regulatory compliance

Current AI systems rely heavily on manual auditing and documentation, which hinders scalable governance for automated services. This work proposes Ontological Knowledge Blocks (OKBs), a novel framework that formalizes regulatory obligations as quintuples comprising ontologies, SHACL rules, evidence requirements, and provenance links. By leveraging RDF/OWL modeling, PROV-O for provenance tracking, and an intermediate representation–driven deterministic compiler, the approach enables dynamic switching of governance configurations without modifying service code. Evaluation in an AI-assisted HPC scheduling scenario demonstrates that compliance checks are configuration-sensitive, violations accumulate strictly additively, SHACL validation incurs only 12.6–100.3 milliseconds of latency, and the Combined configuration provides the most comprehensive coverage.

Ensuring compliance of AI systems in the legal domain with the EU’s Artificial Intelligence Act (AI Act) poses significant verification challenges due to the gap between legal requirements and technical implementation. Method: This paper proposes the first verifiable governance framework integrating legal norms and technical controls. It introduces a regulation–technical-control mapping model, designs a forensically aware logging architecture and observability mechanism tailored for RAG/LLM systems, and establishes a multidimensional evaluation metric system weighted by legal risk. We publicly release the open-source auditing tool *rag-forense* and a standardized experimental protocol. Contribution/Results: The framework enables end-to-end compliance audit trails, automated verification, and evidence generation. Empirical evaluation demonstrates its effectiveness in identifying high-risk non-compliance scenarios and producing auditable, traceable compliance proofs—advancing RegTech for legal AI through a reusable methodology and engineering infrastructure.

Legal compliance of machine learning models cannot be directly encoded; instead, abstract legal obligations must be “indirectly operationalized” into verifiable model design choices. Existing approaches either focus narrowly on software-level compliance or overlook legal complexity, failing to address two core challenges: the multiplicity of legal interpretations and the unpredictability of performance–compliance trade-offs. Method: We propose a five-stage interdisciplinary framework introducing the first legal–ML co-modeling paradigm, embedding legal reasoning throughout the ML development lifecycle. It features a legally adaptable operationalization mechanism and a multi-objective trade-off evaluation system. Contribution/Results: Evaluated in an anti-money laundering use case, the framework identifies an optimal configuration achieving both high detection accuracy (12% F1-score improvement) and legal defensibility, demonstrating its systematic capacity to jointly optimize predictive performance and legal legitimacy.

The EU AI Act faces challenges including the absence of systematic methodologies for legal compliance verification, heterogeneous national preparedness, and ambiguous regulatory interpretations. To address these, this study proposes the first comprehensive compliance verification framework tailored to high-risk AI systems. Structured along two dimensions—“method type” (governance vs. testing) and “assessment object” (data, model, process, product)—the framework establishes a multi-layered, lifecycle-spanning verification paradigm. It introduces a novel mapping mechanism that systematically translates legal provisions into executable verification activities, integrating compliance engineering, law-technology alignment modeling, standards-mapping matrices, and risk-informed pathway design. The framework significantly reduces regulatory uncertainty, enhances cross-border assessment consistency, and enables coordinated governance among policymakers, auditors, and developers. (149 words)

This study addresses the challenges posed by the proliferation, complexity, and expanding scope of regulatory requirements in software engineering, which hinder their systematic integration into development processes. To tackle this issue, the paper proposes a viewpoint-centered, artifact-based approach to regulatory requirements engineering. The approach innovatively integrates viewpoint analysis with artifact modeling to develop the AM4RRE (Artifact Modeling for Regulatory Requirements Engineering) framework, which facilitates cross-functional collaboration and ensures consistency in compliance-driven design. Preliminary validation demonstrates that AM4RRE effectively bridges the gap between organizational regulatory processes and software development practices, enabling a shift from ad hoc compliance responses toward systematic integration. This foundational work paves the way for further empirical investigation into scalable and sustainable regulatory compliance in software engineering.

This work addresses the error-prone and labor-intensive process of manually translating regulatory texts such as the GDPR and the EU AI Act into actionable software requirements. The authors propose Reg2Req, the first end-to-end automated pipeline that leverages natural language processing to identify regulatory provisions, generate system-agnostic software requirements accompanied by plain-language explanations, and establish traceability links. The approach supports requirement classification, use case seed generation, and cross-reference analysis, achieving macro-averaged F1 scores of 0.82 on the GDPR and 0.78 on the EU AI Act. A user study demonstrates that the generated plain-language explanations significantly enhance users’ comprehension and confidence in taking compliance actions (p < 0.001), with all participants expressing willingness to adopt the output as a starting point for compliance efforts.

This study addresses the persistent challenge of operationalizing AI governance requirements within software development practice, particularly at the team level. Through an embedded action research approach in an AI startup, the authors construct a translational pipeline that bridges regulatory texts and concrete engineering actions. They propose a governance implementation framework grounded in practitioners’ cognitive orientations—convergence, alignment with existing practices, and disengagement—to shift governance responsibility from externally imposed mandates toward collective team accountability. By integrating legal text analysis, cross-functional collaboration, and collective assessment, the project surfaces developers’ authentic attitudes toward regulation, identifies compliance priorities anchored in user and developer needs, and renders implicit governance work explicit and institutionalized.

This study addresses the empirical gap in evaluating whether AI systems fulfill post-deployment regulatory obligations concerning monitoring, reporting, and impact assessment. Drawing on an AI incident database spanning 2020–2026, it presents the first systematic quantification of compliance gaps across nine post-deployment provisions of the EU AI Act, the NIST AI Risk Management Framework, and the GDPR. Employing a multi-regulatory coding scheme and statistical modeling of compliance, the analysis reveals that 77.1% of incidents lack evidence of post-market monitoring and 99.6% show no data protection impact assessments. Internal monitoring is found to significantly improve compliance rates. Building on these findings, the study proposes a four-stage Proactive AI Governance Compliance Framework (PAGCF), emphasizing continuous monitoring and cross-framework validation to establish an evidence-based foundation for post-deployment accountability and governance.

This work addresses the lack of traceable and tamper-resistant transparency mechanisms in large language models (LLMs) deployed in high-stakes decision-making contexts, which undermines accountability. To bridge this gap, the paper introduces the first LLM lifecycle auditing framework that integrates technical provenance with governance records. It proposes a reference architecture enabling cross-organizational traceability and implements a lightweight, open-source Python-based auditing layer. By leveraging append-only logs, event emitters, structured metadata, and an auditor interface, the system seamlessly integrates into existing LLM workflows with minimal intrusiveness. This design ensures complete, tamper-evident traceability across critical stages—including training, deployment, and monitoring—thereby facilitating robust accountability and responsibility attribution throughout the model’s lifecycle.

This work addresses the lack of unified governance in existing large language model (LLM) agents concerning digital sovereignty, environmental sustainability, compliance, and ethics, which hinders their ability to jointly optimize these multidimensional value objectives. We propose the first multi-agent framework that integrates all four dimensions into a unified, interpretable architecture, comprising a central coordinator and four specialized sub-agents—each dedicated to sovereignty, carbon-aware computation, compliance, and ethics, respectively. By incorporating retrieval-augmented generation (RAG) and an LLM-as-a-judge mechanism, the framework enables real-time arbitration of conflicting objectives and supports modular extensibility. Experimental results demonstrate that our approach significantly enhances semantic consistency, reduces hallucination risks, and achieves strong cross-domain integrability, decision interpretability, and traceability.