The Destiny Instinct: Nothing Here Is Fixed, and Nothing Is Inevitable

On 24 July 2026 the Official Journal of the European Union published Regulation (EU) 2026/1744, adopted on 8 July and known as the Digital Omnibus on AI. It amends the AI Act, Regulation (EU) 2024/1689, and its Article 1, point 40, amends the third paragraph of Article 113, the article that says when each part of the law applies (40, European Union, 2026) (39, European Union, 2024). The original text had the obligations for the high-risk AI systems listed in Annex III, the uses the Act singles out, among them recruitment, work allocation, public benefits and life and health insurance pricing, apply from 2 August 2026 (39, European Union, 2024). The replacement point (c) has them apply from 2 December 2027, and moves the high-risk products under Annex I from 2 August 2027 to 2 August 2028. The amending regulation entered into force on 27 July 2026, under its own Article 4 (40, European Union, 2026), six days before the first date would have arrived. It moved that date by sixteen months. A date in a regulation is fixed until the legislator decides otherwise, on the record.

Set that beside the way AI is talked about. In spring 2025 Ipsos, in a 30-country online survey of 23,216 adults (a vendor survey), put a statement to respondents: "Products and services using artificial intelligence will profoundly change my daily life in the next 3-5 years". On the 30-country average, an unweighted mean of the countries, 67 per cent agreed and 23 per cent disagreed; asked whether such products had already profoundly changed their daily life in the past 3-5 years, 53 per cent agreed and 37 per cent disagreed (31, Ipsos, 2025). The change is expected more than it has been felt. Meanwhile the Digital Decade dashboard, where the Commission tracks the targets the EU set itself for 2030 using Eurostat data, shows the share of EU enterprises with ten or more persons employed, outside the financial sector, using at least one AI technology at 7.65 per cent in 2021 and 8.06 per cent in 2023, then 13.48 per cent in 2024 and 19.95 per cent in 2025 (15, European Commission, 2026). Between 2021 and 2023 the series moved by 0.41 percentage points, by my subtraction, and then it did not stay flat.

Two things are spoken of as settled: a date in the law, which a decision moved, and a tide, which is a sum of decisions not yet taken. This chapter is about seeing the first as terrain and the second as fate, and about what a landscape looks like when both are read as choices with a date and a name.

The questions

Question 9 asked: "The Commission's Digital Decade dashboard sets 75 per cent as the 2030 target for the share of EU enterprises using AI. Following the trend as the 2023 edition of its baseline drew it, where would the share have reached in 2030?", with the options "About 20 per cent", "About 45 per cent" and "About 75 per cent". The measured answer is the first: the baseline trajectory the Commission computed in 2023 reached 20.29 per cent in 2030 (15, European Commission, 2026). Chapter 8 is the home of this question and gives the four baselines the Commission has computed since 2023. The point here is that a trajectory is recomputed each year: by the 2026 edition the same line ends at 54.28 per cent. The target is worded in Article 4(1), point (3)(a), of Decision (EU) 2022/2481 as at least 75 per cent of Union enterprises having taken up one or more of cloud computing services, big data and artificial intelligence; the dashboard draws the same 75 per cent as the 2030 target for AI alone (43, European Union, 2022) (15, European Commission, 2026).

Question 12 asked: "In the AI Act as amended in 2026, when do the obligations for high-risk AI systems listed in Annex III apply?", with the options "They already apply", "From 2 December 2027" and "They were repealed". The measured answer is the second, from Article 1, point 40(b), of Regulation (EU) 2026/1744 (40, European Union, 2026) (39, European Union, 2024). This chapter is its home. The two wrong options are the two forms the instinct takes. "They already apply" is what the 2024 text, read as a fixed thing, would give, since 2 August 2026 has passed. "They were repealed" takes a moved date for the end of the duty. A date moved, by a recorded decision, and the obligations wait at the new one.

