Abstract This research commentary explores how requirements engineering (RE) can contribute to achieving digital humanism in AI-enabled healthcare, ensuring that technological innovation is balanced with human values. Drawing on insights from a panel discussion at the REWBAH’25 (RE for Well-Being, Aging, and Health) workshop, we identify four key themes: the necessity of interdisciplinary collaboration, the nuances of cultural and individual differences, human-AI collaborative decision-making, and the challenge of balancing technological advancement with sustainability and emotional considerations. We argue that RE is well suited for addressing these issues because it brings together diverse stakeholder perspectives to define what systems should achieve and how they should be used. In this paper, we build on digital humanism principles, on RE-relevant frameworks for AI, and on the above themes to frame the role of RE in supporting human-centred healthcare. We highlight open challenges, and outline five promising research directions and related research questions to guide future research and practice in RE, aiming to ensure that AI-enabled healthcare systems better reflect the values of digital humanism.

Purpose This paper aims to present the evaluation of a self-paced tool, CyberSecurity Coach (CYSEC), and discuss the adoption of CYSEC for cybersecurity capability improvement in small- and medium-sized enterprises (SMEs). Cybersecurity is increasingly a concern for SMEs. Previous literature has explored the role of tools for awareness raising. However, few studies validated the effectiveness and usefulness of cybersecurity tools for SMEs in real-world practices. Design/methodology/approach This study is built on a qualitative approach to investigating how CYSEC is used in SMEs to support awareness raising and capability improvement. CYSEC was placed in operation in 12 SMEs. This study first conducted a survey study and then nine structured interviews with chief executive officers (CEOs) and chief information security officers (CISO). Findings The results emphasise that SMEs are heterogeneous. Thus, one cybersecurity solution may not suit all SMEs. The findings specify that the tool’s adoption varied quite widely. Four factors are primary determinants influencing the adoption of CYSEC: personalisation features, CEOs’ or CISOs’ awareness level, CEOs’ or CISOs’ cybersecurity and IT knowledge and skill and connection to cybersecurity expertise. Originality/value This empirical study provides new insights into how a self-paced tool has been used in SMEs. This study advances the understanding of cybersecurity activities in SMEs by studying the adoption of CYSEC. Moreover, this study proposes significant dimensions for future research.

Platforms are emerging that allow data scientists, software and hardware engineers to collaborate through organisational boundaries to develop systems of Artificial Intelligence (AI). Such collaboration involves the exchange of assets representing Intellectual Property (IP) of the collaborators. The tension between permitting access and protecting IP is thus one of the critical challenges faced by organisations willing to innovate through collaboration. Licensing is a common way to address the issue, but the influence of the licensing rules on the intended form of collaboration is still unclear. In this paper, we identify and analyse the rules that are used to regulate IP exchanges in two common forms of collaboration: a) competitions where one customer benchmarks and selects among multiple suppliers and b) consortium projects where multiple parties collaborate to product joint results. Due to our interest in AI, we have chosen to analyse the terms and conditions of competitions hosted on Kaggle™ a leading online platform for Competitions. For consortium projects, we have analysed the DESCA Consortium Agreement template. DESCA is often used for European projects, an increasing number of which are used to fund AI innovation projects. We have applied In Vivo Coding and Concept Coding coding techniques to highlight rules applicable to IP exchange. We structured the findings in the form of tree graphs consisting of interdependent textual phrases to extract, group and compare the terms and conditions of IP sharing in each collaboration form and how they relate to the characteristics of the studied collaborations. The results indicate that each form of collaboration has its own set of rules that address comparable concerns but have different content. Practitioners, both platform providers and collaborators, can utilise our results to implement licensing for IP exchange that fits the desired type of collaboration. For researchers, our results represent a step towards the automation of license generation and enforcement.

