Simplifying Requirements Engineering in the Context of the LGPD: An LLM-Based Investigation

Simplifying Requirements Engineering in the Context of the LGPD: An LLM-Based Investigation Cinara Gomes de Melo Carneiro, Renato de Freitas Bulcão Neto 1

arXiv:2608.11454v1 [cs.SE] 11 Aug 2026

Instituto de Informática – Universidade Federal de Goiás (UFG) Caixa Postal 131 – 74.690-900. - Goiânia – GO – Brazil cinaragomes@discente.ufg.br, rbulcao@ufg.br

Abstract. Compliance with privacy legislation poses a complex challenge to Requirements Engineering (RE): translating legal norms into software requirements. In this context, this study investigates whether Large Language Models (LLMs) can simplify RE within the framework of the Brazilian General Data Protection Law (LGPD). The proposed approach utilizes current legislation to automatically generate User Stories and Acceptance Test Scenarios. The evaluation results demonstrated high performance, confirming the potential of LLMs to ensure regulatory compliance from the software’s inception.

1. Introduction Compliance with data protection regulations, such as the General Data Protection Law (LGPD), has become a critical vector in software quality. In this context, Requirements Engineering (RE) assumes a central role in operationalizing Privacy by Design (PbD) [Cavoukian et al. 2009], a principle that requires the incorporation of privacy measures from system conception through to its implementation. Neglecting this initial stage can result in systems that violate fundamental rights, leading to severe legal sanctions and reputational damage [Brasil 2018]. However, translating abstract legal norms into software requirements imposes significant challenges. Legal text is characterized by ambiguities, whereas software requires determinism. Exacerbating this scenario, software development professionals often lack the necessary legal knowledge to correctly interpret privacy laws, which hinders the proper implementation of protection mechanisms [Canedo et al. 2022][Alves and Neves 2021]. Although there are approaches based on Large Language Models (LLMs) for legal compliance in RE, a literature review reveals a significant gap in the Brazilian context. Almost all identified works focus exclusively on the European General Data Protection Regulation (GDPR). Furthermore, these solutions operate predominantly in a reactive manner, focusing on the a posteriori verification of already consolidated artifacts, such as auditing privacy policies or analyzing source code [Hassani et al. 2024][Garza et al. 2024][Alecci et al. 2025][Kunz et al. 2025], rather than assisting in their construction. Moreover, although the LGPD was inspired by European regulation, the direct importation of these approaches fails to capture local nuances and specific interpretations brought by the National Data Protection Authority (ANPD) in Brazil. Given this scenario, this article presents an investigation into the potential of state-of-the-art LLMs to simplify RE in the privacy domain. Adopting an approach based on Design Science Research [Hevner et al. 2004][Peffers et al. 2007], a RetrievalAugmented Generation (RAG) based artifact was developed and evaluated. The system

uses the text of the LGPD and ANPD guidelines as context to, through Few-Shot Prompting and Chain-of-Thought (CoT) techniques, assist engineers in the requirements elicitation, specification, and validation phases. The goal is to generate User Stories and Acceptance Test Scenarios that seek to ensure compliance from the beginning of software development, following the PbD principle. This article is organized as follows: Section 2 analyzes works related to the intersection of RE, LLMs, and privacy legislation; Section 3 describes the theoretical foundation; Section 4 presents the Methodology, and Section 5 discusses the conclusion and future work.