The instinct

Hans Rosling named a destiny instinct in Factfulness: the idea that innate characteristics determine the destinies of people, countries, religions or cultures, when the data show slow change invisible from one year to the next (8, Rosling et al., 2018). The instinct in this chapter is a cousin with two faces. The first sees architecture as fixed: the systems, the diagram of them on the wall, the "target architecture" with a year in its title, the dates in the regulation that governs them, all as terrain. The second sees AI as a tide: it is coming, the only question is how fast one adapts, and asking whether a particular use should exist is arguing with the sea.

Both faces are useful where a date or a system really is fixed for the planning period. They mislead here because both halves of this landscape change by decision, and the decisions are written down. Architecture that was a document in a drawer is now, in organisations that work this way, files in a repository that change weekly, each change attributable and reversible. Architecture as Code (Chapter 4) keeps every significant architectural decision as a short, numbered record that is superseded by a new one and never rewritten, beside the code, and Architecture as Code (Chapter 6) generates the diagrams from the versioned model (1, Nordqvist, 2025). This book calls such a record a decision record: a dated note that says what was decided, by whom, why, and what it would take to undo. Where one exists, nothing is fixed, because the record says who could change it, and nothing is inevitable, because it shows the thing was chosen. An adoption series is likewise a sum of separate decisions, which can stall, as the EU series did between 2021 and 2023, and jump, as it did after, and a unit exists because someone procured, switched on or built it; the same kind of act can pause, bound or retire it. The instinct hides this by making the technology the subject of the sentence: "AI is being introduced into case handling" rather than "the head of the benefits unit decided to procure a triage system that ranks the queue at Level 0 Advisory". The second sentence has a seat in it. The first has a tide.

Three things in the chapter's evidence are the ones the instinct makes look fixed: the dates of the law, which moved; the series of adoption, which stalled and then jumped; and the architecture diagram, which when it is code changes weekly. Question 12 is the only measure of perception in the chapter, and the test's readers are not a sample. The Ipsos survey measures what respondents expect, not whether they think the change inevitable. Everything else below is about institutions: the Official Journal, Eurostat, two industry surveys of how often organisations change production. It shows that what the instinct calls fixed is not fixed. It does not show that people see it as fixed. In this chapter, destiny is a habit of explanation that removes the decision from the people in the room, and I treat it as that.

Author's note needed: An architecture diagram from the author's practice that hung unchanged for years while the repository behind it changed weekly; two paragraphs, placed here.

The evidence

The law moved, on the record

Figure 11.1: The dates on which the parts of the AI Act apply, as published in 2024 and as amended by Regulation (EU) 2026/1744 in 2026, each pair drawn from the Official Journal text with its article; the Annex III and Annex I high-risk obligations and the national sandbox deadline moved later, Articles 102 to 110 moved six days earlier, and the general date, Article 50 and the general-purpose model obligations did not; the transitional dates of 2 December 2026 are in the text but not drawn. Source: Official Journal of the European Union, Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744 (retrieved 2026).

Figure 11.1 draws the AI Act's timeline twice, as printed in 2024 and as amended in 2026, every date from the two texts (39, European Union, 2024) (40, European Union, 2026). The general date of application, 2 August 2026, and the dates for the original prohibitions, the general-purpose model obligations and Article 50 on transparency stand where they were. What moved is point (c) of the third paragraph of Article 113: the high-risk regime of Chapter III, Sections 1 to 3, now applies from 2 December 2027 for the systems listed in Annex III and from 2 August 2028 for the Annex I products, where the original text had 2 August 2026 and 2 August 2027 (40, European Union, 2026). One change is not a date: Article 4 of the AI Act, on AI literacy, was replaced by Article 1, point 5, of the amending regulation and reworded from an obligation to "ensure, to their best extent, a sufficient level" of staff literacy to one to "support the development" of it. The obligation softened by a recorded decision; it did not disappear.

The implication is organisational, not legal advice. A deployer of an Annex III system has sixteen more months than its 2024 plan allowed; the obligations themselves did not change. The dates in Figure 11.1 are observable: they stand in the Official Journal until another instrument replaces them. Whether they move again is speculation; nothing in the text says so. The date was never the terrain. It was a decision, remade by the body that made it.

How often organisations change production

DORA here is DevOps Research and Assessment, a research programme that Google runs and Google Cloud publishes. It is unrelated to the EU's Digital Operational Resilience Act, Regulation (EU) 2022/2554, also known as DORA (42, European Union, 2022). In this chapter the name means Google's programme.

