Two fictional organisations have run through this book. Nordvik Region is a regional public authority in a Nordic member state of the European Union, with about 6,000 employees serving about 450,000 residents. Hansa Mutual is a mutual insurance group headquartered in Hamburg, with about 9,500 employees and entities in Germany, the Netherlands, Sweden, Poland, Norway, the United Kingdom and Switzerland. This chapter closes the running cases from the perspective of governance. For each organisation it sets out the starting point, the decisions taken across Chapters 2 to 22, what worked, what was hard and a plan for the next 24 months, and it then compares the two. It analyses the cases against the evidence of the chapters; the author's own judgements are kept for Chapter 24.
Nordvik Region's case shows governance under a single legal regime, in which the depth of public-law duty, rather than the number of jurisdictions, sets the difficulty.
Nordvik Region coordinates regional health and social care and public transport, and administers needs-based financial assistance for its municipalities. Under the AI Act it is a deployer of a high-risk system, because AI used to evaluate eligibility for essential public assistance benefits falls under Annex III point 5(a), which brings the deployer duties of Article 26, the fundamental rights impact assessment of Article 27 and registration as a public-authority deployer under Article 49 (1, European Union, 2024). Its usual legal basis for personal data is public task under Article 6(1)(e) of the GDPR, with special-category data under Article 9 in health and social-care contexts (2, European Union, 2016). Administrative law adds the duty to give reasons, public-access and archives law make most records disclosable, and procurement law governs almost everything it buys (9, European Union, 2014).
Primary topics explored
- Nordvik Region
- Hansa Mutual
- Platform and security conditions in brief
- The two roadmaps as code
- The two organisations compared
- Summary
About AI Governance
AI Governance is Book 2 of The Transformed Architecture. It shows how large European enterprises and public authorities decide what artificial intelligence is used for, classify and manage its risks, meet the obligations of the EU AI Act and its neighbours, choose and contract their suppliers, organise the forums that take decisions, and produce the evidence that shows it is all true.
It builds on the conclusions of Architecture as Code.
Chief risk and compliance officers, AI governance boards, CIOs and chief architects, and senior officials in public authorities.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 23: Nordvik Region and Hansa Mutual: Conclusions for Two Organisations in AI Governance gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Future and Conclusions” and is one of 32 drawn from the manuscript.