The Next Years, and a Conclusion

Every year the European Commission's Digital Decade dashboard does something few forecasters do in public. It takes the share of EU enterprises using at least one AI technology, lays a line through the observed points, carries the line to 2030 and publishes where it lands; the next year it does it again, with one more point, and leaves the old line beside the new one. Computed in 2023, the baseline reached 20.29 per cent in 2030. Computed in 2024, 16.76. In 2025, 35.92. In 2026, 54.28 (15, European Commission, 2026). Four projections by the same office, each superseded within a year, each labelled a projection. A reader who wants to know how wrong the 2023 line was about 2025 can look it up: it had the share at 12.35 per cent, and the survey found 19.95 (15, European Commission, 2026).

I open the last chapter with that dashboard because it is the model for what the chapter does. AI Governance, Chapter 22, sets the practice: state each trend, classify its evidence, assign it a horizon and set a review date, so that an outlook can be wrong in a reviewable way (2, Nordqvist, 2026). The earlier chapters describe the measured picture and, where they look ahead, say whose projection it is. My own guesses go in one section of this chapter, marked as mine and nowhere else, written so that the reader can see what would show them wrong. Before it, three sections sort the next years under the three labels the book has used throughout: what is observable now, what is expected within five years and on what evidence, and what is speculation. After it, the test and the stance return, and the two organisations are drawn one last time.

The fourteen measured answers of the test on one page, each with the three options marked beside it

Figure 20.1: The fourteen measured answers of the test on one page: for each question, the measured value or category with the three options offered marked beside it, as Chapter 1 gave them. Source: Eurostat, isoc_eb_ai, isoc_cicce_use, isoc_ai_iaiu, isoc_cisce_ic and isoc_sks_itspt (2024 and 2025 data); European Commission, Digital Decade DESI dashboard (2026); Responsible AI Collaborative, AI Incident Database (snapshot of 2 November 2026); Regulation (EU) 2026/1744; Stack Overflow Developer Survey 2025 (self-selected sample); European Commission Joint Research Centre, AIM-WORK survey 2025 (retrieved 2026).

Observable

Observable, in the sense AI Governance, Chapter 22, gives the word, means already visible in adopted legislation, published guidance, cited standards or production systems, and here in a published dataset as well (2, Nordqvist, 2026). Everything in this section is observable, and none of it is a forecast.

Adoption is a fifth, and the fifth is recent. The share of EU enterprises with ten or more persons employed using at least one of the AI technologies on Eurostat's list was 7.65 per cent in 2021, 8.06 per cent in 2023, 13.48 per cent in 2024 and 19.95 per cent in 2025; the module was not run in 2022, and the 2025 list is one technology longer than the earlier ones. Among large enterprises the 2025 share was 55.03 per cent, among small ones 17.0 per cent (9, Eurostat, 2026). People's own use is about a seventh for work and about a third for anything: in 2025, 15.36 per cent of people aged 16 to 74 in the EU had used a generative AI tool for work in the previous three months and 32.66 per cent for any purpose (14, Eurostat, 2026), and, on a wider question over twelve months, 29.9 per cent of EU workers in the Joint Research Centre's AIM-WORK survey had used an AI-powered tool in their main job (51, Gonzalez Vazquez et al., 2025).

The recorded harms are quiet. In Eurostat's 2024 survey 21.54 per cent of EU enterprises reported an ICT security incident that made services unavailable, destroyed data or disclosed confidential data, and services made unavailable by a hardware or software failure, in 17.97 per cent of enterprises, outnumbered those made unavailable by an attack from outside, 3.43 per cent (11, Eurostat, 2026). ENISA's 4,875 incidents for the year to June 2025 were about 76.7 per cent denial of service, and the agency reported publicly available evidence that AI is misused as a tool more often than attacked as a target (38, ENISA, 2025). In the AI Incident Database's snapshot of 2 November 2026, 566 of the 1,498 classified incidents fall under malicious actors and misuse, 412 of them fraud, scams and targeted manipulation, and 3 under an AI pursuing its own goals in conflict with human goals (35, Responsible AI Collaborative, 2026).

