Nordvik Region and Hansa Mutual: Conclusions for Two Organisations

In the autumn of 2026 two governing bodies asked the same question about the same role. Nordvik Region's regional director asked the chief information security officer for a role charter and a competence plan for the Region's single security architect before the 2027 budget was set, a commission recorded as AIDR-0500. Hansa Mutual's executive board asked the group CISO to show how architecture decisions would keep pace with agents that act in production, the claims-triage agent, the IT-operations agent and the SOC investigation agent HM-SEC-001, a request recorded as AIDR-0550. Every chapter since has shown part of the work that followed, and Chapter 25 told it as a year.

This chapter draws the work together. It sets out what each organisation decided across the book, what worked, what was hard, and the answer each gave to the body that asked. It compares the two artefact sets as they stand at the end of the year, gives each organisation a prioritised 24-month plan for its security architecture practice, explains why the plans differ, and records what remains unresolved. As the conclusion of Part VI, it concerns all four shifts: Shift 1, from documents to code; Shift 2, from gatekeeper to boundary designer; Shift 3, from periodic to continuous, at machine speed; and Shift 4, from sole author to conductor of an AI team. The same four shifts produced a contract-first plan in a single-post public authority that procures, and a delegation-first plan in a multinational team that builds.

Both organisations are fictional, and every decision in this chapter is a decision within the illustration. The events they respond to, the July 2026 incident and the regulations that bind them, are observable. The outcomes of their plans are expected, not observed, and each plan names the signals on which it would be revised.

The two 24-month security architecture plans side by side, Nordvik Region's contract-first plan and Hansa Mutual's delegation-first plan, by period, with the measures they share in the centre

Figure 26.1: The two 24-month plans by period: Nordvik begins by extending the deputy and keeping the stop path within budget and ends by reopening the agent-team question only if two people can supervise one, Hansa begins with review quality and patch velocity and ends by extending Level 3 Bounded only to further reversible drafting, and both share the charter, the catalogue, timed drills, the craft and the horizon register.

One question, two answers

The question both bodies asked was what the security architect must become. They asked it differently, and the difference shaped every answer that followed.

The regional director asked it of one post, before a budget, for a committee of elected members who answer to the public. The post had been converted in 2025 from a security coordinator post whose work was keeping policy documents, coordinating the annual penetration test and answering supplier questionnaires. It had a job description with no decision rights, a 2024 reference architecture that predated most of the AI estate, and controls mapped to ISO/IEC 27001 Annex A in a spreadsheet (23, ISO/IEC, 2022). The commission asked for two things, a charter and a competence plan, and implied a third: what the budget must pay for.

The executive board asked it of a team of six, because agents already acted in production and a fortnightly review board could not sit in the path of changes that agents proposed daily. Hansa's practice was already mostly code: a Structurizr workspace, policy as code with per-market overlays and a control catalogue of about 180 controls. The board asked for a demonstration, not a document: that architecture decisions would keep pace, and that people would remain accountable for them.

This book builds on the conclusion of AI Governance, Chapter 13, that governance as code does not remove forums but changes what they are for: pipelines enforce, observe and remember, forums decide appetite, policy, exceptions and residual risk, and NIS 2 Article 20 and DORA Article 5 anchor oversight in a trained management body (168, Nordqvist, 2026) (6, European Union, 2022) (9, European Union, 2022). Both answers apply that conclusion. Nordvik had too few forums and had to route decisions without creating new ones. Hansa had a forum in the wrong place and had to move it out of the path of routine change.

Nordvik Region: the answer to the regional director

What the Region decided across the book

The Region's decisions form a sequence, each depending on the one before. The charter ROLE-NR-SA-01, effective 1 January 2027 and endorsed by the regional director, gave the post its first written decision rights: to decide the stop-path and egress requirements in tender annexes, to veto an annex or an AI go-live without a stop path, subject to the CISO's recorded override, and to escalate within two working days (Chapter 4). Every right that would have let one person approve their own work became a recommendation to the CISO instead.

