The European instruments that apply to a large enterprise or public authority in 2026 never mention the security architect, yet each can be met only if someone turns its articles into controls, tests and records that run, and that someone is usually the architect. This chapter reads the AI Act, NIS 2, DORA and the Cyber Resilience Act as engineering constraints, article by article, and then separates the accountability the instruments place on management bodies from the professional responsibility of the architect who equips those bodies to discharge it.
The chapter concerns three of the four shifts: Shift 1, from documents to code, because an article is enforceable only as a versioned mapping to a control, test and evidence record; Shift 2, from gatekeeper to boundary designer, because the architect designs controls and decision rights instead of reviewing every system; and Shift 3, from periodic to continuous, at machine speed, because reporting clocks are met only by pipelines. Everything legal below is attributed to the instrument and article and framed as an architectural implication, not legal advice.
An engineer reads a regulation for structure. AI Platform and Security, Chapter 3, set out a chain of four links for an AI platform: the legal source, the capability that satisfies it, the codified artefact that configures it, and the evidence it produces (163, Nordqvist, 2026). This chapter adds a fifth element, a named owner, because the instruments address people and bodies, not tools. Four reading rules keep the method honest.
Primary topics explored
- Regulation as a design input
- The AI Act
- NIS 2
- DORA
- The Cyber Resilience Act
- Personal accountability and the architect
About The Transformed Security Architect
The Transformed Security Architect is Book 6 of The Transformed Architecture. It describes how the security architect role is transformed when architecture is code, when AI drafts and acts, and when adversaries move at machine speed: the craft, the architect's own AI team, the role in the organisation, the competences and the career, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team and AI Threat.
Security architects, CISOs and heads of security architecture, enterprise, solution and AI architects, engineering leads, competence and hiring leads, procurement and programme leaders, and risk, compliance and audit.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 18: Regulation as Constraint: AI Act, NIS 2, DORA, CRA and the Architect's Accountability in The Transformed Security Architect gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “The Role in the Organisation” and is one of 31 drawn from the manuscript.