The law's dates stand where the Official Journal put them in July 2026. Regulation (EU) 2024/1689, the AI Act, entered into force on 1 August 2024; its general provisions and prohibitions have applied since 2 February 2025, its obligations for general-purpose AI models since 2 August 2025, and its general date of application, 2 August 2026, is unchanged (39, European Union, 2024). Regulation (EU) 2026/1744, the Digital Omnibus on AI, adopted on 8 July 2026 and in force from 27 July, replaced points (a) and (c) of the third paragraph of Article 113 and added a point (d), so that the obligations of Chapter III, Sections 1 to 3, apply from 2 December 2027 to the high-risk systems listed in Annex III and from 2 August 2028 to those under Annex I; it moved the national regulatory sandboxes to 2 August 2027 and added two prohibitions that apply from 2 December 2026 (40, European Union, 2026). The implication for an organisation is a plan with dates in it, not legal advice.

Expected

Expected means supported by strong evidence, with uncertain timing or form, within five years (2, Nordqvist, 2026). Every statement about the future in this section is labelled expected, each is followed by its evidence, and where the expectation is somebody else's I say whose.

Expected, on the Commission's own trajectory and labelled as the Commission's: the share of EU enterprises using at least one AI technology reaches 25.98 per cent in 2026, 32.83 per cent in 2027, 40.15 per cent in 2028, 47.46 per cent in 2029 and 54.28 per cent in 2030 on the baseline computed in 2026 from past performance (15, European Commission, 2026). The target it is drawn against, 75 per cent by 2030, stands in Decision (EU) 2022/2481 for enterprises that have taken up cloud computing, big data or artificial intelligence, and the dashboard draws it against the AI indicator alone (43, European Union, 2022). Expected: the next State of the Digital Decade report recomputes the line and moves its end point, because the four vintages so far have moved every year and the method has not changed. I quote the line because it is the best-documented projection there is, not as a forecast of its end point.

Expected: the next Eurostat enterprise survey reports a higher share than 19.95 per cent. The share has risen at every survey since 2021, 26 of 27 member states rose between 2024 and 2025 (9, Eurostat, 2026), and paid cloud services, an older technology on the same survey, rose from 17.82 per cent of enterprises in 2014 to 52.74 per cent in 2025 (10, Eurostat, 2026). The size of the rise is not evidenced, part of the last one was a longer list of technologies, and I give no figure.

Expected: agents spread from organisations like Hansa Mutual, which build, to organisations like Nordvik Region, which buy, and they arrive at the buyers first as features inside products those organisations already license, at autonomy levels the suppliers chose, before they arrive as decisions. The evidence for the spread is marked for what it is: about three in ten of the developers who answered the 2025 Stack Overflow survey, a self-selected sample, said they used AI agents at work, from daily to infrequently, the sum of three published answers (28, Stack Overflow, 2025), and GitHub's own telemetry, a vendor's figures about its own platform, has more than 40 per cent of pull requests on GitHub starting with an agent's first draft by September 2026, up from 17 per cent in March (24, GitHub, 2026). The evidence for the path is the series' conclusion about Mode 0 Ambient AI, the first of the six usage modes that AI Governance, Chapter 2, defines (2, Nordqvist, 2026): AI Red Team, Chapter 8, found that vendor AI in licensed products may already act at an effective autonomy nobody decided (4, Nordqvist, 2026), and AI Boss, Chapter 10, found that the AI that manages people in offices arrives as features nobody decided to switch on (7, Nordqvist, 2026). Both illustrative landscapes carry such a feature, a grey square at Level 4 Autonomous with no seat, at the start of 2027; that is a drawing, not a measurement. Expected, therefore: European organisations are likely to acquire more such marks, and many will acquire them without noticing.

Expected: named decision holders multiply where the deployer duties of the AI Act apply. Article 26(2) requires a deployer of a high-risk AI system to assign human oversight to natural persons with the necessary competence, training and authority (39, European Union, 2024), and under the amended Article 113 that duty applies to the systems listed in Annex III from 2 December 2027 (40, European Union, 2026). In this book's notation a natural person with authority is a seat. Expected, and narrower than it sounds: the seats appear on the high-risk marks, which are a minority of any landscape, and whether they spread to the assistants and the ambient features is a choice each organisation makes, because no article asks for it. The Transformed Security Architect, Chapters 18 and 27, concludes that European regulation places its duties on management bodies and organisations and, one level below, on named people, and that accountability for a boundary cannot be delegated to a system (6, Nordqvist, 2026); the law supplies the names for some marks, and the organisation supplies the rest or does not.