2. Related Work Recent literature indicates that the application of LLMs in Software Engineering has optimized regulatory compliance assurance. A large part of this scenario is dominated by a posteriori verification strategies, where RAG techniques and Knowledge Graphs are employed to audit complex legal documents, such as contracts, Data Processing Agreements (DPAs), and privacy policies [Hassani et al. 2024, Hassani 2024, Garza et al. 2024, Jain et al. 2023]. In these ecosystems, approaches based on multi-agent architectures have been proposed to deal with the legal ambiguity of complex systems [Das et al. 2025]. Simultaneously, at the implementation level, approaches use LLMs to identify compliance with privacy legislation directly in technical artifacts, inspecting source code snippets according to official taxonomies [Kunz et al. 2025] or analyzing low-level bytecode (Smali) [Alecci et al. 2025], always acting as a validation layer over already developed software. However, moving beyond mere document auditing, recent research has begun to explore active support for requirements elicitation through the direct generation of technical artifacts. Specifically, the method proposed by [Pragyan et al. 2024] operates in artifact generation by translating user narratives into structured segments of the Record of Processing Activities (RoPA) required by the GDPR. In the healthcare domain, the approach by [Madine et al. 2025] also actively acts in elicitation by synthesizing a list of atomic requirements and architectural constraints from the intersection between HIPAA and GDPR. Complementarily, when modeling new European directives (such as the AI Act), [Falcarin et al. 2025] proposes generating Abstract Meaning Representations (AMR) and structured Knowledge Graphs to inform and guide the RE process. Despite these advances in artifact generation, these approaches fail to deliver operational requirements for agile development. Other methods operate under a purely extractive perspective of legal rights from predefined sources [Abualhaija et al. 2025] or are limited to evaluating ready-made user stories [Aberkane et al. 2024], not advancing to the proactive synthesis of new functional requirements from a Privacy by Design perspective. The approach proposed in this article fills these gaps, standing out due to two fundamental differences from the state of the art. First, while most current works are limited to compliance verification, this method uses the capability of LLMs to translate legal obligations and transform them into fundamental artifacts of the agile development cycle: User Stories and Gherkin-based Acceptance Test Scenarios. This anticipates regulatory compliance, actively integrating it into elicitation and delivering specifications ready for implementation. Second, while almost the entirety of the literature focused on privacy in RE and LLMs concentrates on the European GDPR, this work addresses the

Brazilian General Data Protection Law (LGPD), adapting requirements engineering to the legal and normative nuances of the Brazilian context.

3. Theoretical Foundation 3.1. Method for Legal Requirements Extraction The present work adopts the method proposed by [de Melo Carneiro et al. 2024b][de Melo Carneiro et al. 2024a], which grounds the systematic translation of the LGPD’s legal language into software requirements. The methodological core consists of the syntactic decomposition of legal provisions, building requirement sentences based on Subject + Action Verb + Object. The extraction process is segmented into the following phases: 1. Actor Identification: The initial step strictly locates the legal figures (Data Subject, Controller, Processor, and Data Protection Officer) defined in the norm. The actor appearing as the syntactic subject in the article’s clause is designated as the actor in the requirement composition, avoiding the use of generic terms like "System". 2. Action Verb Location: The verb defining the system’s operation is identified. The method prescribes a critical normalization for implicit verbs: conditions described as nouns must be converted into action verbs. Example: The expression "upon request" is converted to the verb "request", clarifying the necessary action in the system. 3. Object Definition: The term that suffers the verb’s action is determined, consolidating the sentence in the form Actor + Action + Object. 4. Requirement Classification: Items are categorized into Functional Requirements (FR), referring to behaviors and functionalities, or Non-Functional Requirements (NFR), referring to constraints and quality standards. 5. Refinement via Actor Inversion: To maximize completeness, role inversion is applied. It verifies whether the actor opposite to the one identified in Step 1 should assume a complementary obligation. Example: A right attributed to the "Data Subject" generates, through inversion, an obligation to "allow" or "process" for the "Controller". Figure 1 shows an output example generated by the method in question.

Figure 1. Method for Transforming Legal Requirements into Software Requirements

In this work, the steps of the extraction method served as the basis for the chain of thought instructed to the model. By forcing the LLM to explicitly follow this extraction script — instead of directly requesting the final requirement — the system reproduces a human expert’s analytical process, resulting in a requirement extraction that is more accurate and adherent to the legal text. 3.2. Design Science Research The present research adopts Design Science Research (DSR) as its methodological approach, fundamentally oriented towards problem-solving and the creation of innovations that alter the state of the real world, differing from traditional sciences that only seek to describe or predict phenomena [Simon 2019]. The primary objective of this approach is the production of scientific knowledge through the development and evaluation of artifacts, which, according to [Hevner et al. 2004], are not limited to software, being classified into four categories: constructs (vocabulary), models (abstractions), methods (algorithms/practices), and instantiations (implemented systems). Conducting DSR requires a rigorous balance between the Relevance cycle, which aligns the research with business environment needs, and the Rigor cycle, which grounds the artifact in the existing theoretical knowledge base [Hevner et al. 2004]. For operationalization, it follows the logical flow of the Design Science Research Methodology (DSRM) proposed by [Peffers et al. 2007], comprising the stages of problem identification and motivation, definition of objectives, design and development, demonstration, evaluation, and finally, communication of results, ensuring both the delivery of a practical solution and the formalization of academic knowledge.

