Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

On Developing an Artifact-based Approach to Regulatory Requirements Engineering

Oleksandr Kosenkov, Michael Unterkalmsteiner, Jannik Fischbach, Daniel Mendez, Davide Fucci, Tony Gorschek

TL;DR

This paper tackles the challenge of deriving software requirements from regulatory acts by bridging legal interpretation with requirements engineering. It proposes AM4RRE, an artifact-based regulatory RE model that extends the AMDiRE framework with legal concepts and a two-view content model. The authors report focus-group studies with legal researchers to identify core challenges and a conceptual validation with RE and legal researchers, supporting the feasibility of artifact-based regulatory RE. The findings indicate that AM4RRE can capture essential legal concepts and support engineering-legal coordination, while acknowledging limitations such as incomplete replacement of interpretation and model complexity. The work lays a foundation for tool-supported extensions and large-scale empirical evaluations in practice.

Abstract

Context: Regulatory acts are a challenging source when eliciting, interpreting, and analyzing requirements. Requirements engineers often need to involve legal experts who, however, may often not be available. This raises the need for approaches to regulatory Requirements Engineering (RE) covering and integrating both legal and engineering perspectives. Problem: Regulatory RE approaches need to capture and reflect both the elementary concepts and relationships from a legal perspective and their seamless transition to concepts used to specify software requirements. No existing approach considers explicating and managing legal domain knowledge and engineering-legal coordination. Method: We conducted focus group sessions with legal researchers to identify the core challenges to establishing a regulatory RE approach. Based on our findings, we developed a candidate solution and conducted a first conceptual validation to assess its feasibility. Results: We introduce the first version of our Artifact Model for Regulatory Requirements Engineering (AM4RRE) and its conceptual foundation. It provides a blueprint for applying legal (modelling) concepts and well-established RE concepts. Our initial results suggest that artifact-centric RE can be applied to managing legal domain knowledge and engineering-legal coordination. Conclusions: The focus groups that served as a basis for building our model and the results from the expert validation both strengthen our confidence that we already provide a valuable basis for systematically integrating legal concepts into RE. This overcomes contemporary challenges to regulatory RE and serves as a basis for exposure to critical discussions in the community before continuing with the development of tool-supported extensions and large-scale empirical evaluations in practice.

On Developing an Artifact-based Approach to Regulatory Requirements Engineering

TL;DR

This paper tackles the challenge of deriving software requirements from regulatory acts by bridging legal interpretation with requirements engineering. It proposes AM4RRE, an artifact-based regulatory RE model that extends the AMDiRE framework with legal concepts and a two-view content model. The authors report focus-group studies with legal researchers to identify core challenges and a conceptual validation with RE and legal researchers, supporting the feasibility of artifact-based regulatory RE. The findings indicate that AM4RRE can capture essential legal concepts and support engineering-legal coordination, while acknowledging limitations such as incomplete replacement of interpretation and model complexity. The work lays a foundation for tool-supported extensions and large-scale empirical evaluations in practice.

Abstract

Context: Regulatory acts are a challenging source when eliciting, interpreting, and analyzing requirements. Requirements engineers often need to involve legal experts who, however, may often not be available. This raises the need for approaches to regulatory Requirements Engineering (RE) covering and integrating both legal and engineering perspectives. Problem: Regulatory RE approaches need to capture and reflect both the elementary concepts and relationships from a legal perspective and their seamless transition to concepts used to specify software requirements. No existing approach considers explicating and managing legal domain knowledge and engineering-legal coordination. Method: We conducted focus group sessions with legal researchers to identify the core challenges to establishing a regulatory RE approach. Based on our findings, we developed a candidate solution and conducted a first conceptual validation to assess its feasibility. Results: We introduce the first version of our Artifact Model for Regulatory Requirements Engineering (AM4RRE) and its conceptual foundation. It provides a blueprint for applying legal (modelling) concepts and well-established RE concepts. Our initial results suggest that artifact-centric RE can be applied to managing legal domain knowledge and engineering-legal coordination. Conclusions: The focus groups that served as a basis for building our model and the results from the expert validation both strengthen our confidence that we already provide a valuable basis for systematically integrating legal concepts into RE. This overcomes contemporary challenges to regulatory RE and serves as a basis for exposure to critical discussions in the community before continuing with the development of tool-supported extensions and large-scale empirical evaluations in practice.
Paper Structure (23 sections, 4 figures)

This paper contains 23 sections, 4 figures.

Table of Contents

  1. Introduction
  2. Terminology
  3. Related Work
  4. Methodology overview
  5. Focus group design and implementation
  6. Synthesis and model generation
  7. Conceptual Validation
  8. Threats to Validity
  9. Focus Group Results (RQ1)
  10. Ch1: Detachment from legal interpretation practice
  11. Ch2: Non-linear and iterative nature of legal interpretation
  12. Ch3: Ignorance of the software context
  13. Ch4: Limited application of legal concepts in regulatory RE approaches
  14. Artifact model for Regulatory Requirements Engineering - AM4RRE (RQ2)
  15. Role Model (C1)
  16. ...and 8 more sections

Figures (4)

  • Figure 1: Overview of main components of the AM4RRE model
  • Figure 2: Pictogrammatic overview of the AM4RRE Artifact Model showing only the integration of legal concepts with requirements concepts (red associations).
  • Figure 3: Fragment of the AM4RRE content model (C3.2) depicting concepts (classes); associations remain simplified.
  • Figure 4: Exemplary instance of selected classes of the artifact content model for two regulatory acts: GDPR and EDPB Guidelines 07/2020.