Figure 11.2: Three panels from DORA's annual survey: the 2024 performance clusters (left), how often the 2025 respondents' organisations deploy changes to production, from on demand to fewer than once in six months (centre), and the share of respondents relying on or using AI in 2024 and 2025 (right, two differently worded questions); a vendor survey of self-selected respondents published by Google Cloud under a licence that limits reproduction of the report's own charts, so the figures are quoted with attribution and redrawn. Source: DORA, State of AI-assisted Software Development 2025 and Accelerate State of DevOps Report 2024, Google Cloud, vendor survey (retrieved 2026).

The fixed half of the instinct meets the surveys of how often organisations change the systems they run. DORA surveys technology professionals every year, nearly 3,000 in 2024 and 4,867 in 2025, a vendor survey of a self-selected, technology-heavy sample (19, DeBellis et al., 2024) (20, DeBellis et al., 2025). The centre panel of Figure 11.2 draws the distribution the 2025 report prints: 16.2 per cent of respondents deploy to production on demand, 6.5 per cent between once an hour and once a day, 21.9 per cent between once a day and once a week, 31.5 per cent between once a week and once a month, 20.3 per cent between once a month and once every six months, and 3.6 per cent less often (20, DeBellis et al., 2025). The left panel shows the 2024 report's performance clusters, which combine deployment frequency with other measures and do not compare with the distribution beside it. In this sample, an upper bound for organisations in general, 76.1 per cent of respondents deploy at least monthly and 44.6 per cent at least weekly, the report's own cumulative shares. For such an organisation an architecture is not a document drawn once. It is the state the last deployment left, and the next is days away.

The same surveys measure AI's arrival: 75.9 per cent of 2024 respondents relied at least in part on AI in their daily professional responsibilities (19, DeBellis et al., 2024), and 90 per cent of 2025 respondents reported using AI at work (20, DeBellis et al., 2025), a differently worded measure. What AI does to the work is less settled. The 2024 report associated a 25 per cent increase in AI adoption with a 1.5 per cent reduction in delivery throughput and a 7.2 per cent reduction in delivery stability; the 2025 report states that the throughput association had turned positive while the one with instability remained. These are associations in a self-selected sample, and the reversal is the point: what AI does to software delivery was not fixed between one report and the next.

The Cloud Native Computing Foundation's annual survey, 689 respondents from its own community in late 2024, describes the mechanism. In that sample 77 per cent said that some, much or nearly all of their deployment practices adhered to GitOps principles, 22 per cent nearly all (21, Silverthorne & Hendrick, 2025). GitOps keeps the desired state of a system in a version-controlled repository and lets automation make the running system match it, so that every change is a commit by a named person and every commit can be reverted. Where it is practised, the record is the architecture.

Reversibility that decays

The last piece of evidence concerns a direction of change the instinct makes invisible. It is the series' own conclusion, not a population statistic. AI Threat, Chapter 26, found that small delegations erode skill, process, capacity, interfaces and memory until the documented fallback no longer exists, and proposed a delegation register, a list of the functions handed to systems, each with the decision behind it, the human role that remains and the path back, together with a reversibility test: could the organisation perform the function without the system for a defined period, and a failed test freezes further delegation (5, Nordqvist, 2026). AI Boss, Chapters 25, 30 and 33, carried the register into the management of people and illustrated in a worked case a reversibility that decays within months of go-live; its own conclusions table marks the decay as illustrated, not measured (7, Nordqvist, 2026). "Inevitable" is sometimes an accurate description of a delegation whose fallback has quietly gone: a decision that became a destiny because nobody tested whether it could still be undone.

