Legal Requirements Analysis
Sallam Abualhaija, Marcello Ceci, Lionel Briand
TL;DR
This paper surveys approaches for eliciting, representing, and verifying legal requirements in software systems under GDPR. It analyzes how to convert regulations into machine-interpretable representations (norms, obligations, and penalties) and how to perform automated compliance checking using NLP/ML and formal representations. It presents COREQQA, a QA-based pipeline that retrieves compliance-relevant information from regulations and extracts answers with fine-tuned LLMs, and discusses alternative failure-detection strategies based on semantic roles and conceptual models. The discussion also highlights practical challenges, including regulatory change over time, cross-regulatory references, explainability, and the trade-offs between ad-hoc representations and formal legal models, arguing for end-to-end, auditable pipelines.
Abstract
Modern software has been an integral part of everyday activities in many disciplines and application contexts. Introducing intelligent automation by leveraging artificial intelligence (AI) led to break-throughs in many fields. The effectiveness of AI can be attributed to several factors, among which is the increasing availability of data. Regulations such as the general data protection regulation (GDPR) in the European Union (EU) are introduced to ensure the protection of personal data. Software systems that collect, process, or share personal data are subject to compliance with such regulations. Developing compliant software depends heavily on addressing legal requirements stipulated in applicable regulations, a central activity in the requirements engineering (RE) phase of the software development process. RE is concerned with specifying and maintaining requirements of a system-to-be, including legal requirements. Legal agreements which describe the policies organizations implement for processing personal data can provide an additional source to regulations for eliciting legal requirements. In this chapter, we explore a variety of methods for analyzing legal requirements and exemplify them on GDPR. Specifically, we describe possible alternatives for creating machine-analyzable representations from regulations, survey the existing automated means for enabling compliance verification against regulations, and further reflect on the current challenges of legal requirements analysis.