The New Landscape: Who Acts, With Whose Identity, Under Whose Decision

An email never arrives. A supplier has sent Nordvik Region's procurement unit a revised offer before a deadline, and the message sits in a quarantine folder because a classifier in the Region's email gateway scored it as suspicious. The gateway's vendor switched the classifier on in a product update. Nobody at the Region chose it or set its threshold, and when the procurement officer asks who decided that this message should be held, the honest answer is that nobody did. The scene is illustrative, drawn from the model of Nordvik Region that runs through this book.

That folder is the smallest example of the landscape this book is about. A piece of software acted, with an identity of its own rather than a person's, at the highest degree of autonomy there is, on something that mattered to someone, and no record says who was accountable. This chapter defines that landscape in plain words before Chapter 4 teaches the notation for drawing it. It covers what it means that architecture has become code, that AI works beside people and that AI works as agents, and it introduces by name, each from a scene, the terms the rest of the book depends on.

Figure 3.1: Hansa Mutual's seventeen AI uses on 1 January 2027, drawn as marks on a grid of autonomy (columns) and reversibility (rows), in the notation Chapter 4 explains. Illustrative: rendered from landscape/models/hansa_mutual.yaml.

Hansa Mutual is the book's second illustrative organisation, an insurance group, and Figure 3.1 is its landscape. Read two things from it now. There are seventeen marks, not one box labelled "AI". And the grey square at the far right, HM-AMB, has nothing above it, where every other mark carries a small grey circle. That circle is the seat, the place where the notation draws the name of the person who decides about the unit. The square is Hansa Mutual's version of the quarantine folder, and the missing circle is the missing name.

Architecture became code

In the autumn of 2026 the single security architect at Nordvik Region (illustrative) inherited a security reference architecture document last updated in 2024. It lived in a document store beside the repository where the Region's AI platform was built, while the AI estate it was meant to govern was already described as files in that repository, with tests that ran on every change. In November the architect moved what was still true of the document into the repository, as a model of the estate and four policies a machine could check, and retired the rest.

That move is what Architecture as Code means. The architecture of an organisation's systems used to be described in documents and diagrams that were out of date by the time they were approved. Architecture as Code keeps the description as text files in version control, the store in which software is kept. Every change is dated, attributed and reviewable, tests fail when the description and the reality disagree, and a broken rule stops a release instead of being noted in a report. A document can say anything. A test can fail (1, Nordqvist, 2025).

Two consequences follow. Decisions become records: the reasons for a decision are kept beside it in a short numbered record that is never edited, only superseded, called an Architecture Decision Record, so that the rationale outlives the people who made it (1, Nordqvist, 2025). And rules become executable: a policy written as code is checked on every change and can refuse one.

The people who do this work are a small share of the workforce. Question 8 of the test asked: "ICT specialists made up what share of total employment in the EU in 2025?" Eurostat counts as ICT specialists the people in ICT occupations: service managers, professionals such as developers and analysts, technicians, and installers and servicers. The answer is 5.0 per cent, about 10.45 million people, both figures estimates by Eurostat (12, Eurostat, 2026); Chapter 10 gives the full answer. About one worker in twenty is therefore an ICT specialist, and not every one of them writes code. Most workers meet the software as users.

AI beside people

A caseworker in Nordvik Region's social services asks the Region's internal staff assistant to draft a letter to a resident (illustrative). The assistant retrieves the documents on the file and drafts the letter; the caseworker changes two sentences and sends it under their own name. The assistant saw only what the caseworker was allowed to see, because it acted with the caseworker's login and permissions. The Region's model records the unit as the internal staff assistant, serving about 3,200 staff. How many people a unit touches in a year is its reach.

This is AI beside people, and the property that defines it is identity. Many such assistants are built on a large language model, a model trained on very large amounts of text that produces text in return when given a prompt. The AI Act calls the wider class of such models general-purpose AI models, defined as a model that "displays significant generality and is capable of competently performing a wide range of distinct tasks" (Article 3(63)) (39, European Union, 2024). When an assistant works with a person's identity it drafts, retrieves and suggests, and the person remains the one who sends, closes and signs. Such a unit acts "with a person's identity": it can do nothing that person could not do, and when something goes wrong the trail leads to a person who chose to send.