4. Methodology Regarding its nature, this investigation is classified as Applied Research, since it aims to generate knowledge for practical application directed at solving specific problems [Gil 2008]. The adopted approach is DSR, focused on the construction and evaluation of artifacts. The artifact developed in this work is an instantiation of the RAG architecture specialized in LGPD compliance. The methodological process followed the steps proposed by [Peffers et al. 2007], as described below: 4.1. Problem Identification and Motivation The first stage of this research consisted of identifying the difficulty professionals face in translating the LGPD’s complex legal texts into software requirements. The gap motivating this work lies in the fact that current literature is predominantly focused on the European GDPR, with the vast majority of studies restricted to retrospective auditing, i.e., the validation of requirements in already existing systems. There is, therefore, a lack of approaches that enable the automatic generation of software requirements, ensuring legal fidelity from the software’s conception. 4.2. Definition of Solution Objectives The defined objective was to develop a system capable of receiving natural language queries and returning structured software requirements to investigate the potential of

LLMs in RE activities. It was established that the artifact should generate output in the format of User Stories and Acceptance Test Scenarios according to the Gherkin approach, ensuring coverage of the LGPD and ANPD norms. The diagram in Figure 2 illustrates a RAG architecture designed to translate the LGPD’s complexity into software requirements. The automated flow ingests raw legal documents, allows users to ask natural language questions about compliance procedures, and uses an LLM to generate software development artifacts. The final result is not just a legal answer, but User Stories and Acceptance Test Scenarios ready to be implemented by software developers so that systems are built in compliance from the start.

Figure 2. RAG Architecture in the context of the LGPD

The construction of the artifact was carried out using the Python language, with data flow orchestration managed by the LangChain library. The technical architecture was implemented in the following layers: 4.2.1. Data and Retrieval Layer The knowledge base was composed of the full text of the LGPD and ANPD guidelines in PDF format. • Ingestion: The DirectoryLoader integrated with PyPDFLoader was used for PDF extraction. • Advanced Chunking: A Parent Document Retriever architecture was applied, dividing documents into larger chunks (parents with 1,500 characters) for context retention, and smaller chunks (children with 400 characters) for vector search precision. • Embeddings and Vectorization: To convert texts into vector representations, the multilingual model intfloat/multilingual-e5-small was used.

• Storage: Vectors were indexed in Faiss, and the original documents were kept in an InMemoryStore. • Re-ranking: A refinement step was added using a Cross-Encoder (BAAI/bge-reranker-v2-m3). The retrieved documents are re-evaluated and reordered to ensure maximum relevance to the legal context. 4.2.2. Language Models The system was designed to be model-agnostic, simultaneously initializing multiple chains to allow direct comparison. For this study, the following were integrated: 1. Gemini Family (Google GenAI): Using versions 3.1 Flash Lite and 3.1 Pro Preview. 2. Llama 3 Family (Hugging Face): Using versions 3.3 70B-Instruct and 3 8BInstruct executed via endpoints on the Hugging Face infrastructure. For execution, the following hyperparameters were defined: • Temperature (0.0): Selected with a null value to eliminate hallucination and ensure determinism, precision, and consistency in the answers, which is mandatory for the legal compliance context. • Search Top-K (K = 15 → 5): Configured to initially retrieve 15 chunks, which are subsequently processed by the Re-ranker, strictly filtering the 5 most relevant documents (Final Top-K) to compose the LLM’s context window. 4.2.3. Dual-Chain Architecture and Prompt Engineering Unlike traditional single-step approaches, orchestration was structured into a sequential chain pipeline (Dual-Chain) to mitigate confusion between legal interpretation and technical formatting: 1. Legal Analysis Chain (The Lawyer): A first extraction focused on describing the rights and rules of the law in plain text, using only the context retrieved by the RAG. 2. Requirements Engineering Chain (The Engineer): Receives the chewed legal text from the first chain and applies rigid constraints to convert it into a structured JSON of software requirements. The effectiveness of this second stage relied on a System Prompt combining two fundamental techniques recognized in the literature for improving reasoning and adherence in LLMs: • Chain-of-Thought (CoT): Studies demonstrate that the CoT technique significantly increases symbolic reasoning capacity [Santos et al. 2024]. The model is instructed to report its thought process (_thought_process) validating the coverage of retrieved clauses. The prompt instructs strict semantic decomposition into the triad: Actor (Controller, Data Subject, Processor, Data Protection Officer) + Action Verb + Object [de Melo Carneiro et al. 2024b], categorically prohibiting the use of generic actors like "System".

