A Year at Nordvik Region and Hansa Mutual: Two Landscapes Compared

Two pictures are pinned side by side on the first working day of 2027. On the left, seventeen marks: six of them the plum of agents that act with an identity of their own, two of those the largest size the notation draws, one in the row where actions are hard to reverse. On the right, eleven marks, most of them the dark blue of applications built or bought for one purpose, three with hollow diamonds where a control is planned and not yet in place, one drawn hollow because its pilot is paused. The two pictures use the same columns, rows, sizes and colours, so the eye moves between them without translating. That is the only reason the comparison is possible.

The pair are Nordvik Region, a regional public authority in a Nordic member state of the European Union, and Hansa Mutual, a mutual insurance group headquartered in Hamburg with entities in seven countries, four in the EU, one in the EEA and two outside both. Neither is real, and 2027 is a modelled year: it has not run as this book is dated, 7 November 2026, and every event below is one that the two models record, told in the present tense as a scenario and not as a forecast. Every figure is rendered from the two landscape models and nothing in the chapter is data. It follows both through the year in Contour, the notation of Chapter 4, and ends with the two side by side.

Figure 18.1: Hansa Mutual and Nordvik Region at the start of 2027, V6 The comparison view, at identical scales. Illustrative: rendered from landscape/models/hansa_mutual.yaml and landscape/models/nordvik_region.yaml.

January: two landscapes at the start

Read Figure 18.1 in the thirty-second order of Chapter 4. The empty corner, Level 4 Autonomous at R4 Irreversible, is empty in both panels.

Count the squares at Level 3 Bounded and above. A square means the unit acts with an identity of its own. The autonomy levels are the five of AI Red Team, Chapter 6, from Level 0 Advisory, where the AI suggests and a person decides, to Level 4 Autonomous, where it selects and executes without approval of each action (4, Nordqvist, 2026). Hansa Mutual has five squares at Level 3, where the AI executes pre-approved, reversible actions inside a codified playbook: the claims-triage agent HM-CT and the IT-operations agent HM-ITO, both drawn XL because they touch 10,000 people or more in a year, HM-ITO at R3 Hard to reverse because it writes to production; the security operations centre (SOC) investigation agent HM-SOC; the continuous automated red teaming HM-CART; and the small evidence-collection agent HM-EVC at R1. Each carries a filled diamond and a seat marked 2, the tier of a system owner. The sixth plum mark, the agent-boss pilot HM-AB, sits at Level 2 Supervised: it is set up from 1 January, and in the second half of the month a Hamburg claims team starts directing a document-intake agent and a recovery agent, each action approved. Nordvik Region has one square at Level 3, the correspondence classifier NR-CR, and two at Level 4: the citizen-service assistant NR-CS, with a filled diamond and a seat, and the grey Mode 0 mark NR-AMB, with neither.

Find the marks without a seat. There are two, one in each panel, and they are the same kind of unit: ambient AI in licensed software, HM-AMB and NR-AMB. Mode 0 Ambient AI is the first of the six usage modes, the ways an organisation comes to use a model, that AI Governance, Chapter 2, defines, from Mode 0 to Mode 5 Autonomous production agents (2, Nordqvist, 2026). Both sit at Level 4 because the vendors chose the autonomy level, both lack a diamond and a baseline, and nobody is named as deciding about either. The summary strips count it: a seat on 16 of 17 marks at Hansa Mutual, on 10 of 11 at Nordvik Region.

Find the dashed baselines at R3. The baseline is the short line under a mark that says where the proof of control comes from: solid when the system produces it, dashed when a person or a supplier declares it. Hansa Mutual has one, the procured recruitment screening and video-interview system HM-TL, with a seat at tier 3, the chief HR officer. It is high-risk under Annex III point 4(a) of the AI Act, Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, Annex III being the Act's list of uses it treats as high-risk (39, European Union, 2024) (40, European Union, 2026). Nordvik Region has one too, drawn hollow: the recruitment screening pilot NR-TL, paused since September 2026 because the supplier could not show how the ranking was made, with a hollow diamond and a seat at tier 3, the HR director.