How many people work this way is now measured. Question 6 of the test asked: "In 2025, what share of people aged 16 to 74 in the EU had used a generative AI tool for work in the previous three months?" Eurostat asked individuals for the first time in 2025, and the answer is 15.36 per cent of all individuals aged 16 to 74 (14, Eurostat, 2026); Chapter 6 gives the full answer.

Figure 3.2: Share of all individuals in each age group who used generative AI tools in the previous three months, by purpose, EU, 2025; the first year the question was asked. Source: Eurostat, isoc_ai_iaiu (retrieved 2026).

Figure 3.2 breaks the answer down by age. Among people aged 16 to 24, 63.81 per cent had used a generative AI tool for any purpose in the previous three months and 16.28 per cent for work; among those aged 25 to 54, 38.55 per cent and 21.58 per cent; among those aged 55 to 74, 11.98 per cent and 5.48 per cent (14, Eurostat, 2026). All these shares are of all individuals in the group, not of internet users or of AI users, and the book does not mix the denominators.

AI as agents

A claim is filed online against a Hansa Mutual motor policy late in the evening (illustrative). By morning it has been classified, routed and allocated to a named handler, and no person approved the routing. The claims-triage agent acted on the core claims system with credentials of its own, within allocation rules written in advance, and the team leader can reassign. The model records the unit as HM-CT: an identity of its own, a reach of more than 10,000 people a year, and one flat refusal. The agent may route and allocate a claim but may not settle one, and code outside it enforces that line.

This is AI as an agent. An agent, in this book's sense, is a system in which a model directs its own sequence of tool calls towards a goal and which acts with an identity of its own, with its own permissions. It does not want anything and does not understand the claim; it executes a loop. AI Red Team, Chapter 6, draws the consequence: where AI acts with a person's identity, human judgement dominates, and where a machine identity acts, its design becomes the primary control (4, Nordqvist, 2026).

How much the agent may do without a person approving each action is its autonomy level, and the book adopts the five levels of AI Red Team, Chapter 6, by their exact names and in that volume's words. At Level 0 Advisory, "the AI suggests; a person decides and acts." At Level 1 Assisted, "the AI drafts the action; a person reviews and executes it." At Level 2 Supervised, "the AI executes after explicit human approval of each action." At Level 3 Bounded, "the AI executes pre-approved, reversible actions within a codified playbook; a person is informed and can stop it." At Level 4 Autonomous, "the AI selects and executes actions without per-action approval." The line between Level 2 and Level 3 is the one that matters most, because above it a class of actions happens without anyone approving each one. Level 4 is never used for irreversible actions, and the level is "decided and recorded, not discovered" (4, Nordqvist, 2026).

Software developers are among the first to work with AI tools and agents, and a public survey shows how far. Stack Overflow's annual developer survey is a self-selected online survey of the site's users, not a probability sample, but it is public, large and repeated. In 2024, 61.84 per cent of 60,907 respondents answered yes to "Do you currently use AI tools in your development process?" (27, Stack Overflow, 2024). In 2025 the question asked how often, and 78.49 per cent of 33,720 respondents answered daily, weekly, or monthly or infrequently (28, Stack Overflow, 2025). The two shares are comparable only as the sum of all "yes" answers, which is my computation.

Figure 3.3: Share of respondents who use AI tools in their development process and share who highly or somewhat trust the accuracy of the tools' output, all respondents and EU respondents, 2024 and 2025; a self-selected online sample of Stack Overflow users, not a probability sample. Source: Stack Overflow Developer Survey 2024 and 2025 (retrieved 2026).

Figure 3.3 puts use beside trust, and the two move apart. Question 13 of the test asked what share of the 2025 respondents highly trust the accuracy of AI tools' output. The answer is 3.15 per cent of 33,297 respondents, against 2.72 per cent of 37,302 in 2024; the share who trust to some degree, highly or somewhat, fell from 43.04 to 32.79 per cent (27, Stack Overflow, 2024) (28, Stack Overflow, 2025). Chapter 6 gives the full distribution of answers. The 2025 survey also asked, in a question the 2024 survey did not contain, "Are you using AI agents in your work (development or otherwise)?": 14.13 per cent of 31,919 respondents used agents daily, and 37.85 per cent did not and did not plan to (28, Stack Overflow, 2025).

That agents are in use among the developers who answered the survey is observable. That they will spread to organisations like Nordvik Region, which mostly buy software, is expected, because suppliers already ship AI features switched on by default (2, Nordqvist, 2026). Whether a public authority will let an agent act on a resident's case at Level 3 is speculation.