• Few-Shot Learning: Relying on [Pragyan et al. 2024], which evidenced that providing examples is crucial for correct requirements extraction. A validated inputoutput JSON (few-shot) was incorporated into the prompt, ensuring syntactic standardization of keys, User Stories, and Scenarios in Gherkin format, further ensuring safe output parsing through the json_repair library. 4.3. Experimental Evaluation The evaluation stage imposes challenges that transcend simple textual similarity verification. As discussed by [Yu et al. 2024], RAG systems should not be treated as "black boxes", since inconsistencies in the final response can derive from failures in context retrieval, model reasoning, or the generation stage. To evaluate the generated artifacts — which encompass User Stories, Gherkin Test Scenarios, and LGPD legal references —, an approach based on the LLM-as-a-judge paradigm was chosen, ensuring scalability and consistency in the validation cycle. In this paradigm, an advanced model acts independently to evaluate outputs under the critical pillars of Retrieval and Generation, using the RAGAS (Retrieval Augmented Generation Assessment) framework [Es et al. 2024]. To act as the algorithmic judge in this evaluation, the Llama 3.3 70B model was employed. The adoption of this model is based on the recommendations of [Pradhan 2025], which indicate its effectiveness specifically for answer relevance and context relevance metrics. However, aiming to simplify and standardize the evaluation pipeline, Llama 3.3 70B was expanded and used to calculate all metrics in this study. Furthermore, to ensure the accuracy and reliability of the mathematical measurement, the ground truth used as a reference by the judge LLM was prepared and rigorously validated by two LGPD specialists.

4.3.1. Test Cases The system was subjected to a comparative evaluation using five reference queries based on questions of high relevance for LGPD compliance, aiming at the extraction of functional and non-functional requirements: 1. Q1: “What are the technical security measures for access control?” 2. Q2: “For what purposes is the retention of personal data authorized?” 3. Q3: “In which hypotheses will the termination of personal data processing occur?” 4. Q4: “In which hypotheses may the processing of sensitive data occur?” 5. Q5: “List all data subject rights described in Art. 18 of the LGPD.” Each query resulted in the generation of multiple software requirements, varying in quantity according to the tested model. The repository with the generated outputs is available at https://huggingface.co/datasets/CinaraMelo/ resultado_avaliacao_ragas/blob/main/respostas_modelos.md

4.3.2. Protocol and Metrics Definition Based on the taxonomy presented by [Es et al. 2024], metrics were automated to independently quantify the performance of RAG systems. The judge LLM receives the RAG answers and the retrieved contexts, applying the following fundamental criteria: Generation Metrics These metrics evaluate the generation module’s ability to process the provided context and structure a high-quality response [Es et al. 2024]. • Faithfulness: Evaluates whether the generated requirement is factually grounded in the context retrieved from the LGPD, ensuring the absence of hallucinations. The score F is computed as [Es et al. 2024]: F =

|V | |S|

(1)

Where |S| is the total number of statements extracted from the answer and |V | is the number of statements confirmed by the LLM as supported by the context. • Answer Relevance: Assesses whether the produced technical requirement directly addresses the formulated question, penalizing redundant or incomplete outputs [Es et al. 2024]. The AR metric is defined as: n

AR =

1X sim(q, qi ) n i=1

(2)

