New regulations are continuously introduced to ensure that software development complies with ethical standards and prioritizes public safety. Demonstrating compliance requires tracing software requirements to legal provisions. Requirements traceability is a fundamental task in which requirements engineers analyze technical requirements against target artifacts, often under strict time constraints. Performing this analysis manually for complex systems containing hundreds of requirements is infeasible, and the legal dimension further increases the effort required.

In this paper, we investigate two automated solutions based on language models, including large language models (LLMs). The first solution, Kashif, is a classifier that leverages sentence transformers and semantic similarity. The second solution, Rice LRT, prompts a recent LLM using Rice, a prompt-engineering framework. Using a publicly available benchmark dataset, we empirically evaluate Kashif and compare it against seven baseline classifiers from the literature (LSI, LDA, GloVe, TraceBERT, RoBERTa, and LLaMA).

Kashif identifies trace links with an F2 score of approximately 63%, outperforming the best baseline by a substantial margin of 21 percentage points (pp). On a newly created and more complex requirements document traced to the European General Data Protection Regulation (GDPR), Rice LRT outperforms both Kashif and baseline prompting approaches, achieving an average recall of 84% and an F2 score of 61%, improving the F2 score by 34 pp compared to the best baseline prompt.

Our results indicate that requirements traceability in legal contexts cannot be adequately addressed by existing techniques that are not specifically designed for legal artifacts. Furthermore, we demonstrate that our engineered prompt outperforms both classifier-based approaches and baseline prompting methods.