Every chapter of this book has ended by asking what its subject meant for Nordvik Region and Hansa Mutual; this chapter collects those answers into one platform and security conclusion for each. Nordvik, a Nordic regional authority of about 6,000 staff, mostly buys its AI and runs a reduced platform around a procured high-risk system. Hansa, a Hamburg-based mutual insurer of about 9,500 people with entities in seven countries, builds most of its AI on one group platform and lets agents act on production systems. For each, the chapter records the decisions of Chapters 1 to 23, what worked, what was hard, and the next 24 months; conclusions it draws for itself are marked as such.
For the platform, Nordvik Region's legal position comes down to a short list of things to evidence. Ranking applications for essential public assistance puts the benefits-triage system in Annex III point 5(a) of the AI Act, so the Region must show what Articles 26, 27 and 49 ask of a deployer: monitoring and logs, a fundamental rights impact assessment and registration (1, European Union, 2024). Its processing rests on Article 6(1)(e) of the GDPR, and health and social-care workloads carry Article 9 data (2, European Union, 2016), which pins some of them to its own hardware. NIS 2 applies as transposed nationally to the extent that regional government is in scope (4, European Union, 2022), and public procurement law governs almost everything the Region buys (9, European Union, 2014). Since the high-risk system comes from TriageSoft under tender NR-2026-117 and the engineering team is small, Chapter 4 placed the Region's leverage in the gateway and in the evidence its contracts can require.
The platform carries Nordvik's systems almost entirely in Mode 4: the triage system, the staff assistant and the citizen-service assistant of AIDR-0014. Below that, its control points are contracts and configuration: Mode 0 features that suppliers enable, a Mode 2 embedded-assistant pilot, and Mode 1 only through the approved enterprise tool. Mode 3 is one coding agent in the platform team, and the register excludes Mode 5 altogether (Chapter 2). That narrowness lasts, as Chapter 19 points out, only as long as something enforces it.
Primary topics explored
- Nordvik Region
- Hansa Mutual
- Governance-side conclusions
- The two roadmaps as code
- The two organisations compared
- Summary
About AI Platform and Security
AI Platform and Security is Book 3 of The Transformed Architecture. It shows how large European enterprises and public authorities build, secure and operate the platform on which artificial intelligence runs: data, models and DevSecMLOps, retrieval and agents, infrastructure and sovereignty, AI security engineering, evaluation, observability and cost.
The companion volume AI Governance covers risk management, governance, assurance, organisation and leadership; Architecture as Code supplies the underlying discipline.
Platform engineers, security architects, MLOps teams, AI architects and technical decision-makers.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 24: Nordvik Region and Hansa Mutual: Platform and Security Conclusions in AI Platform and Security gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Conclusions” and is one of 29 drawn from the manuscript.