The 2024 reference architecture moved into the AI platform repository as a small model and four policies, starting from the pre-production checklist that was already code (AIDR-0501; Chapter 5). The Region extended generated threat modelling from the citizen-service assistant to the benefits-triage system, with TriageSoft's part shown as a container with contractual properties (Chapter 6). The control catalogue began with the controls the Region must verify in suppliers' systems (AIDR-0502; Chapter 9), and its first briefing to the regional executive committee tracked 24 controls: 9 verified, 13 declared and 2 failed, where declared meant that the supplier stated it and the Region had not yet checked it (Chapter 19).

The boundary decisions were mostly contractual. AIDR-0504 tied the contract, annex, exit plan and evidence schedule of each of the four supplier relationships to one decision, and the renewal annex for the benefits-triage system under tender NR-2026-117 was the first written fully as code (Chapter 20). The call-back rule CBR-NR-BEN-01 made changes to the benefits-triage system's model version, credentials and administrators depend on confirmation through a channel the supplier does not control (Chapter 8). The tier policy recorded as AIDR-0512 routed decisions without a standing board: pipeline gates for the few classes the Region can check by machine, the CISO with the enterprise architect for exceptions, and the regional executive committee for deployments that affect residents' rights (Chapter 17).

On the architect's own use of AI, the Region added the post to the small group allowed Mode 3 tools under MND-NR-01, on open-weight models on its reserved capacity (Chapter 12), and then decided not to build an agent team, extending the mandate with a research skill at Level 0 Advisory instead (AIDR-0503; Chapter 13). The competence plan rests on CMP-NR-01 and the learning path LP-NR-2027-01, financed in the 2027 budget with 15 per cent protected time, 20 training days and 48 hours of an external mentor (AIDR-0532; Chapters 21 and 22).

What worked

Three things worked. The first is that the contract turned out to be an instrument of architecture and not only of purchasing. Directive 2014/24/EU allows a contracting authority to set technical specifications and conditions for the performance of a contract, in Articles 42 and 70, and the Region used that room to write testable requirements, evidence obligations and a stop path the Region can exercise (18, European Union, 2014). AI Threat, Chapter 24, had already concluded that a stop path must lie outside the system it stops, and Nordvik turned that conclusion into a clause a supplier can be held to (171, Nordqvist, 2026). The architect cannot attend every purchase, so the standard annex became the instrument of delegation.

The second is that the catalogue made the Region's dependence visible. Before it existed, a supplier's assurance and a verified control looked the same in the management review. Afterwards, 13 of 24 controls were visibly declared, almost all of them supplier-held, and each was a negotiating position for the next renewal.

The third is the timed drill. The first drill of the benefits-triage stop path took 26 minutes against a budget of 15 because the managed security service provider held the runbook but not the credentials (Chapter 25). The result turned into a requirement in the next call-off under framework agreement NR-2025-044, and the October 2027 re-drill took 11 minutes.

What was hard

The single post was hard throughout, and it is the subject of the Region's conclusion. Every artefact, the annex, the catalogue, the exit tests and the threat models, depends on one person. The architect decides every threat-model candidate, so the AI architect samples a tenth of them each quarter (Chapter 6). The architect has no peer to learn from, so a neighbouring region's security architect assesses competence with the enterprise architect (Chapter 21). The role map showed the places where the same person proposes, holds and checks unless the CISO or the enterprise architect steps in (Chapter 16).

Two smaller difficulties also recur. Supplier boundaries remain declared until verification rights are negotiated, and procurement lead times mean that some annexes change only at renewal. And public-access rules shape every artefact: the charter states rights and limits rather than the weaknesses they address, threat models are classified before storage, and the briefing keeps operational detail in an annex that may be withheld (Chapter 19).

One inconsistency also had to be settled. Versions 1.0.0 and 2.0.0 of the mandate manifest MND-NR-01 allowed the Mode 3 tool to edit files at Level 2 Supervised, while the charter, which took effect on 1 January 2027, set Level 1 Assisted as the ceiling for the architect's own AI. The later instrument governed from that date, and the manifest's scheduled review in May 2027 aligned it as version 3.0.0 (Chapter 25), so the gap between the two instruments lasted four months and was never exercised.