Expected: the AI Act is amended again before 2030. A regulation amended once within two years of its entry into force, by an instrument whose title names simplification and which rewrote dates, the literacy obligation and the transitional rules, is a regulation whose text has been shown to be a decision (40, European Union, 2026); the direction and timing of the next amendment are not evidenced.

Expected: the counts of recorded AI incidents keep rising. The AI Index 2026 counted 362 incidents in the AI Incident Database for 2025 against 233 for 2024 (18, Sajadieh et al., 2026), and the database's own snapshot of November 2026 already holds 463 for 2025, because counts for a year keep rising as reports arrive (35, Responsible AI Collaborative, 2026). The rise says nothing by itself about harm per deployment, because no public dataset counts deployments.

Speculation

Speculation means plausible, consequential and not yet evidenced (2, Nordqvist, 2026). The book's rule is that speculation justifies reversibility, not commitment. I keep this section short, because speculation grows in the telling, and everything in it is speculation.

That a public authority in the European Union lets an agent act at Level 3 Bounded on a resident's case within five years; nothing in the datasets measures it, and the only public-authority landscape in this book, a drawing, has caseworkers deciding every case. That the share of enterprises using AI keeps rising at the pace of 2024 to 2025 until most enterprises use it; the two surveys before 2024, 0.41 percentage points apart, are evidence against assuming so. That the next amendment of the AI Act defers the Annex III date again; a date that has moved once can move, and nothing more is known. That the line manager disappears; AI Boss, Chapter 29, labels that outcome speculation and finds it resting on vendors' forecasts (7, Nordqvist, 2026). That in any organisation that does not test its fallbacks the reversibility of what it has delegated decays within months of go-live; AI Boss, Chapter 33, illustrates the decay and does not measure it (7, Nordqvist, 2026). And that a system escapes control and causes catastrophic harm; on the evidence ladder of AI Threat, Chapter 4, the claim stands at argument and laboratory demonstration (5, Nordqvist, 2026). The incident database holds three entries under the nearest heading, but it records only what has been reported, and a tail event would not appear in it until it had happened.

Speculation is worth stating for one reason: a thing not written down cannot be reviewed, and an entry that can be wrong on the record is better than one that is absent from it.

The author's projections

What follows are my own projections, and nothing else in this book is. They are drafted in the possibilist stance the book has kept since Chapter 1: not the optimist's, which expects the landscape to improve by itself, nor the pessimist's, which expects it to end in the empty corner, but a reading of the data that sees the problems and the progress at once and asks what can be done (8, Rosling et al., 2018). Each carries its label and says what would show it wrong, because a projection that cannot be shown wrong is a mood.

Author's note needed: The four projections below were drafted on the author's behalf from the datasets and the series' conclusions, in the first person, and are to be replaced or confirmed by him before release. A projection he does not hold should be struck, not softened; any he adds should keep the form: the claim, its label, the evidence, and what would show it wrong.

First, expected. I expect that by the end of 2029, two years after the Annex III obligations have applied, a seat above a high-risk AI system in a European organisation will be the rule and a seat above the ambient features in the same organisation's licensed software will still be the exception. The deployer duties supply names for the first group (39, European Union, 2024); nothing supplies them for the second (4, Nordqvist, 2026). What would show me wrong: a register, a supervisory report or a survey showing named decision holders for supplier-enabled features as commonly as for the systems the law names, or showing that the high-risk seats did not appear either.

Second, speculation. My guess is that the EU share of enterprises using AI in 2028 lands between the Commission's two most recent baselines for that year, 27.10 per cent on the line computed in 2025 and 40.15 per cent on the line computed in 2026, and nearer the lower one (15, European Commission, 2026). The reasons are Chapter 8's: part of the 2025 step was a longer list, and the small enterprises, which are most enterprises, stood at 17.0 per cent in 2025 (9, Eurostat, 2026). I label it speculation because it is a number, and no number about this series has survived two years. What would show me wrong: the 2028 figure outside that band, in either direction.