Six ways an organisation comes to use a model

The quarantine folder, the caseworker's draft and the overnight claim are three of six ways an organisation comes to use a model. The way is its usage mode, and the book adopts the six modes that AI Governance, Chapter 2, defines, by their exact names (2, Nordqvist, 2026). Mode 0 Ambient AI is AI that people meet without having chosen it: generated answers in search engines, automatic summaries in collaboration tools and features a supplier switches on in a product update. Mode 1 Conversational assistants is a general-purpose chat interface to a model: the person brings the context in and takes the output away. Mode 2 Embedded workplace assistants is an assistant inside the office tools that reads and acts on mail, documents and calendars with the user's own permissions. Mode 3 Agentic work tools is a tool that runs a model in a loop on a workstation or in a software repository, editing files and running commands while a person delegates and reviews. Mode 4 Built AI applications is a model that the organisation builds into its own system and whose whole life it owns. Mode 5 Autonomous production agents is an agent that acts on business systems without a person approving each step: a person sets the mandate, the bounds and the stop conditions and watches outcomes, not actions.

The classifier is Mode 0, the caseworker's assistant Mode 4, the claims-triage agent Mode 5. Using a large language model is not one activity but at least six, and, as the title of its Chapter 25 puts it, "the usage mode, not the brand, sets the governance" (2, Nordqvist, 2026). Mode 0 is the mode nobody plans. In the book's models, both illustrative organisations carry a Mode 0 unit at Level 4 Autonomous with no named decider on 1 January 2027, drawn grey.

Limits that code enforces

Hansa Mutual's IT-operations agent has write access to production systems (illustrative). It may restart a service on its own within a written playbook, at Level 3 Bounded; it may change a configuration only after a person approves, at Level 2 Supervised; and it may never delete data. The third rule is not a sentence in the agent's instructions. A separate component outside the agent checks every action the agent asks to take against a written list of what this agent may do, and refuses anything not on the list. That component is the policy decision point. The book calls it the policy point and draws it as a small diamond.

The term is adopted from AI Platform and Security, Chapter 4, and its Chapter 11 puts "deterministic code outside the model" in charge of the decision. Around it sits containment, limits that hold whatever anyone intends: credentials that cover one task, a stop switch and a log the agent cannot alter, each enforced outside the agent (3, Nordqvist, 2026). A rule in an agent's instructions lowers the chance that it is broken; a rule enforced outside the agent limits what happens when it is.

A limit without a policy point is a hope. AI Red Team, Chapter 6, concludes that a Level 3 capability without a policy point outside the model is Level 4 with a misleading label (4, Nordqvist, 2026), and the notation outlines such a mark in red. In Figure 3.1 every mark at Level 3 carries a filled diamond, and the grey square at Level 4 carries none: not a rule, not even a hope, just a feature.

Evidence

When Nordvik Region bought its benefits-triage system, which ranks applications for needs-based assistance while caseworkers decide every case, the tender required that the Region be able to stop it from outside the supplier's platform (illustrative). The supplier accepted the clause. Until the first drill the requirement was a sentence everyone had agreed to and nobody had tested. In the scenario of Chapter 18, the first out-of-hours stop drill takes 26 minutes against a budget of 15. The clause was not false. It was a promise.

The distinction the book adopts is in the words of AI Governance, Chapter 11: "That is attestation, a person asserting that a control operated, not evidence, a machine-generated artefact that demonstrates it" (2, Nordqvist, 2026). A contract clause or a slide that says "monitored 24/7" is attestation. A log that shows the stop command arriving and the system halting is evidence. The notation draws it as a short line under each mark, the baseline: solid when the system produces the proof, dashed when a person or a supplier declares it, absent when there is neither.

Who decides

In the spring of 2026, Nordvik Region piloted a recruitment-screening module that ranked applications for care vacancies (illustrative). In September the union for care staff asked how the ranking was made. The supplier could not show it. The HR director paused the pilot and wrote the pause down as a decision record. A named person held the right to stop, used it and left a record: that is what "who decides" means.

The notation draws that name as the seat, a small grey circle above a mark, which carries a decision tier. The book simplifies the tiers to four kinds of person, T1 to T4: the operator or user, the system owner or architect, an executive, and the board or an elected body. T0 means nobody is named, and the seat is absent. The tiers are this book's own. A mandate, the written statement of what a unit may do, is set by the person in the seat, who also holds the right to change it and to stop the unit.