Cybersecurity is essential for the protection of companies against cyber threats. Traditionally, cybersecurity experts assess and improve a company's capabilities. However, many small and medium-sized businesses (SMBs) consider such services not to be affordable. We explore an alternative do-it-yourself (DIY) approach to bringing cybersecurity to SMBs. Our method and tool, CYSEC, implements the Self-Determination Theory (SDT) to guide and motivate SMBs to adopt good cybersecurity practices. CYSEC uses assessment questions and recommendations to communicate cybersecurity knowledge to the end-user SMBs and encourage self-motivated change. In this paper, the operationalisation of SDT in CYSEC is presented and the results of a multi-case study shown that offer insight into how SMBs adopted cybersecurity practices with CYSEC. Effective automated cybersecurity communication depended on the SMB's hands-on skills, tools adaptedness, and the users' willingness to documenting confidential information. The SMBs wanted to learn in simple, incremental steps, allowing them to understand what they do. An SMB's motivation to improve security depended on the fitness of assessment questions and recommendations with the SMB's business model and IT infrastructure. The results of this study indicate that automated counselling can help many SMBs in security adoption. The final publication is available at Springer via https://link.springer.com/chapter/10.1007%2F978-3-030-59291-2_8

Abstract Software developing organizations strive to achieve flexibility to maintain a competitive advantage. There is no common understanding of what characterize flexibility for a software organization beyond the scope of the software product. Without a common understanding, it is difficult to evaluate the degrees of flexibility of software development approaches. The aim of this literature review is to collect attributes that characterize flexibility. The collected attributes are consolidated into a flexibility framework with 3 main attributes: properties of change, flexibility perspectives, and flexibility enablers. The resulting flexibility framework is then used to evaluate Agile and Lean practices. The evaluation shows that Agile and Lean practices address many flexibility attributes. However, some attributes are not addressed, such as infrastructure flexibility and strategic flexibility. On the basis of our evaluation, the classifications of flexibility attributes that we present in this paper could be used to aid software organization flexibility evaluation.

Companies are interested in knowing how users experience and perceive their products. Quality of Experience (QoE) is a measurement that is used to assess the degree of delight or annoyance in experiencing a software product. To assess QoE, we have used a feedback tool integrated into a software product to ask users about their QoE ratings and to obtain information about their rationales for good or bad QoEs. It is known that requests for feedback may disturb users; however, little is known about the subjective reasoning behind this disturbance or about whether this disturbance negatively affects the QoE of the software product for which the feedback is sought. In this paper, we present a mixed qualitative-quantitative study with 35 subjects that explore the relationship between feedback requests and QoE. The subjects experienced a requirement-modeling mobile product, which was integrated with a feedback tool. During and at the end of the experience, we collected the users’ perceptions of the product and the feedback requests. Based on the users’ rational for being disturbed by the feedback requests, such as “early feedback,” “interruptive requests,” “frequent requests,” and “apparently inappropriate content,” we modeled feedback requests. The model defines feedback requests using a set of five-tuple variables: “task,” “timing” of the task for issuing the feedback requests, user’s “expertise-phase” with the product, the “frequency” of feedback requests about the task, and the “content” of the feedback request. Configuration of these parameters might drive the participants’ perceived disturbances. We also found that the disturbances generated by triggering user feedback requests have negligible impacts on the QoE of software products. These results imply that software product vendors may trust users’ feedback even when the feedback requests disturb the users.

The successful launch of an innovation project depends on an attractive vision and how well the vision is supported by the complementary capabilities of the consortium partners that want to cooperate to realize the vision. Alas, for an innovator the search for the right partners and visions can be lengthy and difficult. Even though the analysis of context and problem, the identification of stakeholders, the analysis of stakeholder goals and techno-logical capabilities, and the definition of requirements belong to the cornerstones of requirements engineering, this requirements engineering problem has hardly been explored so far. In an attempt to avoid re-invention of well-tried solutions, we discovered journalism as a discipline that, as a rich body of methodical knowledge, may act as a source for the guidance of how a requirements engineer may support the launch of innovation projects. In the role of a journalist, the requirements engineer makes partners and their capabilities visible and thereby allows the parties to identify each other and meet. The transparency that develops between the parties becomes an instrument for consortia to emerge and to eventually answer calls for innovation with appropriate visions for innovation projects. This paper introduces the problem of initiating innovation projects and describes the potential role of journalism as a metaphor for addressing the problem. The paper also describes our plans in designing an innovation journalism approach that we hope will enable requirements engineers to increase innovation potential and ease the launch of projects that bring about these innovations.

This paper refers to the term “implementation” as the process of integrating a new technology into established workfows. Especially in health care this has proven to be a very critical phase and many large-scale projects have failed on this very last mile. Although strategies such as requirements engineering, co-designing and user interaction design have been proposed to reduce the risk of end-user rejection and subsequently project failur. There is still no tool to analyze, predict and quantify user acceptance and identify critical areas which might be addressed before the start of the implementation phase in order to reduce resistance and increase the effectiveness and effciency.

