The Rules of Thumb in Practice

Picture five people on the same morning, each with a document about AI in front of them. A board member in Hamburg opens a paper headed "AI programme: status and outlook". An architect in a Nordic regional authority opens a proposal that would let a rostering system offer open shifts without a manager approving each one. A regional director takes a seat in a council chamber where a question about "rogue AI" is on the order paper. A journalist opens a press release with a large number in its first line. A citizen reads on a phone that AI is coming for the jobs. None of the five has an hour.

This chapter is for that morning. It collects the nine rules of thumb that Chapters 5 to 13 arrived at, each with one measured fact, and then follows the five readers through their documents. The scenes are illustrative. The board member's and the architect's sit inside the scenario of Chapter 18, which is not a forecast, and the journalist's and the citizen's rest on the public record as it stands in November 2026. The facts about Nordvik Region and Hansa Mutual come from the landscape models from which Figure 19.1 is rendered, at the start of 2027.

The comparison view of Hansa Mutual and Nordvik Region on 1 January 2027

Figure 19.1: Hansa Mutual and Nordvik Region at the start of 2027, V6 The comparison view, at identical scales: the two landscapes the scenes in this chapter are read against. Illustrative: rendered from landscape/models/hansa_mutual.yaml and landscape/models/nordvik_region.yaml.

The nine rules

Each rule is quoted as its chapter set it, with the instinct it answers, the chapter that gives the evidence and one measured fact from it.

1. The box instinct, Chapter 5.

Rule of thumb: When someone says "the AI" or "the cloud", ask which ones, and count them before you judge them.

In 2025, 19.95 per cent of EU enterprises with ten or more persons employed used at least one AI technology and 8.28 per cent at least three (9, Eurostat, 2026).

2. The binary instinct, Chapter 6.

Rule of thumb: Ask at which level, for which action: "automated" is five answers, not one.

Among EU workers, 24 per cent had rosters allocated automatically, 21 per cent their tasks and 5 per cent the speed of their work set by a device (51, Gonzalez Vazquez et al., 2025).

3. The model instinct, Chapter 7.

Rule of thumb: Ask what it is used for and who deploys it before you ask which model it is.

Of the 1,498 classified incidents in the AI Incident Database, 1,462 occurred after deployment (35, Responsible AI Collaborative, 2026), and Annex III of the AI Act lists uses, not models (39, European Union, 2024).

4. The straight-line instinct, Chapter 8.

Rule of thumb: Never extend the last two points; ask what bent the last curve and what could bend this one.

The Commission's baselines for the 2030 share, computed in 2023, 2024, 2025 and 2026, reached 20.29, 16.76, 35.92 and 54.28 per cent, each superseded within a year (15, European Commission, 2026).

5. The fear instinct, Chapter 9.

Rule of thumb: When a story frightens you, find the base rate and the quiet harm it hides.

In Eurostat's 2024 survey, 17.97 per cent of EU enterprises had services made unavailable by a hardware or software failure against 3.43 per cent by an attack from outside (11, Eurostat, 2026); 3 of the 1,498 classified incidents are AI pursuing its own goals (35, Responsible AI Collaborative, 2026).

6. The size instinct, Chapter 10.

Rule of thumb: Never accept a number alone; ask what it is divided by and compared with.

The incident count rose from 179 for 2023 to 463 for 2025, with no count of deployments to divide it by (35, Responsible AI Collaborative, 2026), while ICT specialists rose from 3.0 to 5.0 per cent of EU employment between 2011 and 2025, Eurostat estimates (12, Eurostat, 2026).

7. The destiny instinct, Chapter 11.

Rule of thumb: Nothing here is fixed and nothing is inevitable; ask what was decided, by whom, and what it would take to reverse it.

The date from which the Annex III high-risk obligations apply moved from 2 August 2026 to 2 December 2027 by a recorded decision, Regulation (EU) 2026/1744 (40, European Union, 2026).

8. The single-perspective instinct, Chapter 12.

Rule of thumb: Before you decide, read the landscape from the other two chairs.

In a vendor's 2025 panel, 81 per cent of leaders said they expected agents to be moderately or extensively part of their AI strategy within twelve to eighteen months (25, Microsoft, 2025), while 3.15 per cent of the developers in a self-selected survey highly trusted AI output (28, Stack Overflow, 2025).

9. The blame instinct, Chapter 13.

Rule of thumb: Look for the seat before you look for the culprit; if nobody was named to decide, that is the finding.

