The Single-Perspective Instinct: Security, Compliance and Productivity Share One Landscape

Three people describe the same thing, and none of them is wrong. The thing is a drafting assistant for office staff, and the three descriptions come from published surveys of the three groups who sit closest to such tools. The first voice is a leader's. In a vendor survey of 31,000 knowledge workers in 31 markets, fielded for Microsoft's Work Trend Index in February and March 2025, 81 per cent of the respondents classed as leaders expected agents to be moderately or extensively integrated into their company's AI strategy within twelve to eighteen months (25, Microsoft, 2025). From that chair the assistant is a first step on a path already scheduled.

The second voice is a worker's. The Joint Research Centre's AIM-WORK survey, a telephone survey of 70,316 individuals aged 16 to 65 across the 27 member states, asked workers "In the last 12 months, did you use an AI-powered tool when performing your main paid job?"; 30 per cent answered yes (51, Gonzalez Vazquez et al., 2025). From that chair the assistant is a tool that a minority has used.

The third voice belongs to the person who keeps the record of what goes wrong. Eurostat's enterprise survey of 2024 found that 3.43 per cent of EU enterprises with ten or more persons employed, outside the financial sector, had seen their ICT services made unavailable by an attack from outside (11, Eurostat, 2026). From that chair the assistant is one more channel into the organisation, one more place where a credential, a document or an instruction can leave or arrive.

Put the three voices in one room, as in this illustrative scene at Nordvik Region when its internal staff assistant is reviewed. The head of digitalisation brings the measured drafting time per standard letter. A caseworker brings the experience of a tool that writes the first paragraph and has to be corrected in the third. The chief information security officer brings the question of which case documents the assistant's casework variant can reach. All three are competent and looking at the same unit; the meeting goes badly when one of them decides for all three. This chapter is about why that happens and what a picture has to show for it to stop.

The questions

Question 13 asked: "Among developers who answered the Stack Overflow survey in 2025, what share said they highly trust the accuracy of AI tools' output?", with the options "Under 5 per cent", "About 30 per cent" and "About 60 per cent". Chapter 6 is its home and gives the measured answer: of the 33,297 respondents who answered, 3.15 per cent chose highly trust, so the answer is under 5 per cent (28, Stack Overflow, 2025). I return to it because the question is about a chair. The survey is a self-selected online survey of Stack Overflow users with more than 49,000 responses, not a probability sample. Among the 33,720 who answered the question on use, 78.49 per cent used AI tools at least monthly (28, Stack Overflow, 2025). The option "About 60 per cent" is what the use figure would suggest if read alone; the chair that reads the output line by line sees something else.

The instinct

The single-perspective instinct is the habit of seeing only security, only compliance or only productivity, when the three sit on one landscape and move together. Rosling gave the same name to explaining the whole world through one lens, and his advice was to get a toolbox rather than a hammer (8, Rosling et al., 2018). The instinct in this book is narrower: it is what expertise does to a reading. A security officer is trained to see an estate as paths an attacker could take, a compliance officer as obligations attached to articles and deadlines, a product leader as things that could be done faster. Each narrowness is useful, and a person who tried to hold all three views at once would hold none of them well.

It misleads when one chair decides for all. The pull of the productivity chair is to read a vendor survey in which 81 per cent of leaders expect agents within eighteen months and 24 per cent say their companies have already deployed AI organisation-wide (25, Microsoft, 2025), and to conclude that the organisation is behind. The pull of the security chair is to read a threat report in which AI is a tool of intrusion and a target, and to conclude that the assistant should wait. The pull of the compliance chair is to read the AI Act, Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 (39, European Union, 2024) (40, European Union, 2026), and ask which Annex the unit falls under. None of the three conclusions is false. Each reads one dimension of a mark that has seven, and a decision taken on one dimension moves the other six unseen.

I want to be exact about what the evidence below shows. It shows that the surveys of the three chairs measure different things: leaders' expectation and self-reported deployment, workers' use and attitude, developers' use and trust, and the record of incidents. Taken for one another they mislead: an expectation read as adoption, an attitude read as use, a count of availability failures read as a measure of AI risk. It does not show that decision-makers read from one chair. None of the sources asks that, and they describe groups and institutions, not the perception of any reader. That one chair decides for all is the pattern the instinct names, and the Nordvik meeting illustrates it; it is not data. The correction rests on what the surveys measure, not on a claim about what people think.