The picture corrected

Contour, the notation of this book, draws an organisation's AI uses as marks on a grid. The columns are the five autonomy levels, what the AI may do without a person approving each action, from Level 0 Advisory to Level 4 Autonomous, which the book adopts from AI Red Team, Chapter 6 (4, Nordqvist, 2026). The rows are the four reversibility tiers, R1 Reversible at once to R4 Irreversible. The colour is the usage mode, how the organisation came to use the model, one of the six that AI Governance, Chapter 2, defines, Mode 0 Ambient AI to Mode 5 Autonomous production agents (2, Nordqvist, 2026). The grey seat above a mark carries the decision tier of the person who holds the decision right, T1 an operator up to T4 a board or an elected body; the diamond is the policy point, a control outside the model that enforces what the unit may do; the line beneath is the baseline, where the proof of control comes from. V2, the landscape over time, draws a trail for a mark that changed cell, a tick for one that appeared and a hollow mark with a cross for one retired.

Both organisations below are illustrative, and their 2027 is the scenario told in Chapter 18, drawn from their landscape models. It is not a forecast and not evidence.

Figure 11.3: Hansa Mutual's landscape from 1 January to 31 December 2027 in V2, the landscape over time: no mark changed column or row, and the seat above the IT-operations agent reads 4 at the end of the year where it read 2 at the start. Illustrative: rendered from landscape/models/hansa_mutual.yaml.

Figure 11.3 is Hansa Mutual's year in the scenario. The instinct expects agents advancing towards the empty corner, the shaded cell at Level 4 Autonomous and R4 Irreversible. The view shows no advance: seventeen units at the start and seventeen at the end, no trail, no tick, no cross. Six units are Mode 5 agents, five at Level 3 Bounded and one at Level 2 Supervised. The IT-operations agent HM-ITO, of reach XL, sits at R3 Hard to reverse with write access to production, the mark nearest the empty corner, and it does not move. What moves is the number in its seat. In the scenario the first stop drill of that agent takes 17 minutes against a budget of 5, because the alert reaches a duty analyst who does not hold the decision and the 15-minute credentials outlive the revocation (The Transformed Security Architect, Chapters 10 and 25) (6, Nordqvist, 2026). On 31 March 2027 the executive board takes the decision right over every agent with write access to production to itself, and the seat changes from 2, the head of the group AI platform, to 4. On 30 April the seat above the claims-triage agent HM-CT rises from 2 to 3 after its allocation of work is reassessed as high-risk under Annex III point 4(b) (39, European Union, 2024). The decision rights change, each change dated and reasoned in the model's notes, while the agent the tide story would have advancing stays where it is and the board moves towards it.

Figure 11.4: Nordvik Region's landscape from 1 January to 31 December 2027 in V2, the landscape over time: the recruitment screening pilot NR-TL is drawn hollow with a cross at Level 1 Assisted and R3 Hard to reverse, retired on 30 June, and the platform team's agentic work tools NR-AWT carry a trail one column to the left. Illustrative: rendered from landscape/models/nordvik_region.yaml.

Figure 11.4 is Nordvik Region's year in the scenario, and it holds the mark that Hansa Mutual's year does not: a retired one. At Level 1 Assisted and R3 Hard to reverse, the row where a person's outcome is at stake, the recruitment screening pilot NR-TL is drawn hollow with a cross. It is a procured module that ranks applications for care vacancies, a high-risk use under Annex III point 4(a), with a hollow diamond for a policy point only planned and a dashed baseline for evidence that is the supplier's word. It is paused on 18 September 2026 when the care staff's union asks how the ranking is made and the supplier cannot show it, and retired on 30 June 2027 when the HR director reports to the regional executive committee. The trail in row R2 is the platform team's agentic work tools NR-AWT moving from Level 2 Supervised to Level 1 Assisted on 1 May, when their mandate is brought into line with a role charter's ceiling: autonomy taken back, by a decision, from a unit that is working.

A third event has no mark of its own. The rostering system NR-SW enters Level 3 Bounded for one class of action, offers of open shifts, on 11 March. A reversibility test of that delegation runs from 5 to 16 April and finds that the deputy has never planned a route by hand, that the manual template lacks the travel-time rule and that the ward competence rules cannot be exported; its conditions are met on 30 June, and the deputy of each home-care unit then plans the routes by hand one week a month. The test is what checks, after the move, whether the delegation can still be undone. Marks move left as well as right, marks are retired, seats climb, fallbacks are rebuilt, each with a date and a name.

