Document Open Access Logo

Operationalizing the EU AI Act in Agile Software Development: A Guideline-Based Approach

Authors Dennis Schrader , Eva-Maria Schön , Henning Fritzemeier, Michael Neumann

PDF

File

Thumbnail PDF
PDF
LIPIcs.ESEM.2026.94.pdf
  • Filesize: 0.75 MB
  • 21 pages

Document Identifiers

Subject Classification

ACM Subject Classification
  • Software and its engineering
  • Human-centered computing → Empirical studies in collaborative and social computing
Keywords
  • EU AI Act
  • AI Governance
  • Agile Software Development
  • Regulatory Compliance
  • Guidelines
  • Design Science Research

Metrics

Abstract

Context. The EU AI Act requires providers and deployers of Artificial Intelligence (AI) systems to implement documentation, risk management, and human oversight. Agile teams that ship AI features in short iterations lack specific artifacts to discharge these duties, since the regulation’s abstract provisions do not map onto agile practices such as the Definition of Done, Sprint Reviews, or working agreements.

Objective. We provide agile teams with an actionable compliance instrument: an evaluated guideline that operationalizes EU AI Act obligations as activities integrable into existing agile practices. We further document the translation method to make its potential adaptation to other regulations examinable.

Method. Following Design Science Research, we assessed each EU AI Act article along three dimensions (technical, normative, organizational). We subsequently classified the articles using a traffic-light scheme and mapped those deemed highly relevant to previously documented pain points of agile teams working with AI. We evaluated the resulting catalog by eliciting practitioners' perceptions through a survey followed by semi-structured interviews with the same participants (N=11) and analyzed the data via qualitative content analysis.

Results. The guideline comprises 12 items covering roles and responsibilities, risk and quality management, transparency and traceability, monitoring, and regulatory sandboxes. Practitioners rated the catalog as understandable and relevant; feasibility varied with organizational maturity. Participants associated perceived adoption feasibility with collective ownership across roles and integration into existing agile events rather than parallel compliance processes.

Conclusions. The catalog gives agile teams a starting point to transform their delivery practices towards EU AI Act compliance without dismantling agile practices. A replication package is publicly available.

Cite As Get BibTex

Dennis Schrader, Eva-Maria Schön, Henning Fritzemeier, and Michael Neumann. Operationalizing the EU AI Act in Agile Software Development: A Guideline-Based Approach. In 20th International Symposium on Empirical Software Engineering and Measurement (ESEM 2026). Leibniz International Proceedings in Informatics (LIPIcs), Volume 394, pp. 94:1-94:21, Schloss Dagstuhl – Leibniz-Zentrum für Informatik (2026) https://doi.org/10.4230/LIPIcs.ESEM.2026.94

Author Details

Dennis Schrader
  • University of Applied Sciences and Arts Hannover, Germany
Eva-Maria Schön
  • University of Applied Sciences Emden/Leer, Germany
Henning Fritzemeier
  • Volkswagen AG, Wolfsburg, Germany
Michael Neumann
  • University of Applied Sciences and Arts Hannover, Germany

Acknowledgements

We thank all participants who participated in the survey and expert interviews for their time and valuable insights.

