Enterprise AI Project Wiki · Requirements and business scenarios
User requirement
Also calledUser requirements · Requirements for use · End-user requirement · User-side requirement
User requirements are a set of specifiable and verifiable requirements for system use and the quality of use outcomes, derived from user needs, capabilities, and context of use. They state how users must be able to exchange information with a system to achieve goals and how effective, efficient, safe, accessible, or satisfactory the result must be for specified users, tasks, and environments.
User requirements govern how a system supports use, not how users obey a system
A user need explains what is necessary for an outcome; a user requirement converts that need, user capability, and context into a statement for design and evaluation. ‘An infrequent requester needs to know what is missing before submission’ remains a need. ‘Before submission, the service shall identify required evidence that is missing and present each missing item and its basis understandably’ begins to be a user-system interaction requirement.
‘The user must remember an eight-character code’ and ‘the user should find the button within five seconds’ are not good user requirements. The first may transfer design burden to a person; the second writes system performance as a user obligation. Requirements should constrain the system, service, or support arrangement so specified users can complete a task under real conditions.
User requirements cover both system behavior and quality in use. A workflow can submit successfully yet fail its user requirements when a screen reader cannot operate it, errors cannot be understood, batch work is too slow, or a consequential decision lacks confirmation.
The principal types of user requirement
Users care both that a task can be completed and that it is completed quickly, clearly, safely, and accessibly enough for real work. The first concern describes capability; the second describes quality in use. Recording both prevents a feature from existing while remaining impractical to adopt.
User-system interaction requirements
Specify interactions users require to recognize information, make inputs and selections, receive outputs, correct errors, withdraw, or recover. They state necessary interaction and outcomes without necessarily choosing controls or page layout.
System outputs and their attributes
Outputs require content, source, format, freshness, completeness, understandability, and actionable next steps. A decision notice must do more than appear; applicable users must understand the result, basis, and next action.
Use-related quality requirements
Specify effectiveness, efficiency, safety, satisfaction, accessibility, error prevention, or other human-centered outcomes for defined users, tasks, and environments and can become system-acceptance criteria.
Assistance and support requirements
When some users require help, alternative channels, training, or delegated service to reach an outcome, specify that support with the interaction rather than assume universal independent digital use.
Applicability and conditions
Bind each requirement to role, task, business object, device, channel, environment, data state, and important exceptions. Easy and fast without context do not create an executable specification.
Traceability to need and capability
Record the user need, observed capability or limitation, policy, and risk behind a requirement. Without an upstream reason, reassess whether it is a preference or unapproved design decision.
How to derive user requirements from user needs
A need explains why the current situation must improve; a requirement turns that need into conditions the solution can satisfy. Derivation is not a rewrite. It identifies tasks, inputs, outcomes, exceptions, and quality boundaries while retaining the link to the original user problem.
Confirm the need and its evidence
Use validated needs or needs with explicit confidence and check role, outcome, reason, research scope, and counterexamples. Do not jump from a feature request to a formal requirement.
Fix the context of use
State users, goals, tasks, devices, environments, channels, frequency, data, time pressure, accessibility needs, and risk so later requirements show where they apply.
Identify necessary interactions
Walk the scenario to find what users must see, enter, choose, confirm, correct, withdraw, receive, and hand over across nominal, insufficient-information, error, unauthorized, and recovery paths.
Define quality of the use outcome
Set risk-proportionate measurable conditions for task success, error prevention, understanding, time, burden, accessibility, and safety rather than choosing unsupported round-number thresholds.
Check other roles and constraints
Ensure serving one role does not disclose information, bypass duty separation, overload support, or break business rules, privacy, security, regulatory, and operational conditions.
Remain implementation-independent where useful
Specify necessary interaction and output attributes without locking components, vendors, controls, or algorithms unless a genuine fixed constraint exists; record design decisions separately.
Choose verification and evidence
Before baselining, state how inspection, analysis, demonstration, test, or user evaluation will verify the statement and specify version, environment, sample, participants, and expected outcome.
Review and approve together
Involve user representation, business, design, technology, testing, security, accessibility, and operations in proportion to risk, resolve conflict and infeasibility, and obtain authorized baseline approval.
How to write an implementable and verifiable user requirement
“The system should be easy to use” gives direction but tells design and test very little. An implementable statement names who completes which task under what conditions and makes the result and limits observable, while leaving room for the technical team to choose a solution.
Unique ID and one principal obligation
Make each statement independently referenceable and singular. Compound obligations connected by and make partial pass, retest scope, and change impact ambiguous.
Explicit responsible subject
Name the system, service, or component that shall act. Avoid support, user-friendly, intelligent, where possible, and other language that lacks responsibility and degree.
Trigger and preconditions
State when the requirement applies, the object and data state, and user role or authority instead of making every behavior unconditional.
