arXiv: Reverse Engineering Compliance: A Dual-Graph Verification Framework for Auditing Legacy IT Security Concepts

This publication introduces a novel verification framework, the Dual-Graph Verification Framework, designed to audit legacy IT security systems for compliance with modern AI safety standards. The paper proposes a method to reverse-engineer existing security controls and map them onto a dual-graph structure, allowing compliance teams to identify gaps between legacy configurations and current regulatory requirements, particularly those emerging under the AI Act and related EU digital frameworks. While not a regulatory change itself, this academic work signals a growing expectation that organizations must systematically validate whether older IT security architectures can support new AI governance obligations.

The framework is most relevant for financial services, critical infrastructure operators, and large technology firms that maintain legacy IT systems while deploying or integrating AI tools. Sectors subject to the EU AI Act, NIS2 Directive, or DORA will need to assess whether their existing security controls can be reliably audited against AI-specific requirements such as robustness, transparency, and human oversight. Compliance teams in regulated industries should pay attention to this methodology as it offers a structured approach to bridging legacy security with emerging AI compliance demands.

Compliance teams should first review their current IT security audit processes to determine if they can accommodate AI-specific verification criteria. Next, they should consider piloting a dual-graph mapping exercise for a critical legacy system to identify potential compliance gaps. Finally, they should monitor whether regulatory bodies or standards organizations adopt similar verification approaches, as this could influence future audit expectations for AI safety and legacy system interoperability.