legal-technical translation

This work addresses the error-prone and labor-intensive process of manually translating regulatory texts such as the GDPR and the EU AI Act into actionable software requirements. The authors propose Reg2Req, the first end-to-end automated pipeline that leverages natural language processing to identify regulatory provisions, generate system-agnostic software requirements accompanied by plain-language explanations, and establish traceability links. The approach supports requirement classification, use case seed generation, and cross-reference analysis, achieving macro-averaged F1 scores of 0.82 on the GDPR and 0.78 on the EU AI Act. A user study demonstrates that the generated plain-language explanations significantly enhance users’ comprehension and confidence in taking compliance actions (p < 0.001), with all participants expressing willingness to adopt the output as a starting point for compliance efforts.

Ensuring compliance of AI systems in the legal domain with the EU’s Artificial Intelligence Act (AI Act) poses significant verification challenges due to the gap between legal requirements and technical implementation. Method: This paper proposes the first verifiable governance framework integrating legal norms and technical controls. It introduces a regulation–technical-control mapping model, designs a forensically aware logging architecture and observability mechanism tailored for RAG/LLM systems, and establishes a multidimensional evaluation metric system weighted by legal risk. We publicly release the open-source auditing tool *rag-forense* and a standardized experimental protocol. Contribution/Results: The framework enables end-to-end compliance audit trails, automated verification, and evidence generation. Empirical evaluation demonstrates its effectiveness in identifying high-risk non-compliance scenarios and producing auditable, traceable compliance proofs—advancing RegTech for legal AI through a reusable methodology and engineering infrastructure.

To address challenges in legal compliance checking—including high subjectivity in regulatory interpretation, dynamic evolution of legislation, and difficulties in cross-disciplinary collaboration—this paper introduces eFLINT, a domain-specific language for computable modeling and automated verification of legal rules, regulatory requirements, and contractual clauses. eFLINT integrates declarative and procedural paradigms, explicitly linking legal concepts to executable computational logic. It combines formal specification, context-aware reasoning, and scenario-based modeling to enable dynamic, end-to-end compliance verification across system design, runtime, and post-execution phases. Designed to balance expressiveness and executability, eFLINT reconciles conflicting requirements through principled language design. Drawing on multi-scenario industrial deployments, the paper distills actionable design principles and a methodology for automation-oriented compliance languages. It contributes both a reusable technical framework and theoretical foundations for computable regulation research in legal technology.

Legal compliance of machine learning models cannot be directly encoded; instead, abstract legal obligations must be “indirectly operationalized” into verifiable model design choices. Existing approaches either focus narrowly on software-level compliance or overlook legal complexity, failing to address two core challenges: the multiplicity of legal interpretations and the unpredictability of performance–compliance trade-offs. Method: We propose a five-stage interdisciplinary framework introducing the first legal–ML co-modeling paradigm, embedding legal reasoning throughout the ML development lifecycle. It features a legally adaptable operationalization mechanism and a multi-objective trade-off evaluation system. Contribution/Results: Evaluated in an anti-money laundering use case, the framework identifies an optimal configuration achieving both high detection accuracy (12% F1-score improvement) and legal defensibility, demonstrating its systematic capacity to jointly optimize predictive performance and legal legitimacy.

This study addresses the compliance challenges faced by data practitioners in machine learning systems under regulations such as the GDPR and the AI Act, particularly concerning data quality. Through semi-structured interviews with practitioners in the European Union, combined with thematic analysis of regulatory texts and engineering workflows, the research systematically uncovers a structural disconnect between regulation-driven data quality requirements and ML engineering practices. It identifies five core challenges: misalignment between legal principles and engineering implementation, fragmented data pipelines, lack of purpose-built compliance tools, ambiguous accountability, and reactive responses to audits. Building on these findings, the work proposes directions for designing compliance-oriented tooling, establishing effective governance mechanisms, and fostering cultural transformation to bridge the gap between regulatory mandates and practical ML development.

This study addresses the persistent challenge of operationalizing AI governance requirements within software development practice, particularly at the team level. Through an embedded action research approach in an AI startup, the authors construct a translational pipeline that bridges regulatory texts and concrete engineering actions. They propose a governance implementation framework grounded in practitioners’ cognitive orientations—convergence, alignment with existing practices, and disengagement—to shift governance responsibility from externally imposed mandates toward collective team accountability. By integrating legal text analysis, cross-functional collaboration, and collective assessment, the project surfaces developers’ authentic attitudes toward regulation, identifies compliance priorities anchored in user and developer needs, and renders implicit governance work explicit and institutionalized.

This study addresses the accelerating fragmentation of global AI governance, which exacerbates the divergence between technological development and regulatory frameworks, thereby impeding systemic interoperability and cross-jurisdictional compliance. To tackle this challenge, the work proposes a “technology–regulation dual interoperability” framework, systematically analyzing the root causes and interaction mechanisms underlying governance fragmentation through policy analysis, cross-jurisdictional comparison, and evaluation of standardization systems. The research reveals a trend of rapid yet dispersed growth in AI governance initiatives, identifies critical barriers to coordination, and offers strategic pathways and practical recommendations for fostering a compatible and coherent global AI governance ecosystem.

Current AI systems rely heavily on manual auditing and documentation, which hinders scalable governance for automated services. This work proposes Ontological Knowledge Blocks (OKBs), a novel framework that formalizes regulatory obligations as quintuples comprising ontologies, SHACL rules, evidence requirements, and provenance links. By leveraging RDF/OWL modeling, PROV-O for provenance tracking, and an intermediate representation–driven deterministic compiler, the approach enables dynamic switching of governance configurations without modifying service code. Evaluation in an AI-assisted HPC scheduling scenario demonstrates that compliance checks are configuration-sensitive, violations accumulate strictly additively, SHACL validation incurs only 12.6–100.3 milliseconds of latency, and the Combined configuration provides the most comprehensive coverage.

This work addresses the inadequacy of current AI runtime logs in providing the structured evidence necessary for legal fact-finding—such as data boundary violations or human interventions. It formalizes, for the first time, the binary factual requirements of regulatory compliance into a criterion of evidentiary sufficiency for runtime records, mandating that logs explicitly encode the legal category of events and their determinative relationships (e.g., provenance, authorization, temporal validity). By integrating legal ontologies, event-type systems, provenance semantics, and temporal validity constraints—and drawing on the law of requisite variety and the Good Regulator theorem from cybernetics—the approach exposes limitations in tamper-proof logging and generic provenance mechanisms. Validation against selected obligations of the EU AI Act demonstrates that this criterion precisely delineates the boundary between traces and hyperproperties in runtime verification, thereby establishing a verifiable foundation for compliance.

针对AI模型准确性评估中的规范性选择问题，结合欧盟AI法案，从指标选取、权衡、数据代表性与阈值设定四方面提出法律-技术分析框架。