The ESPRE workshop serves as a multidisciplinary forum for researchers and practitioners interested in advancing Security and Privacy Requirements Engineering. It promotes dialogue at the intersection of security, privacy, and requirements engineering, with a strong emphasis on addressing the evolving needs of users and organizations. The 12th edition of ESPRE featured nine peer-reviewed contributions covering a range of topics, including requirements extraction, legal and regulatory alignment, traceability, and conceptual modelling. Several papers explored the integration of Large Language Models, reflecting the growing role of AI in this domain. This edition of ESPRE underscores the workshop’s ongoing commitment to fostering innovative, context-aware approaches to the engineering of secure and privacy-preserving systems.
In software development, many different artifacts are created during the process. At the beginning, requirements for the respective software are defined and then written down in a specification. This is followed by other artifacts, such as source code, test cases, or various UML diagrams. Different standards, including ISO 26262 for the automotive industry, require that safety and security requirements be explicitly traced for these different artifacts. However, tracing of requirements in source code is very time-consuming, error-prone, and costly. To reduce the effort involved, various approaches have been developed that use different techniques, such as information retrieval or machine learning, to automate this process. However, these approaches also have problems, so that practical use, especially in safety and security domains, is limited. In this paper, we have therefore developed a plugin for VSCode and a new approach based on LLMs to recover trace links between safety and security requirements and source code. Our results show that the used LLMs are capable of performing this task because they have both code and textual understanding. In various combinations, Llama showed satisfying results in terms of precision (0.8).
The concept of responsible human-centered AI refers to the ethical, accountable, and conscious development, deployment, and operation of AI systems. It is dedicated to ensuring that AI systems align with societal and environmental values, legal norms, and regulations while providing transparency, fairness, privacy, and accountability of the solutions. Responsible human-centered AI encompasses a broad range of socio-technical and sustainability concerns, including biases in AI models, data privacy and security, and explainability of AI decisions, along with robust mechanisms for auditing and monitoring systems' post-deployment to address unintended consequences or evolving risks. The goal of the First International Workshop on Requirements Engineering for Accountable and Conscious Human-centered AI (REACH-AI 2025) is to create a platform for an interdisciplinary discourse of researchers and practitioners on this important aspect of the AI impacts on society.
This paper presents a Q&A knowledge extraction method for developer chatroom environments by summarizing their conversations — ConSum4DCR. In the era of AI, the Internet of Things, and cyber-physical systems, software runtime environments have become increasingly diverse and rapidly evolving. As a critical component of collaborative software development, developer chatrooms exhibit dynamic and multifaceted characteristics (e.g., Q&A patterns in technical discussions, integration with external services such as code snippets or links), which drive developers’ demand for efficient information retrieval. To address the unique nature of conversation texts in developer chatrooms, ConSum4DCR employs an extractive text summarization approach. It segments content into paragraphs at the conversation thread level, applies a topic disentanglement algorithm to handle topic shifts, and uses heuristic rules to prune and merge conversation content to form concise conversation summaries. The paper also proposes experiments to evaluate the effectiveness and readability of the summaries. It assesses summary quality based on the performance of automatic text classifiers and engages developers to read the summaries and complete classification tasks, verifying the extent to which the summaries preserve environmental semantics and enhance comprehensibility. Results show that the method performs excellently in terms of both effectiveness and readability.
Welcome to the sixth edition of the REWBAH workshop, a satellite event of the 2025 IEEE International Requirements Engineering Conference (RE’25). The REWBAH workshop fosters discussion related to requirements engineering resulting from the need to build software systems that not only support healthcare, but also promote well-being, encourage patients and the population in general to live according to healthy lifestyle recommendations, and address the specific needs of an aging population. This multidisciplinary workshop brings together practitioners and researchers from relevant disciplines. Among other objectives, REWBAH aims to: i) develop RE approaches that support multiple perspectives of well-being, aging, and health; ii) examine critical factors that enhance the engagement of patients/population and clinicians and ensure that these systems promote well-being; and iii) explore how requirements engineering can be used as a mediator to create impact and value with emerging technologies, thus contributing to the transformation of health and well-being.
