the content of the\ninformation where necessary.\n(5) A person who appears before the Authority may be represented by a Counsel\nof the choice of that person at any stage of the process .\n(6) Except as provided in subsection (2) where a person  contravenes subsection (1)\n(a) and (b),  that person commits an offence and is liable on summary conviction to a fine\nof not less than two hundred  and fifty  penalty units and not more than ten thousand penalty\nunits or to a term of imprisonment of not less than one year and not more than two years\nor to both. \u201d.\nSection 59D inserted\n26. The principal enactment is amended by the insertion after section 59C, of\n\u201cApplication for Production Order to Collect Computer Data\n59D.   (1)   An investigative officer may apply ex-parte to the High Court for a\nproduction order to collect computer data.\n(2) A production order under section (1) shall require a person in possession or\ncontrol of a computer or computer system to submit specified computer data which is\nstored in the computer or computer system to the investigative officer.\n(3) An investigative officer who makes an application under section (1) shall\ndemonstrate to the satisfaction of the Court that there are reasonable grounds to believe\nthat the computer data is reasonably required for the purposes of a specific criminal\ninvest igation.",
+  "stored in the computer or computer system to the investigative officer.\n(3) An investigative officer who makes an application under section (1) shall\ndemonstrate to the satisfaction of the Court that there are reasonable grounds to believe\nthat the computer data is reasonably required for the purposes of a specific criminal\ninvest igation.\n(4) Where an investigative officer makes an application under section (1), that\ninvestigative officer shall :\n(a) explain why the investigative officer believes the computer data sought, will\nbe available to the person in control of the computer or computer system;\n(b) identify and explain with specificity the type of computer data suspected to\nbe found on the computer or computer system;\n(c) identify and explain with specificity the computer data that may be found on\na computer or computer system that is the subject of an investigation or\nprosecution;\n(d) identify and explain with specificity the offences in respect of which the\nproduction order is sought; and\n(e) indicate what measures shall be taken to ensure that the computer data will\nbe procured\nCYBERSECURITY (AMENDMENT) BILL, 2025\n17\n(i)  whilst maintaining the privacy of other users, customers and third\nparties, and\n(ii) without the disclosure of the computer data of any party not part of\nthe investigation. \u201d.\nSection 59 E inserted\n27. The principal enactment is amended by the insertion after section 59 D, of\n\u201cGrant of production order\n59E.  (1)  The High Court may grant an application for a production order\nunder    subsection (1) of section  59D, if the Court is satisfied that\n(a) the investigative officer has complied with subsection (3) and (4) of section\n59D;",
+  "59E.  (1)  The High Court may grant an application for a production order\nunder    subsection (1) of section  59D, if the Court is satisfied that\n(a) the investigative officer has complied with subsection (3) and (4) of section\n59D;\n(b) the information requested is commensurate, proportionate and necessary for\nthe purposes of a specific criminal investigation or prosecution;\n(c) measures shall be taken to ensure that the computer data is produced whilst\nmaintaining the privacy of other users, customers and third parties and\nwithout the disclosure of information and data of any party not part of the\ninvestigation; and\n(d) the investigation may be frustrated or seriously prejudiced unless the\nproduction of the information is permitted.\n(2) The Court shall require the service provider to keep confidential the\nproduction order and the execution of the production order under this\nsection.\n(3) A production order granted under this Act shall be served on a domestic\nservice provider, foreign service provider or both, or any other relevant\nperson. \u201d.\nSection 59F inserted\n28. The principal enactment is amended by the insertion after section 59E, of\n\u201cApplication for Warrant to Access, Search and Seize Computer Data, Computer or\nComputer System\n59F.  (1)   An investigative officer may apply ex -parte to the High Court for a warrant to :\n(a) access data on a computer or computer system;\n(b) search and seize a computer or a computer system; or\nCYBERSECURITY (AMENDMENT) BILL, 2025\n18 (c) make or retain a copy of computer data on a computer or computer system;\n(d) maintain the integrity of computer data on a computer or computer system;",
+  "(b) search and seize a computer or a computer system; or\nCYBERSECURITY (AMENDMENT) BILL, 2025\n18 (c) make or retain a copy of computer data on a computer or computer system;\n(d) maintain the integrity of computer data on a computer or computer system;\n(e) remove or render inaccessible computer data on a computer or computer\nsystem\nthat is suspected to contain information relevant to an investigation.\n(2) A warrant under subse ction (1) shall require a person who has knowledge\nabout the functioning of the computer or computer system to provide the\nnecessary information to enable an investigative officer undertake the actions\nrequired under paragraphs (a) to (e) of subsection (1).\n(3) An investigative officer who makes an application under subsection (1) shall\ndemonstrate to the satisfaction of the court that there are reasonable grounds\nto believe that the warrant is reasonably required for the purposes of a specific\ncriminal investiga tion.\n(4) A warrant under subsection (1) shall permit a law enforcement officer to\nexpeditiously  extend the search for data from a computer or computer system\nto another computer or computer system or part of it in Ghana where the law\nenforcement officer has reasonable grounds to believe that the data sought is\naccessible from or available  to that other computer or computer system  or\npart of it in Ghana .\u201d.\nSection 59G inserted\n29. The principal enactment is amended by the insertion after section 59F, of\n\u201cGrant of warrant\n59G.  (1)  The High Court may grant an application for a warrant under subsection 1\nof section 59F if the Court is satisfied that\n(a) the investigative officer has complied with subsection (3) of section 59F.",
+  "\u201cGrant of warrant\n59G.  (1)  The High Court may grant an application for a warrant under subsection 1\nof section 59F if the Court is satisfied that\n(a) the investigative officer has complied with subsection (3) of section 59F.\n(b) the information requested is commensurate, proportionate and necessary\nfor the purposes of a specific criminal investigation or prosecution;\n(c) measures shall be taken to ensure that the computer data is produced whilst\nmaintaining the privacy of other users, customers and third parties and\nwithout the disclosure of information and data of any party not part of the\ninvestigation; and\n(d) the investigation may be frustrated or seriously prejudiced unless the\nproduction of the information is permitted.\nCYBERSECURITY (AMENDMENT) BILL, 2025\n19\n(2) The Court shall require the service provider to keep confidential the\nwarrant and the execution of the warrant under this section.\n(3) A warrant granted under this section shall be served on a domestic service\nprovider, foreign service provider or both, or any other relevant person. \u201d.\nSection 59H in serted\n30. The principal enactment is amended by the insertion after section 59G, of\n\u201cApplication for preservation order to preserve computer data\n(1)  A provider of wire or electronic communication services or a remote\ncomputing service on the written request of a law enforcement agency, shall take the\nnecessary steps to preserve records and other evidence in its possession pending the issue\nof a Court o rder and shall take steps to ensure that the request by the law enforcement\nagency is not disclosed to third parties during the period.\n(2)  Where an order from the Court is not obtained and served for fourteen days",
+  "of a Court o rder and shall take steps to ensure that the request by the law enforcement\nagency is not disclosed to third parties during the period.\n(2)  Where an order from the Court is not obtained and served for fourteen days\nafter the receipt of the written request, the wire or electronic communication services, or\nremote computing service provider is not under any obligation to preserve the evidence.\n(3)   An investigative officer authorised by a designated officer may apply ex-parte\nto the Court for an order to require a service provider or any person in control of a\ncomputer or computer system to preserve specified computer data, including traffic data\nthat has been stored by a computer system.\n(4) An investigative officer who makes an application under subsection (1) shall\ndemonstrate to the satisfaction of the Court that the computer data is particularly\nvulnerable to loss or modification. \u201d.\nSection 59I\n31. The principal enactment is amended by the insertion after section 59H, of\n\u201cGrant of preservation order\n59I.  (1)  The High Court may grant an application for a preservation order under\nsubsection (1) of section 59F if the Court is satisfied that :\n(a) the designated officer has complied with subsection (2) of section  59H;\n(b) the extent of the preservation order is commensurate, proportionate and\nnecessary for the purposes of a specific criminal investigation or\nprosecution;\nCYBERSECURITY (AMENDMENT) BILL, 2025\n20 (c) measures shall be taken to ensure that the computer data is preserved whilst\nmaintaining the privacy of other users, customers and third parties and\nwithout the disclosure of information and data of any party not part of the\ninvestigation; and\n(d) the investigation may be frustrated or seriously prejudiced unless the",
+  "20 (c) measures shall be taken to ensure that the computer data is preserved whilst\nmaintaining the privacy of other users, customers and third parties and\nwithout the disclosure of information and data of any party not part of the\ninvestigation; and\n(d) the investigation may be frustrated or seriously prejudiced unless the\npreservation order is permitted.\n(2) The preservation order issued under subsection (1)\n(a) is valid for a period of ninety days, and\n(b) may be renewed for a further period of ninety days upon application to the\nCourt.\n(3) The Court shall require the service provider to keep confidential a\npreservation order issued under this regulation. \u201d.\nSection 59J\n32. The principal enactment is amended by the insertion after section 59I, of\n\u201cPower of entry, inspection and audit\n59J.  (1) The Authority may designate a person as an inspector to inspect premises.\n(2) A person designated as an inspector by the Authority may\n(a) obtain a warrant to :\n(i) enter and inspect premises; and\n(ii) conduct an audit of a computer system\n(b) at any reasonable time, enter  inspect premises  and conduct and audit of a\ncomputer system  without a warrant where the inspector\n(i) reasonably believes that an inspection of the premises is necessary to\nensure compliance by the owner of a critical information infrastructure,\na licensee or a service provider or any other relevant person with the\nAct or Regulations; and\n(ii) has given the occupier of the premises seven days' notice in writing of\nthe intention to enter , inspect the premises  and conduct an audit of a\ncomputer system .\n(3) An inspector shall, before exercising a power of entry and inspection,",
+  "Act or Regulations; and\n(ii) has given the occupier of the premises seven days' notice in writing of\nthe intention to enter , inspect the premises  and conduct an audit of a\ncomputer system .\n(3) An inspector shall, before exercising a power of entry and inspection,\nCYBERSECURITY (AMENDMENT) BILL, 2025\n21 (a) produce evidence of the identity of the inspector; and\n(b) indicate the purpose of entry and inspection.\n(4) An inspector may\n(a) enter a premises;\n(b) inspect the premises;\n(c) inspect a document or equipment found on the premises;\n(d) require a person on the premises to provide any information, or produce any\ndocument in the possession or control of that person that the inspector\nconsiders relevant to ensure compliance with the Act and Regulation and\n(e) require any person on the premises to provide information in respect of a\ndocument or the location of a document.\n(4) For the purpose of this regulation, \u201cpremises\u201d does not include domestic\npremises. \u201d.\nSection 59K  inserted\n33. The principal enactment is amended by the insertion after section 59J, of\n\u201cWitness and Inform ant Protection\n59K.   (1)  Except with the written, informed, explicit and freely given consent of a\nwitness or inform ant, no witness  or inform ant who discloses information relating to\ncybercrime under this Act or administrative infractions under this Act,  shall be obliged to\ndisclose his  name or address or other personal information , or state any matter which\nmight lead to the ir discovery.\n(2) Unless otherwise provided, t he information and the identity of the witness\nor inform ant shall be held to be secret between the Authority  and the  witness or  informer;",
+  "disclose his  name or address or other personal information , or state any matter which\nmight lead to the ir discovery.\n(2) Unless otherwise provided, t he information and the identity of the witness\nor inform ant shall be held to be secret between the Authority  and the  witness or  informer;\nand all matters relating to such information should be privileged and sh all not be disclosed\nin any proceedings before any court, tribunal, commission, or authority.\n(3) The Authority take all necessary and reasonable steps to protect the safety\nand welfare of a witness  or informant , and such t he protection shall extend to persons by\nvirtue of being related to a witness  or info rmant,  or on account of a testimony given by a\nwitness  or informer , or for any other reason upon which the Authority may consider\nsufficient. \u201d.\nSection 67 of Act 10 38 amended\n34. The principal enactment is amended by :\nCYBERSECURITY (AMENDMENT) BILL, 2025\n22  (a) the substitution for the heading before section 67 \u201cOther Online Sexual\nOffences, of\n\u201cOther cybercrime\u201d.\n(b) the substitution for subsection (2)  of section 67 , of\n\u201c(2) A person who contravenes subsection (1) commits an offence and is liable\non summary conviction to  a term of imprisonment of not less than three years and not\nmore than ten years  or a fine of  not less than two hundred and fifty penalty units and not\nmore than twenty -five thousand penalty units  or to both.\u201d.\nSection 67A inserted\n35. The principal enactment is amended by the insertion after section 67, of\n\u201cCyberbullying and online harassment\n67A. (1)  A person shall not use the internet or any form of electronic medium",
+  "more than twenty -five thousand penalty units  or to both.\u201d.\nSection 67A inserted\n35. The principal enactment is amended by the insertion after section 67, of\n\u201cCyberbullying and online harassment\n67A. (1)  A person shall not use the internet or any form of electronic medium\nor technology to bully a child or an adult.\n(2)  A person shall not use a computer or any other electronic medium to\n(a)  send a threatening message or a lewd message to a child;\n(b)  make sexual advances towards a child; or\n(c)  persistently make contact with\n(i)  a child, whether or not the contact is acceptable; or\n(ii)  another person where the contact is unacceptable.\n(3)  A person shall not create a false identity online or a fake social media\nprofile for the purposes of following\n(a)  a child, whether or not the contact is acceptable; or\n(b)  an adult, where the contact is unacceptable.\n(4)  A person shall not use any online computer service or any other\nelectronic device to:\n(a)  track the location of a child;\n(b)  monitor the real -world activities of a child;\n(c)  track the location of another person without the consent of that\nperson;\nCYBERSECURITY (AMENDMENT) BILL, 2025\n23 (d)  monitor the real -world activities of another person without the\nconsent of that person; or\n(e)  obsessively track the location of\n(i)  a child; or\n(ii)  another person without the consent of that person.\n(5)  Despite subsection (4), a parent  or legal guardian  may for the",
+  "consent of that person; or\n(e)  obsessively track the location of\n(i)  a child; or\n(ii)  another person without the consent of that person.\n(5)  Despite subsection (4), a parent  or legal guardian  may for the\npurposes of ensuring the safety of a child, track the location of the child, or monitor\nthe real -world activities of the child.\n(6)  A person shall not use an electronic device or medium to send\n(a)  an unwanted,\n(b)  an unsolicited,\n(c)  a frightening,\n(d)  an obscene,\n(e)  a harassing, or\n(f)  a threatening electronic mail, text message or instant message to a\nchild or an adult.\n(7)  A service provider of a user -to-user service including\n(a)  a chatroom,\n(b)  a social network site,\n(c)  an online gaming platform, or\n(d)  a virtual, augmented and mixed reality shall protect a child from all\nforms of online violence and cyberbullying from users of the user -\nto-user service.\n(8)  A person shall not use an electronic device or an electronic medium\nto deliberately spread false or misleading information with the intent\nto deceive or manipulate a person or a fact.\n(9)  A person who contravenes subsections (1), (2), (3), (4) or (6) commits\nan offence and is liable on summary conviction to a fine of not less\nthan two thousand, five hundred penalty units and not more than\nfive thousand penalty units or to a term of impriso nment of not less",
+  "an offence and is liable on summary conviction to a fine of not less\nthan two thousand, five hundred penalty units and not more than\nfive thousand penalty units or to a term of impriso nment of not less\nthan one year and not more than three years or to both.\nCYBERSECURITY (AMENDMENT) BILL, 2025\n24 (10)  A person who contravenes sub regulation (7) or (8) commits an\noffence and is liable on summary conviction to a fine of not less than\nfive thousand penalty units and not more than twenty -five thousand\npenalty units or to a term of imprisonment of not less than three\nyears and not more than five years or to both.\n(11)  For the purpose of this Act, \u201ccyberbullying\u201d includes any digital\ncommunication and any other activity which strips the recipient of\nthe dignity of the recipient, or causes fear or physical or emotional\nharm such as\n(a) repeatedly sending offensive, rude and insulting messages to\na person;\n(b) distributing derogatory information about a child or any other\nperson;\n(c) posting or sending offensive photos of a child or any other\nperson, whether or not the photos\n(i) have been digitally altered, or\n(ii) were taken with the consent of the victim, with the\nintention to humiliate or embarrass the victim;\n(d)   breaking into an electronic mail, social networking or any\nelectronic account and using the virtual identity of a victim to\nsend, upload or distribute embarrassing materials to or about\nothers;\n(e)  sharing sensitive personal information or any embarrassing\ninformation, or tricking a child or any person to reveal\npersonal or embarrassing information about that child or any\nother person and sharing the information obtained with\nothers;",
