将法规转化为代码：用于软件工程中LLM选择的治理与合规模型
原标题：Operationalizing Regulations into Code: A Model to Enhance Governance and Compliance in LLM Selection for Software Engineering
AI 摘要
本文提出一个基于设计科学研究（DSR）的多准则决策模型，用于在软件工程项目中合规地选择大语言模型（LLM）。该模型将欧盟AI法案、NIST AI风险管理框架、GDPR、LGPD和ISO/IEC 42001等法规要求转化为可操作的技术决策标准，并通过三层结构（法规要求、组织治理能力、生产力与可持续性结果）实现。试点评估使用20个基于CWE和OWASP Top 10的对抗性场景，比较商业云LLM与本地开源LLM，结果表明法规淘汰逻辑（K.O.标准）能防止选择虽技术优秀但存在合规风险的模型。
正文节选
Operationalizing Regulations into Code: A Model to Enhance Governance and Compliance in LLM Selection for Software Engineering Abstract. Integrating Large Language Models (LLMs) into the Software Development Life Cycle (SDLC) can improve developer productivity, but it also introduces security, privacy, and compliance risks during model selection. Regulations and frameworks such as the EU AI Act, the NIST AI Risk Management Framework (RMF), the General Data Protection Regulation (GDPR), the Lei G