Two volumes of the series met the same gap. AI Boss, Chapter 15, reviews surveys in which managers report better decisions and workers report a faster pace and more workload (7, Nordqvist, 2026). AI Red Team, Chapter 8, finds that the ambient AI in licensed software, Mode 0 Ambient AI among the six usage modes (how the organisation came to use the model) that AI Governance, Chapter 2, defines, is a blind spot of security tooling, because the security chair cannot see what it did not deploy (4, Nordqvist, 2026) (2, Nordqvist, 2026). The question this chapter takes up for the general reader is what one picture has to show for three chairs to see the same thing.

Author's note needed: two or three paragraphs from the author's own practice: a review meeting in which a security objection, a compliance question and a product case about the same system talked past one another, what each person was looking at, and what finally put them on one page. It belongs here, after the series' findings and before the evidence.

The evidence

The chart below sets the chairs side by side without comparing them on one scale, because the populations and methods differ; each bar is labelled with the kind of source it comes from, and that label is part of the evidence.

Figure 12.1: One landscape from the chairs: 82 per cent of leaders in a vendor survey call 2025 a pivotal year and 24 per cent say AI is deployed organisation-wide; 62 per cent of EU residents perceive AI at work positively and 30 per cent of workers used an AI tool in their job in the last twelve months; 78.5 per cent of developers who answered use AI tools at least monthly while 32.8 per cent trust the output; 21.5 per cent of enterprises had any ICT security incident and 3.4 per cent lost services to an attack; the populations differ, so the bars sit side by side and are not compared on one scale. Source: Microsoft, Work Trend Index 2025 (vendor survey); European Commission, Special Eurobarometer 554 (2025) and JRC AIM-WORK survey (JRC143072, 2025); Stack Overflow, 2025 Stack Overflow Developer Survey (self-selected sample); Eurostat, isoc_cisce_ic, survey year 2024 (retrieved 2026).

The leaders' chair

The leaders' figures come from a vendor survey and must be read as one. Microsoft's Work Trend Index 2025 classes as leaders the knowledge workers in its online panel who hold mid to upper job titles; 82 per cent of them called 2025 a pivotal year to rethink key aspects of strategy and operations, 81 per cent expected agents within twelve to eighteen months and 24 per cent said their companies had already deployed AI organisation-wide (25, Microsoft, 2025). The vendor sells the tools the survey asks about, its 2025 telemetry excludes European Union tenants, and the percentages describe expectation and self-reported deployment, not measured use. The 2026 edition surveyed 20,000 workers who already use AI, in ten markets, between February and April 2026, so its percentages describe AI users and not the workforce; in it 26 per cent said their leadership was clearly and consistently aligned on AI (26, Microsoft, 2026). The leaders' chair is a chair of expectation: it sees where the landscape is going before it sees where it is.

The workers' chair

The workers' figures come from two public-authority surveys and one university study. AIM-WORK's 30 per cent (29.9 per cent in the report's country figure) and its 20 per cent at least weekly measure conscious use, mostly of chatbots; the report's own note says the measure excludes AI embedded in systems workers are unaware of (51, Gonzalez Vazquez et al., 2025). Special Eurobarometer 554, a face-to-face survey of residents aged 15 and over in April and May 2024, measures attitude rather than use: 62 per cent perceived the use of robots and AI in the workplace positively, 66 per cent agreed that more jobs will disappear than new jobs will be created, and 73 per cent agreed that robots and AI increase the pace at which workers complete tasks (29, European Commission, 2025). The study by the University of Melbourne and KPMG, an online survey of 48,340 respondents in 47 countries and jurisdictions between November 2024 and mid-January 2025, reports that among its 32,352 employees 58 per cent intentionally use AI at work regularly and 77 per cent say their organisation uses AI (34, Gillespie et al., 2025); its samples are online and quota-based, and its licence is non-commercial, so the book quotes its figures and reproduces none of its charts. Three samples asked different questions, so the numbers should not agree. What they have in common is a chair of experience: use that a minority makes weekly, an attitude that is mostly positive, and a pace that is expected to rise.

