Which Legal Requirements are Relevant to a Business Process? Comparing AI-Driven Methods as Expert Aid

Organizations are obliged to ensure compliance with an increasing amount of regulatory requirements stemming from laws, regulations, directives, and policies. As a first step, it is to be determined which of the requirements are relevant in a certain context, depending on factors such as location of the organization and the business processes. For the processes, the identification of relevant requirements can be detailed by an assessment of which parts of each document are relevant for which step of a given process. Nowadays the identification of process-relevant regulatory requirements is mostly done manually by domain and legal experts, posing a tremendous workload due to the extensive number of regulatory documents and their frequent changes. Hence, this work examines how organizations can be assisted in the identification of relevant requirements for their processes based on embedding-based NLP ranking and generative AI. The evaluation highlights strengths and weaknesses of both methods regarding applicability, automation, transparency, and reproducibility. The evaluation results lead to guidelines on which method combinations will maximize benefits for given characteristics such as process usage, impact, and dynamics of an application scenario.