Nordvik Region and Hansa Mutual: Conclusions for Two Organisations

Two fictional organisations have run through this book. Nordvik Region is a regional public authority in a Nordic member state of the European Union, with about 6,000 employees serving about 450,000 residents. Hansa Mutual is a mutual insurance group headquartered in Hamburg, with about 9,500 employees and entities in Germany, the Netherlands, Sweden, Poland, Norway, the United Kingdom and Switzerland. This chapter closes the running cases from the perspective of governance. For each organisation it sets out the starting point, the decisions taken across Chapters 2 to 22, what worked, what was hard and a plan for the next 24 months, and it then compares the two. It analyses the cases against the evidence of the chapters; the author's own judgements are kept for Chapter 24.

Figure 23.1: One jurisdiction, one policy and a contract-held core for Nordvik Region; a group baseline with market overlays and entity projections of one register for Hansa Mutual (the table below).

Overlay	Markets
EU entities	Germany, the Netherlands, Sweden, Poland
EEA entity	Norway, with the incorporation lag
Outside the AI Act and DORA	United Kingdom, Switzerland

Table for Figure 23.1: Hansa Mutual's market overlays.

Nordvik Region

Nordvik Region's case shows governance under a single legal regime, in which the depth of public-law duty, rather than the number of jurisdictions, sets the difficulty.

Starting point

Nordvik Region coordinates regional health and social care and public transport, and administers needs-based financial assistance for its municipalities. Under the AI Act it is a deployer of a high-risk system, because AI used to evaluate eligibility for essential public assistance benefits falls under Annex III point 5(a), which brings the deployer duties of Article 26, the fundamental rights impact assessment of Article 27 and registration as a public-authority deployer under Article 49 (1, European Union, 2024). Its usual legal basis for personal data is public task under Article 6(1)(e) of the GDPR, with special-category data under Article 9 in health and social-care contexts (2, European Union, 2016). Administrative law adds the duty to give reasons, public-access and archives law make most records disclosable, and procurement law governs almost everything it buys (9, European Union, 2014).

As Chapter 6 records, the Region's first assessment round found eleven AI services in use, three of them reached by staff without any review. A cautious authority discovered that it was already using more AI than it governed, and that most of it had arrived through suppliers.

Governance decisions across the book

The central system is the benefits-triage system, procured from TriageSoft under tender NR-2026-117, which ranks about 40,000 applications a month so that caseworkers handle the most urgent first; caseworkers decide every case. AIDR-0007 set its intended purpose, fairness thresholds and a retirement criterion for model version 3.2.0; AIDR-0011 designed human oversight; and AIDR-0018 replaced the model with version 4.0.0 without postcode features after a parity breach lasted longer than the retirement criterion allowed. The table summarises the governance layer the chapters added.

Part	Chapters	Decisions and artefacts
I Foundations	2 to 5	Usage-mode register; one regulatory position per system; principles weighted towards Principle 6; intake form for UC-2026-017; legal mandate note LM-2026-009
II Sovereignty and suppliers	6 and 7	Model-origin and supplier policy with a published approval matrix; vendor due-diligence questionnaire issued with the tender
III Risk, governance, trust and assurance	8 to 11	Risk tiering under Annex III point 5(a); staff assistant (AIDR-0211) reaching the opposite answer; policy treating an unknown tier as high; oversight specification; FRIA-2026-002; audit test procedure TP-AI-014
IV Organisation and leadership	12 to 17	Shared platform agreement with Eastby Municipality; escalation ending with the regional executive committee; consultation commitments NR-ALG-2026-007; portfolio entry UC-2026-061; reasons log and register entry NR-ALG-2026-003
V Experience	18 to 21	Cases 1 and 5 as mirrors and SyRI as warning; anti-patterns of a cautious buyer; decommissioning record NR-ALG-2022-011

Most of these artefacts are written to be read by residents and the ombudsman as well as by the pipeline, and several exist only because the Region procures rather than builds, such as the questionnaire drawing on the EU model contractual AI clauses (18, European Commission, 2023). The SyRI judgment (202, District Court of The Hague, 2020) explains why FRIA-2026-002 and the register entry are kept where an outside reviewer can read them: an authority that scores residents must be able to show its model and evaluation to a court.