Observable behavior or result
Use actions and outcomes that can be examined, such as display, accept, reject, retain, restore, notify, or complete, rather than an internal process masquerading as a user result.
Inputs, outputs, and boundaries
Specify information, source, permitted format, error handling, access, and exclusions and reference shared data definitions or business rules without copying them.
Quality threshold and tolerance
Where time, accuracy, completion, burden, or error matters, define object, conditions, statistic, sample, window, and tolerance—not merely a number.
Traceability and verification attributes
Connect need, scenario, risk, design, test, and acceptance and record method, owner, status, version, and change history.
What to review before baselining user requirements
Once baselined, requirements drive design, estimates, and acceptance. Discovering a wrong role, missing exception, or contradiction later is much more expensive. The review asks whether every sentence is reliable enough for downstream teams to act on.
- Is it necessary?
Trace it to an adopted user need, risk, policy, or objective and explain the consequence of deletion.
Check parent need, rationale, and exclusion decision.
- Is it correct and at the right level?
It constrains system use rather than the user and is neither a wish nor a prematurely fixed control or code path.
Check terminology, responsible subject, and design-decision record.
- Is it clear, singular, and unambiguous?
Business, design, development, and test readers reach the same interpretation, and one statement has one main obligation.
Check peer review, glossary, and playback.
- Is it complete and consistent?
Trigger, inputs, outputs, errors, access, and applicability are sufficient and do not conflict with other requirements, rules, or roles.
Check scenario coverage and conflict/dependency matrix.
- Is it feasible?
Technology, data, time, cost, law, and operations can support it, with assumptions confirmed or explicitly retained as risk.
Check experiments, estimates, dependencies, and assumptions.
- Is it verifiable?
A finite inspection, analysis, demonstration, or test can decide satisfaction without relying on unspecified opinion.
Check method, environment, sample, expectation, and tolerance.
- Is it bidirectionally traceable and modifiable?
It explains why it exists and locates design, implementation, and evidence; change impact can be isolated.
Check links, version, status, and change record.
A constructed example derived from a user need
The customer-independent procurement setting below shows one need becoming several verifiable requirements. The need does not disappear when split; every requirement should trace back to the original task and explain which part it satisfies.
Upstream need UN-07
An infrequent purchase requester preparing an unfamiliar category needs to know applicable rules, missing evidence, and sources before submission so procurement can evaluate the request.
URQ-21: missing-item feedback
When a purchase requester asks to submit a draft, the service shall check information and evidence required by the current rule version before writing submitted status and return each missing item, reason, and verifiable rule source.
URQ-22: no false approval
After the missing-item check passes, the service shall state that the result means only that submission conditions are met, not that purchasing is approved, and shall not create approval state or reserve budget.
URQ-23: accessible error recovery
For approved representative desktop, mobile, and assistive-technology combinations, requesters shall be able to return from each missing item to its input, retain existing data, and run the check again. Actual combinations and measures require approval.
Traceability and verification
All three trace to UN-07 and the submission scenario but use rule-coverage tests, state and denied-access tests, representative user tasks, and assistive-technology tests. Versions, rule samples, and participant coverage are recorded.
How to maintain a user-requirements baseline
Requirements can change, but their history must remain visible. The requester, originating need, approval, and affected design and tests should be traceable. When user work changes, the team can then update the right statement instead of rediscovering the whole system.
Create a requirements register
Record ID, statement, rationale, source, role, context, priority, verification, owner, status, version, and relationships instead of leaving requirements in prototype comments and chat.
Cover without duplicating
Use a need–scenario–requirement matrix to find omissions, duplication, and conflict. Reference shared quality rules instead of copying divergent versions into many stories.
Approve an identifiable baseline
Name the version used for estimate, design, test, and acceptance with approver, date, open assumptions, and deviations. Latest document is not a stable baseline.
Connect design without rewriting history
Design explains how each requirement is met and records trade-offs. When design finds a requirement infeasible or unnecessary, change it through governance rather than silently changing its meaning.
Bind verification and defects
Plan at least one verification route per requirement and reference requirement IDs in results and issues so closure shows which version and context were retested.
Control change and impact
When research, policy, process, vendor, data, or operations change, assess needs, design, interfaces, training, tests, cost, and release timing and obtain an authorized decision.
Review validity after go-live
Conformance does not prove the need remains met. Use task evidence, support, exceptions, excluded groups, and business outcomes to revise need and requirement baselines when necessary.
Observable user requirements for enterprise AI
“Accurate, natural, and intelligent answers” are difficult to implement and unstable to accept. AI requirements describe observable behavior: when to cite, when to admit uncertainty, when to stop and hand over, and which confirmation precedes an action. This places probabilistic capability inside an accountable process.
Make the basis of a conclusion visible
To decide whether an answer can be used, people often need the cited material, its version, and the period in which it applies. The requirement states which scenarios must show this information and how the system explains or stops when evidence is insufficient. “Answer accurately” describes neither behavior nor a way to check it.