+  "send, upload or distribute embarrassing materials to or about\nothers;\n(e)  sharing sensitive personal information or any embarrassing\ninformation, or tricking a child or any person to reveal\npersonal or embarrassing information about that child or any\nother person and sharing the information obtained with\nothers;\n(f)  repeatedly sending threatening or intimidating messages with\nthreats of harm, or engaging in online activities that cause fear\nin a child or puts any other person in fear;\n(g)  sending messages to another person telling the person to\ncommit suicide;\n(h)  sending grossly offensive, indecent or obscene\ncommunication with the intention of causing emotional\ndistress to a child or any other person; or\n(i)  sending electronic messages that denigrate a child or any other\nperson on the basis of\n(i) colour;\nCYBERSECURITY (AMENDMENT) BILL, 2025\n25 (ii) race;\n(iii) ethnic or national origins;\n(iv) religion ;\n(v) gender; or\n(vi) disability. \u201d.\nSection 67B inserted\n36. The principal enactment is amended by the insertion after section 67A, of\n\u201cCyberstalking of a person\n\u201c67B.       (1)  In furtherance of section 65 of the Act, a person shall not use the\ninternet, chatroom , a social network site, an online gaming platform, or a virtual,\naugmented and mixed reality to\n(a)  harass or stalk a  person ;\n(b)  assume a false identity to anonymously harass or stalk a person;\n(c)  create false information about a person; or\n(d)  post or disseminate false information about a person.\n(2)  A person who contravenes subsection (1) commits an offence and is liable",
+  "(c)  create false information about a person; or\n(d)  post or disseminate false information about a person.\n(2)  A person who contravenes subsection (1) commits an offence and is liable\non summary conviction to a term of imprisonment of not less than one year and not more\nthan ten years or a fine of less than one hundred penalty units and not more than ten\nthousand penalty units or to both.\u201d.\nSection 68 of Act 10 38 amended\n37. The principal enactment is amended in  section 68 by substitution for subsection\n(2), of\n\u201c(2) A person who contravenes subsection (1) commits an offence and is liable\non summary conviction to a term of imprisonment of not less than three years and not\nmore than ten years or a fine of less than two hundred and fifty penalty units and not more\nthan twenty -five thousand penalty units  or to both.\u201d.\nSection 83 of Act 1038 amended\n38. The principal enactment is amended in section 83 by:\n(a) the substitution for paragraph (e) of subsection (4), of\n\u201c(e) requesting for information regarding domain name registration ;\u201d.\n(b) the addition after paragraph (e) of subsection (4) , of\nCYBERSECURITY (AMENDMENT) BILL, 2025\n26 \u201c(f) expedited disclosure of specified stored computer data in a service provider's\npossession or control in an emergency situation without a request for mutual\nassistance ;\u201d.\n(c) the addition after paragraph (f) of subsection (4), of\n\u201c(g)  any other matter related to paragraphs (a) to ( f).\u201d.",
+  "possession or control in an emergency situation without a request for mutual\nassistance ;\u201d.\n(c) the addition after paragraph (f) of subsection (4), of\n\u201c(g)  any other matter related to paragraphs (a) to ( f).\u201d.\n(d)  the addition after paragraph (g) of subsection (4), of\n\u201c(5)  For the purpose of this section an emergency means, a situation in which\nthere is a significant and imminent risk to the life or safety of any natural person. \u201d.\nSection 90 of Act 10 38 amended\n39. The principal enactment is amended in section 90 by  the addition after subsection\n(2), of\n\u201c(3) Despite section 90(1)  and section 90A , the Circuit Court shall have the\njurisdiction to try an offence under sections 62 to 68 A of this Act. \u201d.\nSection 91 of Act 10 38 amended\n40. The principal enactment is amended in section 91 by the addition after paragraph\n(h), of\n\u201c(i) the designation of Sectoral Computer Emergency Response Team;\n(j) the accreditation of Sectoral Computer Emergency Response Team;\n(k)   the accreditation of cybersecurity establishments ;\n(l) the accreditation of non -profit cybersecurity institution ;\n(m) the protection of children ;\n(n) safeguarding the development and deployment of innovative and emerging\ntechnologies or solutions ;\n(o) licensing of cyber security service providers ;\n(p) accreditation of cybersecurity professionals and practitioners;\n(p) any other matter required for ensuring the cybersecurity of the country .\u201d.\nSection 92 of Act 10 38 amended\n41. The principal enactment is amended in section 92 by :",
+  "(p) accreditation of cybersecurity professionals and practitioners;\n(p) any other matter required for ensuring the cybersecurity of the country .\u201d.\nSection 92 of Act 10 38 amended\n41. The principal enactment is amended in section 92 by :\n(a)  the substitution for subsection (1), of\n\u201c(1) the Authority may issue directives to an owner of a critical information\ninfrastructure, a cybersecurity service provider or service provider , innovators, developers\nfor the purpose of ensuring the cybersecurity of the country.\n(b) the substitution for subsection (2), of\nCYBERSECURITY (AMENDMENT) BILL, 2025\n27 \u201c(2) An owner of a critical information infrastructure, cybersecurity service\nprovider or service provider, innovator, developer or any relevant person who fails to\ncomply with the directives issued under this section is liable to pay to the Authority the\nadmin istrative penalty specified in the Second Schedule .\u201d.\n(c)  the insertion after subsection (2) , of\n\u201c(3) The Authority may issue directives to innovators, developers, service\nproviders and cybersecurity service providers for the purpose of securing the adoption and\ndeployment of innovative and emerging technologies or solutions.\u201d.\nSection 94 of Act 10 38 amended\n42. The principal enactment is amended by the substitution for section 94, of\n\u201c(1) A person who, without lawful authority accesses or retrieves subscriber\ninformation or intercepts traffic data or content data, commits an offence and is liable on\nsummary conviction to a fine of not less than two thousand five hundred penalty units and",
+  "\u201c(1) A person who, without lawful authority accesses or retrieves subscriber\ninformation or intercepts traffic data or content data, commits an offence and is liable on\nsummary conviction to a fine of not less than two thousand five hundred penalty units and\nnot more than fifteen thousand penalty units or to a term of imprisonment of not less than\ntwo years and not more than five years or, to both.\n(2) An attempt to gain access to a critical information infrastructure or its\ndependencies, successful or not, constitutes an unlawful access to the critical information\ninfrastructure.\n(3) Any person who attempts to secure access to a critical information\ninfrastructure or its dependencies, successful or not commits an offence and is liable on\nsummary conviction to a term of imprisonment of not less than two years and not more\nthan five years or a fine of not less than four thousand penalty units and not more than\ntwenty -five thousand penalty units or to both.\n(4) The tampering and or destruction of critical information infrastructure or its\ncomponents which affects the confidentiality, integrity or availability of the critical\ninformation infrastructure constitutes unlawful access  to critical information infrastructure ,\nand a person shall be subject to the same criminal penalties specified in subsection (1). \u201d.\nSection 94A inserted\n43. The principal enactment is amended by the insertion after section 94, of\n\u201cComputer related Forgery\n95A. (1) A person shall not intentionally and without right, input, alter, delete\nor suppress computer data resulting in inauthentic data with the intent that they be\nconsidered or acted upon for legal purposes as if they were authentic, regardless of whether\nor no t the data are directly readable and intelligible.\u201d",
+  "or suppress computer data resulting in inauthentic data with the intent that they be\nconsidered or acted upon for legal purposes as if they were authentic, regardless of whether\nor no t the data are directly readable and intelligible.\u201d\n(2) A person who contravenes subsection (1) commits an offence  and\nshall be deemed to have committed the offence of forger y under Chapter Two of the\nCYBERSECURITY (AMENDMENT) BILL, 2025\n28 Criminal Offences Act, 1960 (Act 29) , and shall liable on summary conviction to the same\npunishment for that particular kind of forgery under the law. \u201d.\nSection 94B inserted\n44.  The principal enactment is amended by the inser tion after section 94A, of\n\u201cComputer related Fraud\n95B.  (1) A person shall not intentionally and without right, cause the loss of\nproperty to another person by means of:\n(a)  Any input, alteration, deletion or suppression of computer data;\n(b)  Any interference with the functioning of a computer system;\n(c)  Any deception as to factual circumstances made through a computer\nsystem that causes a person to do or omit to do anything which that person would  not\notherwise do or omit to do;  with the fraudulent or dishonest intent of procuring for oneself\nor for another person, without right, a gain in money or other property .\n(2) A person who contravenes subsection (1) commits an offence  and\nshall be deemed to have committed the offence of defrauding by false pretence under\nsection 13 1 of the Criminal Offences Act, 1960 (Act 29) , and shall liable on summary",
+  "(2) A person who contravenes subsection (1) commits an offence  and\nshall be deemed to have committed the offence of defrauding by false pretence under\nsection 13 1 of the Criminal Offences Act, 1960 (Act 29) , and shall liable on summary\nconviction to the same punishment for defrauding by false pretence under that law. \u201d.\nSection 97 of Act 10 38 amended\n45. The principal enactment is amended in section 97 by:\n(a) the insertion before \u201cAuthority \u201d, of\n\u201cArtificial Intelligence  is technology that enables computers and machines to\nsimulate human learning, comprehension, problem solving, decision -making, creativity and\nautonomy ;\u201d;\n\u201cblock-chain based technology \u201d means a n advanced decentralised  digital record or\ndigital ledger of transactions, that enables recording of transactions, tracking of assets, and\nsharing of records across computer networks in a transparent and immutable way; \u201d.\n\u201cbig data\u201d means a collection of extremely large organized, semi -structured, and\nunstructured information that grows exponentially over time;\u201d ;\n(b) the insertion after \u201cchild\u201d, of\n\u201ccloud technology\u201d means technology that delivers computing services and offers\non-demand access to computing resources such as physical or virtual services, data\nstorage, servers, databases, networking, intelligence, analytics, and software over the\ninternet ;\u201d;\n(c) the insertion after \u201c cloud technology\u201d, of\nCYBERSECURITY (AMENDMENT) BILL, 2025\n29 \u201cconfiscation\u201d, which includes forfeiture where applicable, shall mean the\npermanent deprivation of property by order of a court or other competent\nauthority;\u201d;\n(d) the insertion after \u201cdigital ecosystem\u201d of",
+  "CYBERSECURITY (AMENDMENT) BILL, 2025\n29 \u201cconfiscation\u201d, which includes forfeiture where applicable, shall mean the\npermanent deprivation of property by order of a court or other competent\nauthority;\u201d;\n(d) the insertion after \u201cdigital ecosystem\u201d of\n\u201cdigital services\u201d means services delivered electronically whether traditionally or\nby internet, with minimal physical interaction, and includes:\n(a) social media platforms;\n(b) e-commerce platforms;\n(c) video -on-demand or streaming platforms;\n(d) messaging applications,\n(e) fintech software platforms;\n(f) online banking platforms;\n(e) the insertion after \u201cDirector -General\u201d, of\n\u201cEmergency\u201d shall mean a situation in which there is a significant and imminent\nrisk to the life or safety of any natural person;\u201d;\n(f) the insertion after \u201ce -services\u201d, of\n\u201cFreezing\u201d or \u201cseizure\u201d mean temporarily prohibiting the transfer, conversion,\ndisposition or movement of property or temporarily assuming custody or control\nof property on the basis of an order issued by a court or other competent\nauthority;\u201d;\n(g) the insertion after \u201cinterception of warrant \u201d, of\n\u201cInternet of Things (IoT) means  a network of interrelated physical devices, vehicles,\nappliances and other physical objects that connect and exchange data with other\ndevices and the cloud  across wireless networks , and are typically embedded with\nsensors, processing ability and software and can include mechanical and digital\nmachines and consumer objects ;\u201d;\n(h) the substitution for \u201ccomputer system \u201d, of\n\u201ccomputer system\u201d means an arrangement of interconnected computers that is\ndesigned to perform one or more specific functions, and includes\n(a) an information processing system;",
+  "machines and consumer objects ;\u201d;\n(h) the substitution for \u201ccomputer system \u201d, of\n\u201ccomputer system\u201d means an arrangement of interconnected computers that is\ndesigned to perform one or more specific functions, and includes\n(a) an information processing system;\n(b) an operational technology system, a programmable logic controller, a\nsupervisory control and data acquisition system, or a distributed control\nsystem; and\nCYBERSECURITY (AMENDMENT) BILL, 2025\n30 (c) dependency systems that support the functionality of a computer or\ncomputer network ;\u201d;\n(i) the substitution for \u201claw enforcement agency\u201d, of\n\u201claw enforcement agency\u201d means\n(a) The Police\n(b) The Customs Division of the Ghana Revenue Authority and\n(c) Cyber Security Authority\n(d) Any other agency authorised  by law to exercise the powers of the Police\n(j) the insertion after \u201cprohibited intimate image and visual recording\u201d, of\n\u201cproperty\u201d mean s assets of every kind, in the country or elsewhere whether\ncorporeal or incorporeal, movable or immovable, tangible or intangible, including\nvirtual assets, and legal documents or instruments evidencing title to, or interest in,\nsuch property assets;\u201d;\n(k) the insertion after \u201cproperty\u201d, of\n\u201cproperty of or in the possession or control of a person\u201d includes a gift made by\nthat person;\n(l) the insertion after \u201cpublish\u201d, of\n\u201cquantum computing \u201d means technology that solves complex problems based on\nprinciples of quantum mechanics;\u201d .\nSection 98 of Act 1058 amended\n46. The principal enactment is amended  by substitution for section 98, of\n\u201cRepeals and savings",
+  "that person;\n(l) the insertion after \u201cpublish\u201d, of\n\u201cquantum computing \u201d means technology that solves complex problems based on\nprinciples of quantum mechanics;\u201d .\nSection 98 of Act 1058 amended\n46. The principal enactment is amended  by substitution for section 98, of\n\u201cRepeals and savings\n(1) Sections 118  and 136 of the Electronic Transaction Act, 2008 (Act 772)\nare repealed.\n(2) Sections 35 to 40 this Act repeals sections 55 to 62 of the Electronic\nTransaction Act, 2008 (Act 772) .\n(3) Despite the repeal of sections, any Regulations, bye -laws, directives,\nnotices, orders, directions, appointments or other acts lawfully made or\ndone under the repealed enactment and in force immediately before the\nCYBERSECURITY (AMENDMENT) BILL, 2025\n31 coming into force of this Act shall be deemed to have been made or done\nunder this Act and shall continue to have effect until instruments issued\nor made  until revoked, cancelled, withdrawn or terminated.\u201d.\nSection 99 of Act 10 38 amended\n47. The Extradition Act, 1960 (Act 22) is amended  by:\n(a)  the addition after subsection (3)  of section , of\n\u201c(4)  Despite subsection (1),  for the purposes of extradition , Cybercrime and\nCyber Offences under the First Schedule to this Act,  in the absence of a  separate\narrangement, bilateral or multilateral agreement between Ghana and another signatory of\nthe Budapest Convention on Cybercrime  or any other convention , extradition of fugitive\ncriminals may still take place between Ghana and another signatory of the Budapest\nConvention on Cybercrime  or any other convention  and shall be governed by the\nprovisions of the said convention. \u201d.",
+  "the Budapest Convention on Cybercrime  or any other convention , extradition of fugitive\ncriminals may still take place between Ghana and another signatory of the Budapest\nConvention on Cybercrime  or any other convention  and shall be governed by the\nprovisions of the said convention. \u201d.\nFirst schedule to Act 1038 amended\n48. The principal enactment is amended by substitution for the preamble, of\n\u201cA service provided for reward or a not -for profit basis intended primarily for or aimed at\nensuring or safeguarding the cybersecurity of a computer or computer system belonging\nto a person and includes.\u201d.\nSecond schedule to Act 10 38 amended\n49. The principal enactment is amended by substitution for administrative penalties for\nsections 36(4), 39(2)(a), 39(2)(b), 39(2)(c) and 92(2) and addition of administrative penalties\nfor sections 36(1) and 39(3)(c) .\nNo. Sections of\nAct creating\ncontravention  Contravention  Administrative\nPenalty\n1. 36(1)  The Owner of the designated critical\ninformation infrastructure shall register\ntheir critical information infrastructure\nwith the Authority, and shall pay the\nprescribed annual registration and\ndesignation fee as determined by the\nAuthority or stipulated i n a legislative\ninstrument.  Not less than five\nthousand penalty\nunits, not more than\nfifty thousand\npenalty units .\n2. 36(4)  Owner of a registered critical information\ninfrastructure failing to inform the\nAuthority within seven days of the change\nin legal ownership of the registered critical  Not less than five\nthousand penalty\nunits, not more than\nCYBERSECURITY (AMENDMENT) BILL, 2025\n32 information infrastructure.\nfifty thousand\npenalty units.\n3. 39(2)(a)  Owner of a critical information",
+  "Authority within seven days of the change\nin legal ownership of the registered critical  Not less than five\nthousand penalty\nunits, not more than\nCYBERSECURITY (AMENDMENT) BILL, 2025\n32 information infrastructure.\nfifty thousand\npenalty units.\n3. 39(2)(a)  Owner of a critical information\ninfrastructure failing to report a\ncybersecurity incident .\nNot less than ten\nthousand penalty\nunits, not more than\nfifty thousand\npenalty units.\n4. 39(2)(b)  Owner of a critical information\ninfrastructure failing to cause an audit to be\nperformed on the critical information\ninfrastructure .\nNot less than five\nthousand penalty\nunits, not more than\ntwenty thousand\npenalty units.\n5. 39(3)(c)  Owner of a critical information\ninfrastructure failing to submit a copy of\nthe audit report to the Authority.\nNot less than five\nthousand penalty\nunits, not more than\ntwenty thousand\npenalty units.\n6. 92(2)  Owner of a critical information\ninfrastructure, a cybersecurity service\nprovider or a  provider of a digital service\nfailing to comply with a directive issued by\nthe Authority . Not less than ten\nthousand penalty\nunits, not more than\nfifty thousand\npenalty units\nThird schedule to Act 1038 amended\n50.   The principal enactment is amended by addition after the \u201cOath of Secrecy\u201d, of\nThe Official Oath\n(section 5)\nI,\n\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026..\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\ndo (in the name of the Almighty God swear) (solemnly affirm) that I will at all times well\nand truly serve the Republic of Ghana in the office of \u2026\u2026.and that I will uphold, preserve,",
+  "do (in the name of the Almighty God swear) (solemnly affirm) that I will at all times well\nand truly serve the Republic of Ghana in the office of \u2026\u2026.and that I will uphold, preserve,\nprotect and defend the constituti on of the Republic of Ghana as by law established (so\nhelp me God)."
+]