Figure 3.4: One row per unit of Hansa Mutual's estate on 1 January 2027, with a bar from Level 0 Advisory to the unit's ceiling, thin bars per class of action, a diamond where a policy point enforces and a seat carrying the decision tier; the view Chapter 4 explains. Illustrative: rendered from landscape/models/hansa_mutual.yaml.

I will read two rows of Figure 3.4 aloud. The row HM-CT, the claims-triage agent, runs from Level 0 to Level 3, where a filled diamond shows that a policy point enforces the ceiling and a grey seat carrying a 2 shows that a system owner holds the decision right; under it, routing and allocating a claim reach Level 3 and settling a claim stops at Level 0. The top row, HM-AMB, runs to Level 4 with neither diamond nor seat: nobody decided that ceiling, nothing enforces it, no one is named.

A name is where decision rights start, not where they end. AI Boss, Chapter 4, concludes that every decision with consequences for a person needs a named human decider, and its Chapter 33 that "a name is necessary and not sufficient", because a person attached to a system's output can absorb the blame without having had the means to decide (7, Nordqvist, 2026). The right to stop is assigned in advance and runs outside the system it stops, because, as AI Governance, Chapter 13, concludes, "a stop path inside the system it is meant to stop fails exactly when needed" (2, Nordqvist, 2026). And the law places duties on people. The AI Act, Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, assigns its obligations to providers, who place a system on the market or put it into service, and deployers, who use it. It lists in Annex III the uses it treats as high-risk, among them the evaluation of eligibility for essential public benefits, which is Nordvik Region's benefits triage (39, European Union, 2024) (40, European Union, 2026). The implication is organisational, not legal advice.

Author's note needed: A short first-person passage, three or four sentences, belongs here: a meeting in the author's own practice where an incident was blamed on a person because nobody had designed who decides, told without identifying the organisation. It should show the moral crumple zone before the reader meets the term in Chapter 13.

A landscape in motion

Hansa Mutual's claims-triage agent did not begin as an agent (illustrative). It began as an assistant that recommended a route for a handler to confirm and became an agent that allocates claims to named handlers, with a new identity, a new level and a new classification question: whether allocating work to people is itself a high-risk use.

AI Governance, Chapter 2, calls this mode drift: a good prompt becomes a shared skill, then a built application, then an automation, and "the failure is that the controls stay where the use case started" (2, Nordqvist, 2026). The quietest movement is the loss of the ability to go back. AI Boss, Chapters 25, 30 and 33, illustrates, and marks as illustrated and not measured, that the reversibility of a delegation can decay within months of go-live (7, Nordqvist, 2026). That is why time is a frame of the notation.

Because the landscape moves, every statement about where it is going carries one of three labels, adopted from AI Governance, Chapter 22 (2, Nordqvist, 2026). Observable covers developments already visible in adopted law, published guidance, cited standards or production systems. Expected covers developments with strong evidence but uncertain timing or form within five years. Speculation covers developments that are plausible and consequential but not yet evidenced. What the landscape looks like in 2031 is speculation, and the author's own projections are confined to Chapter 20.

Walking an estate: the seven questions

Before any notation, a reader can walk an organisation's AI estate with seven questions, asked of each AI use rather than each product.

1. What may it do without a person approving each action? Place it at one of the five levels, and ask who decided and where that is written.
2. What would it take to undo what it does? A draft, a minute; a routed case, a day; a person's outcome or a payment, weeks; a disclosure, never.
3. How many people does it touch in a year? Count people, not transactions.
4. How did the organisation come to use it? One of the six modes; expect "it came with the product" more often than anyone planned.
5. With whose identity does it act? A person's, or its own? If its own, who can revoke it?
6. What enforces its limits, and who holds the decision right? A policy point outside the model, and a named person who can stop it from outside?
7. Where does the proof come from? Logs and tests the system produces, or declarations by a person or a supplier?

The answers are the seven dimensions of Chapter 4.

Nordvik Region's landscape, in words

As a worked example, here is every unit that Nordvik Region's model draws on 1 January 2027, in the vocabulary of this chapter. Everything in the table is illustrative.

