Nordvik Region and Hansa Mutual: Conclusions for Two Organisations

Chapters 1 to 30 built two development organisations record by record, and Chapter 31 follows named developers through the year in which the records were made. This chapter turns the records into conclusions for each organisation, a twelve-month plan from September 2031 to August 2032, the decisions that fall to leadership, ten measures by which the book's own claims can be judged locally, and the risks. It concerns all five functions of the developer loop: D1 Frame (what the specification and the acceptance criteria say before anything is generated), D2 Design (the constraints and the ceilings that bound the tools), D3 Build (how far the tools are allowed to write and to act), D4 Prove (who writes the oracle and who reads the diff) and D5 Steward (the owner who can explain a change with the tool switched off and revert it from outside the pipeline).

Everything here is the book's own conclusion, drawn from the records of Chapters 1 to 31 and from nothing else. Those chapters record plans, rules, decisions and dated checks and, in Chapter 31, a small number of outcomes that are marked there as illustrative. Where a result is missing this chapter says so and treats the item as open; where Chapter 31 supplies an illustrative outcome, this chapter uses it and says so. The plans below are therefore proposals, the figures in them are the baselines the earlier chapters fixed, and every outlook carries one of the three labels of AI Governance, Chapter 22 (162, Nordqvist, 2026): observable, expected or speculation. The measures are not findings. They say what each organisation would have to show for the book's claims to hold in its own setting, and what would count against them.

Figure 32.1: A twelve-month plan for each organisation on the developer loop: close what has expired, open what the records support, decide, then read the measures.

What the conclusions rest on

Three rules shaped the plans, and the reader who adapts them to another organisation should keep the rules and replace the items.

The first rule is the order of work. Close what has expired before opening anything new. A claim with a date older than its clock (90 days for a usage claim, 180 days for a value claim, the conventions Chapter 20 takes over from AI Leader (174, Nordqvist, 2026)) is not a basis for a decision, and a plan that adds a tool while an expired claim still stands on the board's table has added a second claim to the first. The consequence is that every plan below spends its first quarter on records that are overdue, and its second on what the closed records support.

The second rule is that no ceiling rises without a decision record and evidence. The delegation profiles DLG-NR-DEV-01 (AIDR-1101) and DLG-HM-DEV-01 (AIDR-1153) set a ceiling per class of development work, and Chapter 4 fixes the five prohibitions that keep Level 4 out of production gates, security-critical and safety-critical code, the agent's own mandate and oracles, irreversible actions on production data and decisions about named people. Neither plan uses Level 4 in any class, and neither touches the people class. A ceiling is not a licence: practice before the profiles was Level 0 almost everywhere, and the plans keep it there until the evidence for a rise exists.

The third rule is that a plan names its owners and its watchers separately. The person who owns a step is not the person who reads whether it closed. An owner who also reads the result has marked their own work, and Chapter 4 gave the reason in the corollary of the stewardship principle, that the test oracle must be independent of the generator, and Chapter 9 applied it. The same logic applies to the plan.

The baselines are the dated values in Chapters 1 to 31, and they have ages. Where the age at 31 August 2031 is derived rather than recorded, the text says "derived". The legal clocks are those of Chapter 24, read in the Official Journal on 11 November 2026. They are not re-read here, and the first quarter of each plan includes the re-reading that the registers themselves require.

Nordvik Region

What the records establish

Nordvik Region found its failures where a resident or a caseworker would meet them. The August 2030 merge to a national-register interface had one approval, and its author could not say which lines came from ambient completion (Chapter 1). The secret in the prompt of March 2030 (INC-NR-2030-0071) showed that the framework agreement NR-2025-102, under which about 22 consultant developers work in the Region's teams, said nothing on AI tools (Chapter 10). The release of 2 December 2030 (CHG-NR-2030-0091) put an unconfirmed assumption into production: the case-platform interface ignored the help-request flag, and 53 applicants were not called for ten days (INC-NR-2030-0094, Chapter 23). The post-incident review PIR-NR-2030-0006 recorded that the Understand test failed for the interface mapping, and the option was switched off by feature flag 22 minutes after the decision.

The year's answer was a set of small, dated records. The delegation profile DLG-NR-DEV-01 caps generate, refactor and test at Level 1 Assisted, document at Level 2 Supervised and everything else at Level 0 or Level 1, with the people class not delegated (Chapter 4). The gate-and-revert rule of AIDR-1111 requires a gate that neither the change nor its author can edit, a named owner and a revert rehearsed within 90 days (Chapter 11). The ownership record OWN-NR-2030-04 names Anders Falk as owner of the portal register adapter with a revert tested on 9 October 2030 (Chapter 12). The mandate MND-NR-DEV-01 (AIDR-1108) limits the platform team's agentic tool to drafting infrastructure code and runbooks, never applying change (Chapter 8). The gateway of AIDR-1116 records metadata only, and the pilot NR-DEV-001 continues only through it (Chapter 16). The interim protocol with the union (AIDR-1122 of 9 December 2030, signed on 12 December) let the pilot continue to 30 June 2031 with no widening beyond the 12 developers; in this illustration it was extended on 17 June 2031 to 31 December 2031 (Chapter 31).

The Region's legitimacy as a public authority explains the shape of these records. A caseworker's decision must be explicable to the applicant, and software that supports the decision inherits the duty. The ownership gap that the inventory of July 2030 found, 31 per cent of 96 repositories with an owner who has left the Region or changed team (OWN-NR-2030-00), is therefore more than a hygiene problem. It is a place where the Region could not give reasons.

What stayed open

Eight items remained open in the records, and they are the Region's agenda. Each is open because the chapters record a plan or a due date and no result.