assets/example_bills/cybersecurity-amendment-bill-2025/document.txt

@@ -0,0 +1,1104 @@
+CYBERSECURITY (AMENDMENT) BILL, 2025
+1 ARRANGEMENT OF SECTIONS
+Section
+1. Section 3 of Act 1038 Amended
+2. Section 4A inserted
+3. Section 5 of Act 1038 amended
+4. Section 13 of Act 1038 amended
+5. Section 14 of Act 1038 amended
+6. Section 15A inserted
+7. Section 20A inserted
+8. Section 20B inserted
+9. Section 31 of Act 1038 amended
+10. Section 35 of Act 1038 amended
+11. Section 36 of Act 1038 amended
+12. Section 37 of Act 1038 amended
+13. Section 40 of Act 1038 amended
+14. Section 47 of  Act 1038 amended
+15. Section 49 of Act 1038 amended
+16. Section 57 of Act 1038 amended
+17. Section 57A inserted
+18. Section 57B inserted
+19. Section 57C inserted
+20. Section 58A inserted
+21. Section 58B inserted
+22. Section 59 of Act 1038 amended
+23. Section 59A inserted
+24. Section 59B inserted
+25. Section 59C inserted
+26. Section 59D inserted
+27. Section 59E inserted
+28. Section 59F inserted
+29. Section 59G inserted
+30. Section 59H inserted
+31. Section 59I inserted
+32. Section 59J inserted
+33. Section 59K inserted
+34. Section 67 of Act 1038 amended
+35. Section 67A inserted
+36. Section 67B inserted
+37. Section 68 of Act 1038 amended
+38. Section 83 of Act 1038 amended
+39. Section 90 of Act 1038 amended
+40. Section 91 of Act 1038 amended
+41. Section 92 of Act 1038 amended
+42. Section 94 of Act 1038 amended
+43. Section 94A inserted
+CYBERSECURITY (AMENDMENT) BILL, 2025
+2 44. Section 94B inserted
+45. Section 97 of Act 1038 amended
+46. Section 98 of Act 1058 amended
+47. Section 99 of Act 1038 amended
+48. First Schedule to Act 1038 amended
+49. Second schedule to Act 1038 amended
+50. Third schedule to Act 1038 amended
+CYBERSECURITY (AMENDMENT) BILL, 2025
+3 A
+BILL
+ENTITLED
+CYBERSECURITY (AMENDMENT)  BILL, 2025
+AN ACT  to amend the Cybersecurity Act, 2020 (Act 1038) to  confer powers on the Cyber
+Security Authority  to investigate  and prosecute cybercrime on the authority of the
+Attorney -General  and recover proceeds of cyber crime ; to revise  the object  and
+functions of the Cyber Security Authority;  to revise the governance and
+administration of the Cyber Security Authority ;  to revise the enforcement powers of
+the Cyber Security Authority  and to provide for related matters.
+Section 3 of Act 10 38 Amended
+1. The Cybersecurity Act, 2020 (Act 1038) referred to in the Act as the “principal
+enactment” is amended by substitution for section 3, of
+“Objects of the Authority
+3. The objects of the Authority are to:
+(a) regulate cybersecurity activities in the country;
+(b) prevent, manage and respond to cybersecurity threats and
+cybersecurity incidents ;
+(c) regulate owners of critical information infrastructure in respect of
+cybersecurity activities, cybersecurity service providers , cybersecurity
+professionals and practitioners, and cybersecurity establishments in
+the country;
+(d) promote the development of cybersecurity in the country to ensure a
+secured and resilient digital ecosystem;
+(e) prevent and detect cybercrime;
+(f) to facilitate the confiscation of proceeds of cybercrime;
+(g) establish a platform for cross -sector engagement on matters of
+cybersecurity for effective co -ordination and co -operation between
+key public institutions and the private sector;
+(h) create awareness of cybersecurity matters; an d
+(i) collaborate  with States, inter -governmental bodies, international
+organisations and international agencies to promote the cybersecurity
+of the country .”.
+Section 4A inserted
+2. The principal enactment  is amended by the insertion after section 4, of
+“Further  Functions of the Authority
+CYBERSECURITY (AMENDMENT) BILL, 2025
+4 4A. The Authority , shall in addition to the functions in section 4, carry out the
+following functions:
+(a) subject to article 88 of the Constitution,  to investigate and on the
+authority of the Attorney -General , prosecute cybercrime  under this
+Act;
+(b) establish standards for certifying the security of innovative  products ,
+Artificial Intelligence, cloud technology, quantum computing, big
+data, Internet of Things (IoT) , blockchain -based technology  and any
+other emerging technologies ;
+(c) certify the security of innovative  products   Artificial Intelligence,
+cloud technology, quantum computing, big data, Internet of Things
+(IoT) , blockchain -based technology  and any other emerging
+technologies , in accordance with the standards established pursuant
+to paragraph ( b);
+(d) accredit the cybersecurity establishments of critical information
+infrastructure  owners, cybersecurity service providers, cybersecurity
+practitioners and professionals  and other relevant person s or
+institutions ;
+(e) accredit non -profit cybersecurity institutions  and cybersecurity
+professional bodies ;
+(f) promote the online protection of women, elderly , persons with
+disabilities  and underserved populations ;
+(g) collaborate with relevant institutions to develop mechanisms
+including technical security solutions and guidelines on the usage of
+smart technology  and other emerging technologies ; and
+(h) promote the protection of digital right s as it relates to cyber security. ”.
+Section 5 of Act 10 38 amended
+3.  The principal enactment is amended in section 5 by the addition after subparagraph
+(iv) of paragraph (a) of subsection (1), of
+“(v) Foreign Affairs and Regional Integration ; and
+(vi)  Gender, Children and Social Protection .”.
+Section 13 of Act 10 38 amended
+4. The principal enactment is amended in section 13  by:
+(a)  the substitution for paragraph (d) of subsection (2), of
+“(d)  the Executive Director of the Data Protection Commission or any
+successor official or entity by whatever name designated, or a
+representative of the Executive Director with the requisite
+knowledge and skills in cybercrime and cybersecurity matters,
+nominated by the Executive Director ;”;
+CYBERSECURITY (AMENDMENT) BILL, 2025
+5 (b) the substitution for paragraph (g) and (k) respectively of subsection (2), of
+“(g) the Director of the National Intelligence Bureau  or any successor
+official or entity by whatever name designated, or a representative of
+the Director with the requisite knowledge and skills in cybercrime ,
+and cybersecurity matters, nominated by the Director;
+(k) the Director General of National Signals Bureau or any successor
+official or entity by whatever name designated, or a representative of
+the Director with the requisite knowledge and skills in cybercrime and
+cybersecurity matters, nominated by the Director; ”;
+(c)  the addition after paragraph (r) of subsection (2), o f
+“(s)  Any other person the Minister may nominate, on the advice of the
+Authority. ”.
+(d) the addition after subsection (13), of
+“(14)  A member of the JCC who is absent from three consecutive meetings
+without sufficient cause ceases to be a member of the JCC .
+(15) Where there is a vacancy, the Minister shall notify the President of
+the vacancy , and the President shall appoint a person to fill the v acancy for
+the unexpired term. ”.
+Section 1 4 of Act 10 38 amended
+5. The principal enactment is amended  in section 14 by the substitution for subsection
+(1), of
+“14     (1).  The Joint Cybersecurity Committee shall collaborate with the Authority and
+the sectors or institutions represented on the Committee for the implementation of
+relevant cybersecurity  measures  including but not limited to the following ways:
+(a) identification of cybersecurity risks that may affect critical information
+infrastructure or the overall cybersecurity of the country ;
+(b) development of cybersecurity policies and guidelines based on identified
+risks, best practices and international standards to mitigate cybersecurity
+risks;
+(c) coordination of cybersecurity activities between sectors and entities to
+ensure that all cybersecurity efforts are aligned to prevent overlap and gaps;
+(d) facilitate the sharing of information between sectors and entities in a secure
+manner and in compliance with relevant data protection laws ;
+(e) collaboration with sectors or institutions to tackle cybercrime including the
+provision of a platform for incidence sharing and incidence response
+mechanisms to facilitate ;
+CYBERSECURITY (AMENDMENT) BILL, 2025
+6 (f) evaluation of the effectiveness of implemented cybersecurity measures based
+on established metrics with a view to continuously improve the cybersecurity
+measures ; and
+(g) collaboration with the Authority to educate the public on matters related to
+cybercrime and cybersecurity. ”.
+Section 15 A inserted
+6. The principal enactment is amended by the insertion after section 15, of
+“Appointment of Deputy -Director s General
+15A. (1)  The President shall in accordance with article 195  of the Constitution
+appoint such Deputy Directors -General as are necessary for the performance of the
+functions of the Authority.
+(2)  The Deputy Directors -General shall hold office on the terms and
+conditions specified in the letters of appointment.
+(3)  The Deputy Directors -General shall act in the absence of the
+Director -General and perform any other functions as determined by the  Board.
+(4)  The Deputy Directors -General shall, subject to the provisions of this
+Act:
+(a) assist the Director -General in the discharge of his functions and
+perform such other functions as the Director -General or the Board
+may delegate to him;
+(b) perform functions related to the object and functions of the
+Authority on the direction or authority of the Director -General  or
+the Board ; and
+(c) be responsible for the direction of the Authority when the Director -
+General is absent from Ghana or is otherwise unable to perform his
+functions. ”.
+Section 20A inserted
+7. The principal enactment is amended by the insertion after section 20, of
+“Terms and Conditions of Service of Staff of the Authority
+20A. (1) The terms and conditions of service of the staff of the Authority shall
+not be less favourable than the staff of the security and intelligence agencies .
+CYBERSECURITY (AMENDMENT) BILL, 2025
+7 (2) The conditions of service attached to posts of legal officers of the
+Authority shall not be less than that of the posts attached to that of legal officers of
+the Attorney -General of the same rank.
+(3) Staff shall, in addition to monthly salaries, be eligible for the payment
+of any gratuity, allowance, pension, subsidy or benefit to members in respect of
+their service  or resignation or retirement .”.
+Section 20B inserted
+8. The principal enactment is amended by the insertion after section 20, of
+“Powers of police
+20B. (1) The Director -General, Deputy Director -General and other
+authorised officers shall exercise the powers  of a Police Officer, including the
+powers of arrest, search and seizure  and have the  same rights, protections
+immunities conferred on a Police officer in the Criminal and Other Offences
+(Procedure) Act, 1960 (Act 30), the Police Service Act, 1970 (Act 350) and any other
+law related to a Police officer  in the performance of their functions under the Act. ”.
+Section 31 of Act 10 38 amended
+9. The principal enactment is amended by substitution for section 31, of :
+“Sources of money for the Fund
+31. The sources of moneys for the Fund include:
+(a)  seed money approved by Parliament;
+(b)  moneys which may become lawfully payable to the Authority for the
+Fund;
+(c) 50% of all fines arising from criminal penalties under th e Act;
+(f) grants, gifts, donations and other voluntary contributions;
+(g) 12% of the communications service tax for the Fund per annum;
+(h) 9 % corporate tax for the Fund per annum;
+(i) a charge determined by the Authority in accordance with the Fees
+and Charges  (Miscellaneous Provisions) Act, 2018 (Act 983) and
+levied on persons licensed by the Bank  of Ghana to carry on business;
+(j)  a proportion of the fees charged on all government e lectronic
+services determined by the  Authority ; and
+(h) any other moneys approved by Parliament for the Fund. ”.
+Section 35 of Act 10 38 amended
+10. The principal enactment is amended  by substitution for section 35, of
+“Designation of critical information infrastructure
+CYBERSECURITY (AMENDMENT) BILL, 2025
+8 35. (1)  The Minister may, on the advice of the Authority, designate a
+computer system or computer network as a critical information infrastructure if the
+Minister considers that the computer system or computer network is essential for
+(a)  national security,
+(b)  the economic and social well -being of citizens , or
+(c)  public health and safety.
+(2) Where the Minister designates a computer system or computer
+network as a critical information infrastructure, the Minister shall publish the sector of the
+designated critical information infrastructure in the Gazette  and, the owner of the Critical
+Information Infrastructure shall be notified of the designation.
+(3)  The Minister shall, in making a determination under subsection (1),
+consider if the  computer system or computer network is necessary for :
+(a)  the security, defence or international relations of the country;
+(b)  the production, preservation or identity of a confidential source of
+information related to  the enforcement of criminal law;
+(c)  the provision of services directly related to
+(i)  communications and telecommunications infrastructure;
+(ii)  banking and financial services;
+(iii)  public utilities
+(iv)  public transportation; and
+(v)  public key infrastructure;
+(d)  the protection of public safety and public health, including
+systems related to essential  emergency services;
+(e)  an international business or communication affecting a citizen of
+Ghana or any other  international business in which a citizen of
+Ghana or the Government has an interest;
+(f)  the Legislature, Executive, Judiciary, Public Services or security
+agencies ; or
+(g)  digital services;
+(h)  services related to the supply chain in the critical information
+infrastructure ecosystem; and
+(i)  any other services determined by the Minister, on the advice of the
+Authority .
+(4)  The Minister shall, by publication in the Gazette , estab lish the
+procedure for the  regulation of a critical information infrastructure. ”.
+Section 36 of Act 10 38 amended
+11. The principal enactment is amended by substitution for section 3 6, of
+“Registration of critical information in frastructure
+CYBERSECURITY (AMENDMENT) BILL, 2025
+9 36. (1)  The Owner of the designated critical information infrastructure shall
+register their critical information infrastructure with the Authority , and shall pay the
+prescribed annual registration and designation  fee as determined by the Authority
+or stipulated in  a legislative instrument .
+(2) For compliance purposes, the owner of an unregistered critical
+information infrastructure shall receive a notification of registration letter from the
+Authority to comply with the Act.
+(3)  During registration, the owner of a critical information infrastructure
+shall nominate a point of contact and submit details of the nominee to the
+Authority.
+(4) The owner of a critical information infrastructure shall submit to the
+Authority, verified details of critical information infrastructure, through the
+channels and modalities determined by the Authority.
+(5) The Authority shall validate the information submitted by the owner
+of  a critical information infrastructure, and the owner shall receive a Certificate of
+Registration upon completion of registration requirements.
+(6) The Authority shall  through the issuance of  guidelines or directives
+determine :
+(a)  further requirements for the registration of a critical information
+infrastructure ;
+(b)  the procedure for the registration of a critical information
+infrastructure; and
+(c)  any other matter relating to the registration of a critical information
+infrastructure.
+(7)  Where there is any change in the legal ownership of a designated
+critical information infrastructure, the owner of the designated critical information
+infrastructure shall , within  seven days after the change, inform the Authority of the
+change in ownership.
+(8) An owner of a designated  critical information infrastructure who
+contravenes subsectio n (1) and  (3) is liable to pay to the Authority the administrative
+penalty specified in the Second  Schedule. ”.
+Section 37 of Act 10 38 amended
+12. The principal enactment is amended by substitution for section 37 , of
+“Withdrawal of designation of critical information infrastructure
+“37. (1) The Minister may, on the advice of the Authority, withdraw the
+designation of a  critical information infrastructure at any time if the Minister considers that
+CYBERSECURITY (AMENDMENT) BILL, 2025
+10 the computer or computer network no longer satisfies the criteria of a critical information
+infrastructure .
+(2) The Minister may  publish the withdrawal of critical information
+infrastructure sector in the Gazette .
+(3) The owner of a designated critical information infrastructure shall
+receive notification of the withdrawal of the designation  by letter from the Minister. ”.
+Section 40 of Act 10 38 amended
+13.  The principal enactment is amended in section 40 by substitution for subsection
+(2), of
+“(2) A person who contravenes subsection (1) commits an offence and is liable
+on summary conviction to a fine of not less than four thousand penalty units and not more
+than twenty -five thousand penalty units , or both .”.
+Section 47 of Act 10 38 Amended
+14. The principal enactment is amended in section 47 by:
+(a) the addition after subsection (6), of
+“(7) A Sectoral Computer Emergency Response Team shall within twenty -four
+hours after receiving a report of a cybersecurity incident from the owner of a designated
+critical information infrastructure, a service provider, a licensee or any relevant person
+report  the cybersecurity incident to the National Computer Emergency Response Team.”.
+(b) the addition after subsection (7), of
+“(8) A Sectoral Computer Emergency Response Team who contravenes
+subsection (7) is liable to pay to the Authority the administrative penalty specified in the
+Second Schedule.”.
+Section 49 of Act 1038 Amended
+15.  The principal enactment is amended in section 49 by
+(a) the substitution for subsection (1), of
+“(1)  A person shall not provide a cybersecurity service for a reward unless that
+person obtains a licence issued by the Authority in accordance with the Act.”.
+(b) the substitution for subsection (2), of
+CYBERSECURITY (AMENDMENT) BILL, 2025
+11  “(2) A person shall not provide a cybersecurity service on a not -for-profit basis
+unless that person obtains an accreditation issued by the Authority in accordance with the
+Act.”.
+(c) addition after subsection (2), of
+“(3) A person who contravenes subsection (1) and (2) is liable to pay to the
+Authority the administrative penalty the equivalent to the cost of damage caused and value
+of the financial gain made , or an administrative penalty of not less than fifty thousand
+penalty units and not more than one hundred thousand penalty units. ”.
+Section 57 of Act 1038 Amended
+16. The principal enactment is amended by the substitution for section 57, of
+(1) The Authority shall establish a mechanism for the accreditation of
+cybersecurity professionals and practitioners.
+(2) An individual shall not practise  as a cybersecurity professional or
+cybersecurity practitioner unless that individual has been accredited by the Authority;
+(3) A person shall not knowingly engage the services of a cybersecurity
+professional or cybersecurity practitioner who has not been accredited by the Authorit y;
+(4) A person who contravenes subsection (2) or (3)  is liable to pay to the
+Authority an administrative penalty of not less than two hundred and fifty penalty units
+and not more than twenty thousand penalty units .
+Section 57A inserted
+17. The principal enactment is amended by the insertion after section 57, of
+“Cyber hygiene certification scheme
+57B. (1) The Authority shall establish a scheme for the certification of cybersecurity
+professionals and practitioners, and cybersecurity service providers who will be entrusted
+to perform cyber hygiene certification service as an alternative to other international best
+practice security frameworks.
+(2)  The Cyber Security Authority shall conduct periodic audits to ensure
+compliance with the cyber hygiene certification scheme and associated prescribed fees.
+(3) Any complaints regarding non -compliance  shall be investigated, and
+appropriate enforcement actions shall be taken. ”.
+Section 57B inserted
+CYBERSECURITY (AMENDMENT) BILL, 2025
+12 18. The principal enactment is amended by the insertion after section 58A, of
+“Application for certification to provide the Cyber hygiene certification services
+57B.  (1) A licensed  cybersecurity service provider or accredited CP who seeks to
+provide the Authority’s  cyber hygiene certification service shall apply in writing to the
+Authority.
+(2) The application shall be made in the prescribed form and accompanied by
+the:
+(a) supporting documentation, and
+(b) prescribed fee  that the Authority may determine .”.
+Section 57C inserted
+19. The principal enactment is amended by the insertion after section 58B, of
+“Standardised , Review and Administration of Fees for Cyber Hygiene Certification
+Service
+57C.   (1)  A certified cybersecurity professional or practitioner or cybersecurity service
+provider  shall charge a fee for cyber hygiene certification services as determined by the
+Cyber Security Authority.
+(2) A certified cybersecurity professional or practitioner or cybersecurity service
+provide r shall not charge fees exceeding the approved flat rate for cyber hygiene
+certification services.
+(3) A certified cybersecurity professional or practitioner or cybersecurity service
+provider who fails to comply wit h subsection (2) shall be  liable to pay to the Authority an
+administrative penalty specified in the Second Schedule (not less than two hundred and
+fifty penalty units and not more than five thousand penalty units)
+(4) 30% of the revenue generated by a certified cybersecurity professional or
+practitioner or cybersecurity service provider  under the scheme shall be paid into the
+cybersecurity fund.
+(5) The Cyber Security Authority shall,  by notice published in the Gazette,
+determine the applicable flat rate for cyber hygiene certification services.
+(6) The flat rate shall be reviewed periodically based on, industry trends, and the
+affordability needs of stakeholders. ”.
+Section 58A inserted
+20. The principal enactment is amended by the insertion after section 5 8, of
+CYBERSECURITY (AMENDMENT) BILL, 2025
+13 “Certification of the security of innovative and emerging technologies.
+58A. The Authority shall establish a mechanism for the certification of the security of
+innovative and emerging technologies. ”.
+Section 58B inserted
+21. The principal enactment is amended by the insertion after section 58A, of
+“Accreditation of non -profit cybersecurity institutions
+58B.  The Authority shall establish a mechanism for the accreditation of non -profit
+cybersecurity institutions .”.
+Section 59 of Act 10 38 Amended
+22. The principal enactment is amended  in section 59 by the addition after paragraph
+(e) of subsection (1), of
+“(g) certif ication of  the security of innovative and emerging technologies including
+Artificial Intelligence, cloud technology, quantum computing, big data, and blockchain -
+based technology. ”.
+Section 59A inserted
+23. The principal enactment is amended by the insertion after section 59, of
+“Enforcement powers
+59A.  (1) A person who:
+(a)  knowingly fails to comply with or acts in contravention of this Act,
+regulations or directives issued under this Act ;
+(b)  knowingly fails to comply with prescribed cybersecurity standards and
+requirements ;
+(c)  provides cybersecurity services without a licence or acts as a cybersecurity
+professional or practitioner without accreditation ;
+(d)  willfully obstructs, hinders, molests or assaults personnel of the Authority
+duly engaged in the exercise of power conferred on the Authority under this
+Act.
+commits an offence and is liable on summary conviction to a term of imprisonment
+of not more than five years or to a fine of not more than twenty thousand penalty
+units, or to both.
+CYBERSECURITY (AMENDMENT) BILL, 2025
+14 (1) Where an offence is committed by a corporate entity, that entity is liable to
+a fine of not more than twenty  thousand penalty units and each director of
+that entity shall be deemed to have committed the offence.
+(2) Despite subsection (1), the Authority may, where a person has breached this
+Act, Regulations or directives or where a licensee, an accreditation holder
+has breached a condition contained in its licence or accreditation :
+(a)  warn the person, licensee, or accreditation holder,
+(b)  issue a cease -and-desist order,
+(c)  apply to the High Court for
+(i)  an injunction to restrain the person, licensee, or accreditation
+holder from continuing the breach, or
+(ii)  other  appropriate order to enforce compliance with this Act,
+(d) propose amendments to the licence or accreditation in accordance
+with this Act or Regulations
+(e) suspend or terminate the licence or accreditation in accordance with
+this Act, or
+(f) impose administrative penalties in accordance with the second
+schedule of the Act
+(g) or take any other action that it considers appropriate and that is not
+contrary to this Act.
+(4)  Nothing shall prevent the Authority from pursuing only criminal
+enforcement actions under subsection (1) or only administration
+enforcement actions under subsection (2), or a combination of
+both. ”.
+Section 59B inserted
+24. The principal enactment is amended by the insertion after section 59A, of
+“Power to conduct investigations  and to prosecute cybercrime ”
+59B.  (1) The Authority shall upon the occurrence of a cybersecurity incident or a
+cybercrime conduct criminal investigations  and prosecute same .”
+(2)  The Authority shall have the jurisdiction  to prosecute all offences under the
+Electronic Transactions Act, 2008 (Act 772).
+(3) Where a person is convicted of a cybercrime under this Act, the Authority
+may apply to the Court for an order to confiscate moneys, proceeds, benefits, properties
+and assets purchased by a person with proceeds derived from or in the commission of the
+cybercrime.
+CYBERSECURITY (AMENDMENT) BILL, 2025
+15
+(4) Despite subsection (5), nothing shall prevent the Authority from instituting
+a civil action independently or at the same time as the prosecution to recover moneys,
+proceeds, benefits, properties and assets purchased by a person with proceeds derived from
+or in the commission of the cybercrime.
+(5) In relation to subsection (6) if criminal prosecution fails, civil asset recovery
+should still proceed, and confiscation orders should have the effect of a civil judgment
+appealable from the High Court to the Court of Appeal. ”.
+(6) Where the Authority considers that freezing of property is necessary to
+facilitate an investigation or prosecution, the Authority shall in writing direct the freezing
+of:
+(a)  the property of a person or entity  being investigated; or
+(b)  specified property held by a person or entity other than the person
+or entity being investigated or prosecuted.
+(7) The Authority shall within 14 days after the freezing of the property apply
+to the Court for a confirmation of the freezing.
+Section 59 C inserted
+25. The principal enactment is amended by the insertion after section 59 B, of
+“Power to request for information
+59C.  (1) The Authority may, for the purposes of carrying out an investigation in
+respect of a contravention of the Act, Regulations or any other relevant enactment by the
+owner of a critical information infrastructure, a licensee, a service provider or any other
+person, by notice in writing, require a person to :
+(a) attend at a time and place specified in the notice; and
+(b) furnish the Authority with information related to a matter relevant to the
+investigation.
+(2)   A notice under subsection (1) shall indicate the subject matter and purpose
+of the request. ”.
+(3) Where a person required to furnish the Authority with an information is
+under an obligation not to disclose, or asserts a right not to disclose, the Authority shall
+apply to the High Court for an order for the production of the information.
+(4)  Where an information is furnished to the Authority, the Authority shall
+make copie s or extract from the Information and request the person
+CYBERSECURITY (AMENDMENT) BILL, 2025
+16 producing the information to provide an ex planation on the content of the
+information where necessary.
+(5) A person who appears before the Authority may be represented by a Counsel
+of the choice of that person at any stage of the process .
+(6) Except as provided in subsection (2) where a person  contravenes subsection (1)
+(a) and (b),  that person commits an offence and is liable on summary conviction to a fine
+of not less than two hundred  and fifty  penalty units and not more than ten thousand penalty
+units or to a term of imprisonment of not less than one year and not more than two years
+or to both. ”.
+Section 59D inserted
+26. The principal enactment is amended by the insertion after section 59C, of
+“Application for Production Order to Collect Computer Data
+59D.   (1)   An investigative officer may apply ex-parte to the High Court for a
+production order to collect computer data.
+(2) A production order under section (1) shall require a person in possession or
+control of a computer or computer system to submit specified computer data which is
+stored in the computer or computer system to the investigative officer.
+(3) An investigative officer who makes an application under section (1) shall
+demonstrate to the satisfaction of the Court that there are reasonable grounds to believe
+that the computer data is reasonably required for the purposes of a specific criminal
+invest igation.
+(4) Where an investigative officer makes an application under section (1), that
+investigative officer shall :
+(a) explain why the investigative officer believes the computer data sought, will
+be available to the person in control of the computer or computer system;
+(b) identify and explain with specificity the type of computer data suspected to
+be found on the computer or computer system;
+(c) identify and explain with specificity the computer data that may be found on
+a computer or computer system that is the subject of an investigation or
+prosecution;
+(d) identify and explain with specificity the offences in respect of which the
+production order is sought; and
+(e) indicate what measures shall be taken to ensure that the computer data will
+be procured