Usage-mode profile

Nordvik Region's profile is deliberately narrow: three Mode 4 systems (benefits triage, the staff assistant and a citizen-service assistant), Mode 3 tools confined to a small platform team, and no Mode 5 agents. Its exposure sits at the two ends: Mode 0 and a Mode 2 pilot through suppliers and tenant permissions, and Mode 4 as a high-risk deployer.

What worked

Five things worked. First, because AIDR-0007 named in advance the condition for retiring the model, the parity breach behind AIDR-0018 was handled as a planned decision with a shadow period and an updated FRIA, not as a crisis. Second, oversight became a mechanism: a blind sample of five per cent, contributing factors rather than a bare score, alerts on override rates that are too low as well as too high, and a stop function that returns the queue to date order within a minute turned Article 14 into something TP-AI-014 can test. Third, the register entry and public FRIA summary of Chapter 17 are generated from the same descriptors as the deployed system, so the authority's public statements describe what is running.

Fourth, consultation was written as controls. The commitments on the staff assistant in Chapter 15, among them a ban on using usage logs for performance assessment, deletion of logs after 90 days and adoption figures only for groups of ten or more, could be verified rather than trusted, and adoption followed. The pilot answered 1,200 real guidance questions with a link to the correct section in 91 per cent of cases, and measured drafting time fell from 27.0 to 21.5 minutes per standard letter against a comparison group (Chapter 16). Fifth, limits were recorded honestly, including a consultation commitment that has no automated test.

What was hard

The public-law duties were hardest, because they apply to every decision, not to the AI system as such. Giving reasons a resident can understand required the reasons log of Chapter 17, separate from the technical logs of Articles 12 and 26(6) of the AI Act and retained as long as a decision can be appealed. A disparity for single-parent households was found by the quarterly test and corrected, but only after deployment.

Supplier dependence was the second difficulty. Its revision discipline lives largely in the contract, written slowly into tenders under Directive 2014/24/EU as transposed, and it depends on what TriageSoft will disclose about model versions, evaluation and incidents; the roles it must retain are a system owner, the team leaders who exercise oversight, and someone who can run the evaluation gates (Chapter 12). Skills were the third: the Region hires within fixed pay scales and shares its platform with Eastby Municipality partly to spread scarce specialists.

The fourth difficulty was residents' rights. A FRIA that identified children, paper applicants and people with limited language proficiency among the affected groups set obligations no technical control alone can meet, such as a real alternative channel; Article 86 of the AI Act gives an affected person the right to a clear and meaningful explanation from the deployer (1, European Union, 2024). The fifth was ambient and embedded AI: the Mode 2 pilot showed that an embedded assistant reads whatever each user can already reach, so tidying sharing permissions and sensitivity labels became a precondition for wider roll-out; the UK government's cross-government Copilot experiment in Chapter 18 likewise noted that such an assistant, which retrieves what a user can already access, may highlight files that user should not be able to reach (203, UK Government Digital Service, 2025).

Advantages and disadvantages

Nordvik Region's advantages are a single legal regime, a clear public mandate and a tradition of openness: one set of rules and one market surveillance authority mean that every conclusion resolves into one policy, one register and one escalation path, and accountability to elected politicians gives its forums a natural top tier. Its disadvantages are limited engineering capacity, long procurement cycles and exposure to supplier lock-in. It cannot generate much of the evidence it is accountable for, because the system that produces it belongs to a supplier, and retiring a procured system requires a new procurement.

A prioritised plan for the next 24 months

The order follows the conclusions of the book and the amended AI Act, under which the Annex III high-risk obligations apply from 2 December 2027 (27, European Union, 2026).