The incident record names "scammers" as the most frequent deployer, in 240 incidents, and has no field for the person inside an organisation who held the decision right (35, Responsible AI Collaborative, 2026).

The test, question by question

The test in Chapter 1 has fourteen questions, each explained in full in one chapter of Part II, which gives its measured answer and its evidence. Where another chapter touches a question it refers back.

Question What it asked about Explained in
Question 1 EU enterprises using at least one AI technology, 2025 Chapter 10
Question 2 Large EU enterprises using at least one AI technology, 2025 Chapter 10
Question 3 The change in the EU share between 2021 and 2023 Chapter 8
Question 4 AI-using enterprises with three or more technologies, 2025 Chapter 5
Question 5 EU enterprises buying paid cloud services, 2025 Chapter 5
Question 6 People in the EU using a generative AI tool for work, 2025 Chapter 6
Question 7 EU enterprises with an ICT security incident that made services unavailable, destroyed data or disclosed confidential data, 2024 survey Chapter 9
Question 8 ICT specialists as a share of EU employment, 2025 Chapter 10
Question 9 The 2030 share on the trend of the Commission's 2023 baseline Chapter 8
Question 10 The most common purpose of AI use in EU enterprises, 2025 Chapter 5
Question 11 The most frequent kind of harm in the AI Incident Database Chapter 7
Question 12 When the Annex III high-risk obligations apply Chapter 11
Question 13 Developers who highly trust AI output, 2025 Chapter 6 (and Chapter 12)
Question 14 EU workers whose tasks a device allocates automatically Chapter 6

The executive

The board member sits on the executive board of Hansa Mutual, a mutual insurance group with about 9,500 employees and entities in seven countries, the management body for the purposes of DORA, Regulation (EU) 2022/2554 (42, European Union, 2022). The paper's first sentence reads: "The AI is now automated across claims handling in all markets." Its second: "Our model performed within tolerance throughout 2026." Its last page is a chart in which a line runs through two measured years and continues, dashed, to 2030.

The first rule applies before the page is turned. "The AI" at Hansa Mutual is seventeen units in six usage modes, the six ways of coming to use a model that AI Governance, Chapter 2, defines, from Mode 0 Ambient AI, the features a vendor switches on, to Mode 5 Autonomous production agents, which act with an identity of their own (2, Nordqvist, 2026). The strip under the left panel of Figure 19.1 counts them: one each in Modes 0, 1 and 2, two in Mode 3, six in Mode 4 and six in Mode 5. Three touch claims handling at scale: two Mode 4 assistants, drawn as circles because they act with each handler's permissions, and a Mode 5 claims-triage agent, drawn as a square because it acts with an identity of its own. The paper's one box also holds the underwriting-support model, a Mode 4 square at R3 Hard to reverse, because a premium quoted is a person's outcome.

The second rule takes "automated". The autonomy levels are the five of AI Red Team, Chapter 6, from Level 0 Advisory, where the AI suggests and a person decides, to Level 4 Autonomous, where it selects and executes without per-action approval, and the level belongs to an action, not a product (4, Nordqvist, 2026). The two assistants sit at Level 1 Assisted: they draft, a handler reviews and sends. The claims-triage agent sits at Level 3 Bounded for routing and allocating a claim, behind a filled diamond, and at Level 0 Advisory for settling one. "Automated across claims handling" is true of routing, false of settlement and misleading about drafting.

The third rule takes "our model". The claims assistant takes its model from a general-purpose provider outside the EU under a recorded exception; the triage agent and the underwriting model run on the group's own platform in Frankfurt. What matters is what each is used for and under whose authority. The triage agent's allocation of claims to individual handlers falls under Annex III point 4(b) of the AI Act, the entry for systems used to make decisions affecting the terms of work-related relationships or to allocate tasks based on individual behaviour or personal traits (39, European Union, 2024); Annex III is the Act's list of high-risk uses. In the scenario of Chapter 18 the group reassesses that function under the point and lifts its seat to tier 3 on 30 April. The model does not change; the use is reclassified and the decision right moves, and a paper about the model shows neither.

The EU share of enterprises using AI, the 2030 target and the Commission's four baseline trajectories

Figure 19.2: Four observations, one target and the four baseline trajectories the Commission computed in 2023, 2024, 2025 and 2026, each labelled with the value it projects for 2030: the public example of a line redrawn every year. Source: European Commission, Digital Decade DESI dashboard, indicator dd_ai, based on Eurostat isoc_eb_ai (retrieved 2026).