+CYBERSECURITY (AMENDMENT) BILL, 2025
+17
+(i)  whilst maintaining the privacy of other users, customers and third
+parties, and
+(ii) without the disclosure of the computer data of any party not part of
+the investigation. ”.
+Section 59 E inserted
+27. The principal enactment is amended by the insertion after section 59 D, of
+“Grant of production order
+59E.  (1)  The High Court may grant an application for a production order
+under    subsection (1) of section  59D, if the Court is satisfied that
+(a) the investigative officer has complied with subsection (3) and (4) of section
+59D;
+(b) the information requested is commensurate, proportionate and necessary for
+the purposes of a specific criminal investigation or prosecution;
+(c) measures shall be taken to ensure that the computer data is produced whilst
+maintaining the privacy of other users, customers and third parties and
+without the disclosure of information and data of any party not part of the
+investigation; and
+(d) the investigation may be frustrated or seriously prejudiced unless the
+production of the information is permitted.
+(2) The Court shall require the service provider to keep confidential the
+production order and the execution of the production order under this
+section.
+(3) A production order granted under this Act shall be served on a domestic
+service provider, foreign service provider or both, or any other relevant
+person. ”.
+Section 59F inserted
+28. The principal enactment is amended by the insertion after section 59E, of
+“Application for Warrant to Access, Search and Seize Computer Data, Computer or
+Computer System
+59F.  (1)   An investigative officer may apply ex -parte to the High Court for a warrant to :
+(a) access data on a computer or computer system;
+(b) search and seize a computer or a computer system; or
+CYBERSECURITY (AMENDMENT) BILL, 2025
+18 (c) make or retain a copy of computer data on a computer or computer system;
+(d) maintain the integrity of computer data on a computer or computer system;
+(e) remove or render inaccessible computer data on a computer or computer
+system
+that is suspected to contain information relevant to an investigation.
+(2) A warrant under subse ction (1) shall require a person who has knowledge
+about the functioning of the computer or computer system to provide the
+necessary information to enable an investigative officer undertake the actions
+required under paragraphs (a) to (e) of subsection (1).
+(3) An investigative officer who makes an application under subsection (1) shall
+demonstrate to the satisfaction of the court that there are reasonable grounds
+to believe that the warrant is reasonably required for the purposes of a specific
+criminal investiga tion.
+(4) A warrant under subsection (1) shall permit a law enforcement officer to
+expeditiously  extend the search for data from a computer or computer system
+to another computer or computer system or part of it in Ghana where the law
+enforcement officer has reasonable grounds to believe that the data sought is
+accessible from or available  to that other computer or computer system  or
+part of it in Ghana .”.
+Section 59G inserted
+29. The principal enactment is amended by the insertion after section 59F, of
+“Grant of warrant
+59G.  (1)  The High Court may grant an application for a warrant under subsection 1
+of section 59F if the Court is satisfied that
+(a) the investigative officer has complied with subsection (3) of section 59F.
+(b) the information requested is commensurate, proportionate and necessary
+for the purposes of a specific criminal investigation or prosecution;
+(c) measures shall be taken to ensure that the computer data is produced whilst
+maintaining the privacy of other users, customers and third parties and
+without the disclosure of information and data of any party not part of the
+investigation; and
+(d) the investigation may be frustrated or seriously prejudiced unless the
+production of the information is permitted.
+CYBERSECURITY (AMENDMENT) BILL, 2025
+19
+(2) The Court shall require the service provider to keep confidential the
+warrant and the execution of the warrant under this section.
+(3) A warrant granted under this section shall be served on a domestic service
+provider, foreign service provider or both, or any other relevant person. ”.
+Section 59H in serted
+30. The principal enactment is amended by the insertion after section 59G, of
+“Application for preservation order to preserve computer data
+(1)  A provider of wire or electronic communication services or a remote
+computing service on the written request of a law enforcement agency, shall take the
+necessary steps to preserve records and other evidence in its possession pending the issue
+of a Court o rder and shall take steps to ensure that the request by the law enforcement
+agency is not disclosed to third parties during the period.
+(2)  Where an order from the Court is not obtained and served for fourteen days
+after the receipt of the written request, the wire or electronic communication services, or
+remote computing service provider is not under any obligation to preserve the evidence.
+(3)   An investigative officer authorised by a designated officer may apply ex-parte
+to the Court for an order to require a service provider or any person in control of a
+computer or computer system to preserve specified computer data, including traffic data
+that has been stored by a computer system.
+(4) An investigative officer who makes an application under subsection (1) shall
+demonstrate to the satisfaction of the Court that the computer data is particularly
+vulnerable to loss or modification. ”.
+Section 59I
+31. The principal enactment is amended by the insertion after section 59H, of
+“Grant of preservation order
+59I.  (1)  The High Court may grant an application for a preservation order under
+subsection (1) of section 59F if the Court is satisfied that :
+(a) the designated officer has complied with subsection (2) of section  59H;
+(b) the extent of the preservation order is commensurate, proportionate and
+necessary for the purposes of a specific criminal investigation or
+prosecution;
+CYBERSECURITY (AMENDMENT) BILL, 2025
+20 (c) measures shall be taken to ensure that the computer data is preserved whilst
+maintaining the privacy of other users, customers and third parties and
+without the disclosure of information and data of any party not part of the
+investigation; and
+(d) the investigation may be frustrated or seriously prejudiced unless the
+preservation order is permitted.
+(2) The preservation order issued under subsection (1)
+(a) is valid for a period of ninety days, and
+(b) may be renewed for a further period of ninety days upon application to the
+Court.
+(3) The Court shall require the service provider to keep confidential a
+preservation order issued under this regulation. ”.
+Section 59J
+32. The principal enactment is amended by the insertion after section 59I, of
+“Power of entry, inspection and audit
+59J.  (1) The Authority may designate a person as an inspector to inspect premises.
+(2) A person designated as an inspector by the Authority may
+(a) obtain a warrant to :
+(i) enter and inspect premises; and
+(ii) conduct an audit of a computer system
+(b) at any reasonable time, enter  inspect premises  and conduct and audit of a
+computer system  without a warrant where the inspector
+(i) reasonably believes that an inspection of the premises is necessary to
+ensure compliance by the owner of a critical information infrastructure,
+a licensee or a service provider or any other relevant person with the
+Act or Regulations; and
+(ii) has given the occupier of the premises seven days' notice in writing of
+the intention to enter , inspect the premises  and conduct an audit of a
+computer system .
+(3) An inspector shall, before exercising a power of entry and inspection,
+CYBERSECURITY (AMENDMENT) BILL, 2025
+21 (a) produce evidence of the identity of the inspector; and
+(b) indicate the purpose of entry and inspection.
+(4) An inspector may
+(a) enter a premises;
+(b) inspect the premises;
+(c) inspect a document or equipment found on the premises;
+(d) require a person on the premises to provide any information, or produce any
+document in the possession or control of that person that the inspector
+considers relevant to ensure compliance with the Act and Regulation and
+(e) require any person on the premises to provide information in respect of a
+document or the location of a document.
+(4) For the purpose of this regulation, “premises” does not include domestic
+premises. ”.
+Section 59K  inserted
+33. The principal enactment is amended by the insertion after section 59J, of
+“Witness and Inform ant Protection
+59K.   (1)  Except with the written, informed, explicit and freely given consent of a
+witness or inform ant, no witness  or inform ant who discloses information relating to
+cybercrime under this Act or administrative infractions under this Act,  shall be obliged to
+disclose his  name or address or other personal information , or state any matter which
+might lead to the ir discovery.
+(2) Unless otherwise provided, t he information and the identity of the witness
+or inform ant shall be held to be secret between the Authority  and the  witness or  informer;
+and all matters relating to such information should be privileged and sh all not be disclosed
+in any proceedings before any court, tribunal, commission, or authority.
+(3) The Authority take all necessary and reasonable steps to protect the safety
+and welfare of a witness  or informant , and such t he protection shall extend to persons by
+virtue of being related to a witness  or info rmant,  or on account of a testimony given by a
+witness  or informer , or for any other reason upon which the Authority may consider
+sufficient. ”.
+Section 67 of Act 10 38 amended
+34. The principal enactment is amended by :
+CYBERSECURITY (AMENDMENT) BILL, 2025
+22  (a) the substitution for the heading before section 67 “Other Online Sexual
+Offences, of
+“Other cybercrime”.
+(b) the substitution for subsection (2)  of section 67 , of
+“(2) A person who contravenes subsection (1) commits an offence and is liable
+on summary conviction to  a term of imprisonment of not less than three years and not
+more than ten years  or a fine of  not less than two hundred and fifty penalty units and not
+more than twenty -five thousand penalty units  or to both.”.
+Section 67A inserted
+35. The principal enactment is amended by the insertion after section 67, of
+“Cyberbullying and online harassment
+67A. (1)  A person shall not use the internet or any form of electronic medium
+or technology to bully a child or an adult.
+(2)  A person shall not use a computer or any other electronic medium to
+(a)  send a threatening message or a lewd message to a child;
+(b)  make sexual advances towards a child; or
+(c)  persistently make contact with
+(i)  a child, whether or not the contact is acceptable; or
+(ii)  another person where the contact is unacceptable.
+(3)  A person shall not create a false identity online or a fake social media
+profile for the purposes of following
+(a)  a child, whether or not the contact is acceptable; or
+(b)  an adult, where the contact is unacceptable.
+(4)  A person shall not use any online computer service or any other
+electronic device to:
+(a)  track the location of a child;
+(b)  monitor the real -world activities of a child;
+(c)  track the location of another person without the consent of that
+person;
+CYBERSECURITY (AMENDMENT) BILL, 2025
+23 (d)  monitor the real -world activities of another person without the
+consent of that person; or
+(e)  obsessively track the location of
+(i)  a child; or
+(ii)  another person without the consent of that person.
+(5)  Despite subsection (4), a parent  or legal guardian  may for the
+purposes of ensuring the safety of a child, track the location of the child, or monitor
+the real -world activities of the child.
+(6)  A person shall not use an electronic device or medium to send
+(a)  an unwanted,
+(b)  an unsolicited,
+(c)  a frightening,
+(d)  an obscene,
+(e)  a harassing, or
+(f)  a threatening electronic mail, text message or instant message to a
+child or an adult.
+(7)  A service provider of a user -to-user service including
+(a)  a chatroom,
+(b)  a social network site,
+(c)  an online gaming platform, or
+(d)  a virtual, augmented and mixed reality shall protect a child from all
+forms of online violence and cyberbullying from users of the user -
+to-user service.
+(8)  A person shall not use an electronic device or an electronic medium
+to deliberately spread false or misleading information with the intent
+to deceive or manipulate a person or a fact.
+(9)  A person who contravenes subsections (1), (2), (3), (4) or (6) commits
+an offence and is liable on summary conviction to a fine of not less
+than two thousand, five hundred penalty units and not more than
+five thousand penalty units or to a term of impriso nment of not less
+than one year and not more than three years or to both.
+CYBERSECURITY (AMENDMENT) BILL, 2025
+24 (10)  A person who contravenes sub regulation (7) or (8) commits an
+offence and is liable on summary conviction to a fine of not less than
+five thousand penalty units and not more than twenty -five thousand
+penalty units or to a term of imprisonment of not less than three
+years and not more than five years or to both.
+(11)  For the purpose of this Act, “cyberbullying” includes any digital
+communication and any other activity which strips the recipient of
+the dignity of the recipient, or causes fear or physical or emotional
+harm such as
+(a) repeatedly sending offensive, rude and insulting messages to
+a person;
+(b) distributing derogatory information about a child or any other
+person;
+(c) posting or sending offensive photos of a child or any other
+person, whether or not the photos
+(i) have been digitally altered, or
+(ii) were taken with the consent of the victim, with the
+intention to humiliate or embarrass the victim;
+(d)   breaking into an electronic mail, social networking or any
+electronic account and using the virtual identity of a victim to
+send, upload or distribute embarrassing materials to or about
+others;
+(e)  sharing sensitive personal information or any embarrassing
+information, or tricking a child or any person to reveal
+personal or embarrassing information about that child or any
+other person and sharing the information obtained with
+others;
+(f)  repeatedly sending threatening or intimidating messages with
+threats of harm, or engaging in online activities that cause fear
+in a child or puts any other person in fear;
+(g)  sending messages to another person telling the person to
+commit suicide;
+(h)  sending grossly offensive, indecent or obscene
+communication with the intention of causing emotional
+distress to a child or any other person; or
+(i)  sending electronic messages that denigrate a child or any other
+person on the basis of
+(i) colour;
+CYBERSECURITY (AMENDMENT) BILL, 2025
+25 (ii) race;
+(iii) ethnic or national origins;
+(iv) religion ;
+(v) gender; or
+(vi) disability. ”.
+Section 67B inserted
+36. The principal enactment is amended by the insertion after section 67A, of
+“Cyberstalking of a person
+“67B.       (1)  In furtherance of section 65 of the Act, a person shall not use the
+internet, chatroom , a social network site, an online gaming platform, or a virtual,
+augmented and mixed reality to
+(a)  harass or stalk a  person ;
+(b)  assume a false identity to anonymously harass or stalk a person;
+(c)  create false information about a person; or
+(d)  post or disseminate false information about a person.
+(2)  A person who contravenes subsection (1) commits an offence and is liable
+on summary conviction to a term of imprisonment of not less than one year and not more
+than ten years or a fine of less than one hundred penalty units and not more than ten
+thousand penalty units or to both.”.
+Section 68 of Act 10 38 amended
+37. The principal enactment is amended in  section 68 by substitution for subsection
+(2), of
+“(2) A person who contravenes subsection (1) commits an offence and is liable
+on summary conviction to a term of imprisonment of not less than three years and not
+more than ten years or a fine of less than two hundred and fifty penalty units and not more
+than twenty -five thousand penalty units  or to both.”.
+Section 83 of Act 1038 amended
+38. The principal enactment is amended in section 83 by:
+(a) the substitution for paragraph (e) of subsection (4), of
+“(e) requesting for information regarding domain name registration ;”.
+(b) the addition after paragraph (e) of subsection (4) , of
+CYBERSECURITY (AMENDMENT) BILL, 2025
+26 “(f) expedited disclosure of specified stored computer data in a service provider's
+possession or control in an emergency situation without a request for mutual
+assistance ;”.
+(c) the addition after paragraph (f) of subsection (4), of
+“(g)  any other matter related to paragraphs (a) to ( f).”.
+(d)  the addition after paragraph (g) of subsection (4), of
+“(5)  For the purpose of this section an emergency means, a situation in which
+there is a significant and imminent risk to the life or safety of any natural person. ”.
+Section 90 of Act 10 38 amended
+39. The principal enactment is amended in section 90 by  the addition after subsection
+(2), of
+“(3) Despite section 90(1)  and section 90A , the Circuit Court shall have the
+jurisdiction to try an offence under sections 62 to 68 A of this Act. ”.
+Section 91 of Act 10 38 amended
+40. The principal enactment is amended in section 91 by the addition after paragraph
+(h), of
+“(i) the designation of Sectoral Computer Emergency Response Team;
+(j) the accreditation of Sectoral Computer Emergency Response Team;
+(k)   the accreditation of cybersecurity establishments ;
+(l) the accreditation of non -profit cybersecurity institution ;
+(m) the protection of children ;
+(n) safeguarding the development and deployment of innovative and emerging
+technologies or solutions ;
+(o) licensing of cyber security service providers ;
+(p) accreditation of cybersecurity professionals and practitioners;
+(p) any other matter required for ensuring the cybersecurity of the country .”.
+Section 92 of Act 10 38 amended
+41. The principal enactment is amended in section 92 by :
+(a)  the substitution for subsection (1), of
+“(1) the Authority may issue directives to an owner of a critical information
+infrastructure, a cybersecurity service provider or service provider , innovators, developers
+for the purpose of ensuring the cybersecurity of the country.
+(b) the substitution for subsection (2), of
+CYBERSECURITY (AMENDMENT) BILL, 2025
+27 “(2) An owner of a critical information infrastructure, cybersecurity service
+provider or service provider, innovator, developer or any relevant person who fails to
+comply with the directives issued under this section is liable to pay to the Authority the
+admin istrative penalty specified in the Second Schedule .”.
+(c)  the insertion after subsection (2) , of
+“(3) The Authority may issue directives to innovators, developers, service
+providers and cybersecurity service providers for the purpose of securing the adoption and
+deployment of innovative and emerging technologies or solutions.”.
+Section 94 of Act 10 38 amended
+42. The principal enactment is amended by the substitution for section 94, of
+“(1) A person who, without lawful authority accesses or retrieves subscriber
+information or intercepts traffic data or content data, commits an offence and is liable on
+summary conviction to a fine of not less than two thousand five hundred penalty units and
+not more than fifteen thousand penalty units or to a term of imprisonment of not less than
+two years and not more than five years or, to both.
+(2) An attempt to gain access to a critical information infrastructure or its
+dependencies, successful or not, constitutes an unlawful access to the critical information
+infrastructure.
+(3) Any person who attempts to secure access to a critical information
+infrastructure or its dependencies, successful or not commits an offence and is liable on
+summary conviction to a term of imprisonment of not less than two years and not more
+than five years or a fine of not less than four thousand penalty units and not more than
+twenty -five thousand penalty units or to both.
+(4) The tampering and or destruction of critical information infrastructure or its
+components which affects the confidentiality, integrity or availability of the critical
+information infrastructure constitutes unlawful access  to critical information infrastructure ,
+and a person shall be subject to the same criminal penalties specified in subsection (1). ”.
+Section 94A inserted
+43. The principal enactment is amended by the insertion after section 94, of
+“Computer related Forgery
+95A. (1) A person shall not intentionally and without right, input, alter, delete
+or suppress computer data resulting in inauthentic data with the intent that they be
+considered or acted upon for legal purposes as if they were authentic, regardless of whether
+or no t the data are directly readable and intelligible.”
+(2) A person who contravenes subsection (1) commits an offence  and
+shall be deemed to have committed the offence of forger y under Chapter Two of the
+CYBERSECURITY (AMENDMENT) BILL, 2025
+28 Criminal Offences Act, 1960 (Act 29) , and shall liable on summary conviction to the same
+punishment for that particular kind of forgery under the law. ”.
+Section 94B inserted
+44.  The principal enactment is amended by the inser tion after section 94A, of
+“Computer related Fraud
+95B.  (1) A person shall not intentionally and without right, cause the loss of
+property to another person by means of:
+(a)  Any input, alteration, deletion or suppression of computer data;
+(b)  Any interference with the functioning of a computer system;
+(c)  Any deception as to factual circumstances made through a computer
+system that causes a person to do or omit to do anything which that person would  not
+otherwise do or omit to do;  with the fraudulent or dishonest intent of procuring for oneself
+or for another person, without right, a gain in money or other property .
+(2) A person who contravenes subsection (1) commits an offence  and
+shall be deemed to have committed the offence of defrauding by false pretence under
+section 13 1 of the Criminal Offences Act, 1960 (Act 29) , and shall liable on summary
+conviction to the same punishment for defrauding by false pretence under that law. ”.
+Section 97 of Act 10 38 amended
+45. The principal enactment is amended in section 97 by:
+(a) the insertion before “Authority ”, of
+“Artificial Intelligence  is technology that enables computers and machines to
+simulate human learning, comprehension, problem solving, decision -making, creativity and
+autonomy ;”;
+“block-chain based technology ” means a n advanced decentralised  digital record or
+digital ledger of transactions, that enables recording of transactions, tracking of assets, and
+sharing of records across computer networks in a transparent and immutable way; ”.
+“big data” means a collection of extremely large organized, semi -structured, and
+unstructured information that grows exponentially over time;” ;
+(b) the insertion after “child”, of
+“cloud technology” means technology that delivers computing services and offers
+on-demand access to computing resources such as physical or virtual services, data
+storage, servers, databases, networking, intelligence, analytics, and software over the
+internet ;”;
+(c) the insertion after “ cloud technology”, of
+CYBERSECURITY (AMENDMENT) BILL, 2025
+29 “confiscation”, which includes forfeiture where applicable, shall mean the
+permanent deprivation of property by order of a court or other competent
+authority;”;
+(d) the insertion after “digital ecosystem” of
+“digital services” means services delivered electronically whether traditionally or
+by internet, with minimal physical interaction, and includes:
+(a) social media platforms;
+(b) e-commerce platforms;
+(c) video -on-demand or streaming platforms;
+(d) messaging applications,
+(e) fintech software platforms;
+(f) online banking platforms;
+(e) the insertion after “Director -General”, of
+“Emergency” shall mean a situation in which there is a significant and imminent
+risk to the life or safety of any natural person;”;
+(f) the insertion after “e -services”, of
+“Freezing” or “seizure” mean temporarily prohibiting the transfer, conversion,
+disposition or movement of property or temporarily assuming custody or control
+of property on the basis of an order issued by a court or other competent
+authority;”;
+(g) the insertion after “interception of warrant ”, of
+“Internet of Things (IoT) means  a network of interrelated physical devices, vehicles,
+appliances and other physical objects that connect and exchange data with other
+devices and the cloud  across wireless networks , and are typically embedded with
+sensors, processing ability and software and can include mechanical and digital
+machines and consumer objects ;”;
+(h) the substitution for “computer system ”, of
+“computer system” means an arrangement of interconnected computers that is
+designed to perform one or more specific functions, and includes
+(a) an information processing system;
+(b) an operational technology system, a programmable logic controller, a
+supervisory control and data acquisition system, or a distributed control
+system; and
+CYBERSECURITY (AMENDMENT) BILL, 2025
+30 (c) dependency systems that support the functionality of a computer or
+computer network ;”;
+(i) the substitution for “law enforcement agency”, of
+“law enforcement agency” means
+(a) The Police
+(b) The Customs Division of the Ghana Revenue Authority and
+(c) Cyber Security Authority
+(d) Any other agency authorised  by law to exercise the powers of the Police
+(j) the insertion after “prohibited intimate image and visual recording”, of
+“property” mean s assets of every kind, in the country or elsewhere whether
+corporeal or incorporeal, movable or immovable, tangible or intangible, including
+virtual assets, and legal documents or instruments evidencing title to, or interest in,
+such property assets;”;
+(k) the insertion after “property”, of
+“property of or in the possession or control of a person” includes a gift made by
+that person;
+(l) the insertion after “publish”, of
+“quantum computing ” means technology that solves complex problems based on
+principles of quantum mechanics;” .
+Section 98 of Act 1058 amended
+46. The principal enactment is amended  by substitution for section 98, of
+“Repeals and savings
+(1) Sections 118  and 136 of the Electronic Transaction Act, 2008 (Act 772)
+are repealed.
+(2) Sections 35 to 40 this Act repeals sections 55 to 62 of the Electronic
+Transaction Act, 2008 (Act 772) .
+(3) Despite the repeal of sections, any Regulations, bye -laws, directives,
+notices, orders, directions, appointments or other acts lawfully made or
+done under the repealed enactment and in force immediately before the
+CYBERSECURITY (AMENDMENT) BILL, 2025
+31 coming into force of this Act shall be deemed to have been made or done
+under this Act and shall continue to have effect until instruments issued
+or made  until revoked, cancelled, withdrawn or terminated.”.
+Section 99 of Act 10 38 amended
+47. The Extradition Act, 1960 (Act 22) is amended  by:
+(a)  the addition after subsection (3)  of section , of
+“(4)  Despite subsection (1),  for the purposes of extradition , Cybercrime and
+Cyber Offences under the First Schedule to this Act,  in the absence of a  separate
+arrangement, bilateral or multilateral agreement between Ghana and another signatory of
+the Budapest Convention on Cybercrime  or any other convention , extradition of fugitive
+criminals may still take place between Ghana and another signatory of the Budapest
+Convention on Cybercrime  or any other convention  and shall be governed by the
+provisions of the said convention. ”.
+First schedule to Act 1038 amended
+48. The principal enactment is amended by substitution for the preamble, of
+“A service provided for reward or a not -for profit basis intended primarily for or aimed at
+ensuring or safeguarding the cybersecurity of a computer or computer system belonging
+to a person and includes.”.
+Second schedule to Act 10 38 amended
+49. The principal enactment is amended by substitution for administrative penalties for
+sections 36(4), 39(2)(a), 39(2)(b), 39(2)(c) and 92(2) and addition of administrative penalties
+for sections 36(1) and 39(3)(c) .
+No. Sections of
+Act creating
+contravention  Contravention  Administrative
+Penalty
+1. 36(1)  The Owner of the designated critical
+information infrastructure shall register
+their critical information infrastructure
+with the Authority, and shall pay the
+prescribed annual registration and
+designation fee as determined by the
+Authority or stipulated i n a legislative
+instrument.  Not less than five
+thousand penalty
+units, not more than
+fifty thousand
+penalty units .
+2. 36(4)  Owner of a registered critical information
+infrastructure failing to inform the
+Authority within seven days of the change
+in legal ownership of the registered critical  Not less than five
+thousand penalty
+units, not more than
+CYBERSECURITY (AMENDMENT) BILL, 2025
+32 information infrastructure.
+fifty thousand
+penalty units.
+3. 39(2)(a)  Owner of a critical information
+infrastructure failing to report a
+cybersecurity incident .
+Not less than ten
+thousand penalty
+units, not more than
+fifty thousand
+penalty units.
+4. 39(2)(b)  Owner of a critical information
+infrastructure failing to cause an audit to be
+performed on the critical information
+infrastructure .
+Not less than five
+thousand penalty
+units, not more than
+twenty thousand
+penalty units.
+5. 39(3)(c)  Owner of a critical information
+infrastructure failing to submit a copy of
+the audit report to the Authority.
+Not less than five
+thousand penalty
+units, not more than
+twenty thousand
+penalty units.
+6. 92(2)  Owner of a critical information
+infrastructure, a cybersecurity service
+provider or a  provider of a digital service
+failing to comply with a directive issued by
+the Authority . Not less than ten
+thousand penalty
+units, not more than
+fifty thousand
+penalty units
+Third schedule to Act 1038 amended
+50.   The principal enactment is amended by addition after the “Oath of Secrecy”, of
+The Official Oath
+(section 5)
+I,
+……………………………………………………………..……………………………
+do (in the name of the Almighty God swear) (solemnly affirm) that I will at all times well
+and truly serve the Republic of Ghana in the office of …….and that I will uphold, preserve,
+protect and defend the constituti on of the Republic of Ghana as by law established (so
+help me God).

