Compliance-By-Design In Public-Sector Requirements Engineering

Public digital transformation in regulated domains requires translating normative obligations into verifiable system requirements. However, empirical evidence documenting end-to-end processes from regulation to validated software artifacts remains limited. This study reports an embedded qualitative case study on the digitalization of the Monthly Service Delivery Record (RMA) within the Brazilian Unified Social Assistance System (SUAS). Requirements were elicited through participatory workshops and documentary analysis of three RMA instruments. We identified 195 regulatory criteria and consolidated them into a unified backlog of user stories, fully validated with institutional managers. Regulatory obligations were operationalized into prototype behaviors via automated validations, conditional rules, blocking mechanisms, and traceability controls. The results demonstrate a compliance-by-design pathway that embeds governance controls into system logic and reduces interpretative ambiguity in compliance-driven public reporting systems.