1. In the next six months, complete the inventory, including ambient AI, and make the activation of supplier AI features a contract change-control item. Test the triage stop function against a real incident timeline, and bring the platform team's Mode 3 tools under the curated catalogue and containment baseline.
2. By December 2027, close every gap between the deployer obligations of Article 26 and the evidence obtainable from TriageSoft and confirm that the Article 49 registration and Article 27(3) FRIA notification are current.
3. Over the full period, decide on the evidence whether to scale the Mode 2 pilot; rehearse an exit from the triage supplier on paper at least once, since the records show no such rehearsal; renew Article 4 literacy for about 6,000 employees; and hold the first joint annual review of the staff-assistant commitments in April 2027.
4. Throughout, start no Mode 5 use case unless containment, a stop authority and evaluation evidence are in place and the regional executive committee has decided it as a new use case.

Hansa Mutual

Hansa Mutual's case shows governance under seven legal regimes, in which the difficulty is less the depth of any single duty than keeping one set of decisions consistent across jurisdictions whose law, supervisors and labour arrangements differ.

Starting point

Hansa Mutual writes property and casualty, motor, and in some markets life and supplementary health insurance. Its headquarters, group IT and shared AI platform are in Hamburg. Its Polish entity is a claims service centre for the German, Dutch, Swedish and Norwegian entities, and its subsidiaries in the Netherlands, Sweden, Norway, the United Kingdom and Switzerland each answer to their own supervisor; the UK and Swiss entities keep claims handling at home but use the group platform in Germany. Under the AI Act the group is both provider and deployer of the systems it builds on vendor models, and its underwriting-support model for life and health products is high-risk under Annex III point 5(c) (1, European Union, 2024).

Governance decisions across the book

The best documented system is the claims assistant, a retrieval-augmented generation system over policy wordings used first by about 320 claims handlers. AIDR-0021 chose retrieval over fine-tuning on the evidence of a comparison and kept life and health products out of scope, because Annex III point 5(c) would make them high-risk.

Part	Chapters	Decisions and artefacts
I Foundations	2 to 5	Usage-mode register covering every mode; regulatory position with a market dimension; exception EXC-0004 to the reproducibility principle; readiness checklist with market-specific items
II Sovereignty and suppliers	6 and 7	Model-origin assessment GEO-2026-017; exit plan EXIT-004, drilled twice; contract checklist finding four clauses missing and eight with gaps; AI providers in the DORA register
III Risk, governance, trust and assurance	8 to 11	Register entry with an applies_in block; deployment policy evaluating group rules and each market overlay; Article 50 notices per market; incident record for 212 clauses that lost their validity dates
IV Organisation and leadership	12 to 17	Hub-and-spoke topology with a market liaison and consultation gate per entity; decision minute DEC-2026-031 with a recorded dissent; exception EXC-2026-012; entity report profiles
V Experience	18 to 21	The bank and the manufacturing group as mirrors; its own anti-pattern examples; declared-intent intake UC-2026-052

Almost every artefact carries a market dimension, and many record provider rather than deployer duties. Its contract and exit artefacts answer to Articles 28 and 30 of DORA (3, European Union, 2022), and its fairness tests to the European insurance supervisor's expectations (185, EIOPA, 2025). Its most instructive artefacts bound the group's own speed, such as a deployment policy that fails a release for Norway alone.

Usage-mode profile

Hansa Mutual uses every mode. Mode 4 covers the claims assistant, the claims correspondence assistant and the high-risk underwriting-support model. Mode 5 covers the claims-triage agent (AIDR-0024), which began as an assistant recommending a route for a handler to confirm and went back through intake as a new decision when it became an agent, and the IT-operations agent with write access to production (AIDR-0027). Mode 0 to Mode 3 are all in use, so the profile is no longer a choice but a fact the group must govern, with a market dimension in every mode.

Seven jurisdictions: where the law differs

Five patterns fragment the law under which the same system runs.