Insufficient and conflicting information
On missing evidence, source conflict, knowledge limits, or low confidence, specify clarification, constrained answer, refusal, human takeover, or stopped action without invented completion.
Role and data boundaries
Require model, retrieval, and tools to use only data allowed by identity, role, object, and purpose and negatively test unauthorized queries, cross-tenant access, and prompt injection.
Output structure and permitted variation
For drafts, classification, extraction, recommendation, and decision support, define required fields, format, evidence, acceptable variability, and prohibited outcomes. Natural-language variation is not automatically failure.
Human oversight and takeover
Name who reviews, approves, refuses, or takes over, under which conditions, with which inputs and versions, and what the system stops when no qualified person is available.
Tool-action confirmation and side effects
For sending, writing, ordering, or approval, specify parameter source, preview, confirmation, limit, idempotency, authority, compensation, reversibility, and audit.
Evaluation conditions and statistics
Specify scenario strata, sample version, repetitions, parameters, knowledge and prompt versions, metric denominator, thresholds, tolerance, and hard-stop items so averages do not hide high-risk failure.
Change and degradation
Define reevaluation triggers for model, policy, knowledge, and tool changes and require limiting capability, non-AI fallback, suspension, or restoration to an approved state when requirements fail.
Concepts commonly confused with user requirements
User needs, business requirements, system requirements, and acceptance criteria become progressively more specific along one chain, but they are not interchangeable. User requirements retain the user perspective while becoming precise enough to allocate to systems and processes. Mixing levels either fixes technology too early or preserves wishes that cannot be verified.
| Related concept | How it differs from a user requirement |
|---|---|
| User need | A need is a solution-independent prerequisite for an outcome. A user requirement combines need, capability, context, trade-offs, and constraints into a statement for system-use design and evaluation. |
| A requirement imposed on users | Training, qualification, or operating discipline may constrain users, but user requirements in this ISO context are requirements for use of an interactive system to meet user needs, not commands to users. |
| User story | A story organizes actor, need, and goal into manageable work and may reference several requirements and criteria. A user requirement is a reusable and verifiable specification item. |
| Functional requirement | A functional requirement states system behavior. Interaction requirements can derive functions but also address how users recognize, enter, receive, correct, and control information and include quality in use. |
| Non-functional requirement | NFRs often cover performance, security, reliability, and other quality or constraints. Use-related quality concerns specified users, tasks, and environments; the sets overlap but are not identical. |
| System requirement | System requirements cover whole-system behavior, performance, interface, data, security, operations, and constraints. User requirements are a human-centered source within that wider specification. |
| Interface design | Design chooses controls, layout, flow, and feedback to satisfy requirements. One requirement can have many designs and should not freeze one without a real constraint. |
| Usability goal | A goal expresses direction. A use-related quality requirement specifies user, task, environment, measure, and evaluation condition sufficiently for assessment. |
| Acceptance criterion | A criterion applies requirements to a deliverable, version, environment, sample, and decision rule. A requirement must be verifiable but need not include the project's final sign-off process. |
Sources and scope
This entry explains user requirements for interactive systems, software, and enterprise AI: requirements derived from identified user needs and capabilities that specify user-system interaction and use-related quality. They are not requirements imposed on users and are not identical to raw user needs, user stories, business rules, business requirements, stakeholder requirements, a complete system specification, an individual functional requirement, interface design, a usability aspiration, or acceptance criteria. Some organizations use user requirement more broadly for customer or stakeholder requirements; every project must define its terminology. The actual baseline, thresholds, regulation, and acceptance authority require approval by authorized parties.
- ISO 25065:2019: common format for user requirements specifications covering interaction and use-related quality requirements; confirmed current in 2024
- ISO 9241-115:2024 terms: user requirements derive from needs and capabilities and include interaction and use-related quality requirements
- ISO/IEC/IEEE 29148:2018: requirements-engineering processes, information items, and specification content; confirmed current in 2024
- NASA Systems Engineering Handbook Appendix C: necessary, clear, feasible, implementation-independent, singular, traceable, and verifiable requirement review
- NASA Software Engineering Handbook SWE-050: unique IDs, shall statements, completeness, consistency, modifiability, measurement, peer review, and management
- NASA Technical Requirements Definition: transform stakeholder expectations into validated, bidirectionally traceable requirements ready for baseline
- GOV.UK Service Manual: derive specific stories, features, and content from researched user needs and retain traceability
- GOV.UK Service Manual: actor, need, goal, acceptance criteria, and manageable-delivery boundaries of user stories
- GOV.UK Service Manual: accessible implementation, assistive-technology testing, and component accessibility acceptance conditions
- NIST AI RMF Core: AI purpose, users, context, oversight, evaluation, feedback, appeals, deactivation, degradation, and recovery