assets/example_bills/cybersecurity-amendment-bill-2025/metadata.json

@@ -0,0 +1,10 @@
+{
+  "generated_at": "2026-06-01T11:48:29.371678+00:00",
+  "provider": "qwen",
+  "model": "Qwen/Qwen3-32B:cheapest",
+  "source_url": "https://www.csa.gov.gh/resources/Cybersecurity%20%28Amendment%29%20Draft%20Bill%202025%20final%2015102025.pdf",
+  "document_hash": "d879a4473b3631906b7c4e965195d53f4693a722ce7644e187ab76fca33ef763",
+  "chunk_size": 350,
+  "chunk_overlap": 60,
+  "embedding_model": "sentence-transformers/all-MiniLM-L6-v2"
+}

assets/example_bills/manifest.json

@@ -0,0 +1,100 @@
+[
+  {
+    "id": "cybersecurity-amendment-bill-2025",
+    "title": "Cybersecurity (Amendment) Bill, 2025",
+    "source_url": "https://www.csa.gov.gh/resources/Cybersecurity%20%28Amendment%29%20Draft%20Bill%202025%20final%2015102025.pdf",
+    "document_hash": "d879a4473b3631906b7c4e965195d53f4693a722ce7644e187ab76fca33ef763",
+    "asset_dir": "cybersecurity-amendment-bill-2025"
+  },
+  {
+    "id": "data-harmonisation-bill",
+    "title": "Data Harmonisation Bill",
+    "source_url": "https://moc.gov.gh/wp-content/uploads/2023/03/Data-Harmonisation-Bill.pdf",
+    "document_hash": "",
+    "asset_dir": "data-harmonisation-bill"
+  },
+  {
+    "id": "data-protection-bill-2025",
+    "title": "Data Protection Bill, 2025",
+    "source_url": "https://moc.gov.gh/wp-content/uploads/2023/03/DATA-PROTECTION-BILL.pdf",
+    "document_hash": "",
+    "asset_dir": "data-protection-bill-2025"
+  },
+  {
+    "id": "digital-economy-and-innovation-development-fund-bill-2025",
+    "title": "Digital Economy and Innovation Development Fund Bill, 2025",
+    "source_url": "https://moc.gov.gh/wp-content/uploads/2023/03/DIGITAL-ECONOMY-AND-INNOVATION-DEVELOPMENT-FUND-BILL.pdf",
+    "document_hash": "",
+    "asset_dir": "digital-economy-and-innovation-development-fund-bill-2025"
+  },
+  {
+    "id": "electronic-communications-bill-2025",
+    "title": "Electronic Communications Bill, 2025",
+    "source_url": "https://moc.gov.gh/wp-content/uploads/2023/03/NCA-Electronic-Communications-Bill-2025.pdf",
+    "document_hash": "",
+    "asset_dir": "electronic-communications-bill-2025"
+  },
+  {
+    "id": "electronic-transactions-bill-2025",
+    "title": "Electronic Transactions Bill, 2025",
+    "source_url": "https://nita.gov.gh/wp-content/uploads/2025/NITA-ETA-public-consultation-2025.pdf",
+    "document_hash": "",
+    "asset_dir": "electronic-transactions-bill-2025"
+  },
+  {
+    "id": "emerging-technologies-bill-2025",
+    "title": "Emerging Technologies Bill, 2025",
+    "source_url": "https://moc.gov.gh/wp-content/uploads/2023/03/MoCDTI-EMERGING-TECHNOLOGIES-DRAFT-BILL-2025-2.pdf",
+    "document_hash": "",
+    "asset_dir": "emerging-technologies-bill-2025"
+  },
+  {
+    "id": "ghana-domain-name-registry-bill-2025",
+    "title": "Ghana Domain Name Registry Bill, 2025",
+    "source_url": "https://moc.gov.gh/wp-content/uploads/2023/03/Ghana-Domain-Name-Registry-Bill.pdf",
+    "document_hash": "",
+    "asset_dir": "ghana-domain-name-registry-bill-2025"
+  },
+  {
+    "id": "ghana-meteorological-authority-bill-2025",
+    "title": "Ghana Meteorological Authority Bill, 2025",
+    "source_url": "https://moc.gov.gh/wp-content/uploads/2023/03/GHANA-METEOROLOGICAL-AUTHORITY-BILL.pdf",
+    "document_hash": "",
+    "asset_dir": "ghana-meteorological-authority-bill-2025"
+  },
+  {
+    "id": "kofi-annan-centre-of-excellence-in-ict-bill-2025",
+    "title": "Kofi Annan Centre of Excellence in ICT Bill, 2025",
+    "source_url": "https://moc.gov.gh/wp-content/uploads/2023/03/Kofi-Annan-Centre-of-Excellence-Bill.pdf",
+    "document_hash": "",
+    "asset_dir": "kofi-annan-centre-of-excellence-in-ict-bill-2025"
+  },
+  {
+    "id": "mdhi-bill-2025",
+    "title": "MDHI Bill, 2025",
+    "source_url": "https://moc.gov.gh/wp-content/uploads/2023/03/MISINFORMATION-DISINFORMATION-HATE-SPEECH-1.pdf",
+    "document_hash": "",
+    "asset_dir": "mdhi-bill-2025"
+  },
+  {
+    "id": "national-communications-authority-bill-2025",
+    "title": "National Communications Authority Bill, 2025",
+    "source_url": "https://moc.gov.gh/wp-content/uploads/2023/03/NCA-National-Communications-Authority-Bill-2025.pdf",
+    "document_hash": "",
+    "asset_dir": "national-communications-authority-bill-2025"
+  },
+  {
+    "id": "national-information-technology-authority-bill-2025",
+    "title": "National Information Technology Authority Bill, 2025",
+    "source_url": "https://moc.gov.gh/wp-content/uploads/2023/03/NITA-NATIONAL-INFORMATION-TECHNOLOGY-AUTHORITY-BILL_-10-07-25.pdf",
+    "document_hash": "",
+    "asset_dir": "national-information-technology-authority-bill-2025"
+  },
+  {
+    "id": "postal-courier-and-logistics-commission-bill-2025",
+    "title": "Postal, Courier and Logistics Commission Bill, 2025",
+    "source_url": "https://moc.gov.gh/wp-content/uploads/2023/03/POSTAL-COURIER-LOGISTICS-COMMISSION-BILL.pdf",
+    "document_hash": "",
+    "asset_dir": "postal-courier-and-logistics-commission-bill-2025"
+  }
+]

services/example_bills.py

@@ -0,0 +1,90 @@
+"""Shared example bill manifest helpers."""
+
+from __future__ import annotations
+
+import json
+from dataclasses import dataclass
+from functools import lru_cache
+from pathlib import Path
+from urllib.parse import urlsplit, urlunsplit
+
+
+PROJECT_ROOT = Path(__file__).resolve().parent.parent
+EXAMPLE_BILL_ASSETS_ROOT = PROJECT_ROOT / "assets" / "example_bills"
+EXAMPLE_BILL_MANIFEST_PATH = EXAMPLE_BILL_ASSETS_ROOT / "manifest.json"
+
+
+@dataclass(frozen=True)
+class ExampleBill:
+    id: str
+    title: str
+    source_url: str
+    document_hash: str
+    asset_dir: str
+
+    @property
+    def root_dir(self) -> Path:
+        return EXAMPLE_BILL_ASSETS_ROOT / self.asset_dir
+
+    @property
+    def analysis_path(self) -> Path:
+        return self.root_dir / "analysis.json"
+
+    @property
+    def document_path(self) -> Path:
+        return self.root_dir / "document.txt"
+
+    @property
+    def chunks_path(self) -> Path:
+        return self.root_dir / "chunks.json"
+
+    @property
+    def metadata_path(self) -> Path:
+        return self.root_dir / "metadata.json"
+
+    @property
+    def vector_store_dir(self) -> Path:
+        return self.root_dir / "vector_store"
+
+
+def normalize_example_url(url: str) -> str:
+    stripped = url.strip()
+    parsed = urlsplit(stripped)
+    normalized_path = parsed.path.rstrip("/") or parsed.path
+    return urlunsplit((parsed.scheme.lower(), parsed.netloc.lower(), normalized_path, parsed.query, ""))
+
+
+@lru_cache(maxsize=1)
+def load_example_bills() -> tuple[ExampleBill, ...]:
+    payload = json.loads(EXAMPLE_BILL_MANIFEST_PATH.read_text(encoding="utf-8"))
+    return tuple(ExampleBill(**item) for item in payload)
+
+
+def reload_example_bills() -> tuple[ExampleBill, ...]:
+    load_example_bills.cache_clear()
+    return load_example_bills()
+
+
+def example_bill_titles() -> list[str]:
+    return [bill.title for bill in load_example_bills()]
+
+
+def example_bill_urls_by_title() -> dict[str, str]:
+    return {bill.title: bill.source_url for bill in load_example_bills()}
+
+
+def example_bill_by_title(title: str) -> ExampleBill | None:
+    for bill in load_example_bills():
+        if bill.title == title:
+            return bill
+    return None
+
+
+def example_bill_by_url(url: str | None) -> ExampleBill | None:
+    if not url:
+        return None
+    normalized = normalize_example_url(url)
+    for bill in load_example_bills():
+        if normalize_example_url(bill.source_url) == normalized:
+            return bill
+    return None