Quality requirements, an important class of non-functional requirements, are inherently difficult to elicit. Particularly challenging is the definition of good-enough quality. The problem cannot be avoided though, because hitting the right quality level is critical. Too little quality leads to churn for the software product. Excessive quality generates unnecessary cost and drains the resources of the operating platform. To address this problem, we propose to elicit the specific relationships between software quality levels and their impacts for given quality attributes and stakeholders. An understanding of each such relationship can then be used to specify the right level of quality by deciding about acceptable impacts. The quality-impact relationships can be used to design and dimension a software system appropriately and, in a second step, to develop service level agreements that allow re-use of the obtained knowledge of good-enough quality. This paper describes an approach to elicit such quality-impact relationships and to use them for specifying quality requirements. The approach has been applied with user representatives in requirements workshops and used for determining Quality of Service (QoS) requirements based the involved users' Quality of Experience (QoE). The paper describes the approach in detail and reports early experiences from applying the approach.

SaaS cloud computing, in contrast to packaged products, enables permanent contact between users of a software product and the product-owning company. When planning the development and evolution of a software product, a product manager depends on reliable information about feature attractiveness. So far, planning decisions were based on stakeholder opinion and the customer's willingness to buy. Whether or not a feature actually is used was out of consideration. Analytics that measure the interaction between users and the SaaS gives product managers unprecedented access to information about product usage. To understand whether and how SaaS analytics can be used for product planning decision, we performed 17 in-depth interviews with experienced managers of SaaS products and analyzed the results analyzed with a mixed-method strategy. The empirical results characterize the relevance of a broad range of analytics for product planning decisions, and the strengths and limitations of an analytics-based product planning approach.

Recent Internet of Things (IoT) research has been aiming at interoperability of devices and the integration of sensor networks. The Future Internet - Private Public Partnership (FI-PPP) has created a whole array of different purpose-oriented modules with defined specifications, better known as Generic Enablers. This article gives an overview of legal, ethical and technical norms and standards to be considered when planning, developing and implementing modular medical architectures, integrating the Internet of Things (IoT) and Generic Enablers (GEs) in cutting edge, latest generation medical data networks.

Companies in the software business often distribute requirements engineering responsibilities over several roles. Product management has overall product responsibility and performs early-phase market-driven requirements engineering. Product development implements the product and performs late-phase solution-oriented requirements engineering. Such shared responsibility provides advantages in the utilization of specific knowledge, skills, and resources, but leads to problems of mutual understanding and coordination. Earlier research proposed a negotiation process, handshaking with implementation proposals, that allows product management and development to achieve agreed requirements understanding. The process found acceptance in industry, but the relative advantages compared with traditional requirements hand-off and analysis had not been understood yet. This paper fills this gap by describing a case of measuring requirements and design volatility and an architect's requirements understanding during requirements hand-off, analysis, and negotiation.

The design of the variability of a software product line is crucial to its success and evolution. Meaningful variable features need to be elicited, analyzed, documented and validated when an existing software or reference system evolves into a software product line. These variable features are the main discriminators between individual products and they need to reflect the needs of a large variety of stakeholders adequately. In this paper we present a novel approach, called feature unweaving, that supports the identification and extraction of variable features from a given graphical software requirements model. We have extended our aspect-oriented software product line modeling tool such that it supports feature unweaving: it takes a set of model elements that a domain requirements engineer considers to constitute a variable feature and automatically refactors the model into a semantically equivalent one in which the model elements belonging to this feature are grouped into an aspect. This allows the identification and modeling of variable features in an incremental style. It also substantially reduces both the intellectual and clerical effort required for constructing the variable parts of a software product line requirements model.

GREW'07 brings researchers and industry practitioners together to discuss the area of global product development from a requirements engineering and product management perspective. The workshop aims at analyzing selected challenges, which are put forward by accepted papers, in detail. The session discussions then lift the view in an attempt to identify the future needs with regards to research and study. Industry presence at the workshop is intended to ground the discussions of future research, helping to assure relevance and usefulness from both an industrial and an academic perspective.

Strong stakeholder networks are important for the success of engineering efforts. Such networks reflect the results of negotiation activities among stakeholders in terms of needs, capabilities, backing and knowledge. The larger and more distributed an engineering organization is, the more important it is to understand how such stakeholder networks are built and evolve. Social Goal Networks (SGNs) have been developed to answer an industrial need to understand stakeholder orchestration in a product management context.