EU instruments apply directly but are supervised nationally. In the German, Dutch, Swedish and Polish entities, the AI Act, the GDPR and DORA apply as regulations, and Solvency II sets the system of governance for insurers under Article 41 (184, European Union, 2009). But market surveillance, sandboxes and penalties are organised nationally under Articles 57, 70 and 99 of the AI Act, and financial supervision is national, so the same claims assistant answers to BaFin, to DNB and the AFM, to Finansinspektionen and to the KNF, each with its own expectations.

National derogations change the data rules. The group has one lead supervisory authority under Article 56 of the GDPR, but Article 88 lets member states set more specific rules for employee data and Article 9(4) further conditions for health data (2, European Union, 2016).

Labour law differs by country. The co-determination rights of Chapter 15 differ between the German, Dutch and Swedish entities. Article 26(7) of the AI Act adds a duty for deployers who are employers to inform workers' representatives before a high-risk system is used at the workplace (1, European Union, 2024).

Norway follows through the EEA Agreement, with a lag. EU acts apply in Norway only once incorporated into the EEA Agreement by a decision of the EEA Joint Committee (186, EFTA, n.d.), and the AI Act was still under scrutiny for incorporation at the time of writing (187, EFTA, n.d.), so the group tracks incorporation as a dated trigger rather than assume alignment.

The United Kingdom and Switzerland sit outside the AI Act and DORA. The UK follows a sector-led approach in which existing regulators apply cross-cutting principles to AI (188, DSIT, 2023). Switzerland applies its revised Federal Act on Data Protection (190, Swiss Confederation, 2020) and FINMA's expectations for governance and risk management of AI (192, FINMA, 2024). Transfers from the EU entities rely on the Commission's adequacy decisions for the United Kingdom, renewed in December 2025 until December 2031 (189, European Commission, 2025), and for Switzerland (191, European Commission, 2000).

How the group governs the fragmentation

The book's answer has four interdependent parts. The first is one group governance board with a bounded mandate: the board in Hamburg decides the group baseline, the risk appetite and the decisions that the tiers of Chapter 13 route to it, but its terms of reference say what it cannot decide alone: each subsidiary board keeps the duties Solvency II places at entity level, the UK and Swiss boards answer to their own supervisors, and a group decision becomes final in a market only when that entity's consultation is recorded.

The second is policy as code with market overlays. The group policy expresses what holds everywhere, and an overlay per market, maintained by the market liaison, adds what differs, from Norway's incorporation status to retention periods and consultation procedures. An overlay may add a control but never remove a group one, and where an instrument does not apply as law, the group applies its controls as policy and labels them so.

The third is entity reporting as projections of one register, labelling each obligation as law or group policy (Chapter 16). The fourth is per-market evidence: the evidence manifest of Chapter 11 is generated once and projected per supervisor. None of the four removes the fragmentation; together they make it explicit and testable, so that a change in law becomes a change to one overlay, reviewed as a pull request.

What worked

The decision records worked because they recorded evidence, not opinion: AIDR-0021's comparison and the recommend-only pilot behind AIDR-0027 settled questions that would otherwise have been argued from preference.

The exit plan worked because it was drilled: EXIT-004's first drill in April 2026 took nine hours and exposed a GPU quota too low for the second source, and the second drill in October switched in four hours (Chapter 6). And EXC-2026-012 let the claims correspondence assistant scale before its complaint-rate evidence existed, but only to two of five claims regions, with an expiry date and automatic reversion.

What was hard

Contracts were hard. Chapter 7 found audit rights limited to remote audit, which falls short of the unrestricted rights of access, inspection and audit that Article 30 of DORA requires for critical or important functions (3, European Union, 2022). A contract signed by the group but relied on by seven entities must also carry transfer terms that differ by entity, and Article 49 of Solvency II keeps each insurance entity fully responsible for what it outsources (184, European Union, 2009).

The legal fragmentation was harder than the single-market worked examples show. At the Polish service centre, a claims-triage agent there processes data subject to several national rules on health data and employee monitoring, serves claims handlers whose representatives sit in other countries, and works for a Norwegian entity where the AI Act is still group policy. The agent's permissions, log retention and consultation record must therefore vary by the market of the claim, not by the location of the server.