Then the colours. Hansa Mutual's marks spread across all six modes, with six dark blue Mode 4 built applications and six plum Mode 5 agents. Nordvik Region has no plum: one each of Modes 0 to 3 and seven of Mode 4. The Region builds or buys applications; the group builds agents. The Region's three hollow diamonds, on the rostering system NR-SW, the paused pilot and the embedded workplace assistant pilot NR-EWA, mean that a policy point is planned and not yet in place. A policy point is the deterministic control outside the model that enforces what a unit may call, read, write or send. Hansa Mutual has no hollow diamond.

The first half

Figure 18.2: Nordvik Region's landscape over 2027, V2 The landscape over time: two new marks, two trails and one retirement. Illustrative: rendered from landscape/models/nordvik_region.yaml.

Figure 18.2 is the time view of Chapter 15: the landscape at the end of the year, with a hollow outline where each moved mark was, a trail between, a tick on each new mark and a cross on each retired one. Its subtitle counts the Region's year: eleven units at the start, thirteen at the end, two new, two moved, one retired.

January to March: the rostering system. NR-SW drafts four-week rosters and home-care routes for the Region's hospitals and home care, and unit managers approve every roster. The Region's profile classifies it as high-risk under Annex III point 4(b), the entry for systems used to make decisions affecting the terms of work-related relationships or to allocate tasks based on individual behaviour or personal traits (39, European Union, 2024). On 20 January the Region and its unions agree a delegation profile, the record of what is handed to a system and under what conditions, as AI Boss, Chapter 4, defines it (7, Nordqvist, 2026), and the policy point that is a hollow diamond on 1 January is enforced. The mark moves from pilot to active, and the first daily routes follow in Strandvik home care on 25 January. On 11 March the travel-time and rest constraints become hard constraints, and the one class of action the profile allows without per-action approval, offering an open shift to staff who opted in, goes to Level 3 Bounded. The evidence changes from attested to automatic at the same time, because the constraints now produce logs and gate results. A reversibility test, a trial of doing the work without the system, runs from 5 to 16 April and its conditions are met on 30 June; it follows the rise in level, and the trail shows the level, not the test.

The hollow square at Level 2 Supervised, R2, is the mark on 1 January, and the filled square at Level 3 is the mark from March. The order of the diamond and the level is the point: the diamond is filled in January, seven weeks before the level rises. In the other order the mark would spend seven weeks at Level 3 without an enforced policy point, and the renderer would draw the thin red outline that marks a Level 3 capability without a policy point, which AI Red Team, Chapter 6, calls Level 4 with a misleading label (4, Nordqvist, 2026). The Region negotiates the control before it raises the autonomy, so the trail is clean.

February and April: two new small marks. On 1 February the SOC triage assistant NR-SOC goes live for the Region's six security analysts, after the first cycle of its exercise programme: size S, Level 1 Assisted, R1, with a filled diamond, a seat at tier 2 and a solid baseline, self-hosted because alert data contains personal and health data. On 1 April the exposure prioritisation NR-EXP follows, which proposes an order for fixing exposures of the Region's internet-facing services: Level 0, S, with a filled diamond and a dashed baseline. Both carry a tick.

May: a trail that goes down. On 1 May the Region's agentic work tools NR-AWT, the coding and architecture agents of its small platform team and its one security architect, move from Level 2 Supervised to Level 1 Assisted. The security architect's own written mandate, kept as code and called a mandate manifest in The Transformed Security Architect, Chapter 13 (6, Nordqvist, 2026), is aligned in version 3.0.0 with the ceiling that the role charter sets on 1 January, and in the scenario the platform team's agents are brought under the same ceiling. The amber trail runs from a hollow circle at Level 2 down to a filled circle at Level 1. It is the only leftward trail in either landscape.

Hansa Mutual in the same months. Figure 18.3 is the group's time view, and its subtitle reads differently: seventeen units at the start and at the end, nothing new, moved or retired, not a single trail. What happens in 2027 happens in the seats and the baselines, which the time view draws at their final state and does not trail.

