Functional safety (IEC 61508) and the Cyber Resilience Act (CRA) demand the same foundation for any Embedded Linux product: requirements that are complete, unambiguous, and traceable end-to-end across the entire lifecycle. Yet in many open-source-based embedded projects, requirements live apart from the code — in proprietary, hard-to-audit tools or in documents disconnected from the Git history where the actual product (BSP, Yocto/Buildroot layers, kernel configuration, SBOM) evolves. This gap turns the compliance evidence chain into manual, error-prone reconstruction.

This contribution presents req_man, an open-source, AI-assisted frontend built on top of Doorstop, a Git-native requirements management backend. With Doorstop, requirements are stored as versioned YAML artifacts under Git control. As a result, auditability, diffability, baselines, and a complete change history are obtained by design rather than bolted on — properties the CRA effectively mandates over maintenance windows of at least five years. Because Embedded Linux development already lives in Git, this approach lets requirements, their traceability, and the source, build, and SBOM evidence coexist in the same repository and the same review workflow. The compliance story becomes a single, version-controlled, reviewable trace rather than a parallel paper trail.

req_man complements this foundation with an accessible web interface that lowers the entry barrier to disciplined requirements engineering. It supports elicitation, structured attribution of each item (source, rationale, acceptance criterion, verification method, status, baseline) and an end-to-end trace chain — Need → Requirement → Design/Module → Test/Review — that directly answers the traceability obligations of IEC 61508. Views such as “open items” and an end-to-end trace view make gaps and missing verification visible at a glance, and a lightweight review-and-baseline workflow lets teams freeze a defensible state before assessment or release.

Generative AI is integrated as an assistant, not an authority. It helps detect ambiguous, incomplete, or untestable requirements, proposes verification criteria, and suggests candidate trace links — while human accountability and the full traceability of every change remain intact in Git. We deliberately distinguish two roles of AI that are often conflated: AI as a feature within the tool (improving requirement quality), and AI as a means of producing the tool. req_man itself was created in an exploratory, dialogue-driven “vibe coding” process, which we report on honestly: for a trustworthiness-driven audience this raises a fair question — can a tool produced this way be justified in a safety- and security-critical context? We describe the architecture, quality-assurance, and auditability measures that were necessary precisely because of the AI-driven origin.

We demonstrate the approach on a worked case study and explicitly map the feature set to the evidence obligations of IEC 61508 and the CRA (security-by-design documentation, lifecycle change tracking, and traceability supporting vulnerability handling and SBOM-linked requirements). Finally, we discuss the limits candidly: AI hallucinations, reproducibility, validation effort, and the boundary conditions under which AI-assisted tooling and AI-assisted development are responsible in regulated Embedded Linux domains.

Key take-aways for the audience

■  A concrete, open-source, vendor-neutral way to make requirements traceability part of the existing Embedded Linux Git workflow rather than a separate silo — supporting digital sovereignty and independent auditability.
■  A practical mapping of requirements-management practices to specific CRA and IEC 61508 evidence obligations, including lifecycle change history and SBOM-linked requirements.
■  A realistic, critically reflected account of where generative AI helps in requirements engineering — and where human review remains non-negotiable.
■  Lessons learned from building a compliance-relevant tool via “vibe coding,” and the guardrails needed to keep such a tool trustworthy.

Short Bio:

Matthias Lehmann is Akademischer Oberrat (senior researcher and lecturer) at the Institute of Aircraft Systems (ILS) at the University of Stuttgart, where he has worked since 2003 on safety-critical aerospace systems, requirements engineering, and quality assurance. Before joining academia, he spent seven years as a software development engineer at Diehl Aviation, where he developed an Electronic Flight Control System (EFCS) for primary flight control and led the software team for the Integrated Modular Avionics (IMA) of the Airbus A380, certified to DO-178B Level A. His earlier career in telecommunications at Nortel/DASA included work on ETSI ISDN services in Germany and the USA. His expertise spans functional safety, certification standards (DO-178, ARP4754), and the disciplined, traceable engineering of dependable embedded software.