References

  1. Asmae Bahi, Jihane Gharib, and Youssef Gahi. Integrating generative AI for advancing agile software development and mitigating project management challenges. International Journal of Advanced Computer Science and Applications (IJACSA), 15(3):54-61, 2024. URL: https://doi.org/10.14569/ijacsa.2024.0150306.
  2. Jürgen Bortz and Nicola Döring. Forschungsmethoden und Evaluation für Human- und Sozialwissenschaftler. Springer Medizin, Heidelberg, 4. vollständig überarbeitete edition, 2006. Google Scholar
  3. Schrader Dennis, Eva-Maria Schön, Henning Fritzemeier, and Michael Neumann. Eu ai act-aligned guidelines for agile software development, 2026. Available at: https://doi.org/10.5281/zenodo.21804652. Google Scholar
  4. Schrader Dennis, Eva-Maria Schön, Henning Fritzemeier, and Michael Neumann. Research protocol, 2026. Available at: https://doi.org/10.5281/zenodo.21804701. Google Scholar
  5. Emelie Engström, Margaret-Anne Storey, Per Runeson, Martin Höst, and Maria Teresa Baldassarre. How software engineering research aligns with design science: a review. Empirical Software Engineering, 25(4):2630-2660, 2020. URL: https://doi.org/10.1007/s10664-020-09818-7.
  6. European Union. Regulation (EU) 2024/1689 of the european parliament and of the council of 13 june 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union, L series, 2024. 12 July 2024. URL: https://eur-lex.europa.eu/eli/reg/2024/1689/oj.
  7. Sergio Genovesi. Introducing an AI governance framework in financial organizations: Best practices in implementing the EU AI Act (practitioner track). In Symposium on Scaling AI Assessments (SAIA 2024), volume 126 of Open Access Series in Informatics (OASIcs), pages 9:1-9:7. Schloss Dagstuhl - Leibniz-Zentrum für Informatik, 2025. URL: https://doi.org/10.4230/OASIcs.SAIA.2024.9.
  8. Tomas Herda, Victoria Pichler, Zheying Zhang, Pekka Abrahamsson, and Geir K. Hanssen. Ai and agile software development: From frustration to success xp2025 workshop summary. In Proceedings of the 26th International Conference on Agile Software Development - Workshops, pages 3-13, Cham, 2025. Springer Nature Switzerland. URL: https://doi.org/10.1007/978-3-032-05799-0_1.
  9. Alan R. Hevner, Salvatore T. March, Jinsoo Park, and Sudha Ram. Design science in information systems research1. Management Information Systems Quarterly, 28(1):75-106, March 2004. URL: https://doi.org/10.2307/25148625.
  10. Fabian Hüger, Alexander Poth, Andreas Wittmann, and Roland Walgenbach. An approach to the instantiation of the EU AI Act: A Level of Done derivation and a case study from the automotive domain. In Systems, Software and Services Process Improvement - 30th European Conference, EuroSPI 2023, Grenoble, France, August 30 - September 1, 2023, Proceedings, volume 1890 of Communications in Computer and Information Science, pages 111-123. Springer, 2023. URL: https://doi.org/10.1007/978-3-031-42307-9_9.
  11. Isabelle Hupont, David Fernández-Llorca, Sandra Baldassarri, and Emilia Gómez. Use case cards: A use case reporting framework inspired by the European AI Act. Ethics and Information Technology, 26(2):19, 2024. URL: https://doi.org/10.1007/s10676-024-09757-7.
  12. International Organization for Standardization. ISO/IEC 42001:2023 - Information technology - Artificial intelligence - Management system. https://www.iso.org/standard/81230.html, 2023. ISO/IEC 42001:2023.
  13. Jessica Kelly, Shanza Ali Zafar, Lena Heidemann, João-Vitor Zacchi, Delfina Espinoza, and Núria Mata. Navigating the EU AI Act: A methodological approach to compliance for safety-critical products. In 2024 IEEE Conference on Artificial Intelligence (CAI). IEEE, 2024. URL: https://doi.org/10.1109/CAI59869.2024.00159.
  14. Udo Kuckartz and Stefan Rädiker. Qualitative Inhaltsanalyse - Methoden, Praxis, Umsetzung mit Software und künstlicher Intelligenz. Beltz Juventa, 6. edition, 2024. Google Scholar
  15. Philipp Mayring. Qualitative Content Analysis: A Step-by-Step Guide. SAGE Publications Ltd, London, 1. edition, 2022. Google Scholar
  16. Jakob Mökander, Maria Axente, Federico Casolari, and Luciano Floridi. Conformity assessments and post-market monitoring: A guide to the role of auditing in the proposed European AI regulation. Minds and Machines, 32(2):241-268, 2022. URL: https://doi.org/10.1007/s11023-021-09577-4.
  17. Michael Neumann. Towards a taxonomy of agile methods: The tree of agile elements. In 2021 9th International Conference in Software Engineering Research and Innovation (CONISOFT), pages 79-87, 2021. URL: https://doi.org/10.1109/CONISOFT52520.2021.00022.
  18. Michael Neumann, Lasse Bischof, Nic Elias Hinz, Abdullah Altun, Luca Stockmann, Dennis Schrader, Ana Carolina Ahaus, Erim Can Demirci, Benjamin Gabel, Maria Rauschenberger, Philipp Diebold, Henning Fritzemeier, and Adam Przybyłek. Between policy and practice: GenAI adoption in agile software development teams. In Proceedings of the 27th International Conference on Agile Software Development, volume 578 of Lecture Notes in Business Information Processing, pages 290-308, Cham, 2026. Springer. URL: https://doi.org/10.1007/978-3-032-22375-3_18.
