compliance framework design

Current AI systems rely heavily on manual auditing and documentation, which hinders scalable governance for automated services. This work proposes Ontological Knowledge Blocks (OKBs), a novel framework that formalizes regulatory obligations as quintuples comprising ontologies, SHACL rules, evidence requirements, and provenance links. By leveraging RDF/OWL modeling, PROV-O for provenance tracking, and an intermediate representation–driven deterministic compiler, the approach enables dynamic switching of governance configurations without modifying service code. Evaluation in an AI-assisted HPC scheduling scenario demonstrates that compliance checks are configuration-sensitive, violations accumulate strictly additively, SHACL validation incurs only 12.6–100.3 milliseconds of latency, and the Combined configuration provides the most comprehensive coverage.

Ensuring compliance of AI systems in the legal domain with the EU’s Artificial Intelligence Act (AI Act) poses significant verification challenges due to the gap between legal requirements and technical implementation. Method: This paper proposes the first verifiable governance framework integrating legal norms and technical controls. It introduces a regulation–technical-control mapping model, designs a forensically aware logging architecture and observability mechanism tailored for RAG/LLM systems, and establishes a multidimensional evaluation metric system weighted by legal risk. We publicly release the open-source auditing tool *rag-forense* and a standardized experimental protocol. Contribution/Results: The framework enables end-to-end compliance audit trails, automated verification, and evidence generation. Empirical evaluation demonstrates its effectiveness in identifying high-risk non-compliance scenarios and producing auditable, traceable compliance proofs—advancing RegTech for legal AI through a reusable methodology and engineering infrastructure.

Legal compliance of machine learning models cannot be directly encoded; instead, abstract legal obligations must be “indirectly operationalized” into verifiable model design choices. Existing approaches either focus narrowly on software-level compliance or overlook legal complexity, failing to address two core challenges: the multiplicity of legal interpretations and the unpredictability of performance–compliance trade-offs. Method: We propose a five-stage interdisciplinary framework introducing the first legal–ML co-modeling paradigm, embedding legal reasoning throughout the ML development lifecycle. It features a legally adaptable operationalization mechanism and a multi-objective trade-off evaluation system. Contribution/Results: Evaluated in an anti-money laundering use case, the framework identifies an optimal configuration achieving both high detection accuracy (12% F1-score improvement) and legal defensibility, demonstrating its systematic capacity to jointly optimize predictive performance and legal legitimacy.

The EU AI Act faces challenges including the absence of systematic methodologies for legal compliance verification, heterogeneous national preparedness, and ambiguous regulatory interpretations. To address these, this study proposes the first comprehensive compliance verification framework tailored to high-risk AI systems. Structured along two dimensions—“method type” (governance vs. testing) and “assessment object” (data, model, process, product)—the framework establishes a multi-layered, lifecycle-spanning verification paradigm. It introduces a novel mapping mechanism that systematically translates legal provisions into executable verification activities, integrating compliance engineering, law-technology alignment modeling, standards-mapping matrices, and risk-informed pathway design. The framework significantly reduces regulatory uncertainty, enhances cross-border assessment consistency, and enables coordinated governance among policymakers, auditors, and developers. (149 words)

This study addresses the challenges posed by the proliferation, complexity, and expanding scope of regulatory requirements in software engineering, which hinder their systematic integration into development processes. To tackle this issue, the paper proposes a viewpoint-centered, artifact-based approach to regulatory requirements engineering. The approach innovatively integrates viewpoint analysis with artifact modeling to develop the AM4RRE (Artifact Modeling for Regulatory Requirements Engineering) framework, which facilitates cross-functional collaboration and ensures consistency in compliance-driven design. Preliminary validation demonstrates that AM4RRE effectively bridges the gap between organizational regulatory processes and software development practices, enabling a shift from ad hoc compliance responses toward systematic integration. This foundational work paves the way for further empirical investigation into scalable and sustainable regulatory compliance in software engineering.

This work addresses the error-prone and labor-intensive process of manually translating regulatory texts such as the GDPR and the EU AI Act into actionable software requirements. The authors propose Reg2Req, the first end-to-end automated pipeline that leverages natural language processing to identify regulatory provisions, generate system-agnostic software requirements accompanied by plain-language explanations, and establish traceability links. The approach supports requirement classification, use case seed generation, and cross-reference analysis, achieving macro-averaged F1 scores of 0.82 on the GDPR and 0.78 on the EU AI Act. A user study demonstrates that the generated plain-language explanations significantly enhance users’ comprehension and confidence in taking compliance actions (p < 0.001), with all participants expressing willingness to adopt the output as a starting point for compliance efforts.

This work addresses the inadequacy of existing large language model (LLM) lifecycle frameworks, which predominantly emphasize operational efficiency while lacking explicit support for security-critical activities—such as data provenance, component signing, and access control—and failing to align governance requirements with specific lifecycle phases. The paper proposes the first security-oriented LLM system lifecycle model, structured not by workflow but by security boundaries, organizing 32 phases into four layered pipelines: data, model, distribution, and application, while integrating LLMOps and governance pillars. It uniquely identifies 13 distinct security-critical phases and exposes a structural imbalance wherein regulatory evidence is concentrated at deployment despite pivotal decisions occurring during development. By mapping key standards—including NIST AI RMF, the EU AI Act, and ISO/IEC 42001—the study establishes a phase-to-governance correspondence mechanism, yielding a comprehensive, lifecycle-spanning security analysis framework that offers structured guidance for compliance and secure design.

This study addresses the persistent challenge of operationalizing AI governance requirements within software development practice, particularly at the team level. Through an embedded action research approach in an AI startup, the authors construct a translational pipeline that bridges regulatory texts and concrete engineering actions. They propose a governance implementation framework grounded in practitioners’ cognitive orientations—convergence, alignment with existing practices, and disengagement—to shift governance responsibility from externally imposed mandates toward collective team accountability. By integrating legal text analysis, cross-functional collaboration, and collective assessment, the project surfaces developers’ authentic attitudes toward regulation, identifies compliance priorities anchored in user and developer needs, and renders implicit governance work explicit and institutionalized.

This study addresses the high complexity and labor-intensive challenges of accurately translating privacy regulations such as Brazil’s General Data Protection Law (LGPD) into actionable software requirements. It presents the first systematic exploration of leveraging large language models (LLMs) for generating LGPD-compliant requirements, proposing an automated approach that integrates legal text analysis with requirements engineering to directly map statutory provisions into user stories and acceptance test scenarios. Experimental results demonstrate that the method efficiently produces high-quality, executable compliance requirements, significantly supporting regulatory adherence during early-stage software development. This work thus offers an innovative and practical technical pathway for privacy regulation–driven requirements engineering.

This study addresses the empirical gap in evaluating whether AI systems fulfill post-deployment regulatory obligations concerning monitoring, reporting, and impact assessment. Drawing on an AI incident database spanning 2020–2026, it presents the first systematic quantification of compliance gaps across nine post-deployment provisions of the EU AI Act, the NIST AI Risk Management Framework, and the GDPR. Employing a multi-regulatory coding scheme and statistical modeling of compliance, the analysis reveals that 77.1% of incidents lack evidence of post-market monitoring and 99.6% show no data protection impact assessments. Internal monitoring is found to significantly improve compliance rates. Building on these findings, the study proposes a four-stage Proactive AI Governance Compliance Framework (PAGCF), emphasizing continuous monitoring and cross-framework validation to establish an evidence-based foundation for post-deployment accountability and governance.