Figure 18.3: Hansa Mutual's landscape over 2027, V2 The landscape over time: no mark moves, and the year's changes are in the seats and baselines. Illustrative: rendered from landscape/models/hansa_mutual.yaml.

On 31 March the seat above the IT-operations agent HM-ITO changes from 2 to 4. The first stop drill of the quarter, which measures how long it takes to stop the agent, takes 17 minutes against a budget of 5: the alert from the canary, a decoy placed to catch misuse, reaches a duty analyst who does not hold the decision to stop, and the 15-minute access tokens outlive their revocation (4, Nordqvist, 2026). The executive board, the management body for the purposes of DORA, Regulation (EU) 2022/2554 (42, European Union, 2022), takes the decision right over every agent with write access to production and asks for time-to-stop figures. In the notation nothing moves: the XL plum square stays at Level 3, R3, the mark diagonally nearest the empty corner in either landscape. What changes is the small grey number above it, the difference between a system owner and a board answering for it.

On 30 April the seat above the claims-triage agent HM-CT changes from 2 to 3. The agent allocates claims to individual handlers; that function is reassessed under Annex III point 4(b) (39, European Union, 2024), and under the group's new policy on AI in management the decision right lifts to the executive level, held jointly by the chief HR officer and the chief risk officer. The same day the baseline of the recruitment system HM-TL turns from dashed to solid, because the supplier's logs are now retained.

In the half-year the Region's picture moves, with two ticks, two trails and a diamond filled; the group's stands still and its seats climb. Neither reading is a verdict.

The second half

Figure 18.4: Hansa Mutual at the end of 2027, V4 The decision-rights view: one row per unit, a bar to its ceiling, the seat at the ceiling, with the IT-operations agent's seat at tier 4. Illustrative: rendered from landscape/models/hansa_mutual.yaml.

Because the group's year is a year of seats, Figure 18.4 shows it in the view made for seats, the decision-rights view of Chapter 17, as it stands on 31 December: one row per unit, a bar from Level 0 to the unit's ceiling, the seat and the diamond at its end, thin bars beneath for each class of action. The row for HM-ITO shows what the first half did: the bar reaches Level 3, the diamond is filled, the seat reads 4, and the thin bars stop at Level 3 for restarting a service, Level 2 for changing configuration and Level 0 for deleting data. The row for HM-CT shows the seat at 3. The top row, HM-AMB, has a bar all the way to Level 4, no diamond, and a seat that reads 2, which is the second half's event.

September and November at Hansa Mutual. On 30 September the group adds the supplier-enabled AI features in its licensed software to its AI inventory, the authoritative register of every AI system an organisation provides or deploys, as the glossary of AI Governance defines it and as its Chapter 9 derives it (the model's field for it is ai_system_register) (2, Nordqvist, 2026). It names the head of the group AI platform as register owner and writes notice clauses into its DORA register of information. HM-AMB gains a seat at tier 2 and a dashed baseline. It gains no diamond, because no policy point sits between a vendor's feature and the vendor's own product. In November the agent-boss pilot's mandate, due to expire at the year end, is extended to 30 June 2028. Nothing in the notation records an extension, a limit worth naming: a landscape shows what a unit may do and who decides, not for how long.

June at Nordvik Region. On 30 June the HR director reports to the regional executive committee on the governance of algorithmic management, and two things in the model are dated to that day. The recruitment screening pilot NR-TL is not resumed and is retired; in Figure 18.2 it is drawn hollow with a cross, still at Level 1, R3. And the Region's own grey mark gains what the group's gains three months later: a seat, at tier 2, the AI governance lead as inventory owner, a planned diamond and a dashed baseline, because the supplier-enabled features that process personal data are inventoried and notice clauses are requested in the contracts. The same blind spot is named in both organisations in the same year, under different law, and the notation draws the result identically: a grey square at Level 4 with a small 2 above it. The Region's diamond is hollow, the group's absent.

Figure 18.5: Nordvik Region at the end of 2027, V3 The supply and sovereignty view: the Region's own boundary, its EU and EEA suppliers by role, and three non-EU containers, one holding the retired pilot. Illustrative: rendered from landscape/models/nordvik_region.yaml.