1. The pilot claim is withdrawn and the replacement says "not known". "A third faster" was April 2030 evidence for 12 developers and a survey answered by nine, with delivery time unmeasured. In this illustration it was withdrawn on 20 December 2030 after the six-sprint comparison of AVR-NR-2030-01 (Chapter 31, Chapter 20), and the third revision of 12 August 2031 found lead time, change failure and rework inside the variation of the preceding year, which does not exclude a small effect in either direction. Its usage claim expires on 10 November 2031 (derived from the 90-day clock). What is open is the decision that rests on it: whether to widen the pilot beyond the 12 developers.
2. The negotiation is open. MBA-NR-2030-03 had three open items at its meeting of 22 January 2031: prompt retention for incident analysis, the consultants under NR-2025-102 and the use-of-tool statement. In this illustration the statement was agreed that day, and prompt retention and the consultants remain open (Chapter 31, Chapter 22). Telemetry, the role charter ROLE-NR-DEV-01 (AIDR-1114, in force from 1 February 2031), competence records and the practice-plan scheme (AIDR-1137, Chapter 28) all sit under it.
3. Ownership is closed with conditions. AIDR-1112 required a named owner and deputy for every repository by the end of December 2030, or a proposal to archive it. Chapter 31 records the item as closed with a condition: retirements wait for the archivist's agreement. One archive proposal was still waiting in March 2031, when its build fetched a withdrawn release; the deputy of the register adapter was due to be named by 15 December 2030 and no chapter records the name.
4. The exit test failed its gate twice. The second open-weight model passed at 0.86 against a gate of 0.90 on 120 tasks (RST-NR-2031-0001, 3 February 2031), and in this illustration at 0.88 on the retest of 12 March (RST-NR-2031-0002, Chapters 26 and 31). The exit stands as a stated route, not as a claim that the team can leave without loss. The model that the pilot uses is self-hosted, the platform team of seven engineers is the single owner of the serving stack, and the dark week of June 2031 found a second dependency on the same failure domain, the identity federation at the national shared-service provider.
5. The tender's outcome is not recorded. NR-2030-041 closed in November 2030. Its criteria sheet requires EEA processing or self-hosting, no training on Region code, export of logs and prompt history, an admin switch for agentic mode and an exit export within 30 days (Chapter 18). The agentic module is enabled only by a separate decision, and the amendment of NR-2025-102 with AI-tool clauses is proposed.
6. The archivist and counsel have not answered whether prompts and run records are records. The Region's public-access and archives rules apply to source code and design documents, and the gateway keeps no prompt content until they answer.
7. The legal register is dated. The developer section of DRR-NR-001-LEG (AIDR-1124, 21 January 2031) was due for re-reading by 21 July 2031, and counsel's position on steward status for the published components was due by 31 March 2031. Neither result is recorded (Chapter 24).
8. Most inherited systems have no independent oracle. Nine inherited case and registry systems, among them the case-management system SVC-NR-003 with about 1.1 million lines of Java and PL/SQL and vendor support to 2033, had low test coverage and a regression pack only for the portal and the benefits workflow. By 19 May 2031 packs covered three registry systems and the assessment started on those three (AIDR-1136, Chapter 31); the social-services register Socialia, with 600,000 lines of stored procedures, has none. The tools stay at Level 0 Advisory on systems without a pack (Chapter 9).

Two smaller items fall in the same family. The citizen-built tool OWN-NR-2030-0101 stood at tier C, conditional, with 0 of 20 independent test cases and no tested revert (Chapter 19). The equal-treatment rule of AIDR-1125 is declared in force for new and changed code only, and for the inherited systems it is asserted, not shown (Chapter 25).

The plan

The order follows the rule above. The first quarter closes the overdue records. One of them keeps the platform team's agentic drafting class in time order: MND-NR-DEV-01 (Chapter 8) started at Level 1 Assisted, and AIDR-1116 (Chapter 16, 18 November 2030) raised infrastructure-code drafting to Level 2 Supervised from that date; the mandate record must carry the raise and the evidence that supports it. The second quarter opens what the closed records support, the third takes the decisions that need them, and the fourth reads the measures. The plan is held in version control and adopted by AIDR-1132 (dated 1 September 2031, illustrative), the Region's answer to the commission AIDR-1100, whose first report was due on 30 June 2031.