Welcome to the 15th International Workshop on Model-Driven Requirements Engineering (MoDRE ' 25), held in conjunction with the 33rd edition of the Requirements Engineering Conference. The MoDRE workshop series has established a forum where researchers and practitioners can discuss the challenges and opportunities of Model-Driven Development (MDD) for Requirements Engineering (RE). Model-driven (software) development languages, tools, and techniques have raised the level of abstraction in software development and enabled automation of various parts of the software development process. When effectively applied, MDD techniques can offer significant benefits to RE, by balancing the flexibility for capturing varied user needs with the formality required for model transformations, and by bridging high-level abstraction with the richness of requirements information. MoDRE seeks to explore areas of RE that are not yet fully formalized to be incorporated into an MDD environment. It also seeks to explore how RE models can benefit from advances in the model-driven community, such as flexible, collaborative, and AI-enabled modeling. MoDRE encourages researchers to explore these benefits by identifying new challenges, sharing ongoing work and emerging solutions, analyzing strengths and weaknesses of MDD approaches for RE, and fostering stimulating discussions on the topic during the workshop. This workshop is an opportunity to reflect on the current state and envision the future of MDD approaches for RE. We would like to thank the Program Committee for their valuable feedback to the authors, and, of course, the authors for submitting their papers and making this workshop possible.
With the growing complexity of aerospace embedded systems, effective structuring of software requirements has become increasingly critical. Traditional manual approaches to requirements structuring are labor-intensive and error-prone, hindering efficiency and accuracy. Although large language models (LLMs) show promise in automating this process, their limited domain-specific knowledge constrains their effectiveness in the aerospace domain. To address these limitations, we propose an automated approach for structuring aerospace embedded software requirements, integrating explicit aerospace domain knowledge with the Monitor-Analyze-Plan-Execute (MAPE) architecture. This architecture systematically guides LLMs in accurately identifying and formulating structured requirements. Empirical evaluations demonstrate that our proposed method significantly enhances modeling efficiency while achieving accuracy comparable to manual approaches, underscoring its practical applicability and effectiveness in aerospace software development.
Trustworthiness is often operationalized through a defined set of requirements - e.g., robustness, reliability, transparency, explainability, fairness, accountability, privacy - that systems are expected to meet to be considered trustworthy. With the advent of Artificial Intelligence (AI), the concept of trustworthiness has evolved significantly, expanding beyond merely technical dimensions to encompass ethical and legal nuances. Despite these broadened considerations, the predominant checklist-oriented approach, in which machines are deemed trustworthy upon fulfilling a predetermined set of criteria, remains prevalent. Although this approach might appear natural and beneficial, it risks oversimplifying its inherent complexity. This paper explores this approach with a dual purpose. First, it argues that the conceptual ambiguity currently surrounding trustworthiness crucially impedes effective interdisciplinary communication and risks promoting superficial compliance - i.e., "ethics-washing" - where systems might be labeled trustworthy primarily due to their technical performance, without factually respecting their ethical implications and broader societal impacts, or vice versa. Second, it acknowledges that trustworthiness cannot be merely an intrinsic system attribute but is fundamentally context-dependent, user-relative, and dynamically evolving within human-machine interactions - thus becoming a dynamic concept shaped by these elements. In this light, it is also important not to neglect the notion of perceived trustworthiness, which is introduced to highlight the role of subjective evaluations shaped by contextual and individual factors. These aspects collectively influence trust in AI-powered systems. By integrating technical rigor, ethical awareness, and user-centric evaluations, this paper seeks to refine conceptual clarity, particularly within the domain of requirements engineering.
The integration of Artificial Intelligence (AI) into society demands systems that are demonstrably accountable and aligned with human values. Current Responsible AI efforts are often fragmented, characterized by vendor-specific principles and tools that lack comprehensive lifecycle integration and clearly defined responsibilities, which impedes systematic engineering of accountability and complicates regulatory compliance. This paper argues for a paradigm shift, proposing a role-based Requirements Engineering (RE) framework to embed accountability from a project's inception throughout its lifecycle. This approach translates abstract principles into concrete and verifiable requirements assigned to specific roles. We illustrate the framework with an AI-powered apple-picking use case, mapping development-time and runtime concerns to distinct roles like the Data Steward and Robotics Engineer. The paper concludes by calling for research to create a unified ontology for trustworthy AI and a comprehensive, role-centric lifecycle framework, which is critical for shifting from reactive compliance to a proactive paradigm where accountability is an engineered, intrinsic property of AI systems.