services/ingest.py

@@ -0,0 +1,127 @@
+"""Utilities for ingesting and normalizing documents."""
+
+from __future__ import annotations
+
+import io
+import os
+import re
+import tempfile
+from urllib.parse import urlparse
+from typing import Iterable
+
+import requests
+from docx import Document as DocxDocument
+from lxml import html
+from readability import Document as ReadabilityDocument
+from pypdf import PdfReader
+
+from config import MAX_UPLOAD_SIZE_MB, TIMEOUT_SECONDS
+
+SUPPORTED_EXTENSIONS = {
+    ".pdf": "application/pdf",
+    ".txt": "text/plain",
+    ".md": "text/markdown",
+    ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+}
+
+_CONTROL_CHARS_RE = re.compile(r"[\x00-\x08\x0b\x0c\x0e-\x1f]")
+
+
+class IngestionError(RuntimeError):
+    pass
+
+
+def _ensure_size_limit(file_size: int) -> None:
+    max_bytes = MAX_UPLOAD_SIZE_MB * 1024 * 1024
+    if file_size > max_bytes:
+        raise IngestionError(
+            f"File exceeds maximum size of {MAX_UPLOAD_SIZE_MB} MB."
+        )
+
+
+def extract_text_from_pdf(data: bytes) -> str:
+    reader = PdfReader(io.BytesIO(data))
+    text_chunks: list[str] = []
+    for page in reader.pages:
+        chunk = page.extract_text() or ""
+        text_chunks.append(chunk.strip())
+    return _normalize_text(_repair_known_collapsed_terms("\n".join(text_chunks)))
+
+
+def extract_text_from_docx(data: bytes) -> str:
+    with tempfile.NamedTemporaryFile(delete=False, suffix=".docx") as tmp:
+        tmp.write(data)
+        tmp_path = tmp.name
+    try:
+        document = DocxDocument(tmp_path)
+        paragraphs = [p.text.strip() for p in document.paragraphs if p.text.strip()]
+        return _normalize_text("\n".join(paragraphs))
+    finally:
+        os.unlink(tmp_path)
+
+
+def extract_text_from_text(data: bytes) -> str:
+    return _normalize_text(data.decode("utf-8", errors="ignore"))
+
+
+def ingest_file(filename: str, file_bytes: bytes) -> str:
+    _ensure_size_limit(len(file_bytes))
+    ext = os.path.splitext(filename)[1].lower()
+    if ext not in SUPPORTED_EXTENSIONS:
+        raise IngestionError(f"Unsupported file type: {ext}")
+
+    if ext == ".pdf":
+        return extract_text_from_pdf(file_bytes)
+    if ext == ".docx":
+        return extract_text_from_docx(file_bytes)
+    return extract_text_from_text(file_bytes)
+
+
+def fetch_url_content(url: str) -> str:
+    response = requests.get(url, timeout=TIMEOUT_SECONDS)
+    response.raise_for_status()
+    content_type = (response.headers.get("content-type") or "").lower()
+    path = urlparse(url).path.lower()
+
+    if "application/pdf" in content_type or path.endswith(".pdf"):
+        return extract_text_from_pdf(response.content)
+    if (
+        "application/vnd.openxmlformats-officedocument.wordprocessingml.document" in content_type
+        or path.endswith(".docx")
+    ):
+        return extract_text_from_docx(response.content)
+    if any(text_type in content_type for text_type in ("text/plain", "text/markdown")) or any(
+        path.endswith(ext) for ext in (".txt", ".md")
+    ):
+        return extract_text_from_text(response.content)
+
+    readable = ReadabilityDocument(_strip_xml_control_chars(response.text))
+    summary_html = _strip_xml_control_chars(readable.summary(html_partial=True))
+    parsed = html.fromstring(summary_html)
+    title = readable.short_title() or readable.title() or ""
+    text_content = parsed.text_content()
+    return _normalize_text("\n".join([title, text_content]))
+
+
+def combine_sources(sources: Iterable[str]) -> str:
+    return _normalize_text("\n\n".join(filter(None, sources)))
+
+
+def _normalize_text(value: str) -> str:
+    value = _strip_xml_control_chars(value)
+    clean_lines = [line.strip() for line in value.splitlines()]
+    return "\n".join(line for line in clean_lines if line)
+
+
+def _strip_xml_control_chars(value: str) -> str:
+    return _CONTROL_CHARS_RE.sub("", value)
+
+
+def _repair_known_collapsed_terms(value: str) -> str:
+    replacements = {
+        "NATIONALINFORMATIONTECHNOLOGYAUTHORITY": "National Information Technology Authority",
+        "NationalInformationTechnologyAuthority": "National Information Technology Authority",
+    }
+    for collapsed, expanded in replacements.items():
+        value = value.replace(collapsed, expanded)
+    return value

services/precomputed_assets.py

@@ -0,0 +1,67 @@
+"""Helpers for bundled example-bill analysis assets."""
+
+from __future__ import annotations
+
+import json
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+from services.example_bills import ExampleBill, example_bill_by_url
+
+
+@dataclass(frozen=True)
+class PrecomputedExampleAsset:
+    bill: ExampleBill
+    analysis_payload: dict[str, Any]
+    document_text: str
+    chunks: list[str]
+    metadata: dict[str, Any]
+
+
+def load_precomputed_asset_for_url(url: str | None) -> PrecomputedExampleAsset | None:
+    bill = example_bill_by_url(url)
+    if bill is None:
+        return None
+    return load_precomputed_asset(bill)
+
+
+def load_precomputed_asset(bill: ExampleBill) -> PrecomputedExampleAsset | None:
+    if not bill.analysis_path.exists():
+        return None
+    if not bill.document_path.exists():
+        return None
+    if not bill.chunks_path.exists():
+        return None
+    if not bill.vector_store_dir.exists():
+        return None
+
+    analysis_payload = json.loads(bill.analysis_path.read_text(encoding="utf-8"))
+    document_text = bill.document_path.read_text(encoding="utf-8")
+    chunks = json.loads(bill.chunks_path.read_text(encoding="utf-8"))
+    metadata = {}
+    if bill.metadata_path.exists():
+        metadata = json.loads(bill.metadata_path.read_text(encoding="utf-8"))
+
+    return PrecomputedExampleAsset(
+        bill=bill,
+        analysis_payload=analysis_payload,
+        document_text=document_text,
+        chunks=chunks,
+        metadata=metadata,
+    )
+
+
+def write_precomputed_asset(
+    bill: ExampleBill,
+    *,
+    analysis_payload: dict[str, Any],
+    document_text: str,
+    chunks: list[str],
+    metadata: dict[str, Any],
+) -> None:
+    bill.root_dir.mkdir(parents=True, exist_ok=True)
+    bill.analysis_path.write_text(json.dumps(analysis_payload, indent=2), encoding="utf-8")
+    bill.document_path.write_text(document_text, encoding="utf-8")
+    bill.chunks_path.write_text(json.dumps(chunks, indent=2), encoding="utf-8")
+    bill.metadata_path.write_text(json.dumps(metadata, indent=2), encoding="utf-8")

services/providers.py

@@ -0,0 +1,113 @@
+"""Provider utilities for handling user-supplied API keys."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Any, Dict, Optional
+
+from anthropic import Anthropic
+from openai import OpenAI
+
+from config import (
+    ANTHROPIC_API_KEY,
+    COHERE_API_KEY,
+    DEFAULT_PROVIDER,
+    DEFAULT_COHERE_KEY,
+    GEMINI_API_KEY,
+    DEFAULT_QWEN_MODEL,
+    HF_TOKEN,
+    OPENAI_API_KEY,
+    PROVIDER_METADATA,
+    ProviderConfig,
+    ProviderLiteral,
+)
+
+
+@dataclass
+class ProviderClient:
+    """Container for a provider client and default model."""
+
+    name: ProviderLiteral
+    client: Any
+    default_model: str
+    api_key: str
+
+
+_PROVIDER_MODEL_MAP: Dict[ProviderLiteral, str] = {
+    "qwen": DEFAULT_QWEN_MODEL,
+    "openai": "gpt-5.5",
+    "anthropic": "claude-sonnet-4-6",
+    "gemini": "gemini-2.5-flash",
+    "cohere": "command-a-reasoning-08-2025",
+}
+
+
+_DEFAULT_PROVIDER_KEYS: Dict[ProviderLiteral, Optional[str]] = {
+    "qwen": HF_TOKEN,
+    "openai": OPENAI_API_KEY,
+    "anthropic": ANTHROPIC_API_KEY,
+    "gemini": GEMINI_API_KEY,
+    "cohere": COHERE_API_KEY or DEFAULT_COHERE_KEY,
+}
+
+
+def get_default_api_key(provider: ProviderLiteral) -> Optional[str]:
+    return _DEFAULT_PROVIDER_KEYS.get(provider)
+
+
+def get_provider_config(name: ProviderLiteral) -> ProviderConfig:
+    for config in PROVIDER_METADATA:
+        if config.name == name:
+            return config
+    raise ValueError(f"Unsupported provider: {name}")
+
+
+def validate_api_key(provider: ProviderLiteral, api_key: str | None) -> tuple[bool, Optional[str]]:
+    resolved_key = api_key or get_default_api_key(provider)
+    if not resolved_key:
+        return False, "API key is required."
+
+    config = get_provider_config(provider)
+    if config.key_prefix:
+        if not resolved_key.startswith(config.key_prefix):
+            return False, f"Expected key to start with '{config.key_prefix}'."
+
+    if len(resolved_key.strip()) < 10:
+        return False, "API key looks too short."
+
+    return True, None
+
+
+def instantiate_client(provider: ProviderLiteral, api_key: str) -> ProviderClient:
+    if provider == "qwen":
+        client = OpenAI(api_key=api_key, base_url="https://router.huggingface.co/v1")
+    elif provider == "openai":
+        client = OpenAI(api_key=api_key)
+    elif provider == "anthropic":
+        client = Anthropic(api_key=api_key)
+    elif provider == "gemini":
+        try:
+            import google.generativeai as genai
+        except ImportError as exc:  # pragma: no cover - defensive path
+            raise RuntimeError(
+                "google-generativeai must be installed to use the Gemini provider"
+            ) from exc
+
+        genai.configure(api_key=api_key)
+        client = genai
+    elif provider == "cohere":
+        try:
+            import cohere  # type: ignore[import-not-found]
+        except ImportError as exc:  # pragma: no cover - defensive path
+            raise RuntimeError("cohere must be installed to use the Cohere provider") from exc
+
+        client = cohere.Client(api_key=api_key)
+    else:
+        raise ValueError(f"Unsupported provider: {provider}")
+
+    default_model = _PROVIDER_MODEL_MAP[provider]
+    return ProviderClient(name=provider, client=client, default_model=default_model, api_key=api_key)
+
+
+def list_providers() -> list[ProviderConfig]:
+    return sorted(PROVIDER_METADATA, key=lambda config: config.name != DEFAULT_PROVIDER)