The answer, and what the budget must fund

The Region's answer to AIDR-0500 has three parts. The charter is the first: it gives the post decision rights narrow enough that one person can hold them without becoming a bottleneck or a sole approver. The competence plan is the second: it argues the post's grading from what the post requires, Advanced in design and law, separately from what the holder shows today, which at the December 2026 assessment of CMP-NR-01 was Advanced in law on the stop-path requirement the architect wrote into tender NR-2026-117 and TriageSoft accepted, Practitioner in threat modelling and Foundation in code. At the September 2027 reassessment code had reached Practitioner and design was still below its target, and the stop-path requirement was verified within budget in the October 2027 re-drill.

The third part is what the budget must fund, and it is where the briefing asked the regional executive committee for decisions. It asked the committee to adopt the charter, to fund one post at the same grade so that the role is not a single point of failure, and to require the annex's evidence schedule in the renewal of NR-2026-117. The Region found the deputy where Chapter 22 looked for one: in the platform team, which runs the reserved capacity, the AI gateway and the only Mode 3 tools. The funded post backfills platform capacity so that one platform engineer can serve as designated deputy, following the same craft exercises as the architect (Chapter 15). This book builds on the conclusion of AI Governance, Chapter 14, that upskilling is the strategy and hiring is for scarce specialisms, and that assessment results are personal data whose use is agreed with employee representatives (168, Nordqvist, 2026). The Region upskills, because fixed pay scales and security vetting make hiring slow, and it agreed its assessment rules with the unions before the first assessment.

Hansa Mutual: the answer to the executive board

What the group decided across the book

Hansa's decisions concern delegation: which decisions leave the review board, who holds them instead, and how the group shows that people still answer for them. The charters ROLE-HM-* distributed authority among the head of security architecture, three domain architects and two embedded architects, separated the AI domain architect's rights over containment and identity from the AI architects' rights over guardrails and evaluation, and listed the change classes the board delegates to gates (Chapter 4). The platform team became the accountable implementer of the guardrails the architects design (Chapter 16).

The forum redesign is the centre of the answer. The team measured the fortnightly board over 13 sessions: of 187 items, 131 fell into five routine classes approved unchanged, 41 were exceptions or precedent and 15 were contested or beyond the board's mandate, and the median wait was 17 calendar days. The five routine classes became tier 1 gates after shadow running, the board became the security design authority reviewing on pull requests within five working days, and decisions beyond its mandate go to the group AI governance board (AIDR-0558; Chapter 17).

The machine-speed decisions followed. A delegated playbook replaced the change advisory board's role for known-exploited vulnerabilities, approved by the executive board and withdrawn by a policy check where its conditions lapse (Chapter 10). Recovery of the claims-triage agent became a rehearsed property in RCV-HM-CTA-01 and the experiment SCE-RC-007 (AIDR-0555; Chapter 11). The egress review after the July 2026 incident restricted the Frankfurt mirror to a signed allow-list (AIDR-0552; Chapter 7), and the group retired credentials shared across workloads, with time-limited exceptions (Chapter 8).

On the team's own AI, the agent team under MND-HM-01 drafts reviews, threat models, policies, evidence and research on pull requests, and named architects approve and merge (Chapter 13). The evidence-collection agent, a Mode 5 agent with its own read-only identity, acts at Level 3 Bounded only to refresh evidence links, under a decision the identity domain architect designed (Chapter 8). The response to rubber-stamping, AIDR-0556, introduced review tiers, a critique agent on a different model family, a cap on open proposals, seeded errors and a team-level approval-quality metric (Chapter 14). The UK and Swiss mappings came into the catalogue as overlays owned by the local security officers (Chapter 20), and patch velocity, containment test results and review quality joined the management reporting (AIDR-0559; Chapter 19).

What worked

Delegation to gates worked because the team measured before it delegated. The 70 per cent of items that the board had approved unchanged were the evidence that justified moving them, and shadow running showed that the gate rules reached the board's outcome on 57 of 61 items and were stricter on three of the other four. The board did not disappear; it was relieved of work it had never added value to.

Review tiers worked because they treated the summer's pattern as a failure of design rather than of people. The median time to approval on agent pull requests had fallen from about eleven minutes to under thirty seconds while rejections approached zero (Chapter 25). Approvals given in seconds are the rubber-stamping signal that AI Governance, Chapter 10, warned about (168, Nordqvist, 2026), and the research on automation complacency explains why attentive people drift into it when a system is usually right (107, Parasuraman & Manzey, 2010). The first quarterly report after the redesign showed a Tier 2 median of 22 minutes, a rejection rate of 17 per cent and 86 per cent of seeded errors caught (Chapter 19).