The reversibility test comes from AI Threat, Chapter 26, and AI Boss, Chapter 25 (5, Nordqvist, 2026) (7, Nordqvist, 2026), and is run per function handed to a unit, not per system, because one system holds several functions that decay at different rates. It names the function and the people who would perform it again, fixes the period the organisation must manage without the unit, runs the documented fallback for one cycle in one team, records the result as passed, passed with conditions or failed, closes any conditions by a date, and dates the next test. Nothing in it concerns the model inside the unit: reversibility lives, and decays, in the people, procedures and data outside it.

The rule of thumb

Rule of thumb: Nothing here is fixed and nothing is inevitable; ask what was decided, by whom, and what it would take to reverse it.

The rule turns a statement into three questions. "What was decided" replaces the tide with an act: the procurement, the switch, the mandate, the date in the regulation. "By whom" replaces the terrain with a seat, which, as Hansa Mutual's scenario shows, can change without the mark moving. "What it would take to reverse it" replaces inevitability with a test: the reversibility tier as assessed, and the reversibility test that checks the fallback still exists. Where the answers are "nobody remembers", "nobody in particular" and "nobody has tried", the instinct describes accurately a part of the landscape that has, through neglect, become a destiny, and the remedy is to decide, to name and to test.

The rule stops applying at the top row and at the present date. Some actions are irreversible, which is why R4 exists and why AI Red Team concludes that Level 4 Autonomous is not used for them (4, Nordqvist, 2026). And a decision that stands is binding until it is remade. An organisation that reads this chapter as licence to plan for a further deferral of 2 December 2027 has drawn the wrong conclusion: the date holds until someone with the authority to change it does so on the record, and that someone is not the deployer.

What to do

For an executive

When a system, a date or a trend is presented to you as given, ask for the record that made it so. Ask for the delegation register on one page: the functions handed to AI units, the decision date, the seat that holds it, and the result and date of the last reversibility test. A failed test on that page names a delegation that has stopped being reversible while there is time to rebuild the fallback. Ask how long it takes to stop each unit that acts in production, and treat a drill that fails its budget as the trigger for moving the seat, as Hansa Mutual's board does in the scenario.

For an architect

Keep the decision and its reversal beside the thing decided. In the landscape model a unit's retirement is a dated timeline entry from which the renderer draws the cross; the decision record that explains it sits beside it. The fragment below is the illustrative pair for Nordvik Region's recruitment screening pilot, in the plain form this book uses for a decision record (1, Nordqvist, 2025).

# Illustrative decision record (Nordvik Region, a fictional organisation)
decision_record:
  unit: NR-TL                        # recruitment screening pilot
  date: 2027-06-30
  decided_by: HR director (T3), reported to the regional executive committee
  supersedes: pause of 2026-09-18    # the union asked how the ranking was made
  context: >
    Pilot ranked applications for assistant-nurse and care-assistant
    vacancies; high-risk use (Annex III point 4(a)); supplier outside the EU;
    policy point planned, evidence attested; paused for nine months.
  decision: retire; do not resume; recruiters rank applications as before
  consequences:
    - function returns to recruiters, who performed it throughout the pause
    - supplier module not switched back on
    - mark stays on the 2027 time view, hollow with a cross
  reversal:   # illustrative wording, not from the profile
    what_it_would_take: a new procurement with the policy point enforced
      and the ranking explainable to the union before go-live
    tier_required: T3
# The entry in the unit's timeline that the renderer reads
timeline:
  - date: "2027-06-30"
    status: retired
    note: Not resumed when the HR director reported to the regional executive committee.

The trail it leaves is the cross in Figure 11.4. Do the same for every move, seat change and reversibility test, and the model answers the rule's three questions without anyone having to remember.