services/rag_pipeline.py

@@ -0,0 +1,1276 @@
+"""RAG pipeline utilities for embeddings, summaries, and Q&A."""
+
+from __future__ import annotations
+
+import hashlib
+import inspect
+import json
+import re
+from concurrent.futures import ThreadPoolExecutor
+from dataclasses import dataclass, field
+from functools import lru_cache
+from pathlib import Path
+from typing import Any, Callable, Dict, Iterable, List, ForwardRef, Optional, Protocol, cast
+
+try:
+    from pydantic.v1 import typing as _pydantic_typing  # type: ignore[attr-defined]
+except ImportError:  # pragma: no cover - optional dependency path
+    _pydantic_typing = None
+else:
+    _forward_sig = inspect.signature(ForwardRef._evaluate)
+    _recursive_guard_param = _forward_sig.parameters.get("recursive_guard")
+    if _recursive_guard_param is not None:
+        def _evaluate_forwardref(type_: ForwardRef, globalns: Any, localns: Any) -> Any:
+            evaluator = cast(Any, type_)._evaluate
+            if "type_params" in evaluator.__code__.co_varnames:
+                return evaluator(globalns, localns, None, recursive_guard=set())
+            return evaluator(globalns, localns, recursive_guard=set())
+
+        _pydantic_typing.evaluate_forwardref = _evaluate_forwardref  # type: ignore[attr-defined]
+
+from langchain_community.embeddings import SentenceTransformerEmbeddings
+from langchain_community.vectorstores import FAISS
+from langchain_core.documents import Document
+from langchain.text_splitter import RecursiveCharacterTextSplitter
+from pydantic import BaseModel, Field
+from transformers import AutoTokenizer
+
+from config import (
+    ANTHROPIC_THINKING_BUDGET,
+    DEFAULT_CHUNK_OVERLAP,
+    DEFAULT_CHUNK_SIZE,
+    DEFAULT_EMBEDDING_MODEL,
+    OPENAI_REASONING_EFFORT,
+    PROVIDER_FULL_DOCUMENT_QA_TOKEN_BUDGETS,
+    SCAN_BATCH_SIZE,
+    SCAN_CHUNK_OVERLAP,
+    SCAN_CHUNK_SIZE,
+    SCAN_MAX_WINDOWS,
+    SCAN_TOP_K,
+    TOP_K_RETRIEVAL,
+)
+from services.precomputed_assets import PrecomputedExampleAsset, load_precomputed_asset_for_url
+from services.providers import ProviderClient
+
+OBJECTIVITY_INSTRUCTION = (
+    "Be objective. Reason things out. Based on the available context, and wherever the question "
+    "lends itself, consider multiple relevant perspectives, including opposing perspectives, "
+    "before responding."
+)
+
+
+class SWOTBlock(BaseModel):
+    strengths: List[str] = Field(default_factory=list)
+    weaknesses: List[str] = Field(default_factory=list)
+    opportunities: List[str] = Field(default_factory=list)
+    threats: List[str] = Field(default_factory=list)
+
+
+class ImplementationItem(BaseModel):
+    stakeholder: str = ""
+    obligation: str = ""
+    implementation_burden: str = ""
+    risk_or_note: str = ""
+
+
+class CritiqueItem(BaseModel):
+    issue: str = ""
+    why_it_matters: str = ""
+    recommendation: str = ""
+
+
+class AnalysisResult(BaseModel):
+    executive_summary: str = ""
+    bill_summary: List[str] = Field(default_factory=list)
+    implementation: List[ImplementationItem] = Field(default_factory=list)
+    critique: List[CritiqueItem] = Field(default_factory=list)
+    swot: SWOTBlock = Field(default_factory=SWOTBlock)
+
+
+class Citation(BaseModel):
+    ref_id: int
+    snippet: str
+
+
+class AnswerResult(BaseModel):
+    answer: str
+    citations: List[Citation]
+    provenance: str = "analysis_based"
+    needs_deeper_consent: bool = False
+    deeper_answer_available: bool = False
+    consent_prompt: str = ""
+
+
+class ScanChunk(BaseModel):
+    chunk_id: int
+    text: str
+
+
+class ScanMatch(BaseModel):
+    chunk_id: int
+    relevance_score: int = Field(ge=0, le=3)
+    evidence_snippet: str = ""
+
+
+class ScanResult(BaseModel):
+    matches: List[ScanMatch] = Field(default_factory=list)
+
+
+class TokenizerLike(Protocol):
+    def encode(self, text: str, *args: Any, **kwargs: Any) -> list[int]:
+        ...
+
+
+@dataclass
+class AnalysisSnippet:
+    ref_id: int
+    section: str
+    text: str
+
+
+@dataclass
+class CachedDocumentArtifacts:
+    document_hash: str
+    document_text: str
+    chunks: list[str]
+    analysis: AnalysisResult
+    vector_store: FAISS | None
+    analysis_snippets: list[AnalysisSnippet] = field(default_factory=list)
+    source_url: str | None = None
+    example_bill_id: str | None = None
+    is_precomputed: bool = False
+    metadata: dict[str, Any] = field(default_factory=dict)
+
+
+_DOCUMENT_CACHE: dict[str, CachedDocumentArtifacts] = {}
+
+
+@lru_cache(maxsize=1)
+def _embedding_model(model_name: str = DEFAULT_EMBEDDING_MODEL) -> SentenceTransformerEmbeddings:
+    return SentenceTransformerEmbeddings(model_name=model_name)
+
+
+@lru_cache(maxsize=1)
+def _embedding_tokenizer(model_name: str = DEFAULT_EMBEDDING_MODEL) -> TokenizerLike:
+    return AutoTokenizer.from_pretrained(model_name)
+
+
+def warm_embedding_stack(model_name: str = DEFAULT_EMBEDDING_MODEL) -> None:
+    _embedding_tokenizer(model_name)
+    _embedding_model(model_name)
+
+
+def _split_with_tokenizer(text: str, chunk_size: int, chunk_overlap: int) -> List[str]:
+    tokenizer = _embedding_tokenizer()
+    splitter = RecursiveCharacterTextSplitter(
+        chunk_size=chunk_size,
+        chunk_overlap=chunk_overlap,
+        length_function=lambda value: len(tokenizer.encode(value, add_special_tokens=False)),
+        separators=["\n\n", "\n", ". ", "; ", ", ", " ", ""],
+    )
+    return splitter.split_text(text)
+
+
+def _token_count(text: str) -> int:
+    return len(_embedding_tokenizer().encode(text, add_special_tokens=False))
+
+
+def _full_document_budget(provider_client: ProviderClient) -> int:
+    return PROVIDER_FULL_DOCUMENT_QA_TOKEN_BUDGETS.get(provider_client.name, 0)
+
+
+def _supports_openai_reasoning(model_name: str) -> bool:
+    return model_name.startswith(("gpt-5", "o1", "o3", "o4"))
+
+
+def _supports_anthropic_extended_thinking(model_name: str) -> bool:
+    return model_name.startswith(
+        (
+            "claude-3-7-sonnet",
+            "claude-sonnet-4",
+            "claude-opus-4",
+        )
+    )
+
+
+def _openai_reasoning_kwargs(provider_client: ProviderClient) -> dict[str, Any]:
+    if provider_client.name != "openai" or not _supports_openai_reasoning(provider_client.default_model):
+        return {}
+    return {"reasoning": {"effort": OPENAI_REASONING_EFFORT}}
+
+
+def _anthropic_thinking_kwargs(provider_client: ProviderClient) -> dict[str, Any]:
+    if provider_client.name != "anthropic" or not _supports_anthropic_extended_thinking(provider_client.default_model):
+        return {}
+    return {
+        "extra_body": {
+            "thinking": {
+                "type": "enabled",
+                "budget_tokens": ANTHROPIC_THINKING_BUDGET,
+            }
+        }
+    }
+
+
+def split_into_chunks(text: str, chunk_size: int = DEFAULT_CHUNK_SIZE, chunk_overlap: int = DEFAULT_CHUNK_OVERLAP) -> List[str]:
+    return _split_with_tokenizer(text, chunk_size=chunk_size, chunk_overlap=chunk_overlap)
+
+
+def split_into_scan_chunks(
+    text: str,
+    chunk_size: int = SCAN_CHUNK_SIZE,
+    chunk_overlap: int = SCAN_CHUNK_OVERLAP,
+) -> List[ScanChunk]:
+    chunks = _split_with_tokenizer(text, chunk_size=chunk_size, chunk_overlap=chunk_overlap)
+    return [ScanChunk(chunk_id=idx, text=chunk) for idx, chunk in enumerate(chunks, start=1)]
+
+
+def build_vector_store(chunks: Iterable[str]) -> FAISS:
+    docs = [Document(page_content=chunk, metadata={"chunk_id": idx}) for idx, chunk in enumerate(chunks, start=1)]
+    embeddings = _embedding_model()
+    return FAISS.from_documents(docs, embedding=embeddings)
+
+
+def document_hash_for_text(text: str) -> str:
+    return hashlib.sha256(text.encode("utf-8")).hexdigest()
+
+
+def document_cache_key(document_hash: str) -> str:
+    return f"{document_hash}:{DEFAULT_CHUNK_SIZE}:{DEFAULT_CHUNK_OVERLAP}:{DEFAULT_EMBEDDING_MODEL}"
+
+
+def get_cached_document(document_hash: str) -> CachedDocumentArtifacts | None:
+    return _DOCUMENT_CACHE.get(document_cache_key(document_hash))
+
+
+def cache_document(artifacts: CachedDocumentArtifacts) -> CachedDocumentArtifacts:
+    _DOCUMENT_CACHE[document_cache_key(artifacts.document_hash)] = artifacts
+    return artifacts
+
+
+def save_vector_store(vector_store: FAISS, output_dir: Path) -> None:
+    output_dir.parent.mkdir(parents=True, exist_ok=True)
+    vector_store.save_local(str(output_dir))
+
+
+def load_vector_store(vector_store_dir: Path) -> FAISS:
+    return FAISS.load_local(
+        str(vector_store_dir),
+        _embedding_model(),
+        allow_dangerous_deserialization=True,
+    )
+
+
+def hydrate_precomputed_example(asset: PrecomputedExampleAsset) -> CachedDocumentArtifacts:
+    analysis = AnalysisResult.model_validate(asset.analysis_payload)
+    vector_store = load_vector_store(asset.bill.vector_store_dir)
+    artifacts = CachedDocumentArtifacts(
+        document_hash=asset.bill.document_hash or document_hash_for_text(asset.document_text),
+        document_text=asset.document_text,
+        chunks=asset.chunks,
+        analysis=analysis,
+        vector_store=vector_store,
+        analysis_snippets=build_analysis_snippets(analysis),
+        source_url=asset.bill.source_url,
+        example_bill_id=asset.bill.id,
+        is_precomputed=True,
+        metadata=asset.metadata,
+    )
+    return cache_document(artifacts)
+
+
+def _analysis_schema() -> Dict[str, Any]:
+    return {
+        "type": "object",
+        "properties": {
+            "executive_summary": {"type": "string"},
+            "bill_summary": {"type": "array", "items": {"type": "string"}},
+            "implementation": {
+                "type": "array",
+                "items": {
+                    "type": "object",
+                    "properties": {
+                        "stakeholder": {"type": "string"},
+                        "obligation": {"type": "string"},
+                        "implementation_burden": {"type": "string"},
+                        "risk_or_note": {"type": "string"},
+                    },
+                    "required": [
+                        "stakeholder",
+                        "obligation",
+                        "implementation_burden",
+                        "risk_or_note",
+                    ],
+                    "additionalProperties": False,
+                },
+            },
+            "critique": {
+                "type": "array",
+                "items": {
+                    "type": "object",
+                    "properties": {
+                        "issue": {"type": "string"},
+                        "why_it_matters": {"type": "string"},
+                        "recommendation": {"type": "string"},
+                    },
+                    "required": ["issue", "why_it_matters", "recommendation"],
+                    "additionalProperties": False,
+                },
+            },
+            "swot": {
+                "type": "object",
+                "properties": {
+                    "strengths": {"type": "array", "items": {"type": "string"}},
+                    "weaknesses": {"type": "array", "items": {"type": "string"}},
+                    "opportunities": {"type": "array", "items": {"type": "string"}},
+                    "threats": {"type": "array", "items": {"type": "string"}},
+                },
+                "required": ["strengths", "weaknesses", "opportunities", "threats"],
+                "additionalProperties": False,
+            },
+        },
+        "required": [
+            "executive_summary",
+            "bill_summary",
+            "implementation",
+            "critique",
+            "swot",
+        ],
+        "additionalProperties": False,
+    }
+
+
+def _analysis_summary_schema() -> Dict[str, Any]:
+    return {
+        "type": "object",
+        "properties": {
+            "executive_summary": {"type": "string"},
+            "bill_summary": {"type": "array", "items": {"type": "string"}},
+        },
+        "required": ["executive_summary", "bill_summary"],
+        "additionalProperties": False,
+    }
+
+
+def _implementation_schema() -> Dict[str, Any]:
+    return {
+        "type": "object",
+        "properties": {
+            "implementation": _analysis_schema()["properties"]["implementation"],
+        },
+        "required": ["implementation"],
+        "additionalProperties": False,
+    }
+
+
+def _critique_schema() -> Dict[str, Any]:
+    return {
+        "type": "object",
+        "properties": {
+            "critique": _analysis_schema()["properties"]["critique"],
+        },
+        "required": ["critique"],
+        "additionalProperties": False,
+    }
+
+
+def _swot_schema() -> Dict[str, Any]:
+    return {
+        "type": "object",
+        "properties": {
+            "swot": _analysis_schema()["properties"]["swot"],
+        },
+        "required": ["swot"],
+        "additionalProperties": False,
+    }
+
+
+def _analysis_answer_schema() -> Dict[str, Any]:
+    return {
+        "type": "object",
+        "properties": {
+            "answer": {"type": "string"},
+            "is_sufficient": {"type": "boolean"},
+        },
+        "required": ["answer", "is_sufficient"],
+        "additionalProperties": False,
+    }
+
+
+def _generate_json_payload(
+    provider_client: ProviderClient,
+    *,
+    prompt: str,
+    user_text: str,
+    schema: dict[str, Any],
+    schema_name: str,
+    max_tokens: int = 1500,
+) -> str:
+    if provider_client.name == "openai":
+        response = provider_client.client.responses.create(
+            model=provider_client.default_model,
+            input=[
+                {"role": "system", "content": prompt},
+                {"role": "user", "content": user_text},
+            ],
+            response_format={
+                "type": "json_schema",
+                "json_schema": {"name": schema_name, "schema": schema},
+            },
+            **_openai_reasoning_kwargs(provider_client),
+        )
+        return _extract_openai_json(response)
+    if provider_client.name == "qwen":
+        response = provider_client.client.chat.completions.create(
+            model=provider_client.default_model,
+            messages=[
+                {"role": "system", "content": prompt},
+                {
+                    "role": "user",
+                    "content": (
+                        f"{user_text}\n\n"
+                        "Return only valid JSON matching this schema:\n"
+                        f"{json.dumps(schema)}"
+                    ),
+                },
+            ],
+            temperature=0,
+        )
+        return _strip_json_fences(_extract_chat_completion_text(response))
+    if provider_client.name == "anthropic":
+        response = provider_client.client.messages.create(
+            model=provider_client.default_model,
+            max_tokens=max_tokens,
+            system=prompt,
+            messages=[{"role": "user", "content": [{"type": "text", "text": user_text}]}],
+            response_format={
+                "type": "json_schema",
+                "json_schema": {"name": schema_name, "schema": schema},
+            },
+            **_anthropic_thinking_kwargs(provider_client),
+        )
+        return response.content[0].text
+    if provider_client.name == "cohere":
+        response = provider_client.client.chat(
+            message=user_text,
+            model=provider_client.default_model,
+            preamble=prompt,
+            max_tokens=max_tokens,
+            temperature=0,
+            response_format={
+                "type": "json_object",
+                "schema": schema,
+            },
+        )
+        return _strip_json_fences(_extract_cohere_text(response))
+
+    genai = provider_client.client
+    model = genai.GenerativeModel(
+        model_name=provider_client.default_model,
+        system_instruction=prompt,
+        generation_config=genai.GenerationConfig(
+            temperature=0,
+            response_mime_type="application/json",
+        ),
+    )
+    response = model.generate_content(user_text)
+    return _extract_gemini_text(response)
+
+
+def generate_analysis_progress(provider_client: ProviderClient, document_text: str) -> Iterable[tuple[str, AnalysisResult]]:
+    limited_text = document_text[:30000]
+    base_prompt = (
+        "You are a senior policy analyst helping citizens, civil society, startups, workers, consumers, "
+        "operators, and affected industries understand a government bill. Produce a clear briefing-style analysis, "
+        "not a generic summary. Be objective, text-disciplined, and grounded in the document. Separate what the bill "
+        "expressly provides from what is a reasonable inference about likely effects. Do not attribute powers, "
+        "safeguards, funding mechanisms, oversight tools, or policy instruments to the bill unless they are plainly "
+        "supported by the text. If support for a point is weak, omit it rather than embellish it. Focus on what the "
+        "bill changes, what ordinary people or practitioners in the affected field should be excited or worried "
+        "about, how businesses or industry participants may need to adapt, and what this could mean for growth, "
+        "friction, competition, cost, access, compliance, innovation, investor confidence, public-service delivery, "
+        "or digital infrastructure quality in the affected sector and, where relevant, the national economy. "
+        "Pay particular attention to ground-level effects on workers, professionals, entrepreneurs, recent "
+        "graduates, students, consumers, startups, SMEs, public institutions, and vulnerable or underserved groups "
+        "when the bill plausibly affects them, but do not force demographic groups into the analysis where the fit is "
+        "weak. Do not center implementation implications on lawmakers, legislators, or sponsoring government "
+        "agencies unless a direct downstream burden on the public or private sector depends on them. "
+        "For implementation items, identify the affected stakeholder group, the practical obligation or change in "
+        "behavior they may face, the likely implementation burden, and any practical risk or note. If a stakeholder "
+        "has no formal legal obligation, describe the real-world adjustment, exposure, opportunity, or compliance "
+        "expectation in plain language. Prefer concrete operational, lived-experience, and economic consequences over "
+        "abstract commentary. For critique items, use the structure: issue, why it matters, recommendation, and "
+        "focus on ambiguity, overlap, overreach, implementation bottlenecks, concentration of discretion, compliance "
+        "burden, and risks to competition, innovation, affordability, or access where relevant. Keep recommendations "
+        "tightly connected to the specific weakness identified. For SWOT, keep each item concise, specific, and "
+        "grounded in the bill or a clear downstream effect that follows from the bill. Avoid vague statements. "
+        "Avoid duplicating the same point across sections. "
+        + OBJECTIVITY_INSTRUCTION
+    )
+
+    partial = AnalysisResult()
+    summary_payload = _generate_json_payload(
+        provider_client,
+        prompt=base_prompt + " Return JSON for executive_summary and bill_summary only.",
+        user_text=f"Document content:\n\n{limited_text}",
+        schema=_analysis_summary_schema(),
+        schema_name="BillAnalysisSummary",
+    )
+    summary_result = json.loads(_strip_json_fences(summary_payload))
+    partial.executive_summary = summary_result.get("executive_summary", "")
+    partial.bill_summary = summary_result.get("bill_summary", [])
+    yield "Generating executive summary...", partial.model_copy(deep=True)
+
+    implementation_payload = _generate_json_payload(
+        provider_client,
+        prompt=base_prompt + " Return JSON for implementation implications only.",
+        user_text=f"Document content:\n\n{limited_text}",
+        schema=_implementation_schema(),
+        schema_name="BillAnalysisImplementation",
+    )
+    implementation_result = json.loads(_strip_json_fences(implementation_payload))
+    partial.implementation = [ImplementationItem.model_validate(item) for item in implementation_result.get("implementation", [])]
+    yield "Generating implementation implications...", partial.model_copy(deep=True)
+
+    critique_payload = _generate_json_payload(
+        provider_client,
+        prompt=base_prompt + " Return JSON for critique only.",
+        user_text=f"Document content:\n\n{limited_text}",
+        schema=_critique_schema(),
+        schema_name="BillAnalysisCritique",
+    )
+    critique_result = json.loads(_strip_json_fences(critique_payload))
+    partial.critique = [CritiqueItem.model_validate(item) for item in critique_result.get("critique", [])]
+    yield "Generating critique...", partial.model_copy(deep=True)
+
+    swot_payload = _generate_json_payload(
+        provider_client,
+        prompt=base_prompt + " Return JSON for SWOT only.",
+        user_text=f"Document content:\n\n{limited_text}",
+        schema=_swot_schema(),
+        schema_name="BillAnalysisSwot",
+    )
+    swot_result = json.loads(_strip_json_fences(swot_payload))
+    partial.swot = SWOTBlock.model_validate(swot_result.get("swot", {}))
+    yield "Generating SWOT...", partial.model_copy(deep=True)
+
+
+def generate_analysis_once(provider_client: ProviderClient, document_text: str) -> AnalysisResult:
+    limited_text = document_text[:30000]
+    prompt = (
+        "You are a senior policy analyst helping citizens, civil society, startups, workers, consumers, "
+        "operators, and affected industries understand a government bill. Produce a clear briefing-style analysis, "
+        "not a generic summary. Be objective, text-disciplined, and grounded in the document. Separate what the bill "
+        "expressly provides from what is a reasonable inference about likely effects. Do not attribute powers, "
+        "safeguards, funding mechanisms, oversight tools, or policy instruments to the bill unless they are plainly "
+        "supported by the text. If support for a point is weak, omit it rather than embellish it. Focus on what the "
+        "bill changes, what ordinary people or practitioners in the affected field should be excited or worried "
+        "about, how businesses or industry participants may need to adapt, and what this could mean for growth, "
+        "friction, competition, cost, access, compliance, innovation, investor confidence, public-service delivery, "
+        "or digital infrastructure quality in the affected sector and, where relevant, the national economy. "
+        "Pay particular attention to ground-level effects on workers, professionals, entrepreneurs, recent "
+        "graduates, students, consumers, startups, SMEs, public institutions, and vulnerable or underserved groups "
+        "when the bill plausibly affects them, but do not force demographic groups into the analysis where the fit is "
+        "weak. Do not center implementation implications on lawmakers, legislators, or sponsoring government "
+        "agencies unless a direct downstream burden on the public or private sector depends on them. "
+        "For implementation items, identify the affected stakeholder group, the practical obligation or change in "
+        "behavior they may face, the likely implementation burden, and any practical risk or note. If a stakeholder "
+        "has no formal legal obligation, describe the real-world adjustment, exposure, opportunity, or compliance "
+        "expectation in plain language. Prefer concrete operational, lived-experience, and economic consequences over "
+        "abstract commentary. For critique items, use the structure: issue, why it matters, recommendation, and "
+        "focus on ambiguity, overlap, overreach, implementation bottlenecks, concentration of discretion, compliance "
+        "burden, and risks to competition, innovation, affordability, or access where relevant. Keep recommendations "
+        "tightly connected to the specific weakness identified. For SWOT, keep each item concise, specific, and "
+        "grounded in the bill or a clear downstream effect that follows from the bill. "
+        "Avoid vague statements. Avoid duplicating the same point across sections. "
+        "Respond using JSON that matches the provided schema. "
+        + OBJECTIVITY_INSTRUCTION
+    )
+    payload = _generate_json_payload(
+        provider_client,
+        prompt=prompt,
+        user_text=f"Document content:\n\n{limited_text}",
+        schema=_analysis_schema(),
+        schema_name="BillAnalysis",
+    )
+    return AnalysisResult.model_validate_json(_strip_json_fences(payload))
+
+
+def generate_analysis(provider_client: ProviderClient, document_text: str) -> AnalysisResult:
+    final = AnalysisResult()
+    for _, partial in generate_analysis_progress(provider_client, document_text):
