Non-functional requirements are addressed

Non-functional requirements define the quality bar your product must meet, not just its feature set. A PRD that requires WCAG 2.1 AA compliance means you have committed to accessibility for users with disabilities — omitting ARIA labels and semantic HTML is a functional failure against that commitment, not a cosmetic gap. A performance target of sub-2s load time is a user retention requirement backed by data: conversion drops measurably above that threshold. Security NFRs like encryption at rest are often compliance requirements under GDPR, HIPAA, or SOC 2. ISO 25010:2011 covers functional suitability and reliability jointly — both require that NFRs are demonstrably addressed, not just aspirationally listed.

Check your configuration files and src/ code for each NFR category:

# Performance: verify image optimization and caching are configured
grep -r 'next/image\|Cache-Control\|stale-while-revalidate' src/ next.config.js

# Accessibility: verify ARIA attributes are present on interactive elements
grep -r 'aria-label\|aria-describedby\|role=' src/components/

# Security: verify encryption and rate limiting configuration
grep -r 'encrypt\|rateLimit\|@upstash' src/ prisma/

For each unaddressed NFR, file a specific implementation task rather than a vague "improve accessibility" note. The Security Headers audit, Performance and Load Readiness audit, and Accessibility Fundamentals audit each cover their respective NFR domains in detail if you need a dedicated check.