file: governance/twelve-month-plan-2031.yaml
organisation: Nordvik Region
decided_in: AIDR-1132
owner: {role: head of Applications and Integration, name: Gunilla Roos}
accountable: {role: CIO, name: Henrik Dahl}
partner: Ingrid Halvorsen          # holds the log; reads no telemetry by name
period: 2031-09-01/2032-08-31
rule: close what has expired before opening anything new
level_4_check: no step at Level 4; people class not touched; no ceiling raised in this plan
quarters:
  - id: Q1-close                   # 2031-09 to 2031-11
    steps:
      - {do: decide on the pilot claim as restated in revision 3 of AVR-NR-2030-01 (12 August 2031) and renew its usage claim before 2031-11-10, owner: Anders Falk, evidence_owner: regional controlling, due: 2031-09-30}
      - {do: record in MND-NR-DEV-01 the raise to Level 2 Supervised made by AIDR-1116 on 2030-11-18, with the review evidence for it, owner: Maja Lindqvist, due: 2031-09-30}
      - {do: confirm the register re-read due 2031-07-21 and counsel's position on steward status, owner: Maria Åkesson, due: 2031-09-30}
      - {do: close the archive proposals that wait for the archivist and name the missing deputies, owner: Gunilla Roos, due: 2031-10-31}
      - {do: re-run the exit test against the 0.90 gate, test the local break-glass accounts of the June finding by 2031-09-30 and file both results, owner: Maja Lindqvist, due: 2031-10-31}
      - {do: conclude MBA-NR-2030-03 or extend the interim protocol (now to 2031-12-31) with a new date, owner: Ingrid Halvorsen, due: 2031-11-30}
  - id: Q2-open                    # 2031-12 to 2032-02
    steps:
      - {do: bring the tender outcome under DLG-NR-DEV-01; agentic module only by separate decision, owner: Henrik Dahl, due: 2031-12-15}
      - {do: AI-tool clauses in the next call-off under NR-2025-102, owner: Henrik Dahl, due: 2032-01-31}
      - {do: second reviewer from outside the author team and an oracle approved by the quality engineer for citizen-facing changes, owner: Saga Edvardsson, due: 2032-01-31}
      - {do: regression pack for the case platform and a first pack for Socialia before any change to SVC-NR-003 or Socialia is generated, owner: Linnea Sjöberg, due: 2032-02-29}
  - id: Q3-decide                  # 2032-03 to 2032-05
    steps:
      - {do: review DLG-NR-DEV-01 against the measures; raise nothing without evidence, owner: Gunilla Roos, due: 2032-03-23}
      - {do: decide whether to extend the assessment of AIDR-1136 beyond three registry systems, only where regression packs exist, owner: Henrik Dahl, due: 2032-04-30}
      - {do: budget request for consultants and junior intake, with team-level measures, owner: Gunilla Roos, due: 2032-04-30}
  - id: Q4-read                    # 2032-06 to 2032-08
    steps:
      - {do: read measures K1 to K10 and the horizon register HZN-NR-2031-01, owner: Ingrid Halvorsen, due: 2032-08-31}
stop_rule: the union IT representative, the owner or the platform lead may stop any step; the stop sits in the GitOps pipeline, outside the tool

Conclusions for Nordvik Region

Four conclusions follow from the records, and the plan is built on them.

First, the Region's ceilings are right for what it has shown, and they should stay. The tools sit at Level 0 or Level 1 in nine of ten classes in DLG-NR-DEV-01, and documentation at Level 2. Nothing in the records meets the condition for a rise: a named owner who passes the Understand test with the tool switched off, an oracle independent of the generator and a revert path outside the pipeline, all with evidence no older than 90 days. The rehearsals on file are the revert of CHG-NR-2030-0212 (9 minutes against 15 in staging, repeated in 11 minutes on 8 January 2031 in this illustration) and the manual revert outside the pipeline in the dark week of June 2031, which took 34 minutes against 30; the only live test of Understand failed (PIR-NR-2030-0006). A ceiling that stays where it is costs developer time. A ceiling raised without the evidence costs a second incident of the kind that reached 53 applicants.

Second, the Region's public-law setting sets the order of work. Ownership, the archivist's ruling and the union agreement come before any extension of tools, because each is a claim the Region may be asked to show: by an auditor, by a resident who asks for the reasons behind a decision, or by the union's IT representative, Tomas Ekblad. The Swedish pattern is information and negotiation before an important change (Chapter 22), and a pilot extended on a stale claim would put the Region in the position that its own negotiation record was opened to avoid.

Third, capacity sets the pace, and the plan states it. About 25 employees write code as their main work, and the platform team of seven carries the gateway, the golden paths, the package proxy and the serving stack, as well as reliability work for which the Region has no separate function. A plan that gave the platform team a step in every quarter would promise outcomes the staffing cannot deliver. The plan therefore gives it six steps in the year, none of them a new capability, and treats the single-owner dependency on the serving stack as a risk, not as a fact to be accepted.

Fourth, the consultants are the Region's least examined exposure. About 22 consultant developers work inside the Region's repositories under a framework that was silent on AI tools until the amendment in progress, and the supplier teams of TriageSoft and SamDrift write code the Region does not review. The Region's own developers have a delegation profile, a gateway and a pilot protocol. The consultants have the Region's golden paths and nothing that binds their tools. The amendment of NR-2025-102 and the criteria sheet of NR-2030-041 are the Region's two instruments, and the plan puts the amendment into the first call-off after the negotiation concludes.

Decisions for leadership at Nordvik Region

Eight decisions belong to named people and bodies. The head of Applications and Integration prepares them, and the deciders decide.

Decider	Decision	Why it is theirs	When
CIO Henrik Dahl	Keep every class of DLG-NR-DEV-01 at its present ceiling and raise none without a filed result and a record	The profile is the CIO's to set within the delegation order (AIDR-1101)	Review on 23 March 2032 and every 90 days between
CIO	Extend the pilot or any tool to more developers only when the restated claim is filed, MBA-NR-2030-03 is concluded and a mandate exists for any agentic mode	The stop rule of Chapter 20 and the decision AIDR-1122	At the start of Q1
HR director Ingrid Halvorsen, with the IT representative of the union	Conclude MBA-NR-2030-03, including prompt retention and the consultants	The employer's duty to inform and negotiate before an important change (Chapter 22)	By 30 November 2031
Regional archivist and legal counsel Maria Åkesson	Rule whether prompts, run records and accepted outputs are records, and for how long they are kept	The Region's archives and public-access rules (Chapter 18)	Before the negotiation concludes
CIO	Decide the agentic module of the tender outcome as a separate decision, with the mandate that Chapter 8 requires	Procurement route decided in AIDR-1118; value below the executive committee's EUR 2 million line	Q2
Regional executive committee	Treat the consultant volume and the junior intake in the budget with the team-level measures in hand, and without the "third faster" claim	A budget decision is the committee's; the same question was put in September 2030 (Chapter 15)	April 2032
CIO, with the executive committee if the programme exceeds EUR 2 million	Extend the modernisation assessment beyond the three registry systems only where regression packs exist	Procurement policy (profile); vendor support for SVC-NR-003 ends in 2033	By 30 April 2032
Regional director	Keep the people class undelegated; no tool decides about a named developer's pay, rating or access to work	The ceiling in Chapter 4 and the delegation order	Standing

The seventh decision has a longer horizon than the plan. Vendor support for the case-management system ends in 2033, and an assessment that starts in 2032 leaves little time. The conclusion is not that the Region should migrate with AI, but that it should first make it possible to know whether a migration preserved behaviour, which is a regression pack and an owner who can explain the module, and Chapter 12 shows what each costs.

