Norsk English

Testing and Validating Regulatory Decision Flows for Automated Compliance Assessment

Determining whether legal decision flows remain correct across regulations like the AI Act and GDPR is unsolved. This thesis develops an automated validation layer to test the execution and reliability of legal decision flows.

Contact persons

LexAlign - SINTEF´s Compliance Assessment Framework. Ill.: SINTEF

What the project is about

LexAlign represents regulatory procedures as executable decision flows to derive compliance obligations. As it expands from pipeline-specific AI Act scenarios into a regulation-agnostic engine executing GDPR, Data Act, and AI Act flows, verifying engine reliability becomes critical. This project focuses on building an automated validation layer to catch broken execution branches, engine bugs, and silent regressions across multi-regulation decision flows.

Research topic focus

The thesis investigates how to systematically test and validate a generic regulatory decision-flow engine without relying on manual verification.

The central research question is how can a generic regulatory decision-flow engine be evaluated so that errors in legal flow logic, execution code, and input interpretations are accurately isolated and traced?

The methodology will consist of evaluating legal decision logic, path correctness, and boundary cases across multi-regulation decision trees using automated testing techniques and validation frameworks.

Expected results and learning outcomes

  • Validation layer: A functional testing prototype for executable legal decision flows.
  • Empirical Evaluation: Evaluation metrics assessing LexAlign's path coverage, fault isolation, and consistency across multiple regulations.
  • Competencies: Practical experience in legal technology (LegalTech/RegTech), legal knowledge representation, software testing principles, and decision system verification.

Desired qualifications

  • Master’s student in Law (or related legal degree) with a strong emphasis or specialization in Legal Technology, Computable Law, or Information Technology Law.
  • Solid understanding of European digital regulations (e.g., EU AI Act, GDPR, Data Act) and legal reasoning structures.
  • Interest in how legal clauses translate into formal rule-based execution systems, decision logic, and automated compliance testing.
  • Basic familiarity with software logic, decision trees, or structured data (e.g., JSON/flow diagrams) is an advantage, though deep programming skills are not strictly required.