Third, expected. I expect that agents reach public authorities like Nordvik Region first through the products they already buy, that the first agent most such authorities run at Level 3 will be one a supplier shipped inside a procured system, and that the authority will discover the level rather than decide it. The mechanism is documented in the series (4, Nordqvist, 2026) and the direction of the supplier market in the vendors' own figures (24, GitHub, 2026). What would show me wrong: public algorithm registers in which the autonomous units of public authorities are predominantly procured by decision, with a recorded level and a seat, before any supplier-shipped agent appears in them.

Fourth, expected. I expect the recorded profile of harm in 2030 to look like the profile of 2026: people using AI against other people as the largest category, systems failing at the tasks they were trusted with as the second, and the system that escapes control as a handful of entries. The two records this book uses agree on that shape by different methods, and the shape has held while the counts have grown (35, Responsible AI Collaborative, 2026). What would show me wrong: a classified record in which the subdomain for an AI pursuing its own goals grows faster than the record as a whole for two consecutive years, or in which failure overtakes misuse.

I have left out the projection most readers want, whether AI at work will be good or bad for the people in it; the data do not support one and the stance does not permit one. What they support is narrower: the quiet harms the series found appear earlier and more widely than the loud ones, and AI Boss, Chapter 33, concludes that they are properties to design against before deployment. The same chapter adds the series' sixth commitment, to keep a named person in the chair for every consequence (7, Nordqvist, 2026). Whether that commitment is kept is not a projection. It is work.

The test, again

Fourteen questions opened the book, and Figure 20.1 is the page they were answered on. Take them again now, from memory, before you read the table. What should have changed is not the letters, which the datasets fixed, but the reasons: a reader of Part II answers Question 1 with a denominator in mind, Question 9 with a vintage, Question 12 with an article and Question 11 with a base rate. The table gives each measured answer as the dataset states it and, in the last column, what would change it.

Question Measured answer What would change the answer
1. Enterprises in the EU using at least one AI technology, 2025 About 20 per cent: 19.95 per cent of enterprises with ten or more persons employed (9, Eurostat, 2026) The next annual survey; a further change to the list of technologies
2. Large enterprises using at least one AI technology, 2025 About 55 per cent: 55.03 per cent (9, Eurostat, 2026) The next annual survey
3. Change in the share of enterprises using AI, 2021 to 2023 It rose by less than one percentage point: 7.65 to 8.06 per cent (9, Eurostat, 2026) Nothing but a revision of the two published values; the past does not move
4. AI-using enterprises with three or more technologies, 2025 About four in ten: 8.28 of 19.95 per cent of all enterprises, an estimate by division (9, Eurostat, 2026) The next survey; a change in the list, which changes both shares
5. Enterprises buying at least one paid cloud service, 2025 About 50 per cent: 52.74 per cent (10, Eurostat, 2026) The next cloud module; a change in the list of services, as in 2021
6. People aged 16 to 74 using a generative AI tool for work, 2025 About 15 per cent: 15.36 per cent of all individuals (14, Eurostat, 2026) The second year of the question, which has one data point so far
7. Enterprises reporting an ICT security incident that made services unavailable, destroyed data or disclosed confidential data, 2024 survey About 20 per cent: 21.54 per cent; services made unavailable are counted separately: by a hardware or software failure in 17.97 per cent of enterprises, by an attack from outside in 3.43 per cent (11, Eurostat, 2026) The next security module; a change in what the module asks
8. ICT specialists in total employment, 2025 About 5 per cent: 5.0 per cent, about 10.45 million people, estimates (12, Eurostat, 2026) The next labour force year; the share moved two points in fourteen years, across series breaks in 2011 and 2021
9. The 2030 share on the trend of the Commission's 2023 baseline, against a 75 per cent target About 20 per cent: 20.29 per cent, written 20.3 in Chapter 1 (15, European Commission, 2026) Nothing; the 2023 baseline is a document. The 2026 baseline reaches 54.28, and the next report will say something else
10. Most common purpose of AI in enterprises, 2025 Marketing or sales: 34.7 per cent of AI-using enterprises (9, Eurostat, 2026) The next survey; among large enterprises the order is already different
11. Most frequent harm among classified incidents, AI Incident Database People using AI against people: 566 of 1,498 classified incidents, 412 of them fraud (35, Responsible AI Collaborative, 2026) The next snapshot; counts are revised, and the record measures what was reported
12. When the Annex III high-risk obligations apply From 2 December 2027: Regulation (EU) 2026/1744, Article 1, point 40 (40, European Union, 2026) Another amending instrument, published in the Official Journal; nothing else
13. Developers who highly trust AI tools' output, 2025 Under 5 per cent: 3.15 per cent of a self-selected sample (28, Stack Overflow, 2025) The next survey; between 2024 and 2025 use rose from 61.84 to 78.49 per cent on differently worded answer options, the share who highly trust rose from 2.72 to 3.15 per cent and the share who trust to some degree fell from 43.04 to 32.79 per cent, sums of published shares (27, Stack Overflow, 2024)
14. Workers whose tasks are allocated automatically, 2024 to 2025 About 20 per cent: 21 per cent of EU workers (51, Gonzalez Vazquez et al., 2025) A second wave of the survey; Special Eurobarometer 554, in the field about half a year earlier on a differently worded question, found 22 per cent (29, European Commission, 2025)