The evidence-collection agent worked within its narrow limits. Refreshing an evidence link is reversible and cheap to check, and internal audit samples the agent's work rather than repeating it (Chapter 9). The report for the fourth quarter of 2026 showed 121 of 180 controls verified, 52 declared and 7 failed; the page for the third quarter of 2027 showed 151 verified, 25 declared and 4 failed (Chapter 25). The share of verified controls is the measure the board now reads.

What was hard

Review throughput remained the binding constraint. Six architects cannot review in depth everything the agents draft, and the cap on open proposals turns that limit into a queue rather than a rubber stamp. The queue is the honest result, and it means that the agents' capacity is limited by human attention, which is the principle Chapter 13 stated for both organisations.

Consent was slow, and rightly so. Because the review agents read pull requests and can show who wrote what, the rollout of MND-HM-01 and the first review-quality report waited for works-council consultation in Germany and the Netherlands and union consultation in Sweden. Under the German Works Constitution Act, technical devices designed to monitor employees' behaviour or performance are subject to co-determination, in section 87(1) number 6 (22, Germany, 2001). The agreements recorded in AIDR-0566 and in the terms of AIDR-0556 make the metrics team-level only and exclude performance ranking.

The drills were humbling. The first timed stop of the IT-operations agent took 17 minutes against a budget of five (Chapter 25). The fix shortened task-scoped tokens to five minutes and made the deny rule at the policy decision point the first mechanism (Chapter 10); where earlier chapters give 15 minutes as the default, the later decision of five minutes applies to Hansa's agents. Patch velocity also started above its threshold, with a 90th percentile of 118 hours against 72 at the end of 2026 (Chapter 19), and came inside it, at 61 hours, only by the third quarter of 2027 (Chapter 25).

The regimes outside the EU were the last hard thing. The UK entity is supervised by the PRA, whose operational resilience policy requires insurers within its scope to identify important business services, set impact tolerances and show they can remain within them (228, Prudential Regulation Authority, 2021). The Swiss entity follows FINMA's expectations, which since December 2024 include guidance on governance and risk management for AI (218, FINMA, 2024). Neither regime maps one-to-one onto DORA or the AI Act, and the overlays carry that difference as data, entry by entry, as law or as group policy.

The answer to the board

Hansa's answer to AIDR-0550 is that architecture keeps pace with agents when the review board no longer sits in the path of routine change, when every agent proposal has a review tier computed before anyone reads it, and when evidence is generated rather than attested. It is also that the pace is bounded by people: by the number of architects who can review in depth, by the two architects whose competence records show AI-03 at Advanced, on which the evidence collector's Level 3 ceiling depends (Chapter 21), and by the agreements with employee representatives. The board receives the answer as indicators it can watch: decision latency, patch velocity, time to stop and review quality.

This book builds on the conclusion of AI Red Team, Chapter 28, that AI strengthens cyber defence when it acts inside a written mandate, at an autonomy level matched to the reversibility of its actions, on a platform where containment holds whatever anyone intends, and under continuous verification (170, Nordqvist, 2026). Hansa's answer applies the same conclusion to the architects' own agents.

The two artefact sets

The artefact set this book recommends is the same for both organisations; what each holds at the end of the year differs in scale and in what remains outside it.

Artefact	Nordvik Region at the end of the year	Hansa Mutual at the end of the year
Role charter	`ROLE-NR-SA-01`, one post, narrow vetoes, self-approval converted to recommendations	`ROLE-HM-*`, six charters, delegated change classes listed
Control catalogue	52 entries, supplier controls first, many still declared	About 180 controls, UK and Swiss overlays inside, evidence increasingly generated
Boundaries	Tender annexes as code, stop path the Region can exercise	Containment profiles per agent, signed mirror allow-list
Decision routing	Tier policy without a standing board (AIDR-0512)	Design authority with tier 1 gates (AIDR-0558)
Own AI	`MND-NR-01` version 3.0.0, Mode 3, edits at Level 1, research at Level 0, no agent team	`MND-HM-01` version 4, agent team, evidence collector at Level 3 for links only
Competence	`CMP-NR-01` reassessed, `LP-NR-2027-01`, deputy from the platform team assessed at Foundation	`CMP-HM-*` with two AI-03 Advanced holders, apprenticeship at the Polish service centre, hiring profile `HP-HM-2027-01`
Reporting	One-page briefing to the regional executive committee	Generated quarterly report to the executive board

The table shows an asymmetry. Nordvik had to build what Hansa already had, and Hansa had to remove what Nordvik never built.