Consultation was hard because a group roll-out moves at the pace of its slowest consultation. And although both Mode 5 agents operate within approval policies, deny-by-default permissions and stop paths, the group's forums must hold stop authority for workloads that act at machine speed in several jurisdictions at once.

Advantages and disadvantages

Hansa Mutual's advantages are scale, skills and the ability to build, so it can run governance as code end to end and generate the evidence its supervisors ask for. Its disadvantages are legal fragmentation, the tension between one baseline and national requirements, labour arrangements that differ by country, data flows across the Polish service centre and the UK and Swiss adequacy boundaries, and the governance weight of the agency it grants. It also carries provider obligations for the systems it builds and, as a deployer of its Annex III point 5(c) system, a fundamental rights impact assessment under Article 27(1) (1, European Union, 2024).

A prioritised plan for the next 24 months

1. In the next six months, write the market overlays fully as code, starting with the Norwegian incorporation trigger and the UK and Swiss adequacy dependencies; name stop holders in each market for the Mode 3 and Mode 5 agents, with a group stop path that does not depend on the systems it stops; and close the contract and exit-plan gaps.
2. By December 2027, bring the underwriting-support model fully under the high-risk regime in every EU entity, extending the early application agreed for Sweden in DEC-2026-031, complete the Article 27 assessments, and generate per-market evidence views for every supervisor.
3. Over the full period, expand agent autonomy only through intake and on containment and evaluation evidence; drill every exit plan twice a year; complete consultation for the embedded assistant in the Netherlands, Norway and Switzerland before enabling it there; and review the overlays whenever a national rule, adequacy decision or EEA incorporation status changes.

Platform and security conditions in brief

These conclusions rest on platform and security work this book treats only in outline, above all containment that does not depend on intent, whether the actor is an attacker whose estimated mean time to exploit has fallen to minus seven days, while adversaries integrate AI to accelerate the attack lifecycle (81, Mandiant, 2026), or the organisation's own agent. The incident of Chapter 19 showed what happens when it fails: a credential shared by many evaluation workloads, and an early alert after which on-call staff advised that stopping the evaluation run was not required; OpenAI's plan of action includes clarifying decision rights for pausing or terminating affected activity (86, OpenAI, 2026). Governance decides who holds that decision; the platform makes it executable.

The two roadmaps as code

Worked example: Nordvik Region's and Hansa Mutual's governance roadmaps

Illustrative example. The two roadmaps record each organisation's plan for November 2026 to October 2028, approved by merge and checked by a pipeline against the inventory and the register. The roadmap identifiers and dates are invented.

# roadmaps/nordvik-region-governance-2026-2028.yaml (illustrative)
roadmap: NR-GOV-RM-2026
organisation: Nordvik Region
approved_by: regional-executive-committee
period: {from: 2026-11, to: 2028-10}
jurisdictions: [national-public-law]
modes_excluded: [5]
items:
  - id: NR-RM-01
    horizon_months: [0, 6]
    action: Complete inventory including ambient AI; supplier AI features off by default
  - id: NR-RM-02
    horizon_months: [0, 6]
    action: Test the triage stop function against a real incident timeline
    decision_records: [AIDR-0011]
  - id: NR-RM-03
    horizon_months: [6, 13]
    action: Close deployer evidence gaps with TriageSoft before 2027-12-02
    decision_records: [AIDR-0018]
    assessments: [FRIA-2026-002]
gates:
  - No Mode 5 use case without containment, a stop authority, evaluation evidence and a committee decision