Hansa Mutual

What the records establish

Hansa Mutual found its failures where a supervisor or an auditor would look. The settlement module that paid 312 claims twice in June 2029 (INC-HM-2029-0207) was approved by the only other person who knew it, and no AI took part. The coding agent that proposed a dependency that did not exist (FND-HM-2030-0012) was stopped by the package proxy, and nobody had been told of two earlier refusals. The defect in CHG-HM-2030-0412 paid 31 claims with the wrong deductible (INC-HM-2030-0364), because the review record had listed partial-loss claims with two deductibles as not covered, in FND-HM-2030-0021, with neither an owner nor a date. The steward, Stefan Brückner, passed Name, Understand and Revert, and the change was reverted in 38 minutes by feature flag and pipeline rollback (Chapter 23). The contrast with 2029 is the record: the first incident failed Name and Understand, and the third passed them.

The year's answer was the same as the Region's in kind and larger in scale. DLG-HM-DEV-01 (AIDR-1153) sets generate at Level 2 Supervised outside the security-critical and payment paths, refactor at Level 2, review at Level 1 with the rule that an AI comment never counts as one of two human approvals, and one Level 3 Bounded class, patch-level dependency updates under MND-HM-DEV-01 (Chapter 8). The agent pilot MND-HM-DEV-02 (AIDR-1158) gives the claims core team a sandbox, a task-scoped identity and a stop path. The rule of AIDR-1161 applies the gate-and-revert test to every production change, and the Level 3 class lapses with the profile or with a revert rehearsal older than 90 days (Chapter 11). The test oracle for the deductible calculation was owned by the test engineer Ewelina Maj, with 36 expert cases, a replay of 12,400 recorded claims and a mutation score of 0.83 on changed lines (VER-HM-2030-0007, Chapter 9). The exit plan EXIT-005 for the IDE assistant HM-DEV-001 passed its quality gate at 0.91 against 0.90 on 150 tasks on 19 January 2031 (Chapter 26).

What stayed open

Nine items remained open.

1. The 42 per cent has reached the executive board and the board record is not recorded as corrected. The February 2030 dashboard figure stands beside 27 per cent in a sample of 40 merged pull requests (August 2030), with persistence and value not measured (AVR-HM-2030-01). Stefan Brückner withdrew the figure from his team's reporting on 14 October 2030, and the headcount conversation record of autumn 2030 asks that it be kept out of the 2031 planning assumption on the roughly 190 external developers until two quarters of team-level measures exist (Chapter 15). The group's first report of 28 April 2031 restated it as withdrawn, verified for one sample, persistence and value not measured. The sample of 26 August 2031 found, in this illustration, the same share within five percentage points and a persistence difference too small for 40 pull requests to resolve (Chapter 31). The dashboard figure is 18 months old (derived).
2. The works agreement is not signed. KBV-IT-2024-DEV-01 was in negotiation with review due on 30 September 2031, and the interim terms of AIDR-1172 (27 January 2031) apply in all group companies: no report by named developer, no acceptance rates in appraisal or pay, no widening of the agent pilot, no more than 340 licences. The Polish and Dutch representatives have asked for the same terms as Hamburg (Chapter 22).
3. The Level 3 class has no measured result. The class of patch-level updates is suspended by two merged updates reverted within 14 days, or by evidence older than 90 days (Chapter 8). The rehearsal lapsed on 31 December 2030 and was repeated on 8 January 2031, so for a week the class ran at Level 2 Supervised (Chapter 31, illustrative). The profile review of 28 March 2031 (AIDR-1185) renewed the class for six months, to 30 September 2031 (derived), with a longer waiting period for new releases. No count of merged and reverted updates is recorded.
4. The mainframe estate is listed in part. AIDR-1162 required the COBOL estate to be listed by named owner and deputy by the end of January 2031, the settlement module first. OWN-HM-2030-07 names Ralf Hauser as owner of the settlement module and Ewelina Maj as oracle owner, with three recorded conversations targeted by 31 December 2030. Of the twelve maintainers of the policy administration platform, five are within eight years of retirement (Chapter 12).
5. The legal register maps two jurisdictions of seven. DRR-HM-001-LEG (AIDR-1174, 3 February 2031) maps Germany and the EU. The Netherlands, Sweden, Poland, Norway, the United Kingdom and Switzerland are listed as not mapped. Whether the mobile claims app and the broker plug-in are products with digital elements under the Cyber Resilience Act is a question for counsel, and the group treats them as in scope meanwhile. The classification of the nearshore partner under DORA is recorded as open, with the stricter reading applied (Chapter 24). The register's re-verification date was 28 July 2031.
6. The exit evidence has expired. The 180-day age limit on the EXIT-005 result ended on 18 July 2031 (derived), and the dependency record's review fell due on 19 July 2031 (Chapter 26).
7. The managed-service provider's code assistance is a blind spot. Alster Managed Services uses its own Mode 0 assistance for the mainframe batch, and the provenance field says "not asserted" until the contract gives the group a right to know (Chapter 10).
8. The junior route was cut in one team and reopened. The head of the broker interface team took no apprentices for the 2030 intake, citing the 42 per cent figure; in this illustration he reversed that on 28 March 2031 and took two for the 2031 intake (Chapters 13 and 31). The anti-pattern check of AIDR-1180 (17 February 2031) still lists the unowned agent and a prototype outside Flowdesk as open.
9. The error-budget pilot and the legacy explainer have no results. AIDR-1166 piloted a policy that lowers delegation when the error budget is spent, with review due 20 April 2031. HM-DEV-003, the legacy explainer, runs at Level 0 Advisory with four of the twelve mainframe developers.