Different new directives on information and software technologies have been recently published by the European Union, such as the Artificial Intelligence Act (AI Act), the Cyber-Resilience Act, the Network and Information Security Directive 2 (NIS2), and the Digital Service Act. Since the enactment of the General Data Protection Regulation (GDPR), the legal compliance have been performed with expensive certifications and reviews made by consultants of various documents (e.g. the Data Protection Assessment), but now the use of new technologies might accelerate the compliance process by using tools to transform complex legal texts into machine-readable knowledge representations. In our work, we construct the knowledge graphs from the regulatory texts and other relevant documents (such as the Software Requirements Specification) and we aim at assessing the compliance by identifying matches between the two graph representations, with the development of an auditor-oriented compliance tool. We plan to leverage on large-language models (LLMs) to assist in aligning requirement specifications across multiple regulatory frameworks. By highlighting the pitfalls of diverse tools during the experimental analysis, we aim to emphasize the necessity of refining legal text processing workflows to enable
The integration of distributed digital twins (DTs) within an industrial metaverse presents a significant challenge to system stability and predictability. Continuous, asynchronous updates to individual DTs and their underlying generative AI foundation models create dynamic interdependencies that traditional, centralized requirements management systems cannot adequately govern due to inherent issues of trust, transparency, and data integrity. This paper argues for a paradigm shift, proposing a decentralized, multi-party requirements management framework built on Web3 distributed ledger technology. In this approach, requirements are transformed from static documents into immutable, traceable transactions on a shared ledger, with their validation and enforcement automated through smart contracts. The proposed system establishes a single, verifiable source of truth, enabling the use of automated guardrails and negotiated adjustments to contain the impact of changes. This ensures that the complex mesh of DTs can co-evolve in a stable, predictable, and secure manner, addressing key barriers and fostering the adoption of a collaborative industrial metaverse, as illustrated through a practical semiconductor manufacturing use case.
The use of AI is increasingly adopted in knowledge-intensive domains. One such domain is healthcare, in which experience is imperative for the quality and fit of treatment in diverse contexts. In these professions, mentoring by experts is highly recommended for young professionals. However, these are often not available due to insufficient experienced professionals or limited accessibility to mentors in remote locations. This research in progress explores the potential of developing and integrating AI for mentoring services as part of the ecosystem of healthcare professionals. Specifically, we explore the development of an agentic AI requirements approach for facilitating such ecological solution and demonstrate it on the case of a digital mentor for occupational therapists. The proposed approach is aimed at providing a new frontier for enhancing clinical practice and decision-making, emphasizing the integration of ecological health principles. By systematically addressing multi-level influences, including intrapersonal, interpersonal, organizational, community, and public policy factors, this approach aims to provide requirements for a nuanced, context-sensitive system, tailored to the complexities of client care. The paper outlines a dual-adaptive agentic AI architecture, combining functional agents tasked with specific problem-solving and ecological health requirements agents that ensure adaptability, trustworthiness, and reflective engagement. A fictional case study is employed to illustrate the system’s application, highlighting the interplay between individual attributes and broader environmental factors affecting performance. This illustration underscores the importance of ecological health understanding and outlines future research directions for refining the architecture of ecological health agentic AI systems, thereby improving outcomes for both therapists and clients.
During the development of automotive systems, establishing cross-layer traceability links between system-level and component-level requirements is crucial for ensuring the consistency and integrity of system development. However, this process faces numerous challenges: there are significant semantic differences between requirements at different levels, and system-level functions often correspond to multiple component-level functions, creating complex one-to-many mapping relationships that further increase the difficulty of traceability. To address these issues, we propose a method for constructing cross-layer traceability links for automotive systems. The method first categorizes the typical mapping relationships between system-level and component-level requirements into two patterns: aggregation and cascading. Based on predefined structured requirements meta-models and prompting engineering techniques, it utilizes LLMs to perform semantic parsing and structured modeling of natural language requirements documents. Subsequently, a terminology dictionary is constructed to unify and normalize synonymous terms across layers. Additionally, a signal dependency graph of component-level requirements is built to assist in identifying semantic links and execution paths between requirements. We use a case study to demonstrate that this method shows good adaptability in dealing with issues such as terminology heterogeneity, semantic inconsistency, and structural complexity. It significantly improves the efficiency and accuracy of constructing cross-layer traceability links, providing strong support for subsequent requirements change management, system verification, and testing.
The increased sophistication and complexity of modern software development pose a significant challenge to software supply chain risk management. Modern software is characterized by intricate dependency trees and an increased scale. As a result, the software supply chain attack surface has also increased, and with it, the number of reported disruptions. These attacks aim at destabilizing entire supply chains by compromising individual components in open source software, thereby triggering cascading disruptions. In response, several governance and regulatory efforts for ensuring software supply chain security have been made. At the European Union level, the recent introduction of Network and Information Security Directive 2 (NIS2) and Cyber Resilience Act (CRA) aims to establish robust cybersecurity requirements for organizations and products, including the secure development and importing of software products in the European market. However, translating verbatim requirements into actionable technical implementations for secure software development is a complex and time-consuming challenge for practitioners. This paper addresses this gap by leveraging the functionality of a selected number of open source tools to partially automate and simplify compliance with a number of requirements extracted from NIS2 and CRA. We identify key software supply chain security requirements in the two legislations and map them to relevant open source tools capable of partially automating compliance tasks. Additionally, we propose an easily replicable, automated pipeline also implementable as GitHub workflows, which simplifies practitioners’ and organizations’ NIS2 and CRA compliance efforts.