The developers' chair

The developers' chair is the one closest to the output. The 2025 figures were given above: 78.49 per cent using AI tools at least monthly, 3.15 per cent highly trusting the output and 29.64 per cent somewhat trusting it, so that 32.79 per cent trusted it to some degree (28, Stack Overflow, 2025). The 2024 edition, with 65,437 respondents, asked about use with a yes-or-no answer where 2025 split the yes by frequency, so the two years' use figures answer different questions and are not compared (27, Stack Overflow, 2024). The trust question kept its wording but changed its answer options. In that sample the share highly trusting the output moved from 2.72 per cent in 2024 to 3.15 per cent in 2025, and the share trusting it to some degree from 43.04 per cent (40.32 and 2.72, by my sum) to 32.79 per cent. Every one of these figures is a share of a self-selected sample of people who visit one website, not a European estimate. Within that limit the chair is consistent: people who read the output line by line use it often and check it. That is what Level 1 Assisted, one of the five autonomy levels of AI Red Team, Chapter 6, looks like from the inside: the AI drafts, a person reviews and executes (4, Nordqvist, 2026).

The security chair

The security chair reads two kinds of record. Eurostat's survey of enterprises with ten or more persons employed, conducted in 2024, found that 21.54 per cent had experienced an ICT security incident of any of the six kinds asked about, and that 17.97 per cent had had ICT services unavailable because of hardware or software failure against 3.43 per cent because of an attack from outside (11, Eurostat, 2026). On unavailability, then, the official record shows failure far more often than attack. ENISA's threat landscape is a curated collection of publicly reported events: of its 4,875 incidents between July 2024 and June 2025, about 76.7 per cent were denial-of-service attacks and 17.8 per cent intrusions, and the agency describes the hacktivist campaigns, driven primarily by low-level denial-of-service operations, as resulting overall in very low impact. It records AI "both as tools to facilitate or enhance offensive activities and as targets for exploitation", and writes that "publicly available evidence suggests that misuse of LLMs and other AI tools occurs more frequently than direct efforts to compromise AI systems" (38, ENISA, 2025). The security chair sees AI first as something the adversary uses and second as something to be attacked; that reading is correct from that chair, and it does not say whether the assistant saves the caseworker time. The gaps between the chairs are gaps between chairs, not errors in one of them.

The picture corrected

The correction is not a fourth chair. It is one landscape that each chair can read in its own order, from the same marks, so that what one chair sees is visible to the other two.

Figure 12.2: Nordvik Region's landscape at the start of 2027, V1, read in three orders from the same eleven marks: by colour and size for productivity, by shape and diamond for security, by row, seat and baseline for compliance. Illustrative: rendered from landscape/models/nordvik_region.yaml.

Figure 12.2 is Nordvik Region's one-page landscape at the start of 2027 (illustrative): eleven marks on the grid of autonomy level by reversibility tier. The productivity chair reads it by colour and size first: the large dark marks of Mode 4 Built AI applications, the benefits-triage system NR-BT and the citizen-service assistant NR-CS at reach XL (10,000 people or more touched in a year), then NR-SA and NR-CR at reach L: where the use is and whom it touches. The security chair reads the same marks by shape and diamond. A rounded square acts with an identity of its own; the squares at Level 3 Bounded and Level 4 Autonomous, NR-CR and NR-CS, are the agents, and each carries a filled diamond: a policy point outside the model enforces what it may call, read, write or send. The grey square NR-AMB at Level 4 Autonomous, the ambient AI in licensed software, has no diamond, no seat and no baseline, and that is the first thing the security chair should ask about. The compliance chair reads row, seat and baseline; the seat is the grey circle that names the tier of the person who holds the decision right. The two marks in the R3 Hard to reverse row, NR-BT and the paused recruitment screening pilot NR-TL, affect a person's outcome. NR-BT has a seat at T2 and a solid baseline, a named system owner and automatic evidence; NR-TL has a hollow diamond and a dashed baseline, a policy point only planned and evidence that is a supplier's declaration. Three readers, one picture, and each can see what the other two are looking at.

The evidence view is where the three chairs come closest, because evidence is what each of them eventually has to produce.

Figure 12.3: Nordvik Region's evidence view at the start of 2027, V5: six units produce logs, five produce tests or evaluations, four run gates and policies as code, four rest on attestations alone, and one, the ambient AI in licensed software, has no evidence at all. Illustrative: rendered from landscape/models/nordvik_region.yaml.