Two 24-month plans

Both plans run from October 2027 to September 2029, in four periods of six months. Each measure has an owner, a dependency and a verification, so that the plan can be checked against what happened rather than against what was intended. This book builds on the conclusion of AI Threat, Chapter 32, that a register reaches the board as one page with at most three decisions and is reviewed on change (171, Nordqvist, 2026); the plans follow the same discipline.

Practical guide: building a 24-month plan for a security architecture practice

Purpose. Turn a year's decisions into a plan that a CISO can fund, a board can follow and an auditor can check.

Roles. The security architect or head of security architecture drafts; the CISO approves; the body that commissioned the work, a regional director or an executive board, endorses the decisions that need funding; internal audit or the audit committee receives the verification evidence.

Steps.

List every decision record of the year and mark each as done, in progress or reopened. Record numbering errors and conflicting details here and settle them by the later-dated decision.
For each of the four shifts, name the one constraint that most limits the practice today, such as the single post, review throughput or a regime outside the catalogue. Plan against constraints, not against the artefact list.
Order the measures by the constraint they relieve first, then by reversibility: reversible measures early, commitments that are hard to undo late and conditional.
Give each measure one owner by role, its dependencies, and a verification that produces evidence: a drill time, a share of verified controls, a competence record, a merged pull request.
Write the conditions under which an autonomy level may rise, as thresholds, and the signals on which the plan would be revised. Default: no autonomy increase without two consecutive quarters of review-quality evidence; adapt the thresholds to the organisation's risk appetite.
Keep the plan as code beside the charter and the catalogue, and review it each half-year and on any trigger it names.

Definition of done. Every measure has an owner, a verification and a period; at most three decisions go to the commissioning body; and every increase in autonomy is conditional on recorded evidence.

Worked example: the two 24-month plans as code

Illustrative example. Nordvik's plan is recorded with its conclusion as AIDR-0507. Its first measures relieve the single point of failure, and the agent-team question returns only when the conditions of the earlier deferral are met.

# plans/security-architecture-2027-2029.yaml (Nordvik Region, illustrative)
plan: PLAN-NR-SA-2027
decision_record: AIDR-0507
owner: security-architect
approved_by: chief-information-security-officer
period: {from: 2027-10-01, to: 2029-09-30}
constraint: single post, boundaries held through suppliers
measures:
  - id: M1
    what: Extend the deputy from a fifth of a post to a designated alternate for every protected path; peer review with a neighbouring region
    period: months-0-6
    owner: chief-information-security-officer
    depends_on: [AIDR-0540, AIDR-0542]
    verify: deputy runs the benefits-triage stop drill alone; second owner on every protected path
  - id: M2
    what: Keep the benefits-triage stop path within budget, including the MSSP break-glass credential (AIDR-0541)
    period: months-0-24
    owner: security-architect
    depends_on: [annex MS-1 to NR-2025-044]
    verify: quarterly out-of-hours drill at or under 15 minutes
  - id: M3
    what: Annexes as code for the staff assistant and the hosting provider
    period: months-6-12
    owner: security-architect
    depends_on: [NR-2026-031 renewal window]
    verify: annex merged; evidence schedule received each quarter
  - id: M4
    what: Reassess CMP-NR-01; design at Practitioner, code held at Practitioner
    period: months-6-12
    owner: chief-information-security-officer
    verify: unassisted design review and threat model assessed by the peer
  - id: M5
    what: Move supplier controls from declared to verified; MSSP annex at amendment
    period: months-12-18
    owner: security-architect
    verify: verified share of tracked controls at or above 60 per cent
  - id: M6
    what: Reopen the agent-team deferral against its triggers
    period: months-18-24
    owner: chief-information-security-officer
    condition: two people with evidenced competence can supervise agents
    verify: decision recorded either way
decisions_for_regional_director: [continue deputy funding, fund verification rights in renewals]
revise_on: [deputy post vacant, supplier change of control, Mode 5 agent in the estate]

Hansa's plan is recorded with its conclusion as AIDR-0561. Its first measures protect review quality and machine-speed properties, and the only autonomy increase is conditional.