For a public official

In a public authority a decision presented as inevitable escapes the scrutiny public decisions are meant to receive. Write the decision as a decision: the committee paper that proposes an AI use names the function handed over, the level at which the unit acts, the person who holds the decision right and what it would take to reverse it, and the public register entry says the same in the same words. Publish the retirements: a register that lists only what is running says that AI only arrives, and one that keeps the retired entries, with the reason, says that the authority decides. And treat the law's dates as decided. The deployer duties of Article 26 and, for the deployers Article 27(1) names, the fundamental rights impact assessment of Article 27 sit in Section 3 of Chapter III and apply to Annex III systems from 2 December 2027 (39, European Union, 2024) (40, European Union, 2026). Article 26(8) sends public-authority deployers to the registration obligations of Article 49, which sits in Section 5 of Chapter III, a section the amended Article 113(3)(c) does not name. I give no date for Article 49; that is a question for the authority's lawyers.

Nordvik Region and Hansa Mutual

Both organisations are illustrative, and what follows is the scenario of Chapter 18, not history. The destiny the instinct would write for Nordvik Region is the slow one: a pilot becomes a practice, and in a few years the Region's work is done by systems nobody chose to keep. The scenario shows the opposite at each step: a pilot paused when a union asks a question and retired by a named director, a bounded class of action followed by a test that finds the missing fallbacks, agents that lose a level because a charter sets a ceiling.

For Hansa Mutual the destiny would be the fast one: six Mode 5 agents on a trajectory towards more agents at higher levels. The group adds none and moves none. Its reversibility test of the claims-triage delegation, run from 15 to 19 March, finds that a deputy needs three times as long to allocate claims by hand and that complex claims concentrate on four handlers. Where Nordvik's year is decisions about marks, Hansa's is decisions about who decides. Both carry Annex III systems, whose obligations apply from 2 December 2027.

Summary

The chapter opened with a date that moved: Regulation (EU) 2026/1744, in force from 27 July 2026, moved the Annex III high-risk obligations from 2 August 2026 to 2 December 2027 and the Annex I ones from 2 August 2027 to 2 August 2028. Beside it stood the tide: two thirds of Ipsos's respondents, on a 30-country average, expecting AI to change their daily life profoundly, and an EU adoption series that moved by 0.41 percentage points between 2021 and 2023 before rising to 13.48 and 19.95 per cent.

The instinct sees architecture as fixed and AI as fated. The evidence, which is about institutions and not about what people believe, showed both halves to be decisions on the record: the law's dates moved by an amending regulation anyone can read; organisations change production often, 44.6 per cent of DORA's respondents at least weekly, with GitOps making every change a reviewable, reversible commit; and the one thing that drifts unseen is reversibility, which one worked case illustrates decaying within months of go-live unless a test checks that the fallback still exists.

The picture corrected is V2, the landscape over time. In the illustrative scenario Hansa Mutual's year has no trail: the marks stay where they are while the board takes the decision right over production write access after a failed stop drill. Nordvik Region's has a retired high-risk pilot, a trail to the left where autonomy is taken back, and a test that finds a fallback that had decayed. The rule of thumb follows: nothing here is fixed and nothing is inevitable; ask what was decided, by whom, and what it would take to reverse it.

Chapter 12 turns to the single-perspective instinct, and to the way security, compliance and productivity each read the same marks and miss what the other two see.

