AI Governance
Framework Bridges Regulatory Compliance and LLM Selection in Software Development
Researchers propose a governance model to translate complex AI regulations into practical criteria for choosing language models safely in software engineering workflows.
Adopting Large Language Models in software development pipelines can supercharge developer efficiency, but the choice of which model to use carries hidden risks around data protection, security, and regulatory compliance. A new framework tackles the challenge of converting abstract legal obligations into concrete decision-making tools.
The Regulatory Puzzle#
Major frameworks—the EU AI Act, GDPR, LGPD, NIST's AI Risk Management Framework, and ISO/IEC 42001—all set compliance expectations for AI systems. Yet translating these directives into actionable engineering choices remains largely unsolved. Organizations struggle to operationalize abstract regulatory language when selecting which LLM to integrate into their development workflows.
A Three-Layer Model#
Researchers have built a governance model through Design Science Research that structures compliance into three connected layers: regulatory requirements at the top, organizational capabilities and decision-making in the middle (implemented via a multi-criteria matrix with knockout and weighted scoring options), and measurable productivity and sustainability outcomes at the bottom. A feedback loop allows operational insights to refine the regulatory interpretation over time.
The approach centers on the LLM governance assessment protocol (PAG-LLM), which operationalizes compliance by making governance criteria explicit during model selection.
Testing Against Risk#
A pilot study ran 20 adversarial scenarios informed by the Common Weakness Enumeration (CWE) and OWASP Top 10 security frameworks, comparing commercial cloud-based LLMs against local open-source alternatives. The results revealed sharply different risk profiles depending on the model type and deployment model.
Crucially, the research found that knockout criteria—hard regulatory constraints—can disqualify technically strong models that fail compliance requirements. This demonstrates that governance-driven selection is workable, even when it means passing over otherwise competitive tools.
Implications#
The findings suggest organizations can embed regulatory logic directly into their procurement and deployment decisions, reducing the gap between what regulations demand and what engineering teams actually implement.