Two readings of the table are the lesson of the whole book. Ten of the fourteen answers are shares, and every one carries its denominator in the table; the size instinct of Chapter 10 reads the number, and the reader of this book reads the number and the thing it is divided by. And the last column is almost never empty: twelve of the fourteen answers are expected to change at the next survey, snapshot or instrument, and the two that cannot, Questions 3 and 9, are history. A test whose answers move is a test about a landscape that moves by dated decisions, which is what Chapter 11 asked the reader to see.

A reasonable hope

Rosling's possibilism was not a prediction that things turn out well. It was a refusal of both the drama of decline and the drama of rescue, grounded in looking at the numbers and asking what can be done (8, Rosling et al., 2018). On this landscape the facts allow a reasonable hope, and they demand work, and the two belong in one sentence.

The hope is reasonable because the picture is quieter than either story told about it. A fifth of enterprises, more than half of large ones, about a seventh of people using the tools for work: a landscape with room to be drawn before it is decided (9, Eurostat, 2026). The most frequent recorded harm is people defrauding people, which is old and answerable. Where the series documents agents in production, they act under a policy point outside the model, a named person and evidence the system produces, and each of those is a design, not a hope. The runaway system is three entries among 1,498 classified incidents (35, Responsible AI Collaborative, 2026), but that comfort is limited: the database records reported incidents only, and a tail event would not appear in it until it had happened. The hope rests on the quiet picture and on the designs, not on that count.

The work is demanded because none of it happens by itself. The grey square at Level 4 without a seat is on both illustrative landscapes at the start of 2027. The dashed baseline under a high-risk system is a promise until someone tests it. Reversibility can decay within months where nobody tests the fallback, an illustration and not a measurement. The denominator is left off the slide. The projection is recomputed by the Commission and read as a prophecy by everyone else. Each is a place where an instinct of Part II wins by default, and each has a rule of thumb that answers it, collected in Chapter 19 and on one page in Appendix B.

So here is Monday. Count the units: not the products, the uses, and include the ones nobody chose. Place each on the grid, at the level it holds for its most autonomous action and in the row of what it would take to undo that action. Look at the empty corner. Find the marks without a seat and give each a name, by role, with the authority, information and time to decide otherwise. Find the dashed baselines at R3 and ask when the control was last tested. Find the Mode 0 marks and ask the suppliers what they have switched on. Ask, of every number that reaches you, what it is divided by. Label every sentence about next year. Then render the picture again in a quarter and read the trails. Chapter 14 showed how to draw it from the registers an organisation already keeps.

The picture is the instrument. Rosling replaced two boxes with four levels drawn the same way every time, so that anyone who had learnt the chart once could read a continent at a glance (8, Rosling et al., 2018). This book has tried to do the same for a smaller world, with one mark per AI use and seven things on every mark, so that an executive, an architect, an official, a journalist and a citizen can look at the same page and ask the same questions: at which level, how reversible, how many people, how it arrived, with whose identity, who decides, and how we know. Where the page is drawn honestly, the instincts have less to work with, the projections can be checked, and the hope stays reasonable.

Nordvik Region and Hansa Mutual

The last figure of the book is the two illustrative landscapes side by side at the end of the scenario of Chapter 18, 31 December 2027, at identical scales, as the comparison frame requires. Nordvik Region and Hansa Mutual are fictional, the view is rendered from their models, and nothing in it is data or forecast.