The fourth rule takes the last page. Figure 19.2 is the public version of the same chart: the Commission's four baselines for the EU share end at 20.29, 16.76, 35.92 and 54.28 per cent in 2030, each superseded within a year (15, European Commission, 2026). Those are the Commission's projections, not forecasts of this book. The 75 per cent target is observable as a text of law: Decision (EU) 2022/2481 sets it for enterprises that have taken up cloud computing, big data or artificial intelligence, and the dashboard draws it against the AI indicator alone (43, European Union, 2022). The paper's dashed line rests on two measured years and should be labelled speculation; the useful question is what bent the group's own curve and whether that cause is still working.

The eighth and ninth rules close the reading. The paper is written from the productivity chair; before the board decides it needs the security and compliance readings of the same marks, down to the obligations that attach to the underwriting-support model as a high-risk system under Annex III point 5(c) (39, European Union, 2024). And the seat. The grey number above the IT-operations agent in Figure 19.1 reads 2, the tier of a system owner. In the scenario of Chapter 18 a stop drill takes 17 minutes against a budget of 5 and the board takes that seat itself on 31 March. A paper that says "the AI" to a board does not tell it which decisions it holds, or will have to hold.

Rewritten with the rules applied, the paper's first paragraph names three units at stated levels, seats and baselines, says which allocation function is under reassessment and makes no projection. It is longer. It is also the first version a board could act on.

The architect

Nordvik Region is a regional public authority in a Nordic member state of the European Union, with about 6,000 employees and about 450,000 residents. It has one security architect and no standing architecture review board. In the scenario of Chapter 18 the architect receives, in the first quarter of 2027, a proposal that the rostering and shift-allocation system, bought for the hospitals and home care, offer open shifts to staff who have opted in without a unit manager approving each offer, once travel-time and rest constraints are enforced as hard constraints. In Figure 19.1 the system, NR-SW, is a square at Level 2 Supervised with a hollow diamond and a seat at tier 3.

The architect starts with the second rule, because the proposal says "automated offers". The unit holds three actions at three levels: it drafts a roster at Level 2 Supervised, since the unit manager approves every roster; it would offer an open shift at Level 3 Bounded, without per-action approval; and it flags a breach of the rest rules at Level 1 Assisted. AI Red Team, Chapter 6, concludes that the line between Level 2 and Level 3 is the most important in the scheme, and that Level 3 is defined by a policy decision point outside the model, deterministic code that checks every request against what the unit may do (4, Nordqvist, 2026). The first check is therefore the diamond, and in Figure 19.1 it is hollow: the control is planned, not enforced. In the scenario it is enforced on 20 January, the day a delegation profile is agreed with the unions, seven weeks before the level rises on 11 March. A delegation profile is the record of which function is handed to a system and under what conditions, as AI Boss, Chapter 4, defines it (7, Nordqvist, 2026). In the other order the renderer would draw the thin red outline reserved for a Level 3 capability without an enforced policy point, which AI Red Team calls Level 4 with a misleading label.

The third rule disarms a question. The supplier's model is not what the review is about: a system used for the purposes that Annex III point 4(b) lists is high-risk whatever model is inside it, and the Region's profile classifies the rostering system so (39, European Union, 2024). The Region is its deployer only. That the deployer obligations of Article 26 apply to this unit from 2 December 2027 is observable, because the instrument that set the date is adopted and published (40, European Union, 2026).

The seventh and ninth rules are the architect's own. What was decided: the delegation profile, negotiated with the unions, with offers going to opted-in staff in a published rotating order into which nothing about the person enters. By whom: the seat reads 3, the HR director, with unit managers approving every roster beneath it. What it would take to reverse: the mark sits at R2 Reversible with effort, and in the scenario a reversibility test run from 5 to 16 April, in which the work is done without the system, finds a deputy who has never planned a route by hand and a manual template without the travel-time rule. The test illustrates, and does not measure, the reversibility that decays within months of go-live, as AI Boss, Chapter 33, puts it (7, Nordqvist, 2026), and the architect writes the retest into the conditions, which are met on 30 June.

The eighth rule is where a security architect reads from the other two chairs. From the compliance chair, Article 26(7) requires an employer to inform workers' representatives and affected workers before putting a high-risk system into use at the workplace (39, European Union, 2024); the negotiation of January does that. The baseline turns from dashed to solid on 11 March, when the hard constraints begin to produce logs and gate results, and the architect approves on that day, not before. The trail in Figure 18.2 records a review done in that order.