Where sim(q, qi ) represents the cosine similarity between the embeddings of the original question q and the n hypothetical questions qi generated from the answer. Retrieval Metrics These metrics evaluate the system’s effectiveness in identifying and ordering pertinent context passages in the vector base. • Context Precision: Evaluates the quality of the retrieval results’ ordering, verifying whether the relevant elements (ground truth) are ranked in the top positions. It is calculated as: Pn (Precision@k × vk ) Context Precision = k=1 Pn (3) k=1 vk Where k represents the position in the list, n the total number of retrieved items, vk is a relevance indicator (1 if the item at position k is relevant, 0 otherwise), and Precision@k is the precision up to position k. • Context Recall: Verifies whether the system retrieved all the essential chunks to compose a normatively complete answer, comparing the retrieved context with the Ground Truth of each question [Es et al. 2024]. Table 1 details the performance of the Gemini 3.1 Flash Lite, Gemini 3.1 Pro, Llama 3.1 8B, and Llama 3.3 70B models regarding the aforementioned metrics for each query. Additionally, graph 3 illustrates the overall average performance among the compared models.

Table 1. Detailed results of each question by model.

Model

Question

Faithfulness

Relevance

Recall

Precision

Gemini 3.1 Flash Lite

Q1 Q2 Q3 Q4 Q5

0.8000 1.0000 0.8750 0.9474 0.7222

0.9260 0.8968 0.9669 0.9389 0.9330

0.6667 1.0000 0.8000 0.8889 1.0000

0.8056 1.0000 1.0000 0.9500 0.9167

Gemini 3.1 pro

Q1 Q2 Q3 Q4 Q5

1.0000 0.9565 1.0000 1.0000 0.9524

0.9534 0.9316 0.9192 0.9435 0.9018

0.6667 0.8000 1.0000 0.9000 1.0000

1.0000 1.0000 1.0000 0.9500 1.0000

Llama 3 8B

Q1 Q2 Q3 Q4 Q5

0.8333 1.0000 0.9375 1.0000 1.0000

0.9417 0.9485 0.9774 0.9513 0.9177

0.6667 0.8000 1.0000 1.0000 1.0000

1.0000 1.0000 1.0000 0.9500 1.0000

Llama 3.3 70B

Q1 Q2 Q3 Q4 Q5

0.7037 1.0000 0.9524 0.9286 0.2727

1.0000 0.9526 0.9380 0.9648 0.9133

0.6667 0.8000 1.0000 0.9000 1.0000

1.0000 1.0000 1.0000 0.9500 0.9167

Overall RAGAS Averages Comparison

Score

0.8

Relevance

0.93 0.99 0.99 0.97

Faithfulness

0.87 0.87 0.89 0.87

0.93 0.93 0.95 0.95

1

0.87 0.98 0.95 0.77

1.2

0.6 0.4 0.2 0

Gemini 3.1 Flash Lite

Gemini 3.1 pro

Recall Llama 3 8B

Precision Llama 3.3 70B

Figure 3. Comparison of overall averages obtained for each RAGAS metric.