The plan

The plan has the same order and a different first move. The Region closes records that nobody has read. The group closes records that people did read, and that expired while the group's attention was on the next rollout. The plan is adopted by AIDR-1182 (dated 8 September 2031, illustrative) and held in version control.

file: governance/twelve-month-plan-2031.yaml
organisation: Hansa Mutual
decided_in: AIDR-1182
owner: {role: head of Group Application Development, name: Dr. Philipp Reinhardt}
accountable: {role: group CIO, name: Rainer Lehmann}
partner: Dr. Annette Krämer         # chief risk officer; reads the log, not the telemetry
period: 2031-09-01/2032-08-31
rule: close what has expired before opening anything new
level_4_check: no step at Level 4; people class not touched; Level 3 only for the one approved class
quarters:
  - id: Q1-close                    # 2031-09 to 2031-11
    steps:
      - {do: sign KBV-IT-2024-DEV-01 or extend the interim terms of AIDR-1172 with a date, owner: Marlene Voss, with: Thomas Brandt, due: 2031-09-30}
      - {do: carry the restatement of the 42 per cent (sample of 40, method, date; second sample 2031-08-26) into the executive board record, owner: Rainer Lehmann, evidence_owner: group controlling, due: 2031-10-15}
      - {do: re-test EXIT-005 on 150 held-out tasks and file the result, owner: Lukas Frey, due: 2031-09-30}
      - {do: renew MND-HM-DEV-01 on measured reverts or lower the class to Level 2 Supervised, owner: Rainer Lehmann, reviewer: Dr. Annette Krämer, due: 2031-09-30}
      - {do: complete the COBOL and PL/I list by named owner and deputy, owner: Dr. Philipp Reinhardt, due: 2031-10-31}
      - {do: counsel's conclusion on the mobile app and broker plug-in under the CRA, owner: Ulf Zimmermann, due: 2031-10-31}
  - id: Q2-open                     # 2031-12 to 2032-02
    steps:
      - {do: stepped roll-out measured by team, minimum group size 5, outcomes at service level, owner: Stefan Brückner, evidence_owner: group controlling, due: 2032-02-29}
      - {do: provenance right-to-know clause in the managed-service contract, owner: Lukas Frey, due: 2032-01-31}
      - {do: map the Netherlands and Poland in DRR-HM-001-LEG before other entities, owner: Ulf Zimmermann, due: 2032-02-29}
      - {do: decide the 2032 apprentice intake for the broker interface team, owner: head of the broker interface team, due: 2031-12-15}
  - id: Q3-decide                   # 2032-03 to 2032-05
    steps:
      - {do: review DLG-HM-DEV-01 against the measures; raise nothing without evidence, owner: Rainer Lehmann, due: 2032-03-30}
      - {do: scope of the assessment of SVC-HM-003 and succession for the five maintainers, owner: Dr. Philipp Reinhardt, due: 2032-05-31}
  - id: Q4-read                     # 2032-06 to 2032-08
    steps:
      - {do: read measures K1 to K10 and the horizon register HZN-HM-2031-01, owner: Dr. Annette Krämer, due: 2032-08-31}
stop_rule: the Konzernbetriebsrat, the mandate owners and Hansa Forge on-call may stop any agent step; the stop sits in the Hansa Forge gateway, outside the agent

Conclusions for Hansa Mutual

First, scale lets Hansa build controls, and its exposure is volume. The group has 62 delivery teams, about 290 developers and a platform that builds its own proxy, identity service and sandbox. What it cannot buy is reviewer hours. The illustrative arithmetic of Chapter 9 puts 32 review hours a week at about 42 diffs of 45 minutes each, and 60 diffs at about 32 minutes each. The horizon register HZN-HM-2031-01 sets a trigger at a median review time under 20 minutes for two quarters. The plan therefore keeps the agent pilot narrow until the works agreement is signed, and keeps review at Level 1, with an AI comment never counting as a human approval.

Second, the 42 per cent is a claim with a known age, and the plan's job is to make the board hold it that way. A figure that went to the executive board without its scope cannot be recalled, but it can be restated beside the sampled 27 per cent, with the statement that persistence and value were not measured, as the report of April 2031 already did. The restatement is a decision for the group CIO, not a communications task. A controlled trial elsewhere shows the gap between belief and measurement: the one trial of experienced developers in their own codebases measured 19 per cent more time with the tools while the developers believed they were 20 per cent faster (63, Becker et al., 2025). That finding is not about Hansa, and the plan does not transfer it. It says why a self-report or a telemetry share is not an outcome, and it is the reason the restated claim carries "not measured" for value.

Third, the legacy risk is a risk of people. The 6.5 million lines of COBOL and PL/I behind SVC-HM-003 are maintained by twelve people with an average age of 54, and the estate is owned by a department. The duplicated settlements of 2029 failed Name and Understand without any AI. The conclusion is that a legacy-explainer tool at Level 0 Advisory is useful only if it feeds recorded conversations with the people who know the module, and that a migration with AI needs the oracle first, which the replay of recorded settlement runs already supplies for part of the estate.

Fourth, legal fragmentation is a cost the group has not finished paying. The register maps two jurisdictions, and the Dutch consent right under the works-council act and the Polish service centre, with about 120 of the people in Group Application Development, are the two next in line. The United Kingdom and Switzerland sit outside the AI Act, DORA and the Cyber Resilience Act and follow their own regimes (Chapter 24). A group platform that applies one ceiling everywhere is simpler than seven rules, and the conclusion is to apply the stricter reading everywhere while the mapping is finished, as AIDR-1172 already does for the interim terms.