The public official

The regional director of Nordvik Region sits in the council chamber. In September 2026 a group in the regional council tabled a motion to pause the Region's use of AI until the risks are understood; the council referred it to its audit committee, which asked for a report by the end of the first quarter of 2027. The scene is illustrative, and so is the question on the order paper: whether the Region's "rogue AI" could decide about a resident's benefits without a person. The answer will be quoted.

The fifth rule comes first, because a frightening story is asking for a base rate. In the AI Incident Database, the subdomain for AI pursuing its own goals in conflict with human goals or values holds 3 of the 1,498 classified incidents; fraud, scams and targeted manipulation holds 412 (35, Responsible AI Collaborative, 2026). AI Threat, Chapter 4, grades claims on an evidence ladder from fiction and argument through laboratory demonstration and incident in the wild to pattern at scale; in that book's later chapters agents acting beyond their mandate reach incident in the wild (Chapter 25), and a system escaping control altogether has not left the lower rungs (5, Nordqvist, 2026). Then the quiet harm the story hides: the Region's own threat register lists, among its larger exposures, a ranking that quietly deprioritises the wrong people, while its direct exposure to an escaping agent is low because it runs no autonomous production agent.

The first and second rules make the answer precise. The Region's landscape in Figure 19.1 has eleven units and no Mode 5 agent. Its two marks at Level 4 Autonomous are the citizen-service assistant, which answers residents' questions from published information, and the ambient AI in licensed software, whose autonomy the vendors chose. The benefits-triage system, the largest mark in the R3 row, sits at Level 0 Advisory: it ranks the queue of incoming applications by urgency, and caseworkers decide every case, as its decision record on human oversight says. No system in the Region decides about a resident's benefits; one orders the queue in which people decide, and the ordering is the thing to watch.

The ninth and seventh rules give the councillor somewhere to look afterwards. The seat above the benefits-triage mark reads 2: the Head of Benefits Unit is the system owner, and the director answers to this chamber for that naming. The unit is high-risk under Annex III point 5(a), access to essential public assistance benefits, and the Region has carried out the fundamental rights impact assessment that Article 27 asks of it (39, European Union, 2024). What it would take to reverse: the contracts require a stop path outside the supplier's system. It is a list of decisions, each with a name and a date, which is what the word "rogue" has no room for. The councillor's fear was not foolish; it was about the wrong mark, and the right one deserves the attention the councillor was ready to give.

The journalist

The press release is hypothetical and its kind is common. Its first line says that 463 incidents involving AI were recorded in 2025, up from 313 in 2024; its second says the trend is accelerating. Both counts are real: they are the incident records in the AI Incident Database dated to each year, in the snapshot of 2 November 2026 (35, Responsible AI Collaborative, 2026).

The sixth rule first: divided by what, and compared with what. The database counts what was reported in the press and accepted by volunteer editors, and earlier years keep rising: the Stanford AI Index 2025 reported 233 incidents for 2024 from the same database, and the November 2026 snapshot holds 313 (17, Maslej et al., 2025) (35, Responsible AI Collaborative, 2026). Nor is there a denominator. Between 2024 and 2025 the share of EU enterprises using at least one AI technology rose from 13.48 to 19.95 per cent (9, Eurostat, 2026), but no public dataset counts deployments in a way that would let the incidents be divided by them. The honest sentence names the gap: the count rose, and whether the rate did, nobody can say from these figures.

AI in use in the EU in 2025, on five bases

Figure 19.3: AI use in the EU in 2025 on five bases: all enterprises with ten or more persons employed, large enterprises, small enterprises and, for individuals, a generative AI tool used for any purpose and for work; the first three differ by denominator, the last two by population and question as well. Source: European Commission, Digital Decade DESI dashboard, based on Eurostat isoc_eb_ai and isoc_ai_iaiu (retrieved 2026).

Figure 19.3 is the denominator chart of Chapter 10: "AI use" is 19.95 per cent of all enterprises with ten or more persons employed, 55.03 per cent of large enterprises, 17.0 per cent of small ones, and, for individuals, 32.66 per cent for any purpose and 15.36 per cent for work (9, Eurostat, 2026) (14, Eurostat, 2026).

The fifth and third rules decide what the story is about. The record's largest category is people using AI against other people, 412 incidents under fraud, scams and targeted manipulation, and its most frequent alleged deployers are "scammers", in 240 incidents (35, Responsible AI Collaborative, 2026). A story about 463 incidents illustrated with a picture of a robot has illustrated 3 of them; the story the numbers support is about what people did with a tool, which is about use and deployer before it is about any model. The fourth rule stops the second paragraph: two points, 313 and 463, do not make a trend, and what bent the curve is partly adoption, partly attention and partly editorial throughput. The ninth rule is for the follow-up call: in the incidents that were not fraud, who inside the deploying organisation had been named to decide that the system might act as it did, and who could stop it. The record has no field for that person.

