Sleimi, Amin[University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT)]
Briand, Lionel[University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > SVV >]
2022
In Proceedings of the 30th IEEE International Requirements Engineering Conference (RE'22), Melbourne, Australia 15-19 August 2022
39-50
Yes
30th IEEE International Requirements Engineering Conference
from 15-0802022 to 19-08-2022
[en] Requirements Engineering ; Regulatory Compliance ; Natural Language Processing (NLP) ; Question Answering ; Language Models (LMs) ; BERT
[en] Software systems are increasingly subject to regulatory compliance. Extracting compliance requirements from regulations is challenging. Ideally, locating compliance-related information in a regulation requires a joint effort from requirements engineers and legal experts, whose availability is limited. However, regulations are typically long documents spanning hundreds of pages, containing legal jargon, applying complicated natural language structures, and including cross-references,
thus making their analysis effort-intensive. In this paper, we propose an automated question-answering (QA) approach that assists requirements engineers in finding the legal text passages relevant to compliance requirements. Our approach utilizes large-scale language models fine-tuned for QA, including BERT and three variants. We evaluate our approach on 107 question-answer pairs, manually curated by subject-matter experts, for four different European regulatory documents. Among these documents is the general data protection regulation (GDPR) – a major source for privacy-related requirements. Our empirical results show that, in ~94% of the cases, our approach finds the text passage containing the answer to a given question among the top five passages that our approach marks as most relevant. Further, our approach successfully demarcates, in the selected passage, the right answer with an average accuracy of ~ 91%.
[University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > SVV >]