Three readers of one evidence view

Read Figure 12.3 (illustrative) as an auditor, an engineer and a politician in turn. A filled cell means the system produces that kind of evidence by operating, a hatched cell means a person or a supplier has declared it, and the word "none" in red means there is nothing.

The auditor reads the attestations column first, because an attestation is what an audit samples and re-performs. Four units rest on attestations alone, the rostering system NR-SW, the approved conversational assistant NR-CA, the embedded workplace assistant pilot NR-EWA and the paused recruitment pilot NR-TL, all operated by suppliers, so the auditor's question is what each supplier would have to show for the declaration to be checked. The distinction the column rests on, from AI Governance, Chapter 11, is that an attestation is a person asserting that a control operated, while evidence is a machine-generated artefact that demonstrates it (2, Nordqvist, 2026).

The engineer reads the gates column, because a gate is the thing the engineer can change. Four units have gates and policies as code, NR-CS, NR-AWT, NR-SA and NR-BT, and for those four a failing control fails the release, the practice Architecture as Code (Chapter 9C) describes for risk as code (1, Nordqvist, 2025). The two units with logs and tests but no gate, NR-CR and the case-note summariser NR-CN, show the engineer that a test which does not block a release is information, not control.

The politician, at Nordvik Region a member of the regional executive committee, reads the red cell and the R3 rows. The red cell says that the ambient AI the Region's suppliers switched on has no evidence of any kind, and the missing seat in Figure 12.2 has already said who answers for it: nobody yet. The R3 rows hold the benefits-triage system, with three filled cells, and the recruitment pilot, with one hatched cell. The AI Act places the first in Annex III, point 5(a), access to essential public assistance benefits, with the deployer duties of Article 26 and the fundamental rights impact assessment of Article 27, and the second in Annex III, point 4(a), recruitment (39, European Union, 2024). Without a legal briefing the view shows which of the two could answer a supervisory authority tomorrow.

Three readers have reached three compatible conclusions from one picture. Observable: the instruments already make the same records answer to more than one reader: the deployer duties of the AI Act for high-risk systems, the incident reporting NIS 2 requires of entities in its scope, and the incident reporting and register of information DORA requires of financial entities all draw on the same logs and evidence (39, European Union, 2024) (44, European Union, 2022) (42, European Union, 2022). The obligations of Chapter III, Sections 1 to 3, of the AI Act for Annex III systems apply from 2 December 2027 after the 2026 amendment (40, European Union, 2026), so for a unit like NR-BT the shared evidence has a date. Where no instrument requires it, sharing is a choice.

A three-chair review in one meeting

The practice that follows from the picture fits in one meeting, and the order matters. Render the one-page landscape (V1) and the evidence view (V5) from the landscape model as of the meeting date; the picture is the paper. Seat three chairs, one reading for productivity, one for security and one for compliance. Each reads aloud in its own order: productivity reads colour, size and column; security reads shape, diamond and the empty corner; compliance reads row, seat and baseline. Each then names the one mark it would change first, and where two chairs name the same mark, that is the decision of the meeting. Then each chair reads the mark another chair named, in its own order. The three readings and the decision go into one review record against the model's unit identifiers, and the model is changed, so that the next rendering shows the decision.

The rule of thumb

Rule of thumb: Before you decide, read the landscape from the other two chairs.

The rule is about sequence rather than balance. It does not ask the executive to weigh security against productivity, the trade-off framing that keeps the chairs apart; it asks for two more readings of the same marks before the decision: no go-live decided on reach without a look at the diamond, no pause decided on a threat report without a look at the seat and the baseline, no classification decided on the Annex without a look at the level. Evidence is the one dimension on which all three chairs eventually have to agree, so start with the evidence column.

The rule stops applying in two places. It does not apply where the law has already decided for one chair: a practice prohibited under Article 5 of the AI Act is not improved by a productivity reading (39, European Union, 2024), and a unit in the empty corner, Level 4 Autonomous at R4 Irreversible, is not improved by a compliance reading. And it does not apply when the other chairs are empty: an organisation with nobody who can read a landscape for security or for compliance cannot fix that by asking the product leader to read twice, and whether the chairs exist is itself a finding.