The citizen

The headline says that AI will take the jobs, and under it is a survey figure: two thirds of Europeans agree. The rules are questions, and three of them fit on a phone screen.

The sixth and eighth rules go together. The figure is real: Special Eurobarometer 554, a face-to-face survey of 26,415 residents aged 15 and over in the 27 member states in April and May 2024, asked for agreement with the statement "Due to the use of robots and artificial intelligence, more jobs will disappear than new jobs will be created", and 66 per cent of respondents agreed (29, European Commission, 2025). Read from the other chairs, the same survey gives figures the headline left out: 62 per cent perceived the use of robots and AI in the workplace positively and 32 per cent negatively, and 66 per cent of those in work answered that the most recent digital technologies, including AI, currently had a positive impact on their own employment. The report's own note says that agreement with the first statement had fallen by eight points since March 2017: the line the headline implies is rising had, on the survey's own comparison, been falling.

The second rule takes the word behind the headline. The Joint Research Centre's AIM-WORK survey of 70,316 people aged 16 to 65 across the member states found that 29.9 per cent of workers had used an AI-powered tool in their main paid job in the previous twelve months. It also asked about being managed by a device: rosters allocated automatically, 24 per cent of workers; tasks, 21 per cent; shifts that could be cancelled on a low rating, 7 per cent; the speed of work set by a device, 5 per cent (51, Gonzalez Vazquez et al., 2025). "Automated" is a gradient from a tool a person picks up, through a roster a manager can change, to a pace nobody in the building sets. Eurobarometer respondents perceived most negatively automatically firing workers, 78 per cent, and monitoring workers, 63 per cent (29, European Commission, 2025): the quiet harms of the fifth rule, named without a story about a machine escaping.

The ninth rule is the one the citizen can act on. Asked whether their employer had informed them about the use of digital technologies, including AI, to manage activities in their workplace, 49 per cent of respondents in employment answered yes in some form and 18 per cent had received a detailed explanation including their rights; 74 per cent of all respondents rated prohibiting fully automated decision-making important (29, European Commission, 2025). The question to ask at work is the seat's question: who decides when a device allocates a shift or scores a quarter, and who can be asked to decide otherwise. For high-risk systems the AI Act gives the question a date: Article 26(7) requires employers to inform workers' representatives and affected workers before such a system is used at the workplace, and for the systems of Annex III the obligations apply from 2 December 2027, which is observable because the instrument is adopted and published (39, European Union, 2024) (40, European Union, 2026).

The rules at the table

Each reader began with the rule that fitted the word that triggered an instinct: "the AI", "automated", "our model", a dashed line, a frightening story, a lone count, "rogue", a paper from one chair, a culprit. The practical guide is the nine rules, in the order the chapters set them, as the questions a meeting can put to any document about AI before it decides on it: which ones, and how many; at which level, for which action; used for what and deployed by whom; divided by what; what base rate and what quiet harm; what bent the last curve; what was decided, by whom, and what would reverse it; what the other two chairs see; and for any failure, who held the seat. Appendix B prints the nine rules on one page beside the hand-drawing pages for the views, so that a meeting can draw the landscape and ask the questions on the same sheet. The thirty-second reading order of Chapter 4 is the same checklist applied to a picture instead of a paper.

Author's note needed: A short passage, one or two paragraphs, from the author's own practice would carry this section: a meeting at which the checklist, or an earlier form of it, was used on a real paper, which question changed the decision, and how long it took. It belongs here, after the list and before the two organisations.

Nordvik Region and Hansa Mutual

The board paper was Hansa Mutual's and the council question Nordvik Region's, and the difference between the scenes is the difference between the two landscapes, both illustrative. At Hansa Mutual the rules are needed against size and agency: seventeen units, six of them agents, and a board whose instincts are the box and the model; the rule it most needs is the ninth, because it will hold a seat itself. At Nordvik Region they are needed against fear and destiny: eleven units, no agents, and a high-risk system at Level 0 Advisory in the R3 row; the rules it most needs are the fifth and the seventh. The strips under Figure 19.1 record where each stands on 1 January 2027: at Hansa Mutual a filled diamond on 16 of 17 marks, a seat on 16 and a solid baseline on 12; at Nordvik Region a filled diamond on 7 of 11, a seat on 10 and a solid baseline on 6. Neither strip is a verdict. Each is where the next question starts.

