自动将法规条款转化为可执行的软件需求，附带易懂解释，提升合规效率。
From Regulation to Requirements: An Automated Requirement Derivation and Explanation Pipeline
- 通过分析法规文本识别含要求的条款，自动生成系统无关的需求与解释。
- 在GDPR和欧盟人工智能法案上分别达到0.82和0.78的F1分数，人类评估得分超4.4。
- 适合需要快速生成合规需求的开发者、法务或项目负责人使用。
确保软件符合通用数据保护条例（GDPR）和欧盟人工智能法案（EU AI Act）等法规，对需求工程师而言是一项重大挑战，因需将复杂的法律条文转化为可操作的软件需求——这一过程在实践中仍主要依赖人工，容易出错。本文提出一个自动化法规到需求的转化流程，能识别法规文档中承载需求的条款，并生成与系统无关的软件需求，同时附带可追溯至法律来源的通俗解释。我们在GDPR（398个条款）和欧盟人工智能法案（574个条款）上评估该方法，要求条款识别的宏平均F1分数分别为0.82和0.78，优于基于SetFit的基线模型。人工评估显示，生成需求的完整性和正确性评分分别为4.60和4.45，以及3.74和3.54；解释清晰度评分接近满分（4.92和4.94，满分为5）。我们实现该方法为名为Reg2Req的开源工具，支持需求分类、用例预设、交叉引用分析、定义索引及可追溯矩阵，助力实际合规落地。25名从业者参与的用户研究显示，通俗解释显著提升对需求的理解程度与执行信心（p < 0.001），所有参与者均表示会以Reg2Req作为制定软件需求的起点。
原文摘要 · Abstract (English)
Ensuring software compliance with regulations such as the General Data Protection Regulation (GDPR) and the Artificial Intelligence Act (EU AI Act) poses a significant challenge, as requirements engineers must translate complex legal text into actionable software requirements - a process that remains largely manual and error-prone in practice. We present an automated regulation-to-requirements pipeline that identifies requirement-bearing clauses in regulatory documents and derives system-agnostic software requirements, accompanied by plain-language explanations, traceable to their legal sources. We evaluate the pipeline on the full clause sets of the GDPR (398 clauses) and the EU AI Act (574 clauses). For requirement-bearing clause identification, the approach achieves macro-averaged F1 scores of 0.82 and 0.78, respectively, outperforming a SetFit-based baseline. Human evaluation shows high completeness (4.60 and 4.45) and correctness (3.74 and 3.54) of derived requirements, while explanation clarity scores are near-ceiling (4.92 and 4.94) on a 1-5 scale. We implement the approach in Reg2Req, a publicly released tool that further supports requirement classification, use case seeding, cross-reference analysis, definition indexing, and a traceability matrix to operationalize regulatory compliance in practice. A user study with 25 practitioners shows that the plain-language explanations significantly improve comprehension of derived requirements and confidence in acting on them (p < 0.001), and that all participants would use Reg2Req as a starting point for deriving software requirements from a regulation.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。