The Impact of Regulatory and Institutional Requirements on Engineering Design Priorities
Authors
Omorov Akzholbek, Mikhaylov Bogdan
Share
Annotation
This article examines how regulatory and institutional requirements reshape engineering priorities during software design and architecture decisions. The global compliance software market reached USD 60.35 billion in 2025 and is projected to grow at 14.2 percent annually through 2035, driven by expanding legal frameworks such as GDPR, HIPAA, PCI DSS, and the EU AI Act. The study employs a systematic literature review of 18 sources published between 2019 and 2026, complemented by a comparative case analysis of four regulated software systems spanning healthcare, financial technology, and cloud services. The central hypothesis holds that regulatory constraints, when embedded as first-class architectural requirements rather than post-hoc additions, reduce total compliance overhead and improve security quality attributes. The analysis reveals three dominant transformation patterns: security-first architecture restructuring, privacy-by-design integration, and compliance-driven DevSecOps adoption. A novel Regulatory Compliance Priority Matrix (RCPM) is proposed as a structured tool for software engineers to map legal obligations to architecture quality attributes at the design stage. Findings confirm that early compliance integration reduces rework costs by 30 to 40 percent compared to reactive approaches. The results are relevant to software engineers, system architects, and product managers working in regulated industries in the United States and globally.
Keywords
Authors
Omorov Akzholbek, Mikhaylov Bogdan
Share
References:
Souppaya, M., Scarfone, K., & Dodson, D. (2022). Secure software development framework (SSDF) version 1.1: Recommendations for mitigating the risk of software vulnerabilities (NIST Special Publication 800-218). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-218.
A-LIGN. (2025). A-LIGN releases fifth annual Compliance Benchmark Report. Retrieved from: https://www.a-lign.com/articles/a-lign-releases-fifth-annual-compliance-benchmark-report (date accessed: March 12, 2026).
European Parliament, & Council of the European Union. (2024). Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No. 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act). Official Journal of the European Union. Retrieved from: https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng (date accessed: March 24, 2026).
World Economic Forum. (2025). Global cybersecurity outlook 2025. Retrieved from: https://www.weforum.org/publications/global-cybersecurity-outlook-2025/ (date accessed: April 6, 2026).
Jain, S. (2024). Evaluating the role of data privacy regulations in secure software development life cycles (SDLC). Communications on Applied Nonlinear Analysis, 32(1s), 483–494. https://doi.org/10.52783/cana.v32.2240.
ISO/IEC/IEEE. (2020). ISO/IEC/IEEE 24748-3:2020: Systems and software engineering — Life cycle management — Part 3: Guidelines for the application of ISO/IEC/IEEE 12207 (software life cycle processes). International Organization for Standardization. Retrieved from: https://www.iso.org/standard/77698.html (date accessed: April 18, 2026).
Kosenkov, O., Elahidoost, P., Gorschek, T., Fischbach, J., Mendez, D., Unterkalmsteiner, M., Fucci, D., & Mohanani, R. (2025). Systematic mapping study on requirements engineering for regulatory compliance of software systems. Information and Software Technology, 178, Article 107622. https://doi.org/10.1016/j.infsof.2024.107622.
Tunca, M. (2024). Privacy by design: A systematic literature review of European and British regulatory perspectives for software and information engineering. In Proceedings of the 2024 13th International Conference on Software and Information Engineering (ICSIE ’24) (pp. 54–63). Association for Computing Machinery. https://doi.org/10.1145/3708635.3708639.
Negri-Ribalta, C., Lombard-Platet, M., & Salinesi, C. (2024). Understanding the GDPR from a requirements engineering perspective: A systematic mapping study on regulatory data protection requirements. Requirements Engineering, 29(4), 523–549. https://doi.org/10.1007/s00766-024-00423-4.
Orellana, C., Cereceda-Balic, F., Solar, M., & Astudillo, H. (2024). Enabling design of secure IoT systems with trade-off-aware architectural tactics. Sensors, 24(22), Article 7314. https://doi.org/10.3390/s24227314.
de Chaves, S. A., & Benitti, F. B. V. (2023). Privacy by design in software engineering: An update of a systematic mapping study. In Proceedings of the 38th ACM/SIGAPP Symposium on Applied Computing (pp. 1362–1369). Association for Computing Machinery. https://doi.org/10.1145/3555776.3577626.
Elkourdi, F., Wei, C., Xiao, L., Yu, Z., & Asan, O. (2024). Exploring current practices and challenges of HIPAA compliance in software engineering: Scoping review. IEEE Open Journal of Systems Engineering, 2, 94–104. https://doi.org/10.1109/OJSE.2024.3392691.
Kosenkov, O., Unterkalmsteiner, M., Fischbach, J., Mendez, D., Gorschek, T., & Fucci, D. (2024). On developing an artifact-based approach to regulatory requirements engineering. In 2024 IEEE 32nd International Requirements Engineering Conference Workshops (REW) (pp. 262–271). IEEE. https://doi.org/10.1109/REW61692.2024.00041.
Klymenko, O., Kosenkov, O., Meisenbacher, S., Elahidoost, P., Mendez, D., & Matthes, F. (2022). Understanding the implementation of technical measures in the process of data privacy compliance: A qualitative study. In Proceedings of the 16th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM ’22) (pp. 261–271). Association for Computing Machinery. https://doi.org/10.1145/3544902.3546234.
Lombardi, F., & Fanton, A. (2023). From DevOps to DevSecOps is not enough. CyberDevOps: An extreme shifting-left architecture to bring cybersecurity within software security lifecycle pipeline. Software Quality Journal, 31(2), 619–654. https://doi.org/10.1007/s11219-023-09619-3.
Dupont, S., Ginis, G., Malacario, M., Porretti, C., Maunero, N., Ponsard, C., & Massonet, P. (2021). Incremental Common Criteria certification processes using DevSecOps practices. In 2021 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) (pp. 12–23). IEEE. https://doi.org/10.1109/EuroSPW54576.2021.00009.
Kosenkov, O., Unterkalmsteiner, M., Mendez, D., & Fucci, D. (2021). Vision for an artefact-based approach to regulatory requirements engineering. In Proceedings of the 15th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM ’21) (pp. 1–6). Association for Computing Machinery. https://doi.org/10.1145/3475716.3484191.
ISO/IEC/IEEE. (2023). ISO/IEC/IEEE 15288:2023: Systems and software engineering — System life cycle processes. International Organization for Standardization. Retrieved from: https://www.iso.org/standard/81702.html (date accessed: July 3, 2026).
Other articles of the issue