Figure 18.5 is the supply and sovereignty view of Chapter 16 at the end of the year. Four units sit inside the Region's own boundary, and the rest sit with the supplier that hosts or supplies them: an EU hosting supplier, an EEA hosting supplier and an EU application provider for the rostering system. Three containers lie outside the EU. One holds the model provider behind the conversational assistant, beside the retired pilot's supplier, where the view still puts the pilot because the model keeps retirements for a year. A second holds the workplace-suite vendor's EU data region and a third the vendors behind the ambient features. The Region's leverage is the contract, and the view shows where each reaches.

September and October at Nordvik Region. On 1 September the embedded workplace assistant pilot NR-EWA is widened from fewer than 100 people to between 100 and 999, from S to M, after the tenant policies are enforced and audit logs retained; the diamond that is hollow since the pilot began is filled the same day. The notation has no trail for a change of size, so the reader compares the two snapshots. On 1 October the benefits-triage system NR-BT, XL at Level 0, R3, high-risk under Annex III point 5(a), the entry for access to essential public assistance benefits (39, European Union, 2024), adds attestations to its evidence: the external stop drill is re-run within budget and the supplier's evidence schedule comes into force. The mark does not move and its baseline is already solid; the change shows only in the evidence view of Chapter 17.

December, for both. The AI Act's obligations of Chapter III, Sections 1 to 3 apply from 2 December 2027 to systems classified as high-risk under Article 6(2) and Annex III, the date Article 113 carries as amended (40, European Union, 2026) (39, European Union, 2024). That date is observable, because it stands in adopted law; the year around it is a scenario. In the Region's landscape the date touches the benefits-triage and rostering systems, both deployed; in the group's, the underwriting-support model, the recruitment system and, since April, the allocation function of the claims-triage agent, which the group both provides and deploys. The notation does not draw the legal classification, so the date leaves no trace in any figure: a landscape tells you which marks the date is about, and the register behind each mark tells you what is owed. That is an architectural implication, not legal advice.

December: two landscapes at the end

Figure 18.6: Hansa Mutual and Nordvik Region at the end of 2027, V6 The comparison view, at identical scales. Illustrative: rendered from landscape/models/hansa_mutual.yaml and landscape/models/nordvik_region.yaml.

Read Figure 18.6 in the same order as Figure 18.1. The empty corner is empty in both panels. Hansa Mutual has the same five squares at Level 3 and the same grey square at Level 4; Nordvik Region now has two squares at Level 3, the correspondence classifier and the rostering system, and the same two at Level 4. No circle sits at Level 3 or Level 4 in either panel at either date, so neither landscape contains the pattern this book calls delegated access without delegation: a person's account used at those levels without that person approving each action. It is one case of the collapse into one identity of the AI component and the person on whose behalf it acts, which AI Platform and Security, Chapter 12, names as the most common identity mistake (3, Nordqvist, 2026). No mark lacks a seat, the strips reading 17 of 17 and 13 of 13, the retired pilot included. The group's recruitment system has a solid baseline now; the Region's R3 row holds the benefits-triage system, solid, and the crossed outline of the retired pilot, dashed. The group's colours are unchanged; the Region's dark blue count rises from seven to nine with the two security units, and there is still no plum.

The strips carry the year in three numbers each. Hansa Mutual: filled diamond 16 before and after, seat 16 then 17, solid baseline 12 then 13 of 17. Nordvik Region: filled diamond 7 then 11, seat 10 then 13, solid baseline 6 then 8, of 11 and then 13. The Region's numbers move more because it has more hollow diamonds to fill; the group's move less because most of what it changes is the tier of a seat, which the strip counts as a seat either way. What the group does in 2027 is in the numbers inside the seats, 4 above HM-ITO and 3 above HM-CT, and the strip does not add those up.

Side by side

The comparison frame does one thing: it draws two landscapes at identical scales, sizes and colours, with one legend between them, and forbids rescaling either to fit. Rosling's income levels worked because the four levels were the same in every chart (8, Rosling et al., 2018); the frame borrows the discipline, not the chart.