Decisions for leadership at Hansa Mutual

Eight decisions belong to named people and bodies.

Decider	Decision	Why it is theirs	When
Executive board, presented by group CIO Rainer Lehmann	Take the restated 42 per cent into the board record, and attach no target or headcount assumption to an AI-assisted share	The figure reached the board in February 2030 (Chapter 15); the board owns the planning assumptions on external developer capacity	By 15 October 2031
Group CIO	Renew MND-HM-DEV-01 on measured reverts and a rehearsal no older than 90 days, or lower the class to Level 2	The class approval is the owner's under DLG-HM-DEV-01 and lapses on a stale rehearsal (AIDR-1161)	By 30 September 2031
Chief HR officer Marlene Voss and the Konzernbetriebsrat	Sign KBV-IT-2024-DEV-01, with the Polish and Dutch representatives consulted on the same terms	Co-determination under BetrVG section 87(1) no. 6 on tools suited to monitor behaviour or performance (Chapter 22)	By 30 September 2031
General counsel Ulf Zimmermann	Conclude whether the group is a manufacturer of products with digital elements for the mobile app and the broker plug-in	The register treats them as in scope until counsel concludes otherwise (AIDR-1174)	By 31 October 2031
Chief risk officer Dr. Annette Krämer	Decide the DORA classification of the nearshore partner and the cadence of exit tests for the coding tools	DORA Articles 28 and 29 on third-party risk and exit (Chapter 26)	Q2
Group CIO	Fund the knowledge-capture and succession plan for the mainframe estate, and decide the scope of an assessment	The estate is owned by a department; five of twelve maintainers are within eight years of retirement (HZN-HM-2031-01)	By 31 May 2032
Head of Group Application Development Dr. Philipp Reinhardt	Hold the broker interface team's apprentice intake for 2032 at the level the group scheme needs	The intake review of AIDR-1180 and Chapter 13	By 15 December 2031
Executive board	Keep the people class undelegated across all seven entities	The ceiling in Chapter 4; the board is the management body for DORA purposes	Standing

Comparison

The two plans share the rule and begin from different places. The table sets them side by side. It describes what each organisation could show, and it ranks neither.

	Nordvik Region	Hansa Mutual
Frame of legitimacy	Public law: reasons for decisions, public access and archives rules, published code	Financial supervision: DORA change and third-party rules, the Cyber Resilience Act for two products
Hardest of Name, Understand and Revert	Understand: the interface mapping of PIR-NR-2030-0006 and the inherited systems	Name, for the estate: a department, not a person, owns the mainframe platform
Ceilings now and in twelve months	Level 0 to Level 2 across ten classes; no rise; Level 0 on inherited systems	Level 0 to Level 2, one Level 3 class; no rise; the class is renewed or lowered
Route to the representatives	Information and negotiation before the change; MBA-NR-2030-03 open	Co-determination; KBV-IT-2024-DEV-01 unsigned; two further representations ask for the same terms
First move	Read the results nobody filed; name owners; re-run the exit test	Restate the 42 per cent; sign the agreement; renew or lower the class
What the plan buys	A pilot decision with a result, owners for the 96 repositories, a consultant clause	A board record that holds a claim with its age, a measured Level 3 class, a mapped register
Main residual risk	The platform team of seven as single owner of tools and serving stack	Reviewer hours against the growth of agent-authored changes

Three similarities matter more than the differences. In both organisations the claim that reached a senior body ran ahead of its evidence, and in both the first act of the plan is to restate it with its age. In both, the ownership gap precedes the AI gap: the 31 per cent of unowned repositories and the estate owned by a department existed before the first assistant was licensed, and the tools made the gap visible. And in both, the junior route is the least visible dependency. Nordvik takes two juniors and Hansa takes a cohort, and a team that stops taking them because of a dashboard figure has made a decision that nobody recorded (Chapter 13). Neither plan assumes that developers are AI-fluent, that productivity has risen or that code is secure. Neither has measured any of the three, and the plans measure what can be measured and write "not measured" for the rest.

Measures

The book's claims are tested locally by ten measures. Each is tied to a part of the thesis, has an owner who is not the owner of the system measured, a method and a rule for how old the evidence may be. The five parts of the thesis are: the developer is transformed, not abolished (1); delegation is graded and has a ceiling (2); verification is the scarce skill and the junior route must be rebuilt (3); AI may draft but may not own (4); and productivity, quality and competence are claims that need evidence (5). A measure whose evidence is older than its clock is reported as expired with its last value and is not carried forward as current. A lower figure at month 12 than at baseline is not a failure if the method has become more honest; that is the book's own reading, and it is stated before the figures exist.

ID	Thesis part	Measure	Method	Evidence-age rule
K1	4: stewardship	Name, Understand and Revert pass on a sample of AI-involved changes that reached production	Owner explains the change with the tool off; revert performed from outside the pipeline within the agreed time	90 days
K2	2: ceiling	Classes with a current delegation profile; uses of Level 4; ceilings raised without a decision record	Profile read against the decision records and run records	90 days
K3	3 and 4: independence	Share of sampled changes whose oracle was written by someone other than the author and is independent of the generator; seeded-fault catch	Verification plans read; faults seeded by the quality function	90 days
K4	3: review	Median review time, diff size and the share of changes with a second reviewer from outside the author's team; AI comments counted as approvals	Review records and a re-read sample of five merged changes	90 days
K5	5: claims	Share of adoption and value claims in packs shown with method, date and status; re-measured usage and value	Packs read; a sample recounted by an evidence owner independent of the sponsor	90 days usage, 180 days value
K6	4: ownership	Repositories and services with a living owner and a deputy; components that two people can explain	Ownership records against the inventory; recorded conversations	180 days
K7	3: junior route	Junior intake against the plan; milestones of apprenticeship plans met; first-quarter work done without the tool	Apprenticeship plans and mentor records; no tool telemetry by name	Plan period; yearly for intake
K8	2 and 4: reversible dependence	Exit and restore tests for the coding toolchain, with result and date	Test on held-out tasks against a stated gate	180 days
K9	3 and 5: competence	Unaided explanations and verification evidence by competence group	Competence records; seeded changes; no reading of prompt logs	90 days verification, 180 days revert drill
K10	2 and 4: supply chain	Refused package names counted and routed; secret-scan results; provenance coverage of changes in the sample	Gateway and proxy records; scans; provenance records	90 days