What to do

For an executive

Run the review above once for the whole landscape and then for every unit whose decision reaches you, and decline to decide from a paper that shows one dimension. The artefact that helps is the review record, one page per unit and meeting; the illustrative form below is the one Nordvik Region's review of its internal staff assistant would produce, every field answered from the rendered views.

# review-records/2027-01-NR-SA.yaml (illustrative one-page review record; the would_change_first and decision entries are examples, not facts about the Region)
review:
  unit: NR-SA                       # id in landscape/models/nordvik_region.yaml
  views_as_of: 2027-01-01
  views: [view_nordvik_landscape_2027-01-01, view_nordvik_evidence_2027-01-01]
  chairs:
    productivity:
      reader: Head of digitalisation (system owner)
      read_first: [mode, reach, level]
      reading: Mode 4, reach L (about 3,200 staff), Level 1 Assisted; drafts, a person sends.
      would_change_first: reach to XL once the casework variant covers all units
    security:
      reader: Chief information security officer
      read_first: [identity, policy_point, empty_corner]
      reading: circle (acts with the user's identity); diamond filled; nothing at Level 4 R4.
      would_change_first: scope of case documents the casework variant may retrieve
    compliance:
      reader: AI governance lead
      read_first: [reversibility, decision_tier, evidence]
      reading: R1, seat T2, solid baseline (logs, tests, gates); not high-risk.
      would_change_first: nothing on this unit; NR-AMB has no seat
  rotation_done: true
  decision:
    agreed_by: [security, compliance]
    change: no change to NR-SA; inventory the supplier-enabled features of NR-AMB and name a decision holder
    model_change: landscape/models/nordvik_region.yaml, unit NR-AMB, timeline 2027-06-30
  next_review: with the views as of 2027-12-31

For an architect

Make the three readings cheap by making them renderable. The landscape model already carries the seven dimensions per unit; the architect's work is to keep it true, so that the views are generated from one source and no chair draws its own picture. Let the pipeline check every field a chair reads: a Level 3 Bounded unit without an enforced policy point should fail a check before it fails a review. Record the kinds of evidence per unit, not only the summary, because the evidence view and the auditor both read the kinds. The architect's artefact is the pipeline step that renders the views on every change to the model and attaches them to the review record, the pattern of one source and generated views that The Transformed Security Architect, Chapter 19, sets out (6, Nordqvist, 2026).

For a public official

Insist that the paper that reaches an elected committee or a supervisory authority is the rendered picture with the three readings, not a prose summary written from one chair. The evidence view shows an elected member which unit could answer a supervisory authority and which has no evidence at all. The official's artefact is the public register entry generated from the same model as the internal views, the practice AI Governance, Chapter 17, describes for algorithm registers (2, Nordqvist, 2026), so that the public reads the picture the committee read. Only 18 per cent of employed Eurobarometer respondents had received a detailed explanation of how digital technologies including AI are used to manage activities in their workplace (29, European Commission, 2025): every public authority has a fourth chair, the people whose work and cases the units touch, and it is often empty at the meeting.

Nordvik Region and Hansa Mutual

Both organisations are illustrative, and what follows is drawn from their models and profiles; the dates of 2027 are the scenario of Chapter 18, not history. The instinct shows up at each in the shape of its strongest chair. At Nordvik Region the strongest chair is compliance: the Region mostly procures, and its elected committee answers to the public. Read for compliance alone, the start of 2027 looks orderly: the high-risk benefits-triage system has a seat, a filled diamond and three filled evidence cells. Read for security, the orderly picture has a grey square at Level 4 Autonomous with nothing under it. Read for productivity, the four units on attestations alone can be documented only from a supplier's declaration. In the scenario the ambient AI gains a seat at T2, a planned policy point and an attestation on 30 June 2027, when the AI governance lead inventories the supplier-enabled features that process personal data: the security chair's first mark reaching the compliance chair's register.

At Hansa Mutual the strongest chair is productivity, and the group's agents at Level 3 Bounded are where the security and compliance chairs do their reading. The group also has a fourth chair, its works councils. In Germany the group works council and the local works councils co-determine under section 87(1), point 6, of the Works Constitution Act (BetrVG) on technical equipment suited to monitor employees' behaviour or performance, and a group works agreement on IT systems governs the figures the claims-triage agent HM-CT may produce about handlers. In the scenario the group's model records, on 30 April 2027, a change under the group policy on AI in management, which the executive board commissioned with the group works council invited to the review: the decision right over HM-CT's allocation function is lifted to the executive level after the function is reassessed under Annex III, point 4(b), and the recruitment screening unit HM-TL moves from attestations alone to supplier logs retained under the same policy.