# roadmaps/hansa-mutual-governance-2026-2028.yaml (illustrative)
roadmap: HM-GOV-RM-2026
organisation: Hansa Mutual
approved_by: executive-board
period: {from: 2026-11, to: 2028-10}
jurisdictions:
  eu: [DE, NL, SE, PL]
  eea: [NO]
  outside_eu_eea: [UK, CH]
items:
  - id: HM-RM-01
    horizon_months: [0, 6]
    action: Market overlays as code with EEA incorporation and adequacy triggers
    triggers: [eea-incorporation-ai-act, adequacy-uk, adequacy-ch]
  - id: HM-RM-02
    horizon_months: [0, 6]
    action: Stop holders named per market for Mode 3 and Mode 5 agents; group stop path
    decision_records: [AIDR-0024, AIDR-0027]
  - id: HM-RM-04
    horizon_months: [6, 13]
    action: High-risk regime and Article 27 assessments for underwriting support in all EU entities
    decisions: [DEC-2026-031]
gates:
  - Agent autonomy expands only through intake, on containment and evaluation evidence
  - An overlay may add a control but never remove a group control

The jurisdictions field is a single value for Nordvik Region and a structured map for Hansa Mutual, which is the whole difference between the two organisations in one line. The gates are the commitments each will not trade for speed: for Nordvik Region, no autonomous agents until the controls and the elected committee's decision exist; for Hansa Mutual, no expansion of agency without evidence and no overlay that weakens the group baseline.

The two organisations compared

Theme	Nordvik Region	Hansa Mutual
Legal regime	One jurisdiction under public law	Seven jurisdictions: EU, EEA and outside both; financial supervision
Role under the AI Act	Mostly deployer; high-risk under Annex III point 5(a); registers under Article 49	Provider and deployer; high-risk under Annex III point 5(c)
Usage modes	Modes 0 to 4; no Mode 5	Every mode, including Mode 5 agents
Sovereignty and suppliers	Leverage through procurement; risk of lock-in	Leverage through the platform; exit plans drilled
Forums	Tiers end with an elected committee whose minutes are public	Group board in Hamburg; entity boards and consultation per market
Change	One co-determination regime; commitments as controls	Separate consultation in each country
Evidence and reporting	One evidence pack for audit and the public	One manifest projected per supervisor
Public accountability	Owed to residents: reasons, register, FRIA summary	Owed to supervisors and policyholders, market by market

The book's conclusions hold for both organisations but resolve differently. For Nordvik Region the main lever is the contract and the main risk is to residents' rights and public trust. For Hansa Mutual the main lever is the platform, and the main risks are legal fragmentation, operational resilience and the agency it grants; each answer is manifold, with an overlay for every market and evidence for every supervisor.

Across the usage modes

Mode	Nordvik Region	Hansa Mutual
Mode 0	Supplier-feature register; activation as a contract change	Supplier-feature register per entity
Mode 1	One approved enterprise tool	Enterprise tiers under group contracts
Mode 2	Controlled pilot; permissions tidied first	Entity-by-entity roll-out behind a consultation gate
Mode 3	Small platform team; curated catalogue	Engineering-wide; catalogue and containment baseline
Mode 4	Procured high-risk system; FRIA	Built systems with provider obligations
Mode 5	None; gate in the roadmap	Two agents; stop holders per market

What each organisation can take from the other

Nordvik Region's practice of generating public transparency from the same descriptors as its deployed systems would serve Hansa Mutual where policyholders ask how an underwriting decision was supported. Hansa's drilled exit plans would serve Nordvik Region, whose records show no rehearsal of an exit from its triage supplier, and Hansa's exceptions with expiry and automatic reversion would give the Region's waivers a firmer shape.

The similarities matter as much as the differences. Both organisations meet AI they did not choose, both depend on general-purpose AI models from providers outside their jurisdiction, both find that literacy and shadow use do not resolve themselves, and both found that the artefacts which made the most difference recorded a decision in advance: a retirement criterion, a stop authority, an exception with an expiry date, a consultation commitment written as a control, and an exit plan that had been drilled.

Summary

Nordvik Region is a cautious public authority with a single legal regime, a procured high-risk core and a narrow usage-mode profile. Its decision records from AIDR-0007 to AIDR-0018 and FRIA-2026-002 show a lifecycle governed by evidence; its hardest problems are public-law duties, supplier dependence and scarce skills. Its next 24 months are about inventory, supplier evidence before December 2027, a tested stop function and resisting Mode 5 until the controls and the elected committee's decision exist.

