This book set out to show that an AI platform for a large European enterprise or public authority can be built and secured with the same disciplines that Architecture as Code (72, Nordqvist, 2025) applies to any other estate: declared intent, version control, automated gates and evidence produced by normal operation. This chapter extracts the conclusions on which several parts agree and turns them into a capability roadmap, followed by a marked forward look. The governance conclusions belong to the sibling volume, AI Governance, Chapter 25 (73, Nordqvist, 2026), and appear here only where the platform depends on them. Judgements and projections are labelled as such.
Chapter 1 named four ways in which AI breaks the assumptions of classical architecture. Behaviour is probabilistic; the model is a derived artefact that degrades silently; the supply chain contains foundation models the organisation cannot inspect. And the legal position of a system under the AI Act, Regulation (EU) 2024/1689 (1, European Union, 2024), is assigned to roles that architectural decisions can change. Parts IV and V added a fifth: AI is also a source of threat, in the hands of adversaries who compress the time from patch to exploit and in the behaviour of the organisation's own agents when a task rewards a shortcut.
The thesis that follows is short. An AI platform is under control when everything that shapes the behaviour of the systems on it is codified, versioned and evaluated together, when every model call and tool call passes a policy point outside the model, when containment holds whatever anyone intends, and when the evidence that all of this is true is produced by the platform's normal operation rather than by an audit project.
Primary topics explored
- The thesis restated for platform and security
- What the platform chapters converge on
- Shared artefacts and engineered trade-offs
- The tensions, from the platform side
- Same conclusions, different platforms
- A capability roadmap
About AI Platform and Security
AI Platform and Security is Book 3 of The Transformed Architecture. It shows how large European enterprises and public authorities build, secure and operate the platform on which artificial intelligence runs: data, models and DevSecMLOps, retrieval and agents, infrastructure and sovereignty, AI security engineering, evaluation, observability and cost.
The companion volume AI Governance covers risk management, governance, assurance, organisation and leadership; Architecture as Code supplies the underlying discipline.
Platform engineers, security architects, MLOps teams, AI architects and technical decision-makers.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 25: Conclusions: Building and Securing AI Platforms in AI Platform and Security gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Conclusions” and is one of 29 drawn from the manuscript.