Exploring GenAI for Regulatory Requirements Traceability: Lessons from Sustainability Software

Abstract

Sustainability regulations such as the European Sustainability Reporting Standards (ESRS) and India's Business Responsibility and Sustainability Reporting (BRSR) act collectively define hundreds of disclosure requirements across fragmented documentations. At SAP, practitioners developing sustainability software struggle to verify regulatory coverage due to the complexity and interpretive demands involved. Our ambition is to develop a system that audits software features against regulatory requirements. This shall be achieved by retrieving relevant engineering artifacts to provide traceable evidence, with an exploratory transfer from ESRS to BRSR providing indication of cross-regulatory applicability as assessed by end users. To address this challenge, we worked in three phases: We conducted expert interviews identifying compliance verification challenges, developed then a generative AI (GenAI) supported auditing approach, before evaluating it with domain experts. Achieving successful results in 21 out of 39 cases on the test set using user documentation strengthens our confidence in that our approach is suitable to reduce manual effort. However, our evaluation also revealed a “trust gap”: despite strong performance, domain experts require human oversight for final compliance decisions due to high stakes and interpretive ambiguity. In this manuscript, we report on our work and share lessons learned and experiences we made in this context.