Simplifying software compliance

Sovrano, Francesco; Hine, Emmie; Anzolut, Stefano; Bacchelli, Alberto

doi:10.1007/s10664-025-10645-x

Back

Sovrano_2025_Springer_s10664-025-10645-x

Journal article

Simplifying software compliance : AI technologies in drafting technical documentation for the AI Act

Sovrano, Francesco ORCID Istituto di sistemi informatici (SYS), Facoltà di scienze informatiche, Università della Svizzera italiana, Svizzera - ETH Zurich, Collegium Helveticum, Zurich, Switzerland - University of Zurich, Switzerland
Hine, Emmie Yale Digital Ethics Center, New Haven, USA - University of Bologna, Italy - KU Leuven, Belgium
Anzolut, Stefano University of Zurich, Switzerland
Bacchelli, Alberto University of Zurich, Switzerland

2025

Published in:

Empirical software engineering. - 2025, vol. 30, p. 91

English The European AI Act has introduced specific technical documentation requirements for AI systems. Compliance with them is challenging due to the need for advanced knowledge of both legal and technical aspects, which is rare among software developers and legal professionals. Consequently, small and medium-sized enterprises may face high costs in meeting these requirements. In this study, we explore how contemporary AI technologies, including ChatGPT and an existing compliance tool (DoXpert), can aid software developers in creating technical documentation that complies with the AI Act. We specifically demonstrate how these AI tools can identify gaps in existing documentation according to the provisions of the AI Act. Using open-source high-risk AI systems as case studies, we collaborated with legal experts to evaluate how closely tool-generated assessments align with expert opinions. Findings show partial alignment, important issues with ChatGPT (3.5 and 4), and a moderate (and statistically significant) correlation between DoXpert and expert judgments, according to the Rank Biserial Correlation analysis. Nonetheless, these findings underscore the potential of AI to combine with human analysis and alleviate the compliance burden, supporting the broader goal of fostering responsible and transparent AI development under emerging regulatory frameworks.

Collections