Unit	In the book's vocabulary
Benefits-triage system (NR-BT)	Mode 4, bought from a supplier and run in the Region's own data centre, with an identity of its own; ranks about 40,000 applications a month at Level 0 Advisory while caseworkers decide every case; hard to reverse, more than 10,000 people a year; policy point enforced, the Head of the Benefits Unit in the seat, proof produced by the system; high-risk under Annex III
Internal staff assistant (NR-SA)	Mode 4, a person's identity, Level 1 Assisted, about 3,200 staff; reversible at once; policy point enforced, head of digitalisation in the seat, proof produced by the system; hosted by a European cloud provider, EEA only, with the Region's keys
Citizen-service assistant (NR-CS)	Mode 4, an identity of its own, Level 4 Autonomous, more than 10,000 residents; reversible with effort, and it hands difficult questions to a person at Level 3 Bounded; policy point enforced, seat held, proof produced by the system; open-weight models on reserved Nordic capacity
Correspondence classifier (NR-CR)	Mode 4, a fine-tuned open-weight classifier with an identity of its own, Level 3 Bounded; reversible at once; policy point enforced, head of the registry in the seat, proof produced by the system
Case-note summariser (NR-CN)	Mode 4, a person's identity, Level 1 Assisted, 180 caseworkers; on premises because of special-category data; policy point enforced, seat held, proof produced by the system
Rostering and shift allocation (NR-SW)	Mode 4, bought from a supplier, an identity of its own, Level 2 Supervised: unit managers approve every roster and every offer of an open shift; a pilot, policy point planned, HR director in the seat, proof declared; high-risk under Annex III
Recruitment screening pilot (NR-TL)	Mode 4, a supplier's module hosted outside the EU, Level 1 Assisted, hard to reverse; paused since September 2026, policy point planned, HR director in the seat, proof declared; high-risk under Annex III
Ambient AI in licensed software (NR-AMB)	Mode 0: email filtering, document suggestions and summaries in security tooling, switched on by vendors at Level 4 Autonomous with identities of their own; no policy point, no seat, no proof
Embedded workplace assistant pilot (NR-EWA)	Mode 2, a person's permissions, Level 1 Assisted, under 100 people; policy point planned, seat held, proof declared
Conversational assistants (NR-CA)	Mode 1, the approved enterprise tool, a person's identity, Level 1 Assisted; policy point enforced, regional director in the seat under the acceptable-use policy; proof declared
Agentic work tools (NR-AWT)	Mode 3, a person's identity, Level 2 Supervised under a written mandate, a small platform team and the security architect; policy point enforced, CISO in the seat, proof produced by the system

Eleven units are drawn on 1 January 2027. Two more, a triage assistant for the security operations centre and a tool that ranks exposures, are planned for February and April 2027 and appear later in the scenario. There is no Mode 5 unit. One unit is at Level 4 because the Region chose it, with a diamond and a seat, and one is there because nobody did, with neither.

Nordvik Region and Hansa Mutual

Each definition can be checked against one unit of the two illustrative models. Ambient AI in licensed software sits on both landscapes on 1 January 2027 in the same condition: Mode 0, Level 4 Autonomous, an identity of its own, no policy point, no seat, no proof. The two organisations differ in almost everything else; the grey square is identical because neither chose it. AI beside people is Nordvik Region's internal staff assistant: a person's identity, Level 1 Assisted, reversible at once, a seat and proof produced by the system. AI as an agent is Hansa Mutual's claims-triage agent: an identity of its own, Level 3 Bounded, a filled diamond and a system owner in the seat. Hansa Mutual has six Mode 5 units, five at Level 3 and one pilot at Level 2. Nordvik Region has none; its nearest is the correspondence classifier, which has an identity of its own at Level 3 Bounded but routes mail and does not direct a sequence of tool calls.

The unit that teaches most is Nordvik Region's citizen-service assistant: Level 4 Autonomous, an identity of its own, more than 10,000 residents, a square in the rightmost column two rows below the empty corner. It is there because its actions are reversible with effort: an answer drawn from published information can be corrected, difficult questions go to a person, and nothing it says decides a resident's case. A cautious public authority runs a Level 4 unit by choice, while an insurer whose six Mode 5 units sit at Level 3 or below has a Level 4 unit only by default, in Mode 0. The level follows the reversibility of the action, not the appetite of the organisation.