Nordvik Region: owners, baselines and proposals for month 12

ID	Owner	Evidence owner	Baseline (last recorded)	Proposal for August 2032 (expected, not a forecast)
K1	Gunilla Roos	Saga Edvardsson	PIR-NR-2030-0006: Understand failed; revert by flag 22 minutes after decision; rehearsal of CHG-NR-2030-0212 9 minutes against 15; manual revert outside the pipeline 34 minutes against 30 (RST-NR-2031-0003, June 2031, illustrative)	Sample of AI-involved changes passes all three tests; failures have a cause and an owner
K2	Henrik Dahl	AI governance lead	DLG-NR-DEV-01, adopted 23 September 2030, reviewed 21 March 2031 (AIDR-1135), every ceiling kept; no Level 4	Four reviews; no Level 4; no rise without a record
K3	Gunilla Roos	Saga Edvardsson	Oracle by the quality function for portal and benefits workflow; none for inherited case systems; seeded fault caught 4 November 2030 (VER-NR-2030-0011)	Second reviewer and approved oracle for citizen-facing changes; tools still Level 0 on systems without one
K4	Anders Falk	Maja Lindqvist	One same-team reviewer, no rule for generated code (July 2030); ROLE-NR-DEV-01 review budget 25 per cent	Rule on generated code in force; review time and diff size reported by team
K5	Anders Falk	Regional controlling	"A third faster", April 2030 (31 per cent acceptance, 12 developers, 9 of 12 surveyed), withdrawn 20 December 2030; revision 3 of 12 August 2031: effect inside the variation (illustrative)	Usage claim renewed before 10 November 2031; value stated as not known, or measured with method and date
K6	Gunilla Roos	Maria Åkesson	31 per cent of 96 repositories without a living owner (OWN-NR-2030-00); deputy of the register adapter vacant	Every repository named, deputised or proposed for archive
K7	Gunilla Roos	Ingrid Halvorsen	APR-NR-2030-01: Emil Nordgren, 2 September to 29 November 2030; intake of two for 2031 kept	Intake of two for 2032 decided with the budget; plans signed with the union informed
K8	Maja Lindqvist	Henrik Dahl	RST-NR-2031-0001: 0.86 against a gate of 0.90, 3 February 2031; RST-NR-2031-0002: 0.88, 12 March 2031 (illustrative)	Re-test filed; pass or a stated route and a dated re-test
K9	Gunilla Roos	Saga Edvardsson	CMP-NR-2030-DEV-01: 4 of 5 seeded defects found unaided, 3 with assistant comment visible; revert 22 minutes against 30; expiry 14 April 2031	Competence records renewed within their clocks; failures recorded
K10	Maja Lindqvist	Joakim Wester	INC-NR-2030-0071; secret scan on both golden paths proposed; no AI-tools clause in NR-2025-102	Scan on both paths; clause in the next call-off

Hansa Mutual: owners, baselines and proposals for month 12

ID	Owner	Evidence owner	Baseline (last recorded)	Proposal for August 2032 (expected, not a forecast)
K1	Stefan Brückner	Dr. Annette Krämer	INC-HM-2030-0364: Name, Understand and Revert passed, revert in 38 minutes; INC-HM-2029-0207 failed Name and Understand	Sample across teams, including a mainframe change; failures have a cause and an owner
K2	Rainer Lehmann	Dr. Annette Krämer	DLG-HM-DEV-01, adopted 30 September 2030, reviewed 28 March 2031 (AIDR-1185); one Level 3 class renewed for six months; quarterly check (AIDR-1180)	Four reviews; no Level 4; class renewed on measured reverts or lowered
K3	Ewelina Maj	Dr. Annette Krämer	VER-HM-2030-0004: 9 of 10 seeded faults caught, 7 drafted tests discarded; VER-HM-2030-0007 mutation score 0.83	Seeded-fault results on a settlement change; unowned "not covered" entries at zero
K4	Stefan Brückner	Jens Albers	Two approvals; AI comments 4 useful, 2 wrong, 3 noise in RVW-HM-2030-0412; 55 and 20 minutes	Median review time and diff size by team; trigger of 20 minutes watched
K5	Rainer Lehmann	Group controlling	42 per cent (February 2030) against 27 per cent of 40 pull requests (August 2030); second sample 26 August 2031 within five points, persistence not resolved (illustrative)	Restated figure with method and date; team-level measures for two quarters; value stated as not measured
K6	Dr. Philipp Reinhardt	Group controlling	14 of 410 services without an active owner; mainframe estate owned by a department; OWN-HM-2030-07 for the settlement module	Every service owned; mainframe estate listed by person and deputy; recorded conversations met
K7	Dr. Philipp Reinhardt	Marlene Voss	APR-HM-2030-01: Aylin Demir, 2 September to 29 November 2030; broker interface team took none in 2030 and, in this illustration, two in 2031	Cohort planned; the broker team's intake decided for 2032 with the reason recorded
K8	Lukas Frey	Dr. Annette Krämer	EXIT-005: 0.91 against 0.90 on 150 tasks, 19 January 2031; evidence expired 18 July 2031 (derived)	Re-test filed within 180 days of the last; partner classification recorded
K9	Dr. Philipp Reinhardt	Ewelina Maj	CMP-HM-2030-DEV-02 at Foundation; the Level 3 class stands only while two developers hold current verification evidence	Count of steward evidence per mainframe component; renewals within clocks
K10	Lukas Frey	Daniel Fischer	Proxy refusals routed to the mandate owner (version 2); last stop drill 14 October 2030, next due 12 January 2031 (no outcome recorded); provenance "not asserted" for the managed-service assistant	Monthly count of refused names; right-to-know clause in the contract