5. Conclusion The analysis validates the integration of LLMs with the RAG architecture as an effective tool for Requirements Engineering, presenting robust retrieval and generation metrics that preserved content accuracy and the legal validity of information. Although the four evaluated models reduced cognitive load, Gemini 3.1 Pro and Llama 3 8B stood out by ensuring the highest Precision and Faithfulness to the context. It should be noted that, in cases where responses showed a lower score in the faithfulness metric, it was observed that the LLM generated a volume of information superior to that contained in the reference ground truth. This level of detail led the evaluator judge to interpret the excess content as hallucination. However, an analysis revealed that much of this additional information was, in fact, correct and pertinent, being strictly penalized for extrapolating the restricted scope of the ground truth. It is also concluded that the performance of proprietary models was statistically similar to that of open-source alternatives. This demonstrates that it is possible to achieve generation and context retrieval quality using open-source models, which represents a significant advantage in terms of technical feasibility, cost reduction, and data privacy. This study investigated the potential of LLMs in simplifying the extraction and adaptation of privacy requirements, aiming to support RE. The comparative tests conducted between open-source and proprietary models indicated that adopting the RAG architecture constitutes a promising approach for this purpose. Generally, it was verified that the performance of the evaluated models showed similarity, reinforcing the technical feasibility of using open solutions in real scenarios. Corroborating the findings of [Das et al. 2025], it was observed that applying a reranking mechanism was a determining factor in maintaining high levels of relevance and faithfulness in the retrieved context, although its use imposes a high computational cost on the process. It must be noted, however, that the stochastic nature of language generation by these models implies an inherent randomness, which can cause slight fluctuations, up or down, in evaluation metrics during different executions. Moreover, experimentation evidenced that the quality of prompt engineering directly and significantly interferes with the accuracy of the obtained responses. Despite the promising performance, it was noted as a limitation that the LLMs presented difficulties and made errors when describing and correctly referencing citations from legal texts. Finally, as a direction for future work, we intend to expand the scope of this research to evaluate the intersection of requirements between the LGPD and the Statute of the Child and Adolescent in the digital environment (ECA Digital). To mitigate the instructional limitations found, we also plan to improve prompt engineering through the adoption of optimization frameworks, such as DSPy, aiming to evaluate whether this approach provides a measurable improvement in response quality and citation accuracy. Furthermore, following the methodological guidelines proposed by Pradhan et al. [Pradhan 2025], we plan to adopt multiple LLMs acting as judges (LLM-as-a-Judge), aiming to increase the robustness of quantitative validation. In addition to this automated validation, qualitative evaluations with human domain experts — covering both Requirements Engineering and data protection professionals — are planned to attest to the practical applicability, completeness, and strict compliance of the generated artifacts.

References Aberkane, A.-J., vanden Broucke, S., Poels, G., and Georgiadis, G. (2024). Leveraging chatgpt for gdpr compliance in requirements engineering: A pilot study. In 2024 IEEE International Conference on Security, Privacy, Anonymity in Computation and Communication and Storage (SpaCCS), pages 34–41. IEEE. Abualhaija, S., Ceci, M., Sannier, N., Bianculli, D., Lannier, S., Siclari, M., Voordeckers, O., and Tosza, S. (2025). Llm-assisted extraction of regulatory requirements: A case study on the gdpr. In 2025 IEEE 33rd International Requirements Engineering Conference (RE), pages 142–154. IEEE. Alecci, M., Sannier, N., Ceci, M., Abualhaija, S., Samhi, J., Bianculli, D., Bissyandé, T., and Klein, J. (2025). Toward llm-driven gdpr compliance checking for android apps. In Proceedings of the 33rd ACM International Conference on the Foundations of Software Engineering, pages 606–610. Alves, C. and Neves, M. (2021). Especificação de requisitos de privacidade em conformidade com a LGPD: Resultados de um estudo de caso. In WER. Brasil (2018). Lei geral de proteção de dados pessoais. https://www.planalto. gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm. Acesso em: 25 de outubro de 2025. Canedo, E. D., Bandeira, I. N., Calazans, A. T. S., Costa, P. H. T., Cançado, E. C. R., and Bonifácio, R. (2022). Privacy requirements elicitation: a systematic literature review and perception analysis of it practitioners. Requirements Engineering, pages 1–18. Cavoukian, A. et al. (2009). Privacy by design: The 7 foundational principles. Information and privacy commissioner of Ontario, Canada, 5:12. Das, S., Deb, N., Chaki, N., and Cortesi, A. (2025). A multi-agent rag framework for regulatory compliance checking of software requirements. ACM Transactions on Software Engineering and Methodology. de Melo Carneiro, C. G., Kudo, T. N., and Bulcão-Neto, R. F. (2024a). Evaluating privacy requirement patterns based on the brazilian general personal data protection law. In Proceedings of the XXIII Brazilian Symposium on Software Quality, pages 114–124. de Melo Carneiro, C. G., Kudo, T. N., and Neto, R. F. B. (2024b). Um método para transformação de requisitos legais em padrões de requisitos de software: Um estudo com a lgpd. In Congresso Ibero-Americano em Engenharia de Software (CIbSE), pages 348–355. SBC. Es, S., James, J., Anke, L. E., and Schockaert, S. (2024). Ragas: Automated evaluation of retrieval augmented generation. In Proceedings of the 18th Conference of the European Chapter of the Association for Computational Linguistics: System Demonstrations, pages 150–158. Falcarin, P., Chowdhury, P., Carbone, E., Scantamburlo, T., Tripodi, R., and Vascon, S. (2025). Legal requirements compliance using nlp and knowledge graphs. In 2025 IEEE 33rd International Requirements Engineering Conference Workshops (REW), pages 412–418. IEEE.