Hansa Mutual and Nordvik Region on 31 December 2027, V6 the comparison view: two landscapes side by side at identical scales

Figure 20.2: Hansa Mutual and Nordvik Region at the end of 2027, V6 the comparison view, at identical scales, sizes and colours. Illustrative: rendered from landscape/models/hansa_mutual.yaml and landscape/models/nordvik_region.yaml.

Read Figure 20.2 in the thirty-second order one last time. The empty corner is empty in both panels. Hansa Mutual has five squares at Level 3 Bounded, all Mode 5, each with a filled diamond, a seat and a solid baseline; Nordvik Region has two, a correspondence classifier and a rostering system that offers open shifts inside a profile agreed with its unions. No mark in either panel lacks a seat: the strips read seat 17 of 17 and 13 of 13. Two grey squares still sit at Level 4, one in each panel, with a small 2 above each, the Region's with a hollow diamond and the group's with none, because neither can put a policy point inside a vendor's product. The Region's R3 row holds its benefits-triage system and the crossed outline of a retired recruitment pilot; the group's holds its underwriting model, its recruitment system and the IT-operations agent whose seat reads 4.

Beyond the scenario's last day, two dated decisions are in the profiles: in the scenario the Region's rostering reaches a third wave of home-care units in the first quarter of 2028 and the group's agent-boss pilot runs under an extended mandate to 30 June 2028. That the Region ever draws a plum square, or that the group ever moves a mark into the rightmost column, is speculation, and nothing in either model points there. What the two share at the end of the year is what the comparison frame was built to show: every mark has a name above it, and a reader who learnt the notation in Chapter 4 can see that in both panels in thirty seconds.

Summary

This chapter sorted the next years under the three labels the book has used throughout, and then, in one marked section, said what the author expects. What is observable is the measured picture of Part II: 19.95 per cent of EU enterprises using at least one AI technology in 2025 after two earlier surveys 0.41 points apart, 15.36 per cent of people using generative tools for work, fraud rather than runaway systems as the most frequent recorded harm, and the AI Act's dates as the Digital Omnibus set them, with the Annex III obligations applying from 2 December 2027 (40, European Union, 2026). What is expected, each item with its evidence, is the Commission's own recomputed trajectory, a further rise in the next survey, the spread of agents to organisations that buy by way of features they did not choose, named decision holders where the deployer duties apply and not beyond, a further amendment of the law and rising incident counts without a denominator. What is speculation, including the decay of reversibility and the escape of a system from control, is kept short and written down so that it can be wrong on the record.

The author's projections, drafted on his behalf and marked for his confirmation, are four, each labelled and each saying what would show it wrong: that seats become the rule on high-risk systems and stay the exception on ambient features by the end of 2029; that the 2028 adoption share lands between the Commission's two most recent baselines and nearer the lower; that agents reach public authorities first inside procured products; and that the profile of recorded harm in 2030 looks like the profile of 2026. The projection the chapter refuses to make is whether AI at work will be good or bad for the people in it.

The test returned with its fourteen measured answers and, beside each, what would change it, and the possibilist close followed: the facts allow a reasonable hope, because the picture is quieter than either story told about it and the designs that govern it exist, and they demand work, because none of it happens by itself. The book ends where it began, with two landscapes drawn the same way, side by side, at the same scale, and a reader who learnt the notation once can read both in thirty seconds and ask the same seven questions of each. That is what the picture is for.