# plans/security-architecture-2027-2029.yaml (Hansa Mutual, illustrative)
plan: PLAN-HM-SA-2027
decision_record: AIDR-0561
owner: head-of-security-architecture
approved_by: group-ciso
period: {from: 2027-10-01, to: 2029-09-30}
constraint: review throughput; UK and Swiss regimes
measures:
  - id: M1
    what: Hold review quality as proposal volume grows
    period: months-0-6
    owner: head-of-security-architecture
    verify: seeded errors caught at or above 0.85; Tier 2 median at or above 15 minutes; team level only
  - id: M2
    what: Extend the delegated patch playbook to the remaining segments
    period: months-0-6
    owner: domain-architect-platform
    verify: patch velocity p90 at or under 72 hours for two quarters
  - id: M3
    what: Keep the IT-operations agent stop path within its five-minute budget
    period: months-0-6
    owner: domain-architect-identity
    verify: quarterly stop-path test passes
  - id: M4
    what: UK and Swiss overlays with generated evidence; PRA impact tolerances mapped
    period: months-6-12
    owner: [uk-local-security-officer, ch-local-security-officer]
    reviewer: domain-architect-platform
    verify: overlay entries each labelled law or group policy; no attested-only entry for agent controls
  - id: M5
    what: Second reviewer pool; apprentice and embedded architects to AI-03 Advanced
    period: months-12-18
    owner: head-of-security-architecture
    depends_on: [AIDR-0566 terms, AIDR-0563 second service-centre architect if funded]
    verify: four architects hold AI-03 Advanced in their competence records
  - id: M6
    what: Level 3 Bounded for further reversible drafting and evidence actions only
    period: months-18-24
    owner: design-authority
    condition: M1 and M5 verified; consultation completed in DE, NL and SE
    excluded: [merge, mandate change, oracle change, any irreversible action]
    verify: mandate manifest change approved at Tier 3
decisions_for_executive_board: [fund the second reviewer pool, accept the Level 3 conditions]
revise_on: [review-quality metric below threshold, change in UK or Swiss regime, new Mode 5 agent]

Two features of the plans repay attention. Neither plan increases autonomy unconditionally: Nordvik's agent-team question waits for a second supervisor, and Hansa's Level 3 extension waits for review-quality evidence and a larger pool of reviewers. And both plans put their autonomy decisions last, after the measures that would make them safe.

Where they differ and why

The same four shifts produced different priorities because the two organisations hold different levers. Nordvik mostly procures, so its leverage is the contract; Hansa mostly builds, so its leverage is the platform. Under Shift 1, from documents to code, Nordvik builds a small catalogue whose first entries are controls in suppliers' systems, while Hansa completes a large catalogue by bringing the regimes outside the EU into it. Under Shift 2, from gatekeeper to boundary designer, Nordvik's boundary is a clause and an interface it controls on its own side, while Hansa's is a containment profile and a gate. Under Shift 3, from periodic to continuous, at machine speed, Nordvik specifies machine-speed properties that suppliers and the MSSP must deliver, while Hansa builds them and reports them to its management body. Under Shift 4, from sole author to conductor of an AI team, Nordvik's question is whether one person's judgement stays independent of one tool, while Hansa's is whether six people's review stays real as agents multiply.

The difference in people explains the order of each plan. A single post is a single point of failure with no one to learn from, so Nordvik's first measure extends the deputy and adds a peer. A team of six can mentor and rotate, but must keep judgement consistent across seven jurisdictions and two sites, so Hansa's first measure is review quality. Team Topologies describes enabling teams that help others acquire capabilities and platform teams that provide them as a service (83, Skelton & Pais, 2019). Hansa's architect at the Polish service centre works in the enabling mode; Nordvik's deputy comes from its platform team because that is where the Region's only engineering capacity lies.