UML state machines are widely used for modeling software behavior. We present a proposal of constructing constraint systems out of state machines with performance requirements. Our approach takes into account hierarchical states and parallel regions, and facilitates viability checking. Also, missing requirements can be automatically deduced, which is particularly valuable in practice. Our approach thus provides a simple yet useful means for model driven engineering of requirements engineering.
Understanding how connected mental health (CMH) tools affect the work environment of mental health clinicians requires carefully designed qualitative inquiry. This paper presents an experience report detailing the iterative development of a semi-structured interview guide used to explore clinicians’ experiences with CMH. The process involved internal workshops, feedback from experts, and pilot testing. Each stage contributed to refining the guide’s clarity, contextual relevance, and alignment with the study’s objectives. The final guide comprised 9 screening questions, 12 background questions, and 10 main interview questions, which were reduced and refined from an initial set of 21 interview questions across three thematic areas; pilot feedback led to revisions in the form of more concrete prompts and clarified language. While semi-structured interviews are widely used in health technology research, the development process is often underreported. By presenting our iterative design process, we highlight how interview guide development can be conceived, validated, and refined to enhance methodological rigor. This paper offers practical insights for researchers conducting qualitative studies in healthcare and technology settings, particularly those working on eliciting perceptions and experiences with CMH.
Given the advent of large language models (LLM), automatic goal-based model analysis in goal-oriented requirements engineering is a new opportunity. A well-known problem within systems collaboration is the interoperability of its components. Pragmatic interoperability is more challenging than other levels (e.g., syntactic, semantic) since it depends on usage. Automatic detection of variation points in goal-based models and variant analysis are vital to improving pragmatic interoperability between components since they deal with different uses. We propose an integrative process using a distributed intentionality modeling language (i*) strategic rationale (SR) goal model with an LLM to detect independent variation points and analyze which variant is desirable to improve systems ' pragmatic interoperability. The automatic analysis of the LLM is experimented with using
Deploying AI-driven physical systems demands mechanisms that can both enable innovation and ensure safety. This case study presents a prototype implementation of a large language model (LLM)-controlled unmanned aerial vehicle (UAV) operating under a runtime assurance (RTA) mechanism. The safeguarding layer served to constrain the UAV’s actions within predefined safety boundaries, allowing experimentation with untrusted, LLM-based controller in a physical testing environment. The system was used to engage stakeholders including: operators, robotics engineers, autonomy specialists, and safety experts, to explore the behavioural boundaries and trust requirements for such architectures. Through iterative prototyping and live demonstrations, we elicited feedback that informed and refined a set of cross-cutting requirements for both the controller and the RTA mechanism. The study highlights how agile systems engineering practices can support real-world testing of novel AI-controlled systems to elicit and develop requirements, while preserving safety and operational oversight. We conclude by outlining how such runtime-assurance-enabled testbeds can support future research into physical AI, trust calibration, and assured autonomy.
For many older adults, mobile apps remain difficult to use and raise significant concerns about how personal data is handled. To inform the design of age-friendly apps, we conducted a requirements-oriented review of 21 existing mobile apps available on the Google Play Store. These apps, selected based on their relevance to caregiving, safety, medical management, and social connection, were analyzed in terms of functionality, usability, and HIPAA1 -related privacy risks. Using automated review analysis and HIPAA compliance tools, we identified recurring issues such as navigation complexity, limited accessibility across devices, and insufficient data protection. From these insights, we derived a set of functional and non-functional requirements tailored to the needs of older adults. Through a structured analysis of existing applications, this study offers actionable design recommendations to guide the development of age-friendly mobile technologies.
Diagrams can be valuable tools in requirements engineering to establish a shared understanding between software engineers and stakeholders. However, interacting with these visual representations can be challenging for some stakeholders who prefer textual descriptions and may need support to interpret notation elements and understand the diagram structure and meaning. To address this need, we explore the use of Large Language Models to effectively assist stakeholders interacting with diagrams by providing automatic textual explanations and contextual guidance. Specifically, we aim to design and evaluate with stakeholders an interactive layer (integrated into an end-user-oriented modelling tool) that provides automatic diagram explanations in natural language. As a first step toward our research objective, this paper investigates the capability of GPT4 to generate appropriate textual descriptions from domain models. We use a test data set consisting of UML class diagrams in various formats, belonging to the domain of digital agriculture, and develop a set of prompts to generate the interactive explanatory layer. We conduct a technical evaluation of the output, focusing on correctness, completeness, and understandability. The results provide valuable insights to inform future design and research, while also revealing potential challenges in real-world applications.