+        final = partial
+    return final
+
+
+def prepare_document_artifacts(
+    document_text: str,
+    *,
+    provider_factory: Callable[[], Any] | None = None,
+) -> tuple[str, list[str], FAISS]:
+    document_hash = document_hash_for_text(document_text)
+    cached = get_cached_document(document_hash)
+    if cached is not None and cached.vector_store is not None:
+        return cached.document_hash, cached.chunks, cached.vector_store
+
+    with ThreadPoolExecutor(max_workers=2) as executor:
+        chunks_future = executor.submit(split_into_chunks, document_text)
+        provider_future = executor.submit(provider_factory) if provider_factory is not None else None
+        chunks = chunks_future.result()
+        vector_store = build_vector_store(chunks)
+        if provider_future is not None:
+            provider_future.result()
+    return document_hash, chunks, vector_store
+
+
+def get_precomputed_example_artifacts(url: str | None) -> CachedDocumentArtifacts | None:
+    asset = load_precomputed_asset_for_url(url)
+    if asset is None:
+        return None
+    if asset.bill.document_hash:
+        cached = get_cached_document(asset.bill.document_hash)
+        if cached is not None:
+            return cached
+    return hydrate_precomputed_example(asset)
+
+
+def build_cached_document_artifacts(
+    *,
+    document_text: str,
+    chunks: list[str],
+    analysis: AnalysisResult,
+    vector_store: FAISS | None,
+    source_url: str | None = None,
+) -> CachedDocumentArtifacts:
+    return cache_document(
+        CachedDocumentArtifacts(
+            document_hash=document_hash_for_text(document_text),
+            document_text=document_text,
+            chunks=chunks,
+            analysis=analysis,
+            vector_store=vector_store,
+            analysis_snippets=build_analysis_snippets(analysis),
+            source_url=source_url,
+        )
+    )
+
+
+def build_analysis_snippets(analysis: AnalysisResult) -> list[AnalysisSnippet]:
+    snippets: list[AnalysisSnippet] = []
+    next_ref = 1
+
+    def push(section: str, text: str) -> None:
+        nonlocal next_ref
+        cleaned = " ".join(text.split()).strip()
+        if not cleaned:
+            return
+        snippets.append(AnalysisSnippet(ref_id=next_ref, section=section, text=cleaned))
+        next_ref += 1
+
+    push("Executive Summary", analysis.executive_summary)
+    for item in analysis.bill_summary:
+        push("Bill Summary", item)
+    for item in analysis.implementation:
+        push(
+            "Implementation",
+            f"{item.stakeholder}: {item.obligation}. Burden: {item.implementation_burden}. Risk/Note: {item.risk_or_note}",
+        )
+    for item in analysis.critique:
+        push(
+            "Critique",
+            f"{item.issue}. Why it matters: {item.why_it_matters}. Recommendation: {item.recommendation}",
+        )
+    for label, values in (
+        ("Strength", analysis.swot.strengths),
+        ("Weakness", analysis.swot.weaknesses),
+        ("Opportunity", analysis.swot.opportunities),
+        ("Threat", analysis.swot.threats),
+    ):
+        for value in values:
+            push(f"SWOT {label}", value)
+    return snippets
+
+
+def _question_terms(text: str) -> set[str]:
+    return {term for term in re.findall(r"[a-z0-9]{3,}", text.lower())}
+
+
+def search_analysis_snippets(snippets: list[AnalysisSnippet], question: str, top_k: int = 5) -> tuple[str, list[Citation]] | None:
+    if not snippets:
+        return None
+    terms = _question_terms(question)
+    if not terms:
+        return None
+
+    ranked: list[tuple[int, AnalysisSnippet]] = []
+    for snippet in snippets:
+        snippet_terms = _question_terms(snippet.text)
+        score = len(terms & snippet_terms)
+        if score > 0:
+            ranked.append((score, snippet))
+    if not ranked:
+        return None
+
+    ranked.sort(key=lambda item: (-item[0], item[1].ref_id))
+    selected = [snippet for _, snippet in ranked[:top_k]]
+    context_blocks: list[str] = []
+    citations: list[Citation] = []
+    for idx, snippet in enumerate(selected, start=1):
+        citations.append(Citation(ref_id=idx, snippet=snippet.text))
+        context_blocks.append(f"[ref{idx}] {snippet.section}\n{snippet.text}")
+    return "\n\n".join(context_blocks), citations
+
+
+def _answer_question_from_analysis_context(
+    provider_client: ProviderClient,
+    context_text: str,
+    question: str,
+) -> dict[str, Any]:
+    prompt = (
+        "You answer follow-up questions about a government bill using only the provided analysis summary snippets. "
+        "Answer directly and clearly. Set is_sufficient to true only if the analysis snippets materially answer the "
+        "question. If they do not fully answer it, say what is missing and set is_sufficient to false. "
+        "Do not pretend you have read the full bill if you only have analysis snippets. "
+        + OBJECTIVITY_INSTRUCTION
+    )
+    payload = _generate_json_payload(
+        provider_client,
+        prompt=prompt,
+        user_text="Analysis snippets:\n" + context_text + "\n\nQuestion:\n" + question,
+        schema=_analysis_answer_schema(),
+        schema_name="AnalysisAnswer",
+        max_tokens=900,
+    )
+    return json.loads(_strip_json_fences(payload))
+
+
+def answer_query(
+    provider_client: ProviderClient,
+    analysis: AnalysisResult | None,
+    vector_store: FAISS | None,
+    question: str,
+    doc_text: str | None = None,
+    allow_full_document: bool = False,
+) -> AnswerResult:
+    if analysis is not None:
+        snippets = build_analysis_snippets(analysis)
+        analysis_context = search_analysis_snippets(snippets, question)
+        if analysis_context is not None:
+            context_text, citations = analysis_context
+            analysis_answer = _answer_question_from_analysis_context(provider_client, context_text, question)
+            return AnswerResult(
+                answer=analysis_answer["answer"].strip(),
+                citations=citations,
+                provenance="analysis_based",
+                needs_deeper_consent=not analysis_answer.get("is_sufficient", False),
+                deeper_answer_available=bool(doc_text or vector_store is not None),
+                consent_prompt=(
+                    "This answer is based on the summary and analysis. "
+                    "If you want, I can run a deeper full-document answer next."
+                ),
+            )
+
+    if allow_full_document:
+        return answer_query_from_full_document(provider_client, vector_store, question, doc_text=doc_text)
+
+    return AnswerResult(
+        answer=(
+            "I couldn't fully answer that from the summary and analysis alone. "
+            "If you want, I can run a deeper full-document answer."
+        ),
+        citations=[],
+        provenance="analysis_based",
+        needs_deeper_consent=True,
+        deeper_answer_available=bool(doc_text or vector_store is not None),
+        consent_prompt="A deeper full-document answer is available.",
+    )
+
+
+def answer_query_from_full_document(
+    provider_client: ProviderClient,
+    vector_store: FAISS | None,
+    question: str,
+    *,
+    doc_text: str | None = None,
+) -> AnswerResult:
+    context_text = "No context available."
+    citations: list[Citation] = []
+
+    if doc_text:
+        full_document_answer = _answer_question_from_full_document(provider_client, doc_text, question)
+        if full_document_answer is not None:
+            return AnswerResult(
+                answer=full_document_answer.strip(),
+                citations=[],
+                provenance="full_document",
+            )
+
+        scan_context = _scan_document_for_context(provider_client, doc_text, question)
+        if scan_context:
+            context_text, citations = scan_context
+
+    if not citations and vector_store is not None:
+        context_text, citations = _retrieve_context_from_vector_store(vector_store, question)
+
+    answer = _generate_answer_from_context(provider_client, context_text, question)
+    return AnswerResult(answer=answer.strip(), citations=citations, provenance="full_document")
+
+
+def _answer_question_from_full_document(
+    provider_client: ProviderClient,
+    doc_text: str,
+    question: str,
+) -> str | None:
+    if _token_count(doc_text) > _full_document_budget(provider_client):
+        return None
+
+    prompt = (
+        "You answer questions about government bills. Read the full document carefully, "
+        "reason through the relevant provisions, and answer the user's question logically. "
+        "Base your answer only on the provided document. If the answer is not supported by the document, say you are unsure. "
+        + OBJECTIVITY_INSTRUCTION
+    )
+    user_text = "Full document:\n" + doc_text + "\n\nQuestion:\n" + question
+
+    if provider_client.name == "openai":
+        response = provider_client.client.responses.create(
+            model=provider_client.default_model,
+            input=[
+                {"role": "system", "content": prompt},
+                {"role": "user", "content": user_text},
+            ],
+            **_openai_reasoning_kwargs(provider_client),
+        )
+        return _extract_openai_text(response)
+    if provider_client.name == "qwen":
+        response = provider_client.client.chat.completions.create(
+            model=provider_client.default_model,
+            messages=[
+                {"role": "system", "content": prompt},
+                {"role": "user", "content": user_text},
+            ],
+            temperature=0,
+        )
+        return _extract_chat_completion_text(response)
+    if provider_client.name == "anthropic":
+        response = provider_client.client.messages.create(
+            model=provider_client.default_model,
+            max_tokens=1000,
+            system=prompt,
+            messages=[{"role": "user", "content": [{"type": "text", "text": user_text}]}],
+            **_anthropic_thinking_kwargs(provider_client),
+        )
+        return response.content[0].text
+    if provider_client.name == "cohere":
+        response = provider_client.client.chat(
+            message=user_text,
+            model=provider_client.default_model,
+            preamble=prompt,
+            max_tokens=1000,
+            temperature=0,
+        )
+        return _extract_cohere_text(response)
+
+    genai = provider_client.client
+    model = genai.GenerativeModel(
+        model_name=provider_client.default_model,
+        system_instruction=prompt,
+        generation_config=genai.GenerationConfig(
+            temperature=0,
+            response_mime_type="text/plain",
+        ),
+    )
+    response = model.generate_content(user_text)
+    return _extract_gemini_text(response)
+
+
+def _retrieve_context_from_vector_store(vector_store: FAISS, question: str) -> tuple[str, list[Citation]]:
+    retrieved_docs = vector_store.similarity_search(question, k=TOP_K_RETRIEVAL)
+    context_blocks: list[str] = []
+    citations: list[Citation] = []
+    for idx, doc in enumerate(retrieved_docs, start=1):
+        snippet = doc.page_content.strip()
+        context_blocks.append(f"[{idx}] {snippet}")
+        citations.append(Citation(ref_id=idx, snippet=snippet))
+
+    context_text = "\n\n".join(context_blocks) if context_blocks else "No context available."
+    return context_text, citations
+
+
+def _generate_answer_from_context(provider_client: ProviderClient, context_text: str, question: str) -> str:
+    prompt = (
+        "You answer questions about government bills. Use the context snippets provided. "
+        "Cite supporting snippets using [ref#] references matching the snippet number. "
+        "If unsure, say you are unsure. "
+        + OBJECTIVITY_INSTRUCTION
+    )
+
+    if provider_client.name == "openai":
+        response = provider_client.client.responses.create(
+            model=provider_client.default_model,
+            input=[
+                {"role": "system", "content": prompt},
+                {
+                    "role": "user",
+                    "content": (
+                        "Context:\n" + context_text + "\n\nQuestion:\n" + question
+                    ),
+                },
+            ],
+            **_openai_reasoning_kwargs(provider_client),
+        )
+        answer = _extract_openai_text(response)
+    elif provider_client.name == "qwen":
+        response = provider_client.client.chat.completions.create(
+            model=provider_client.default_model,
+            messages=[
+                {"role": "system", "content": prompt},
+                {
+                    "role": "user",
+                    "content": (
+                        "Context:\n" + context_text + "\n\nQuestion:\n" + question
+                    ),
+                },
+            ],
+            temperature=0,
+        )
+        answer = _extract_chat_completion_text(response)
+    elif provider_client.name == "anthropic":
+        response = provider_client.client.messages.create(
+            model=provider_client.default_model,
+            max_tokens=800,
+            system=prompt,
+            messages=[
+                {
+                    "role": "user",
+                    "content": [
+                        {
+                            "type": "text",
+                            "text": (
+                                "Context:\n" + context_text + "\n\nQuestion:\n" + question
+                            ),
+                        }
+                    ],
+                }
+            ],
+            **_anthropic_thinking_kwargs(provider_client),
+        )
+        answer = response.content[0].text
+    elif provider_client.name == "cohere":
+        response = provider_client.client.chat(
+            message=(
+                "Context:\n" + context_text + "\n\nQuestion:\n" + question
+            ),
+            model=provider_client.default_model,
+            preamble=prompt,
+            max_tokens=800,
+            temperature=0,
+        )
+        answer = _extract_cohere_text(response)
+    else:  # gemini
+        genai = provider_client.client
+        model = genai.GenerativeModel(
+            model_name=provider_client.default_model,
+            system_instruction=prompt,
+            generation_config=genai.GenerationConfig(
+                temperature=0,
+                response_mime_type="text/plain",
+            ),
+        )
+        response = model.generate_content(
+            "Context:\n"
+            + context_text
+            + "\n\nQuestion:\n"
+            + question
+        )
+        answer = _extract_gemini_text(response)
+
+    return answer
+
+
+def _scan_document_for_context(
+    provider_client: ProviderClient,
+    doc_text: str,
+    question: str,
+) -> Optional[tuple[str, list[Citation]]]:
+    scan_chunks = split_into_scan_chunks(doc_text)
+    if not scan_chunks or len(scan_chunks) > SCAN_MAX_WINDOWS:
+        return None
+
+    ranked_matches: list[ScanMatch] = []
+    for batch_start in range(0, len(scan_chunks), SCAN_BATCH_SIZE):
+        batch = scan_chunks[batch_start : batch_start + SCAN_BATCH_SIZE]
+        parsed_result = _run_scan_batch_with_retry(provider_client, batch, question)
+        if parsed_result is None:
+            return None
+        ranked_matches.extend(parsed_result.matches)
+
+    merged_matches = _merge_scan_matches(ranked_matches)
+    if not merged_matches or merged_matches[0].relevance_score <= 0:
+        return None
+
+    chunk_by_id = {chunk.chunk_id: chunk for chunk in scan_chunks}
+    selected_matches = merged_matches[:SCAN_TOP_K]
+    context_blocks: list[str] = []
+    citations: list[Citation] = []
+    for ref_id, match in enumerate(selected_matches, start=1):
+        chunk = chunk_by_id.get(match.chunk_id)
+        if chunk is None:
+            continue
+        snippet = match.evidence_snippet.strip() or _truncate_snippet(chunk.text)
+        citations.append(Citation(ref_id=ref_id, snippet=snippet))
+        context_blocks.append(
+            f"[ref{ref_id}] Chunk {match.chunk_id} (score {match.relevance_score})\n"
+            f"Evidence: {snippet}\n"
+            f"Full context:\n{chunk.text.strip()}"
+        )
+
+    if not citations:
+        return None
+    return "\n\n".join(context_blocks), citations
+
+
+def _run_scan_batch_with_retry(
+    provider_client: ProviderClient,
+    batch: list[ScanChunk],
+    question: str,
+) -> ScanResult | None:
+    for _ in range(2):
+        payload = _scan_batch(provider_client, batch, question)
+        try:
+            return ScanResult.model_validate_json(_strip_json_fences(payload))
+        except Exception:  # noqa: BLE001
+            continue
+    return None
+
+
+def _scan_batch(provider_client: ProviderClient, batch: list[ScanChunk], question: str) -> str:
+    schema = {
+        "type": "object",
+        "properties": {
+            "matches": {
+                "type": "array",
+                "items": {
+                    "type": "object",
+                    "properties": {
+                        "chunk_id": {"type": "integer"},
+                        "relevance_score": {"type": "integer", "minimum": 0, "maximum": 3},
+                        "evidence_snippet": {"type": "string"},
+                    },
+                    "required": ["chunk_id", "relevance_score", "evidence_snippet"],
+                    "additionalProperties": False,
+                },
+            }
+        },
+        "required": ["matches"],
+        "additionalProperties": False,
+    }
+    prompt = (
+        "You are scanning chunks from a government bill to find context relevant to a user question. "
+        "Return only JSON matching the schema. Include only chunks that are at least somewhat relevant. "
+        "Use relevance_score from 0 to 3, where 3 is highly relevant and 0 is irrelevant. "
+        "Keep evidence_snippet short and copied from the chunk. "
+        + OBJECTIVITY_INSTRUCTION
+    )
+    chunk_text = "\n\n".join(f"Chunk {chunk.chunk_id}:\n{chunk.text}" for chunk in batch)
+    user_text = (
+        f"Question:\n{question}\n\n"
+        f"Chunks:\n{chunk_text}\n\n"
+        f"Return JSON matching this schema:\n{json.dumps(schema)}"
+    )
+
+    if provider_client.name == "openai":
+        response = provider_client.client.responses.create(
+            model=provider_client.default_model,
+            input=[
+                {"role": "system", "content": prompt},
+                {"role": "user", "content": user_text},
+            ],
+            response_format={
+                "type": "json_schema",
+                "json_schema": {"name": "ChunkScan", "schema": schema},
+            },
+            **_openai_reasoning_kwargs(provider_client),
+        )
+        return _extract_openai_json(response)
+    if provider_client.name == "qwen":
+        response = provider_client.client.chat.completions.create(
+            model=provider_client.default_model,
+            messages=[
+                {"role": "system", "content": prompt},
+                {"role": "user", "content": user_text},
+            ],
+            temperature=0,
+        )
+        return _extract_chat_completion_text(response)
+    if provider_client.name == "anthropic":
+        response = provider_client.client.messages.create(
+            model=provider_client.default_model,
+            max_tokens=1200,
+            system=prompt,
+            messages=[{"role": "user", "content": [{"type": "text", "text": user_text}]}],
+            **_anthropic_thinking_kwargs(provider_client),
+        )
+        return response.content[0].text
+    if provider_client.name == "cohere":
+        response = provider_client.client.chat(
+            message=user_text,
+            model=provider_client.default_model,
+            preamble=prompt,
+            max_tokens=1200,
+            temperature=0,
+            response_format={
+                "type": "json_object",
+                "schema": schema,
+            },
+        )
+        return _extract_cohere_text(response)
+
+    genai = provider_client.client
+    model = genai.GenerativeModel(
+        model_name=provider_client.default_model,
+        system_instruction=prompt,
+        generation_config=genai.GenerationConfig(
+            temperature=0,
+            response_mime_type="application/json",
+        ),
+    )
+    response = model.generate_content(user_text)
+    return _extract_gemini_text(response)
+
+
+def _merge_scan_matches(matches: list[ScanMatch]) -> list[ScanMatch]:
+    by_chunk_id: dict[int, ScanMatch] = {}
+    for match in matches:
+        existing = by_chunk_id.get(match.chunk_id)
+        candidate_snippet = match.evidence_snippet.strip()
+        if existing is None or match.relevance_score > existing.relevance_score:
+            by_chunk_id[match.chunk_id] = match
+        elif (
+            existing.relevance_score == match.relevance_score
+            and candidate_snippet
+            and len(candidate_snippet) > len(existing.evidence_snippet.strip())
+        ):
+            by_chunk_id[match.chunk_id] = match
+    return sorted(
+        by_chunk_id.values(),
+        key=lambda item: (-item.relevance_score, item.chunk_id),
+    )
+
+
+def _truncate_snippet(text: str, limit: int = 220) -> str:
+    compact = " ".join(text.split())
+    if len(compact) <= limit:
+        return compact
+    return compact[: limit - 3].rstrip() + "..."
+
+
+def _extract_openai_json(response: Any) -> str:
+    buffer = []
+    output_items = getattr(response, "output", None)
+    if output_items:
+        for item in output_items:
+            for block in item.content:
+                if getattr(block, "type", None) == "output_json_schema":
+                    buffer.append(block.text)
+                elif getattr(block, "type", None) == "output_text":
+                    buffer.append(block.text)
+    if buffer:
+        return "".join(buffer)
+    if hasattr(response, "output_text"):
+        return response.output_text
+    return ""
+
+
+def _extract_openai_text(response: Any) -> str:
+    buffer = []
+    output_items = getattr(response, "output", None)
+    if output_items:
+        for item in output_items:
+            for block in item.content:
+                if getattr(block, "type", None) in ("output_text", "output_message"):
+                    buffer.append(block.text)
+    if buffer:
+        return "".join(buffer)
+    if hasattr(response, "output_text"):
+        return response.output_text
+    return ""
+
+
+def _extract_chat_completion_text(response: Any) -> str:
+    choices = getattr(response, "choices", None) or []
+    if not choices:
+        return ""
+    message = getattr(choices[0], "message", None)
+    if message is None:
+        return ""
+    content = getattr(message, "content", None)
+    if isinstance(content, str):
+        return _strip_thinking_block(content)
+    if isinstance(content, list):
+        parts = []
+        for item in content:
+            text = getattr(item, "text", None)
+            if text:
+                parts.append(text)
+        return _strip_thinking_block("".join(parts))
+    return ""
+
+
+def _extract_gemini_text(response: Any) -> str:
+    text = getattr(response, "text", None)
+    if text:
+        return text
+    candidates = getattr(response, "candidates", None)
+    if candidates:
+        parts = []
+        for candidate in candidates:
+            content = getattr(candidate, "content", None)
+            if not content:
+                continue
+            for part in getattr(content, "parts", []) or []:
+                segment = getattr(part, "text", None)
+                if segment:
+                    parts.append(segment)
+        if parts:
+            return "".join(parts)
+    return ""
+
+
+def _extract_cohere_text(response: Any) -> str:
+    message = getattr(response, "message", None)
+    if message:
+        content = getattr(message, "content", None) or []
+        parts = []
+        for item in content:
+            text = getattr(item, "text", None)
+            if text:
+                parts.append(text)
+        if parts:
+            return "".join(parts)
+    text = getattr(response, "text", None)
+    if text:
+        return text
+    return ""
+
+
+def _strip_json_fences(value: str) -> str:
+    stripped = value.strip()
+    if stripped.startswith("```json"):
+        stripped = stripped[7:]
+    elif stripped.startswith("```"):
+        stripped = stripped[3:]
+    if stripped.endswith("```"):
+        stripped = stripped[:-3]
+    return stripped.strip()
+
+
+def _strip_thinking_block(value: str) -> str:
+    stripped = value.strip()
+    without_think = re.sub(r"(?is)<think>.*?</think>", "", stripped).strip()
+    if without_think:
+        return without_think
+    if "</think>" in stripped:
+        _, _, tail = stripped.rpartition("</think>")
+        return tail.strip()
+    return stripped