The difference in law explains the rest. Nordvik answers to one national regime and to public-access and archives law, so its plan is constrained by procurement windows and by what may be published. As a deployer of a high-risk system, its obligations under Article 26 of the AI Act include assigning human oversight to people with the necessary competence and authority, which the Region meets largely through the design it requires of its suppliers (1, European Union, 2024). Hansa answers to DORA in its EU entities, where Article 28 requires a register of information on contractual arrangements with ICT third-party service providers, including the model providers its architects use (9, European Union, 2022), and to Solvency II's governance requirements (19, European Union, 2009), but also to the PRA and FINMA, which follow neither. Both read the Cyber Resilience Act's essential requirements mainly as the standard they ask suppliers to meet (12, European Union, 2024). These are architectural implications, not legal advice.

Across the usage modes

Usage mode	Nordvik Region's plan	Hansa Mutual's plan
Mode 1 Conversational assistants	Public material only, through the approved enterprise tool	Approved enterprise tiers with classification routing
Mode 3 Agentic work tools	`MND-NR-01` aligned to Level 1 Assisted; research at Level 0 Advisory	Agent team under `MND-HM-01`, drafting at Level 0 to Level 2
Mode 5 Autonomous production agents	None of its own; supplier Mode 5 risk held by contract, stop path the Region can exercise	Evidence collector at Level 3 Bounded for links; further reversible drafting only if conditions are met
Level 4 Autonomous	Not used	Not used for any architecture action

Nordvik's plan stays in Modes 1 and 3 for architecture work and governs supplier Mode 5 risk by contract. Hansa's plan extends Level 3 Bounded only to further reversible evidence and drafting actions, conditional on review-quality metrics. Neither uses Level 4 for an irreversible action, and neither uses it for architecture work at all.

What each can take from the other

Nordvik can take Hansa's habit of measuring before delegating. Its tier policy routes decisions, but it has not yet measured which supplier-control exceptions recur, and the measurement would show which could become a gate. Hansa can take Nordvik's habit of writing for a hostile reader. Nordvik's artefacts are written to survive public-access requests and archiving, and Hansa's review records, which the group CISO must show a supervisor and may one day show a court, would gain from the same discipline about what they state and what they omit.

What remains unresolved

Three problems remain open at the end of the book, and the plans address them without solving them.

The single point of failure. A deputy who is also a platform engineer reduces Nordvik's exposure, but does not remove it. The deputy can run the stop drill and hold the second owner on a protected path; the deputy cannot yet give the architect a second opinion of equal depth. Whether a public authority of Nordvik's size can sustain two security architecture posts within fixed pay scales is a question for its budget, not its architecture. Q10 asked how a single security architect in an authority that mostly procures can hold boundaries in systems that suppliers build and operate. The book's answer from Nordvik's case is partial: through a charter that delegates through the standard annex, a catalogue that shows what is declared and what is verified, and a stop path on the Region's own side. What it cannot answer is how that single architect is replaced when the post falls vacant.

Review throughput. Hansa's agents can draft more than six people can verify. The tiers, the cap and the seeded errors keep the review honest, but they do not increase its capacity. A larger reviewer pool is expected to help; whether the share of agent proposals that require deep review falls as gates mature is speculation, and the plan treats it as a signal rather than an assumption. Lisanne Bainbridge observed that automation leaves operators with the hardest tasks and the least practice (106, Bainbridge, 1983), and Hansa's degraded-mode days and unassisted reviews exist because that irony applies to architects too.

The regimes outside the EU. The overlays bring the UK and Swiss mappings into the catalogue, but they cannot make the regimes converge. That the AI Act will be incorporated into the EEA Agreement for Norway is expected; whether the UK or Switzerland will move closer to it is speculation, and Hansa's plan names a change in either regime as a trigger for revision rather than assuming one.

Q6, raised in Architecture as Code (Chapter 27), asked who is accountable for an architectural change that an agent proposed, drafted or merged (167, Nordqvist, 2025). The two organisations give the same answer in different records: the approver answers for the approval and the author of the gate answers for the gate, and the chain never ends in an agent (Chapter 4). Hansa shows it to a board and a supervisor through a signed review record per change; Nordvik shows it through a record that also survives public-access requests and archiving. Whether a court would accept these records as sufficient is not yet tested and remains open.