Summary

The single-perspective instinct sees only security, only compliance or only productivity, where the three sit on one landscape and move together. The evidence is about what the chairs' surveys measure, not about how decision-makers read. Question 13 showed one chair: 78.49 per cent of the developers who answered the 2025 Stack Overflow survey used AI tools at least monthly and 3.15 per cent highly trusted the output, which looks like ordinary Level 1 Assisted work from the chair closest to the output. The leaders' vendor survey measured expectation, the workers' surveys use and attitude, the security record failure and attack, and the gaps between them are gaps between chairs.

The correction is one landscape read in three orders. In the one-page landscape the productivity chair reads colour and size, the security chair shape and diamond, the compliance chair row, seat and baseline. In the evidence view the three come closest, because the auditor's attestations, the engineer's gates and the politician's red cell sit in one table, and because the AI Act, NIS 2 and DORA already require shared records. A three-chair review runs in one meeting: render the views, read aloud in each chair's order, name one mark each, rotate once, record the readings and change the model.

The rule of thumb is to read the landscape from the other two chairs before you decide: a rule about sequence rather than balance, which stops where the law has decided for one chair or where the other chairs are empty. In the illustrative scenario Nordvik Region's compliance chair learns from its security reading that the ambient AI it never chose has no seat and no evidence; Hansa Mutual's productivity chair learns from a fourth chair, its works councils, that two of its marks record things about people that change who may decide about them. Chapter 13 takes up the last instinct, the blame instinct: the habit of looking for a person to blame when an incident happens in a landscape where nobody designed who decides.