A cautious public authority under one jurisdiction, which buys most of what it runs, spends 2027 filling the controls it planned, starting two small security units on capacity it controls, lowering the autonomy of its engineers' tools to match a charter, retiring the one procured high-risk system it cannot see into, and naming an owner for the AI nobody chose. A commercially driven insurer under seven legal regimes, which builds most of what it runs, spends 2027 moving nothing on the grid and moving decision rights upward on the two agents that touch the most people, converting one supplier's declaration into logs, registering the AI nobody chose, and keeping an agent pilot going under a named team leader. It decides, at a higher level than before, who answers for its agents.

Those are differences, not a ranking, and the frame refuses to produce one. It does not say which organisation is safer, better governed or further ahead, and it does not weigh one XL square at R3 against six S circles at R1; it draws both and leaves the weighing to the reader. It does not show cost, accuracy, model names, the negotiation behind the January agreement or the council question that starts the Region's year. It shows seven dimensions of every AI use, the same seven for both, so that a reader who has seen one landscape can read the other in the same thirty seconds.

One picture can serve a board, a supervisor, an auditor, an engineer, a worker and a works council without five versions of it. In this scenario the same figures serve an HR director reporting to an elected committee and a chief information security officer reporting to a board, each reading a different part of the same picture. And the raised numbers above HM-CT and HM-ITO, and the seats that appear above the two grey marks, are the sixth commitment that AI Boss, Chapter 33, adds to the series' argument: keep a named person in the chair for every consequence (7, Nordqvist, 2026). In the notation that commitment is a seat.

The scenario supports one general conclusion about the frame, and it is a statement about design, not a forecast: two landscapes drawn side by side at the same scale make visible who holds the seats and where the proof comes from, and they withhold a ranking of which organisation is ahead. Whether real boards, supervisors and councils shown such a pair ask those questions is not something this book has measured, and the author's projections are kept for Chapter 20.

Running a year-end landscape review

The practical guide is the review that produces the chapter's figures. It needs a model kept during the year.

1. Fix the two snapshot dates before the year starts, and do not move them.
2. During the year, add a timeline entry the day a decision changes one of a unit's seven dimensions, with the date, the changed fields and a note naming the record behind it.
3. At the year end, render V1 at both dates, V2 between them, V6 where there is a second organisation, and V3, V4 and V5 at the end date.
4. Read the time view in the thirty-second order and write one line per trail, tick and cross.
5. For every mark that did not move, open the decision-rights and evidence views and ask whether its seat or baseline changed.
6. Explain every number that moved between the two summary strips in one sentence, with its record. Do not add the strips up into a score.
7. Write down what the pictures do not show, such as the expiry of a mandate or the date a legal obligation begins to apply.
8. Set the next year's snapshot dates, and keep retired units in the model for one more year.

The snapshots and a timeline block

The artefact is an excerpt of the Region's model that produces the rostering system's trail in Figure 18.2: the two named dates and one unit's timeline, as landscape/models/nordvik_region.yaml holds them (illustrative; fields omitted).

# Excerpt of landscape/models/nordvik_region.yaml (illustrative; fields omitted)
snapshots:
  - {date: "2027-01-01", label: "Start of the year"}
  - {date: "2027-12-31", label: "End of the year"}
units:
  - id: NR-SW
    name: Rostering and shift allocation
    since: "2026-10-01"
    mode: 4
    identity: own
    level: 2
    reversibility: R2
    reach: L
    policy_point: planned
    decision_tier: T3
    decision_holder: HR director
    evidence: attested
    evidence_kinds: [attestations]
    status: pilot
    action_levels: {"draft a roster": 2, "offer an open shift": 2, "flag a rest-rule breach": 1}
    timeline:
      - date: "2027-01-20"
        policy_point: enforced
        status: active
        note: Delegation profile agreed with the unions; the first daily routes follow in Strandvik home care on 25 January.
      - date: "2027-03-11"
        level: 3
        action_levels: {"draft a roster": 2, "offer an open shift": 3, "flag a rest-rule breach": 1}
        evidence: automatic
        evidence_kinds: [logs, gates, attestations]
        note: Travel-time and rest constraints enforced as hard constraints; open-shift offers at Level 3 Bounded within the profile.