Hansa Mutual is a multinational mutual insurance group that builds, uses every usage mode and operates under seven legal regimes. Its answer to fragmentation is one group board with a bounded mandate, policy as code with market overlays, entity reports as projections of one register and per-market evidence, and its next 24 months are about overlays as code, stop holders per market, contract and exit gaps, and the high-risk regime across every EU entity.

Chapter 24 turns to the author's personal reflections on each part, and Chapter 25 draws the book's conclusions together for these two organisations.

Sources

1. European Parliament and Council of the European Union. Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union, 12 July 2024. (1, European Union, 2024)
2. European Parliament and Council of the European Union. Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation). Official Journal of the European Union, 4 May 2016. (2, European Union, 2016)
3. European Parliament and Council of the European Union. Directive 2014/24/EU on public procurement. Official Journal of the European Union, 28 March 2014. (9, European Union, 2014)
4. European Commission (2023). EU model contractual AI clauses to pilot in procurements of AI. Public Buyers Community, Procurement of AI community, 2023 (updated 2025). (18, European Commission, 2023)
5. District Court of The Hague (2020). Judgment of 5 February 2020, NJCM et al. v. the State of the Netherlands (SyRI), case C/09/550982 / HA ZA 18-388, ECLI:NL:RBDHA:2020:1878 (English translation of ECLI:NL:RBDHA:2020:865). Rechtspraak.nl. (202, District Court of The Hague, 2020)
6. UK Government Digital Service (2025). Microsoft 365 Copilot Experiment: Cross-Government Findings Report. GOV.UK, 2 June 2025. (203, UK Government Digital Service, 2025)
7. European Parliament and Council of the European Union. Regulation (EU) 2026/1744 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI). Official Journal of the European Union, 24 July 2026. (27, European Union, 2026)
8. European Parliament and Council of the European Union. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). Official Journal of the European Union, 27 December 2022. (3, European Union, 2022)
9. European Insurance and Occupational Pensions Authority (2025). Opinion on Artificial Intelligence governance and risk management. EIOPA, 6 August 2025. (185, EIOPA, 2025)
10. European Parliament and Council of the European Union (2009). Directive 2009/138/EC on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II) (recast). Official Journal of the European Union, L 335, 17 December 2009. (184, European Union, 2009)
11. European Free Trade Association. Q&A about the EEA Agreement. EFTA. (186, EFTA, n.d.)
12. European Free Trade Association. EEA-Lex factsheet 32024R1689: the Artificial Intelligence Act. EFTA. (187, EFTA, n.d.)
13. Department for Science, Innovation and Technology and Office for Artificial Intelligence (2023). A pro-innovation approach to AI regulation (CP 815). UK Government, 29 March 2023. (188, DSIT, 2023)
14. Swiss Federal Assembly (2020). Federal Act of 25 September 2020 on Data Protection (Data Protection Act, FADP), SR 235.1. Fedlex, in force 1 September 2023. (190, Swiss Confederation, 2020)
15. Swiss Financial Market Supervisory Authority (2024). FINMA Guidance 08/2024: Governance and risk management when using artificial intelligence. FINMA, 18 December 2024. (192, FINMA, 2024)
16. European Commission (2025). Commission Implementing Decision (EU) 2025/2574 amending Implementing Decision (EU) 2021/1772 on the adequate protection of personal data by the United Kingdom. Official Journal of the European Union, 23 December 2025. (189, European Commission, 2025)
17. European Commission (2000). Commission Decision 2000/518/EC on the adequate protection of personal data provided in Switzerland. Official Journal of the European Communities, L 215, 25 August 2000. (191, European Commission, 2000)
18. OpenAI (2026). OpenAI – Hugging Face Incident Technical Report. 26 August 2026. (86, OpenAI, 2026)
19. Mandiant (2026). M-Trends 2026: Data, Insights, and Strategies From the Frontlines. Google Cloud Blog, 23 March 2026. (81, Mandiant, 2026)