How to Write PRDs for Product Managers
Non-Functional Requirements
What They Are
Non-functional requirements describe how well the product must perform its functions. They are the quality characteristics, constraints, and standards the product must meet alongside its core functionality.
They are not features. They are the conditions under which features must work.
A feature that works but loads in twelve seconds is not a working feature. A feature that works but is inaccessible to users with visual impairments is not a complete feature. A feature that works but exposes user data to unauthorised access is a dangerous feature. Non-functional requirements are what prevent these situations.
They are also the requirements most frequently left out of PRDs written by less experienced product managers. Their absence does not surface immediately. It surfaces during development when engineers ask questions that should have been answered in the document, or after launch when the product behaves in ways that were never specified but should have been anticipated.
The Core Categories
Performance requirements define how fast the product must respond and how much load it must handle.
Examples:
- The search results page must load within two seconds under normal network conditions
- The system must support up to 10,000 concurrent users without degradation in response time
- API response time must not exceed 500 milliseconds at the 95th percentile
Reliability and availability requirements define how consistently the product must be available and how it must behave when things go wrong.
Examples:
- The service must maintain 99.9% uptime during business hours
- The system must degrade gracefully when a third-party payment provider is unavailable, preserving user data and displaying a meaningful error message
Security requirements define how user data and system integrity must be protected.
Examples:
- All user passwords must be stored using industry-standard hashing
- Access to admin functions must require multi-factor authentication
- Personal data must be encrypted in transit and at rest
Accessibility requirements define the standards the product must meet to serve users with disabilities.
Examples:
- The feature must meet WCAG 2.1 AA standards
- All interactive elements must be operable via keyboard navigation
- All images must include descriptive alt text
Compliance and regulatory requirements define the legal and industry standards the product must adhere to.
Examples:
- The feature must comply with GDPR requirements for user data collection and deletion
- The payment flow must meet PCI DSS standards for handling cardholder data
Scalability requirements define how the system must behave as usage grows.
Examples:
- The architecture must support a tenfold increase in data volume without re-architecture
- The feature must function correctly across all major browsers and the two most recent versions of iOS and Android
Remember this: Non-functional requirements are not optional additions to a PRD. They are the difference between a feature that works in testing and a feature that works in production, at scale, for all users, without causing harm. Define them before development begins or pay the cost of defining them mid-build.