Summary

This chapter collected the nine rules of thumb of Part II, each with one measured fact, and mapped the fourteen questions of the test to the chapters that explain them. Each rule is one sentence because it has to be carried into a meeting rather than looked up afterwards.

Five readers then applied the rules to five documents. The executive turned "the AI", "automated" and "our model" into marks at known levels with known seats, and a projection labelled speculation. The architect made a rise from Level 2 Supervised to Level 3 Bounded conditional on the diamond being filled, the baseline solid and the reversibility tested. The public official answered a question about rogue AI with a base rate of 3 in 1,498, pointed to the quiet harm in the R3 row and named the seat above it. The journalist found that two counts without a denominator do not make a trend, and the citizen read one survey from three chairs and found the question to ask at work.

The rules do not replace the landscape; they are what to ask of it, and of any document that describes it without drawing it. Chapter 20 does what the rest of the book has deliberately not done: it gives the author's own view of the next years, labelled as his judgement, and closes with what the data show, what is possible and what the reader can do.

Sources

  1. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. aig.geon.se. (2, Nordqvist, 2026)
  2. Nordqvist, G. (2026). AI Red Team: AI as an Active Part of Cyber Defence in European Enterprises and Public Authorities. aired.geon.se. (4, Nordqvist, 2026)
  3. Nordqvist, G. (2026). AI Threat: Are the Dystopias Coming True? Evidence, Risk and Response for European Enterprises and Public Authorities. aithreat.geon.se. (5, Nordqvist, 2026)
  4. Nordqvist, G. (2026). AI Boss: When Artificial Intelligence Manages People in European Enterprises and Public Authorities. aiboss.geon.se. (7, Nordqvist, 2026)
  5. Eurostat (2026). Artificial intelligence by size class of enterprise. Online data code isoc_eb_ai. (9, Eurostat, 2026)
  6. Eurostat (2026). Security incidents and consequences by size class of enterprise. Online data code isoc_cisce_ic. (11, Eurostat, 2026)
  7. Eurostat (2026). Employed information and communications technology (ICT) specialists. Online data code isoc_sks_itspt. (12, Eurostat, 2026)
  8. Eurostat (2026). Individuals - use of generative AI tools. Online data code isoc_ai_iaiu. (14, Eurostat, 2026)
  9. European Commission, Directorate-General for Communications Networks, Content and Technology (2026). Digital Decade DESI dashboard: Digital Decade EU-level trajectories and Digital Economy and Society Indicators. (15, European Commission, 2026)
  10. Maslej, N., Fattorini, L., Perrault, R. et al. (2025). The AI Index 2025 Annual Report. AI Index Steering Committee, Institute for Human-Centered AI, Stanford University. (17, Maslej et al., 2025)
  11. Microsoft (2025). 2025: The year the Frontier Firm is born. Work Trend Index Annual Report (vendor survey). (25, Microsoft, 2025)
  12. Stack Overflow (2025). 2025 Stack Overflow Developer Survey. Stack Exchange Inc. (28, Stack Overflow, 2025)
  13. European Commission, Directorate-General for Employment, Social Affairs and Inclusion (2025). Artificial Intelligence and the future of work. Special Eurobarometer 554. (29, European Commission, 2025)
  14. Responsible AI Collaborative (2026). AI Incident Database. Snapshot of 2 November 2026. (35, Responsible AI Collaborative, 2026)
  15. European Parliament and Council of the European Union (2024). Regulation (EU) 2024/1689 (Artificial Intelligence Act). Official Journal of the European Union. (39, European Union, 2024)
  16. European Parliament and Council of the European Union (2026). Regulation (EU) 2026/1744 (Digital Omnibus on AI). Official Journal of the European Union. (40, European Union, 2026)
  17. European Parliament and Council of the European Union (2022). Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). Official Journal of the European Union. (42, European Union, 2022)
  18. European Parliament and Council of the European Union (2022). Decision (EU) 2022/2481 establishing the Digital Decade Policy Programme 2030. Official Journal of the European Union. (43, European Union, 2022)
  19. Gonzalez Vazquez, I., Fernandez Macias, E., Wright, S. and Villani, D. (2025). Digital Monitoring, Algorithmic Management and the Platformisation of Work in Europe. European Commission, Joint Research Centre, JRC143072. (51, Gonzalez Vazquez et al., 2025)