Sources

1. Microsoft (2025). 2025: The year the Frontier Firm is born. Work Trend Index Annual Report, Microsoft WorkLab, 23 April 2025; survey of 31,000 knowledge workers in 31 markets conducted by Edelman Data x Intelligence between 6 February and 24 March 2025 (vendor survey). (25, Microsoft, 2025)
2. Gonzalez Vazquez, I., Fernandez Macias, E., Wright, S. and Villani, D. (2025). Digital Monitoring, Algorithmic Management and the Platformisation of Work in Europe. European Commission, Joint Research Centre, JRC143072; Publications Office of the European Union, Luxembourg, released 13 October 2025, catalogue number KJ-01-25-490-EN-N, ISBN 978-92-68-31994-9; based on the AIM-WORK survey of 70,316 individuals aged 16 to 65 in the 27 Member States; licensed under CC BY 4.0; the values quoted in the book are kept as the dataset data/jrc_aimwork_2025. DOI: https://doi.org/10.2760/9406086. (51, Gonzalez Vazquez et al., 2025)
3. Eurostat (2026). Security incidents and consequences by size class of enterprise. Online data code isoc_cisce_ic, last updated at the source 15 June 2026; retrieved 7 November 2026 through the Eurostat dissemination API (JSON-stat 2.0) as the dataset data/eurostat_isoc_cisce_ic. DOI: https://doi.org/10.2908/ISOC_CISCE_IC. (11, Eurostat, 2026)
4. Stack Overflow (2025). 2025 Stack Overflow Developer Survey. Stack Exchange Inc.; survey open 29 May to 23 June 2025, results released 29 July 2025; more than 49,000 responses from 177 countries (self-selected online survey of Stack Overflow users); the results data are published in the archive repository github.com/StackExchange/Survey under the Open Database License (ODbL) 1.0, with cell contents under the Database Contents License (DbCL) 1.0, and are kept as the dataset data/stackoverflow_dev_survey_2025. (28, Stack Overflow, 2025)
5. Rosling, H., Rosling, O. and Rosling Rönnlund, A. (2018). Factfulness: Ten Reasons We're Wrong About the World – and Why Things Are Better Than You Think. London: Sceptre (Hodder & Stoughton), hardback published 3 April 2018. ISBN 978-1-4736-3746-7. (8, Rosling et al., 2018)
6. European Parliament and Council of the European Union (2024). Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act). Official Journal of the European Union, L series, 2024/1689, 12 July 2024; as amended by Regulation (EU) 2026/1744. (39, European Union, 2024)
7. European Parliament and Council of the European Union (2026). Regulation (EU) 2026/1744 of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI). Official Journal of the European Union, L series, 2026/1744, 24 July 2026; in force from 27 July 2026, the third day after publication. (40, European Union, 2026)
8. Nordqvist, G. (2026). AI Boss: When Artificial Intelligence Manages People in European Enterprises and Public Authorities. The Transformed Architecture, Book 7, published at aiboss.geon.se. (7, Nordqvist, 2026)
9. Nordqvist, G. (2026). AI Red Team: AI as an Active Part of Cyber Defence in European Enterprises and Public Authorities. The Transformed Architecture, Book 4, published at aired.geon.se. (4, Nordqvist, 2026)
10. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. The Transformed Architecture, Book 2, published at aig.geon.se. (2, Nordqvist, 2026)
11. Microsoft (2026). 2026 Work Trend Index Annual Report: Agents, human agency, and the opportunity for every organization. Microsoft WorkLab, 5 May 2026; survey of 20,000 full-time knowledge workers who use AI at work in 10 markets, conducted by Edelman Data x Intelligence between 18 February and 7 April 2026 (vendor survey); kept with the 2025 edition as the dataset data/microsoft_work_trend_index_2025. (26, Microsoft, 2026)
12. European Commission, Directorate-General for Employment, Social Affairs and Inclusion (2025). Artificial Intelligence and the future of work. Special Eurobarometer 554, Eurobarometer report; fieldwork 25 April to 22 May 2024 by Verian, 26,415 face-to-face interviews with residents aged 15 and over in the 27 Member States; published 13 February 2025. Publications Office of the European Union, catalogue number KE-01-24-018-EN-N, ISBN 978-92-68-21815-0; the values quoted in the book are kept as the dataset data/eurobarometer_ai_work_2025. DOI: https://doi.org/10.2767/8591026. (29, European Commission, 2025)
13. Gillespie, N., Lockey, S., Ward, T., Macdade, A. and Hassed, G. (2025). Trust, attitudes and use of artificial intelligence: A global study 2025. The University of Melbourne and KPMG; online survey of 48,340 respondents in 47 countries and jurisdictions, November 2024 to mid-January 2025 (university-led study supported by KPMG); licensed under Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International (CC BY-NC-SA 4.0); the values quoted in the book are kept as the dataset data/kpmg_trust_in_ai_2025. DOI: https://doi.org/10.26188/28822919. (34, Gillespie et al., 2025)
14. Stack Overflow (2024). 2024 Stack Overflow Developer Survey. Stack Exchange Inc.; survey open 20 May to 20 June 2024, results released 24 July 2024; 65,437 respondents from 185 countries (self-selected online survey of Stack Overflow users); the results data are published in the archive repository github.com/StackExchange/Survey under the Open Database License (ODbL) 1.0, with cell contents under the Database Contents License (DbCL) 1.0, and are kept as the dataset data/stackoverflow_dev_survey_2024. (27, Stack Overflow, 2024)
15. European Union Agency for Cybersecurity (ENISA) (2025). ENISA Threat Landscape 2025. ENISA, 1 October 2025 (revised version 1.3, 22 September 2026); ISBN 978-92-9204-723-8, ISSN 2363-3050; licensed under CC BY 4.0; the report is kept as the dataset data/enisa_threat_landscape_2025. (38, ENISA, 2025)
16. Nordqvist, G. (2025). Architecture as Code. The Transformed Architecture, Book 1, published at aac.geon.se. (1, Nordqvist, 2025)
17. European Parliament and Council of the European Union (2022). Directive (EU) 2022/2555 of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive). Official Journal of the European Union, L 333, 27 December 2022, p. 80. (44, European Union, 2022)
18. European Parliament and Council of the European Union (2022). Regulation (EU) 2022/2554 of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011. Known as DORA. Official Journal of the European Union, L 333, 27 December 2022, p. 1. (42, European Union, 2022)
19. Nordqvist, G. (2026). The Transformed Security Architect: Role, Craft and Career in the Age of AI in European Enterprises and Public Authorities. The Transformed Architecture, Book 6, published at tsa.geon.se. (6, Nordqvist, 2026)