Sources

  1. European Commission, Directorate-General for Communications Networks, Content and Technology (2026). Digital Decade DESI dashboard: Digital Decade EU-level trajectories and Digital Economy and Society Indicators. Key performance indicators of the Digital Decade Policy Programme 2030 with targets and trajectories (dd_ai, dd_cloud, dd_bigdata, dd_dii, dd_ictspec, dd_ai_cloud_da) and the Member State DESI indicators, values from Eurostat; retrieved 7 November 2026 through the dashboard's REST API v1 as the dataset data/digital_decade_indicators. (15, European Commission, 2026)
  2. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. The Transformed Architecture, Book 2, published at aig.geon.se. (2, Nordqvist, 2026)
  3. Eurostat (2026). Artificial intelligence by size class of enterprise. Online data code isoc_eb_ai, last updated at the source 15 June 2026; retrieved 7 November 2026 through the Eurostat dissemination API (JSON-stat 2.0) as the datasets data/eurostat_isoc_eb_ai (AI use by technology type) and data/eurostat_isoc_eb_ai_purpose (AI use by purpose). DOI: https://doi.org/10.2908/ISOC_EB_AI. (9, Eurostat, 2026)
  4. Eurostat (2026). Individuals - use of generative AI tools. Online data code isoc_ai_iaiu, last updated at the source 5 June 2026; retrieved 7 November 2026 through the Eurostat dissemination API (JSON-stat 2.0) as the dataset data/eurostat_isoc_ai_iaiu. DOI: https://doi.org/10.2908/ISOC_AI_IAIU. (14, Eurostat, 2026)
  5. Gonzalez Vazquez, I., Fernandez Macias, E., Wright, S. and Villani, D. (2025). Digital Monitoring, Algorithmic Management and the Platformisation of Work in Europe. European Commission, Joint Research Centre, JRC143072; Publications Office of the European Union, Luxembourg, released 13 October 2025, catalogue number KJ-01-25-490-EN-N, ISBN 978-92-68-31994-9; based on the AIM-WORK survey of 70,316 individuals aged 16 to 65 in the 27 Member States; licensed under CC BY 4.0; the values quoted in the book are kept as the dataset data/jrc_aimwork_2025. DOI: https://doi.org/10.2760/9406086. (51, Gonzalez Vazquez et al., 2025)
  6. Eurostat (2026). Security incidents and consequences by size class of enterprise. Online data code isoc_cisce_ic, last updated at the source 15 June 2026; retrieved 7 November 2026 through the Eurostat dissemination API (JSON-stat 2.0) as the dataset data/eurostat_isoc_cisce_ic. DOI: https://doi.org/10.2908/ISOC_CISCE_IC. (11, Eurostat, 2026)
  7. European Union Agency for Cybersecurity (ENISA) (2025). ENISA Threat Landscape 2025. ENISA, 1 October 2025 (revised version 1.3, 22 September 2026); ISBN 978-92-9204-723-8, ISSN 2363-3050; licensed under CC BY 4.0; the report is kept as the dataset data/enisa_threat_landscape_2025. (38, ENISA, 2025)
  8. Responsible AI Collaborative (2026). AI Incident Database. Database of reported incidents in which AI systems caused or nearly caused harm; the database collections are licensed under Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0) according to the terms of use and the licence file of the database snapshots; the weekly snapshot of 2 November 2026 is kept as the dataset data/aiid_incidents. (35, Responsible AI Collaborative, 2026)
  9. European Parliament and Council of the European Union (2024). Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act). Official Journal of the European Union, L series, 2024/1689, 12 July 2024; as amended by Regulation (EU) 2026/1744. (39, European Union, 2024)
  10. European Parliament and Council of the European Union (2026). Regulation (EU) 2026/1744 of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI). Official Journal of the European Union, L series, 2026/1744, 24 July 2026; in force from 27 July 2026, the third day after publication. (40, European Union, 2026)
  11. European Parliament and Council of the European Union (2022). Decision (EU) 2022/2481 of 14 December 2022 establishing the Digital Decade Policy Programme 2030. Official Journal of the European Union, L 323, 19 December 2022, p. 4. (43, European Union, 2022)
  12. Eurostat (2026). Cloud computing services by size class of enterprise. Online data code isoc_cicce_use, last updated at the source 27 February 2026; retrieved 7 November 2026 through the Eurostat dissemination API (JSON-stat 2.0) as the dataset data/eurostat_isoc_cicce_use. DOI: https://doi.org/10.2908/ISOC_CICCE_USE. (10, Eurostat, 2026)