  19. Mirko Perkusich, Danyllo Albuquerque, Allysson Allex Araújo, Matheus Paixão, Rohit Gheyi, Marcos Kalinowski, and Angelo Perkusich. Adoption of large language models in Scrum management: Insights from brazilian practitioners. In Agile Processes in Software Engineering and Extreme Programming - 27th International Conference, XP 2026, São Paulo, Brazil, April 13-17, 2026, Proceedings, volume 578 of Lecture Notes in Business Information Processing, pages 255-273, Cham, 2026. Springer. URL: https://doi.org/10.1007/978-3-032-22375-3_16.
  20. Daniel Planötscher, Xiaofeng Wang, Mahum Adil, Peggy Gregory, and Sepideh Larimian. Human-AI collaboration in software development activities: Perspectives of agile practitioners. In Proceedings of the 27th International Conference on Agile Software Development, volume 578 of Lecture Notes in Business Information Processing, pages 274-289, Cham, 2026. Springer. URL: https://doi.org/10.1007/978-3-032-22375-3_17.
  21. Daniel Russo, Sebastian Baltes, Niels van Berkel, Paris Avgeriou, Fabio Calefato, Beatriz Cabrero-Daniel, Gemma Catolino, Jürgen Cito, Neil Ernst, Thomas Fritz, Hideaki Hata, Reid Holmes, Maliheh Izadi, Foutse Khomh, Mikkel Baun Kjærgaard, Grischa Liebel, Alberto Lluch Lafuente, Stefano Lambiase, Walid Maalej, Gail Murphy, Nils Brede Moe, Gabrielle O'Brien, Elda Paja, Mauro Pezzè, John Stouby Persson, Rafael Prikladnicki, Paul Ralph, Martin Robillard, Thiago Rocha Silva, Klaas-Jan Stol, Margaret-Anne Storey, Viktoria Stray, Paolo Tell, Christoph Treude, and Bogdan Vasilescu. Generative AI in software engineering must be human-centered: The Copenhagen manifesto. Journal of Systems and Software, 216:112115, 2024. URL: https://doi.org/10.1016/j.jss.2024.112115.
  22. Chalisa Veesommai Sillberg, José Siqueira De Cerqueira, Pekka Sillberg, Kai-Kristian Kemell, and Pekka Abrahamsson. The EU AI Act is a good start but falls short. In Proceedings of the 15th International Conference on Software Business, volume 539 of Lecture Notes in Business Information Processing, pages 114-130. Springer, 2025. URL: https://doi.org/10.1007/978-3-031-85849-9_10.
  23. Francesco Sovrano, Emmie Hine, Stefano Anzolut, and Alberto Bacchelli. Simplifying software compliance: AI technologies in drafting technical documentation for the AI Act. Empirical Software Engineering, 30:91, 2025. URL: https://doi.org/10.1007/s10664-025-10645-x.
  24. Elham Tabassi. Artificial Intelligence Risk Management Framework (AI RMF 1.0). Technical Report NIST AI 100-1, National Institute of Standards and Technology, 2023. URL: https://doi.org/10.6028/NIST.AI.100-1.
  25. Plamen G. Todorov. The application of artificial intelligence in software engineering. International Journal of Advanced Multidisciplinary Research and Studies, 2(5):835-842, 2022. Google Scholar
  26. Michael Tuape, Yohannes Garbielmichael, and Jussi Kasurinen. Architecting trust: Designing human oversight and accountability for AI-driven software engineering under the EU AI Act. In Proceedings of the 13th International Conference in Software Engineering Research and Innovation (CONISOFT 2025). IEEE, 2025. URL: https://doi.org/10.1109/CONISOFT66928.2025.00048.
  27. Rasmus Ulfsnes, Nils Brede Moe, Viktoria Stray, and Marit Skarpen. Transforming software development with generative AI: Empirical insights on collaboration and workflow. In Anh Nguyen-Duc, Pekka Abrahamsson, and Foutse Khomh, editors, Generative AI for Effective Software Development, pages 219-235. Springer, 2024. Google Scholar
  28. Matthias Wagner, Markus Borg, and Per Runeson. Navigating the upcoming European Union AI Act. IEEE Software, 41(1):19-24, 2024. URL: https://doi.org/10.1109/MS.2023.3322913.
  29. Matthias Wagner, Rushali Gupta, Markus Borg, Emelie Engström, and Michal Lysek. AI Act high-risk requirements readiness: Industrial perspectives and case company insights. In Proceedings of the 25th International Conference on Product-Focused Software Process Improvement, Lecture Notes in Computer Science. Springer, 2024. URL: https://doi.org/10.1007/978-3-031-78392-0_5.
  30. Matthias Wagner, Marie-Therese Wittmann, and Markus Borg. A critical look at the EU AI Act’s requirements and affected systems: Who must explain what? In 2025 IEEE 33rd International Requirements Engineering Conference Workshops (REW), pages 494-503, Valencia, Spain, 2025. IEEE. URL: https://doi.org/10.1109/REW66121.2025.00074.
  31. Salla Westerstrand. Fairness in AI systems development: Beyond EU AI Act compliance. In Proceedings of the 15th International Conference on Software Business, volume 539 of Lecture Notes in Business Information Processing, pages 99-113. Springer, 2025. URL: https://doi.org/10.1007/978-3-031-85849-9_9.
  32. Roel J. Wieringa. What Is Design Science?, pages 3-11. Springer Berlin Heidelberg, Berlin, Heidelberg, 2014. URL: https://doi.org/10.1007/978-3-662-43839-8_1.
  33. Claes Wohlin, Per Runeson, Martin Höst, Magnus C. Ohlsson, Björn Regnell, and Anders Wesslén. Experimentation in Software Engineering. Springer, Berlin, Heidelberg, 2. edition, 2012. URL: https://doi.org/10.1007/978-3-642-29044-2.
Any Issues?
X

Feedback on the Current Page

CAPTCHA

Thanks for your feedback!

Feedback submitted to Dagstuhl Publishing

Could not send message

Please try again later or send an E-mail
© 2023-2026 Schloss Dagstuhl – LZI GmbH Schloss Dagstuhl – LZI GmbH About DROPS Imprint Privacy Contact