Sources

1. European Parliament and Council of the European Union (2026). Regulation (EU) 2026/1744 of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI). Official Journal of the European Union, L series, 2026/1744, 24 July 2026; in force from 27 July 2026, the third day after publication. (40, European Union, 2026)
2. European Parliament and Council of the European Union (2024). Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act). Official Journal of the European Union, L series, 2024/1689, 12 July 2024; as amended by Regulation (EU) 2026/1744. (39, European Union, 2024)
3. Ipsos (2025). The Ipsos AI Monitor 2025: A 30-country Ipsos Global Advisor Survey. Ipsos, June 2025; 23,216 adults interviewed online, and in India partly face to face, between 21 March and 4 April 2025 (vendor survey, self-funded by Ipsos); Ipsos's legal mentions deem polls published on its website to be in the public domain, usable with attribution to Ipsos; the values quoted in the book are kept as the dataset data/ipsos_ai_monitor_2025. (31, Ipsos, 2025)
4. European Commission, Directorate-General for Communications Networks, Content and Technology (2026). Digital Decade DESI dashboard: Digital Decade EU-level trajectories and Digital Economy and Society Indicators. Key performance indicators of the Digital Decade Policy Programme 2030 with targets and trajectories (dd_ai, dd_cloud, dd_bigdata, dd_dii, dd_ictspec, dd_ai_cloud_da) and the Member State DESI indicators, values from Eurostat; retrieved 7 November 2026 through the dashboard's REST API v1 as the dataset data/digital_decade_indicators. (15, European Commission, 2026)
5. European Parliament and Council of the European Union (2022). Decision (EU) 2022/2481 of 14 December 2022 establishing the Digital Decade Policy Programme 2030. Official Journal of the European Union, L 323, 19 December 2022, p. 4. (43, European Union, 2022)
6. Rosling, H., Rosling, O. and Rosling Rönnlund, A. (2018). Factfulness: Ten Reasons We're Wrong About the World – and Why Things Are Better Than You Think. London: Sceptre (Hodder & Stoughton), hardback published 3 April 2018. ISBN 978-1-4736-3746-7. (8, Rosling et al., 2018)
7. Nordqvist, G. (2025). Architecture as Code. The Transformed Architecture, Book 1, published at aac.geon.se. (1, Nordqvist, 2025)
8. European Parliament and Council of the European Union (2022). Regulation (EU) 2022/2554 of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011. Known as DORA. Official Journal of the European Union, L 333, 27 December 2022, p. 1. (42, European Union, 2022)
9. DeBellis, D., Storer, K. M., Lewis, A., Good, B., Villalba, D., Maxwell, E., Castillo, K., Irvine, M. and Harvey, N. (2024). Accelerate State of DevOps Report 2024. DORA, published by Google Cloud, document version 2024.3; the tenth DORA report, based on an annual worldwide survey of professionals in technical and adjacent roles (vendor-published survey); licensed under CC BY-NC-SA 4.0; the report is kept as the dataset data/dora_state_of_devops_2024. (19, DeBellis et al., 2024)
10. DeBellis, D., Harvey, N., Storer, K. M., Beane, M., Edwards, R., Fraser, E., Kalliamvakou, E., Kim, G., Good, B., Inman, S., Villalba, D., Maxwell, E., D'Angelo, S. and Murillo, A. (2025). State of AI-assisted Software Development. The 2025 DORA Report, published by Google Cloud, document version 2025.2 (file dated 15 October 2025); based on DORA's annual worldwide survey of software professionals (vendor-published survey); licensed under CC BY-NC-SA 4.0; the report is kept as the dataset data/dora_state_of_devops_2025. (20, DeBellis et al., 2025)
11. Silverthorne, V. & Hendrick, S. (2025). Cloud Native 2024: Approaching a Decade of Code, Cloud, and Change. CNCF Annual Cloud Native Survey 2024, The Linux Foundation, March 2025 (web release 1 April 2025); 750 respondents surveyed in the autumn of 2024; licensed under Creative Commons Attribution-NoDerivatives 4.0 International (CC BY-ND 4.0); the report is kept as the dataset data/cncf_annual_survey_2024. (21, Silverthorne & Hendrick, 2025)
12. Nordqvist, G. (2026). AI Threat: Are the Dystopias Coming True? Evidence, Risk and Response for European Enterprises and Public Authorities. The Transformed Architecture, Book 5, published at aithreat.geon.se. (5, Nordqvist, 2026)
13. Nordqvist, G. (2026). AI Boss: When Artificial Intelligence Manages People in European Enterprises and Public Authorities. The Transformed Architecture, Book 7, published at aiboss.geon.se. (7, Nordqvist, 2026)
14. Nordqvist, G. (2026). AI Red Team: AI as an Active Part of Cyber Defence in European Enterprises and Public Authorities. The Transformed Architecture, Book 4, published at aired.geon.se. (4, Nordqvist, 2026)
15. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. The Transformed Architecture, Book 2, published at aig.geon.se. (2, Nordqvist, 2026)
16. Nordqvist, G. (2026). The Transformed Security Architect: Role, Craft and Career in the Age of AI in European Enterprises and Public Authorities. The Transformed Architecture, Book 6, published at tsa.geon.se. (6, Nordqvist, 2026)