Nordvik Region and Hansa Mutual

Nordvik's conclusion, recorded as AIDR-0507, is that the post must hold boundaries through contracts and a small catalogue, that its first priority is to extend the deputy and build a peer network to reduce the single point of failure, and that it should not run an agent team until two people can supervise it. Hansa's conclusion, recorded as AIDR-0561, is that the review board's delegation to gates, review tiers for agent proposals and the evidence-collection agent let architecture keep pace with agents, but that review throughput and the UK and Swiss regimes remain the binding constraints. The comparison shows the same four shifts producing a contract-first plan in one organisation and a delegation-first plan in the other, and both plans rest on judgement that each organisation decided to keep deliberately: unaided threat models in Nordvik, unassisted reviews and seeded errors in Hansa.

Summary

Two governing bodies asked what the security architect must become, and two organisations answered. Nordvik Region answered the regional director's commission with a charter, ROLE-NR-SA-01, a competence plan built on CMP-NR-01 and LP-NR-2027-01, and a request to fund a deputy so that one post is no longer the only one. Hansa Mutual answered the executive board's request by moving the review board out of the path of routine change, computing review tiers for agent proposals, generating evidence instead of attesting it, and reporting decision latency, patch velocity, time to stop and review quality to the management body.

What worked was the instrument each organisation already had: the contract for Nordvik, the platform for Hansa. What was hard was the scarce resource each lacked: a second person for Nordvik, review capacity and regulatory convergence for Hansa. The 24-month plans follow from those constraints. Nordvik's is contract-first and begins by extending the deputy and keeping the stop path within budget; Hansa's is delegation-first and begins with review quality and patch velocity. In both, autonomy rises last and only on conditions recorded in advance, and the outcomes are expected, not observed.

The chapter concludes all four shifts for the two organisations. Shift 1, from documents to code, meant building a catalogue for Nordvik and completing one for Hansa. Shift 2, from gatekeeper to boundary designer, was a contract problem for one and a delegation problem for the other. Shift 3, from periodic to continuous, at machine speed, meant specifying machine-speed properties for Nordvik and building them for Hansa, and both found in timed drills that their stop paths were slower than their budgets. Shift 4, from sole author to conductor of an AI team, meant deferring an agent team in Nordvik and keeping review real in Hansa.

Three problems remain open: the single point of failure, review throughput and the regimes outside the EU, and the accountability for agent-authored change is shown in records whose standing before a court is untested. Chapter 27 places both organisations in the book's general conclusions and tests the thesis against what all the chapters found.

Sources

European Parliament and Council of the European Union. Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). (1, European Union, 2024)
European Parliament and Council of the European Union. Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive). (6, European Union, 2022)
European Parliament and Council of the European Union. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). (9, European Union, 2022)
European Parliament and Council of the European Union. Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act). (12, European Union, 2024)
European Parliament and Council of the European Union. Directive 2014/24/EU on public procurement. (18, European Union, 2014)
European Parliament and Council of the European Union (2009). Directive 2009/138/EC on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II). (19, European Union, 2009)
Federal Republic of Germany (2001). Betriebsverfassungsgesetz (BetrVG). (22, Germany, 2001)
International Organization for Standardization and International Electrotechnical Commission (2022). ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection — Information security management systems — Requirements. (23, ISO/IEC, 2022)
Skelton, M. & Pais, M. Team Topologies: Organizing Business and Technology Teams for Fast Flow. (83, Skelton & Pais, 2019)
Bainbridge, L. (1983). Ironies of automation. (106, Bainbridge, 1983)
Parasuraman, R. & Manzey, D. H. (2010). Complacency and Bias in Human Use of Automation: An Attentional Integration. (107, Parasuraman & Manzey, 2010)
Nordqvist, G. (2025). Architecture as Code. (167, Nordqvist, 2025)
Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. (168, Nordqvist, 2026)
Nordqvist, G. (2026). AI Red Team: AI as an Active Part of Cyber Defence in European Enterprises and Public Authorities. (170, Nordqvist, 2026)
Nordqvist, G. (2026). AI Threat: Are the Dystopias Coming True? Evidence, Risk and Response for European Enterprises and Public Authorities. (171, Nordqvist, 2026)
Prudential Regulation Authority (2021). Supervisory Statement SS1/21: Operational resilience: Impact tolerances for important business services. (228, Prudential Regulation Authority, 2021)
FINMA (2024). FINMA Guidance 08/2024: Governance and risk management when using artificial intelligence. (218, FINMA, 2024)