  13. Stack Overflow (2025). 2025 Stack Overflow Developer Survey. Stack Exchange Inc.; survey open 29 May to 23 June 2025, results released 29 July 2025; more than 49,000 responses from 177 countries (self-selected online survey of Stack Overflow users); the results data are published in the archive repository github.com/StackExchange/Survey under the Open Database License (ODbL) 1.0, with cell contents under the Database Contents License (DbCL) 1.0, and are kept as the dataset data/stackoverflow_dev_survey_2025. (28, Stack Overflow, 2025)
  14. GitHub (2026). Octoverse: Commits, pushes, reach new highs in 2026 as developers build with agents. The State of the Octoverse 2026, GitHub Blog, 28 October 2026; Octoverse year 1 October 2025 to 30 September 2026 (platform data published by the vendor); kept with the 2024 and 2025 editions as the dataset data/github_octoverse_2025. (24, GitHub, 2026)
  15. Nordqvist, G. (2026). AI Red Team: AI as an Active Part of Cyber Defence in European Enterprises and Public Authorities. The Transformed Architecture, Book 4, published at aired.geon.se. (4, Nordqvist, 2026)
  16. Nordqvist, G. (2026). AI Boss: When Artificial Intelligence Manages People in European Enterprises and Public Authorities. The Transformed Architecture, Book 7, published at aiboss.geon.se. (7, Nordqvist, 2026)
  17. Nordqvist, G. (2026). The Transformed Security Architect: Role, Craft and Career in the Age of AI in European Enterprises and Public Authorities. The Transformed Architecture, Book 6, published at tsa.geon.se. (6, Nordqvist, 2026)
  18. Sajadieh, S., Fattorini, L., Perrault, R., Gil, Y., Parli, V., Santarlasci, L., Pava, J., Maslej, N., Altman, R., Brynjolfsson, E., Brodley, C., Clark, J., Dignum, V., Kumar, V., Landay, J., Lyons, T., Manyika, J., Niebles, J. C., Shoham, Y., Tabassi, E., Wald, R., Walsh, T. and Weld, D. (2026). The AI Index 2026 Annual Report. AI Index Steering Committee, Institute for Human-Centered AI, Stanford University, Stanford, CA, April 2026; licensed under Creative Commons Attribution-NoDerivatives 4.0 International (CC BY-ND 4.0); the report is kept as the dataset data/stanford_ai_index_2026. DOI: https://doi.org/10.48550/arXiv.2606.15708. (18, Sajadieh et al., 2026)
  19. Nordqvist, G. (2026). AI Threat: Are the Dystopias Coming True? Evidence, Risk and Response for European Enterprises and Public Authorities. The Transformed Architecture, Book 5, published at aithreat.geon.se. (5, Nordqvist, 2026)
  20. Rosling, H., Rosling, O. and Rosling Rönnlund, A. (2018). Factfulness: Ten Reasons We're Wrong About the World – and Why Things Are Better Than You Think. London: Sceptre (Hodder & Stoughton), hardback published 3 April 2018. ISBN 978-1-4736-3746-7. (8, Rosling et al., 2018)
  21. Eurostat (2026). Employed information and communications technology (ICT) specialists. Online data code isoc_sks_itspt, last updated at the source 17 April 2026; retrieved 7 November 2026 through the Eurostat dissemination API (JSON-stat 2.0) as the dataset data/eurostat_isoc_sks_itspt. DOI: https://doi.org/10.2908/ISOC_SKS_ITSPT. (12, Eurostat, 2026)
  22. Stack Overflow (2024). 2024 Stack Overflow Developer Survey. Stack Exchange Inc.; survey open 20 May to 20 June 2024, results released 24 July 2024; 65,437 respondents from 185 countries (self-selected online survey of Stack Overflow users); the results data are published in the archive repository github.com/StackExchange/Survey under the Open Database License (ODbL) 1.0, with cell contents under the Database Contents License (DbCL) 1.0, and are kept as the dataset data/stackoverflow_dev_survey_2024. (27, Stack Overflow, 2024)
  23. European Commission, Directorate-General for Employment, Social Affairs and Inclusion (2025). Artificial Intelligence and the future of work. Special Eurobarometer 554, Eurobarometer report; fieldwork 25 April to 22 May 2024 by Verian, 26,415 face-to-face interviews with residents aged 15 and over in the 27 Member States; published 13 February 2025. Publications Office of the European Union, catalogue number KE-01-24-018-EN-N, ISBN 978-92-68-21815-0; the values quoted in the book are kept as the dataset data/eurobarometer_ai_work_2025. DOI: https://doi.org/10.2767/8591026. (29, European Commission, 2025)