Garza, L., Elluri, L., Piplai, A., Kotal, A., Gupta, D., and Joshi, A. (2024). Privcomp-kg: Leveraging kg and llm for compliance verification. In 2024 IEEE 6th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA), pages 97–106. IEEE. Gil, A. C. (2008). Métodos e técnicas de pesquisa social. 6. ed. Ediitora Atlas SA. Hassani, S. (2024). Enhancing legal compliance and regulation analysis with large language models. In 2024 IEEE 32nd International Requirements Engineering Conference (RE), pages 507–511. IEEE. Hassani, S., Sabetzadeh, M., Amyot, D., and Liao, J. (2024). Rethinking legal compliance automation: Opportunities with large language models. In 2024 IEEE 32nd International Requirements Engineering Conference (RE), pages 432–440. IEEE. Hevner, A. R., March, S. T., Park, J., and Ram, S. (2004). Design science in information systems research. MIS quarterly, pages 75–105. Jain, C., Anish, P. R., and Ghaisas, S. (2023). Automated identification of security and privacy requirements from software engineering contracts. In 2023 IEEE 31st International Requirements Engineering Conference Workshops (REW), pages 234–238. IEEE. Kunz, I., Kao, C.-Y., Kowatsch, D., Hiller, J., Schütte, J., Prokhorenkov, D., and Bettinger, K. (2025). Using llms to identify personal data processing in source code. In 2025 IEEE Security and Privacy Workshops (SPW), pages 137–144. IEEE. Madine, M., Musamih, A., Salah, K., Zemerly, M., Ellahham, S., and Jayaraman, R. (2025). Leveraging llms for rapid development of regulatory-compliant software in healthcare. In 2025 IEEE Technology and Engineering Management Society Conference-Global (TEMSCON Global), pages 1–6. IEEE. Peffers, K., Tuunanen, T., Rothenberger, M. A., and Chatterjee, S. (2007). A design science research methodology for information systems research. Journal of management information systems, 24(3):45–77. Pradhan, R. (2025). Ragevalx: An extended framework for measuring core accuracy, context integrity, robustness, and practical statistics in rag pipelines. International Journal of Computer Technology and Electronics Communication, 8(5):11305–11311. Pragyan, K., Ghandiparsi, R., Slavin, R., Ghanavati, S., Breaux, T., and Hosseini, M. B. (2024). Toward regulatory compliance: A few-shot learning approach to extract processing activities. In 2024 IEEE 32nd International Requirements Engineering Conference Workshops (REW), pages 241–250. IEEE. Santos, S., Breaux, T., Norton, T., Haghighi, S., and Ghanavati, S. (2024). Requirements satisfiability with in-context learning. In 2024 IEEE 32nd International Requirements Engineering Conference (RE), pages 168–179. IEEE. Simon, H. A. (2019). The Sciences of the Artificial, reissue of the third edition with a new introduction by John Laird. MIT press. Yu, H., Gan, A., Zhang, K., Tong, S., Liu, Q., and Liu, Z. (2024). Evaluation of retrievalaugmented generation: A survey. In CCF Conference on Big Data, pages 102–120. Springer.

Related documents

• Two Truths and A Lie? Benchmarking Off-the-Shelf LLMs for Requirements Quality Assessment: Performance, False Alarms, and Misses#925587
• Towards an Agentic LLM-based Approach to Requirement Formalization from Unstructured Specifications#120577
• Bridging Stakeholder and Product Requirements: An Empirical Study of Requirement Engineering in the Automotive Industry#346595
• LLMs as Research Instruments for Problems in Engineering Management: A Context Modeling Framework#383731
• EXPLORING HUMAN FACTORS IN LARGE LANGUAGE MODEL-ASSISTED SOFTWARE REQUIREMENTS SPECIFICATION#191278