Summary

The landscape this book draws has three parts, each defined here from a scene. Architecture became code: the description of an organisation's systems moved from documents into version-controlled files that are tested, and decisions are kept as short records beside the thing they decide. AI works beside people, with a person's own identity. And AI works as agents, with an identity of its own, at a level of autonomy, inside a limit enforced by a policy point outside the model, with proof that the system produces or that a person declares.

The chapter adopted, with attribution, the vocabulary that makes the three parts comparable: the six usage modes of AI Governance, Chapter 2; the five autonomy levels of AI Red Team, Chapter 6; the policy point outside the model; evidence as against attestation; and the labels observable, expected and speculation. Three conclusions of the series run through it. The usage mode, not the brand, sets the governance, and the mode nobody plans arrives at Level 4 with no one named. A limit without a policy point outside the model is a hope, and a control whose proof is a promise is a declaration, not a defence. And a name is necessary and not sufficient: who decides is a design, with a seat, a stop path outside the system and a record. Everything in the landscape moves, so a picture of it needs the same axes every time and time as one of its frames. Chapter 4 gives that picture its name and teaches it, starting from the seven questions above.

Sources

1. Nordqvist, G. (2025). Architecture as Code. The Transformed Architecture, Book 1, published at aac.geon.se. (1, Nordqvist, 2025)
2. Eurostat (2026). Employed information and communications technology (ICT) specialists. Online data code isoc_sks_itspt, last updated at the source 17 April 2026; retrieved 7 November 2026 through the Eurostat dissemination API (JSON-stat 2.0) as the dataset data/eurostat_isoc_sks_itspt. DOI: https://doi.org/10.2908/ISOC_SKS_ITSPT. (12, Eurostat, 2026)
3. European Parliament and Council of the European Union (2024). Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act). Official Journal of the European Union, L series, 2024/1689, 12 July 2024; as amended by Regulation (EU) 2026/1744. (39, European Union, 2024)
4. Eurostat (2026). Individuals - use of generative AI tools. Online data code isoc_ai_iaiu, last updated at the source 5 June 2026; retrieved 7 November 2026 through the Eurostat dissemination API (JSON-stat 2.0) as the dataset data/eurostat_isoc_ai_iaiu. DOI: https://doi.org/10.2908/ISOC_AI_IAIU. (14, Eurostat, 2026)
5. Nordqvist, G. (2026). AI Red Team: AI as an Active Part of Cyber Defence in European Enterprises and Public Authorities. The Transformed Architecture, Book 4, published at aired.geon.se. (4, Nordqvist, 2026)
6. Stack Overflow (2024). 2024 Stack Overflow Developer Survey. Stack Exchange Inc.; survey open 20 May to 20 June 2024, results released 24 July 2024; 65,437 respondents from 185 countries (self-selected online survey of Stack Overflow users); the results data are published in the archive repository github.com/StackExchange/Survey under the Open Database License (ODbL) 1.0, with cell contents under the Database Contents License (DbCL) 1.0, and are kept as the dataset data/stackoverflow_dev_survey_2024. (27, Stack Overflow, 2024)
7. Stack Overflow (2025). 2025 Stack Overflow Developer Survey. Stack Exchange Inc.; survey open 29 May to 23 June 2025, results released 29 July 2025; more than 49,000 responses from 177 countries (self-selected online survey of Stack Overflow users); the results data are published in the archive repository github.com/StackExchange/Survey under the Open Database License (ODbL) 1.0, with cell contents under the Database Contents License (DbCL) 1.0, and are kept as the dataset data/stackoverflow_dev_survey_2025. (28, Stack Overflow, 2025)
8. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. The Transformed Architecture, Book 2, published at aig.geon.se. (2, Nordqvist, 2026)
9. Nordqvist, G. (2026). AI Platform and Security: Building and Securing AI Platforms in European Enterprises and Public Authorities. The Transformed Architecture, Book 3, published at aips.geon.se. (3, Nordqvist, 2026)
10. Nordqvist, G. (2026). AI Boss: When Artificial Intelligence Manages People in European Enterprises and Public Authorities. The Transformed Architecture, Book 7, published at aiboss.geon.se. (7, Nordqvist, 2026)
11. European Parliament and Council of the European Union (2026). Regulation (EU) 2026/1744 of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI). Official Journal of the European Union, L series, 2026/1744, 24 July 2026; in force from 27 July 2026, the third day after publication. (40, European Union, 2026)