  Regulatory compliance is increasingly being addressed in the practice of
requirements engineering as a main stream concern. This paper points out a gap
in the theoretical foundations of regulatory compliance, and presents a theory
that states (i) what it means for requirements to be compliant, (ii) the
compliance problem, i.e., the problem that the engineer should resolve in order
to verify whether requirements are compliant, and (iii) testable hypotheses
(predictions) about how compliance of requirements is verified. The theory is
instantiated by presenting a requirements engineering framework that implements
its principles, and is exemplified on a real-world case study.