The top-level fields are the unit on 1 January; each timeline entry overrides fields from its date onwards; the renderer applies the entries up to the date it is asked for. Two entries are enough to draw the trail, fill the diamond and turn the baseline solid. Chapter 14 says where each field comes from, and Appendix A lists them all.

Nordvik Region and Hansa Mutual

The whole chapter is about the two organisations, and they are illustrative throughout: nothing above is evidence of anything, and every event is one the two models record. From Nordvik Region the reader carries that a landscape with hollow diamonds is a landscape with a plan, to be filled in the right order, control before autonomy, and that a trail can go left. From Hansa Mutual, that a year in which nothing moves on the grid can be a year of consequence, and that the seats are where to look for it. From the two together, that one picture serves both and ranks neither.

Summary

The chapter follows Nordvik Region and Hansa Mutual through a modelled 2027 in the notation, from the comparison view of 1 January to the comparison view of 31 December, with the time view of each in between and the decision-rights and supply views where a quarter needs them. The year is a scenario drawn from two models, not a forecast. The Region's year is drawn as motion: two new security units, the rostering system's trail from Level 2 to Level 3 after its policy point is enforced and its delegation profile agreed with the unions, its engineers' tools trailing down to Level 1 to match a charter, a recruitment pilot retired, and a seat added to the AI nobody chose. The group's year is drawn as seats: the board taking the decision right over write access to production after a failed stop drill, the executive level taking the decision right over the allocation of claims to people after a reassessment under Annex III, a supplier's declaration replaced by logs, and a seat added to its own ambient AI. Not one of the group's seventeen marks moves.

The comparison frame shows the two at identical scales and refuses to rank them: a cautious public authority that buys most of what it runs, under one jurisdiction, and a commercially driven insurer that builds, under seven, with their differences drawn as position, shape, colour, diamond, seat and baseline rather than as a score. The practical guide is the year-end review that produces the figures: fixed snapshot dates, a timeline entry for every change with its record, the thirty-second reading, a separate look at seats and baselines for the marks that do not move, and no score. The chapter's one general conclusion concerns design and makes no forecast of how a board or a council will react. Chapter 19 applies the rules of thumb of Part II to documents like these, and Chapter 20 says what the author expects of the next years and labels every sentence of it.

Sources

1. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. aig.geon.se. (2, Nordqvist, 2026)
2. Nordqvist, G. (2026). AI Platform and Security: Building and Securing AI Platforms in European Enterprises and Public Authorities. aips.geon.se. (3, Nordqvist, 2026)
3. Nordqvist, G. (2026). AI Red Team: AI as an Active Part of Cyber Defence in European Enterprises and Public Authorities. aired.geon.se. (4, Nordqvist, 2026)
4. Nordqvist, G. (2026). The Transformed Security Architect: Role, Craft and Career in the Age of AI in European Enterprises and Public Authorities. tsa.geon.se. (6, Nordqvist, 2026)
5. Nordqvist, G. (2026). AI Boss: When Artificial Intelligence Manages People in European Enterprises and Public Authorities. aiboss.geon.se. (7, Nordqvist, 2026)
6. Rosling, H., Rosling, O. and Rosling Rönnlund, A. (2018). Factfulness. London: Sceptre. (8, Rosling et al., 2018)
7. European Parliament and Council of the European Union (2024). Regulation (EU) 2024/1689 (Artificial Intelligence Act). Official Journal of the European Union, L series, 2024/1689. (39, European Union, 2024)
8. European Parliament and Council of the European Union (2026). Regulation (EU) 2026/1744 (Digital Omnibus on AI). Official Journal of the European Union, L series, 2026/1744. (40, European Union, 2026)
9. European Parliament and Council of the European Union (2022). Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). Official Journal of the European Union, L 333. (42, European Union, 2022)