Reading the measures

Three readings are possible at month 12, and each says something different. If the measures improve and the evidence is current, the instruments produced what they promise in this setting, and that supports the book's claims locally and proves nothing beyond it. If the measures are unchanged, the instruments cost effort and bought no evidence; the first question is whether the owners did the work, and the second is whether the instrument is the wrong one. If the measures worsen, the organisation has learned something it did not know. The weakest reading is a measure that cannot be read because its evidence has expired. Many of the baselines above were already past their clocks by the end of August 2031, so the likeliest finding is a claim that nobody re-measured. The remedy is the calendar in the plans, not further measures.

The measures could show a claim of the book wrong, and they should be allowed to. If the Understand test passes on every sample in a quarter in which no developer had a tool-free period, the claim of Chapter 28 that unaided skill decays when it is not exercised has no local support, and the practice plans should be reduced and not defended. If the Level 3 class at Hansa holds its stop criteria for a year with no revert, the group has evidence that Level 3 can hold in that class and none for any other. If the team-level comparison at Nordvik shows a delivery effect, it is a result for 12 developers on their stacks, not for the Region's 18 or for the inherited systems. A measure that can only confirm is a slogan.

Risks

Risks are listed with an early signal, a watcher who is not the owner of the work and a response. They are the organisations' own, drawn from the open items. Each carries a label for what is known.

Risk	Organisation	Early signal	Watched by	Response
The pilot is extended on the April 2030 note	Nordvik	A budget or planning paper repeats "a third faster"	Ingrid Halvorsen; regional controlling	Stop rule of AVR-NR-2030-01 applies; no extension without a filed result
The negotiation never concludes and the interim protocol lapses	Nordvik	The protocol date passes with no new date	Tomas Ekblad for the union side	Extend the protocol with a new date, and do not widen the pilot
The platform team of seven becomes a single point of failure	Nordvik	The exit re-test slips twice; the gateway has no deputy	Henrik Dahl	Name a deputy for the serving stack; defer a new capability before an existing one
Consultants' tools stay unbound	Nordvik	A second incident like INC-NR-2030-0071	Maria Åkesson	AI-tool clauses in the next call-off; criteria sheet for the supplier teams
The inherited systems are modernised before they can be tested	Nordvik	Allocation of the EUR 1.2 million line before regression packs exist	Saga Edvardsson	Fund the packs first; keep the tools at Level 0 on those systems
The 42 per cent returns in a planning paper	Hansa	A headcount or hours assumption cites an AI-assisted share	Dr. Annette Krämer	Standing step in the board paper: claim, method, date, status
Reviewer hours fall behind agent pull requests	Hansa	Median review time under 20 minutes for two quarters; open agent pull requests per reviewer rising	Jens Albers	Lower generate from Level 2 to Level 1 for the team, as the error-budget pilot allows
The Level 3 class erodes quietly	Hansa	A rehearsal older than 90 days; fewer than two developers with current verification evidence	Lukas Frey; Ewelina Maj	The class lapses to Level 2 by its own rule
Retirements outrun knowledge capture	Hansa	The recorded conversations stay at zero; a maintainer gives notice	Ralf Hauser's deputy once named; Marlene Voss	Pay the capture first; assessment second; migration last
Seven jurisdictions, one platform	Hansa	A change to telemetry or prompts examined for Germany only	Ulf Zimmermann; Thomas Brandt	The stricter reading applies everywhere until each entity is mapped
Records become theatre	Both	Records are filed and nobody reads them; the partner reads none	The partner; the audit function	Count open items in each pack; an entry without a closing record is an open item
The plan costs more than it returns	Both	Owners report that the calendar exceeds the time freed	The partner; the representatives	Drop the measure with the weakest link to a decision, and record the reason
A model or price change invalidates the evidence	Both	A provider's notice of change; a vendor update that alters a feature	Platform lead; Lukas Frey	The 30-day notice at Hansa triggers re-measurement; at Nordvik, a vendor update to an IDE is a change of ceiling that needs a record

One risk is of another kind. A plan with owners, dates and a calendar creates the appearance of control, and the appearance is what the anti-patterns of Chapter 30 describe: the acceptance-rate dashboard and the review rubber stamp. The protection is the same in both organisations. A partner reads the log and does not read the telemetry by name, a count of open items sits in each pack, and a drill is run with the tool switched off. None of these removes the risk. Each makes it visible earlier. The regulatory clocks add their own: the Cyber Resilience Act's reporting duty has applied since 11 September 2026 and its main obligations apply from 11 December 2027 (242, European Union, 2024), and the Product Liability Directive treats software as a product for those placed on the market after 9 December 2026 (243, European Union, 2024), as Chapter 24 read them. Whether either reaches Hansa's two products is for counsel, and whether either reaches the Region's published components is the open question of steward status.

Practical guide: writing a twelve-month plan with measures and owners

Purpose. Turn the open items of a development organisation into a plan whose steps have owners and dates, whose measures can be read without the owner's help and whose evidence expires visibly.

Roles. The head of development who owns the plan (head of Applications and Integration, head of Group Application Development); the CIO who is accountable for the delegation profile; a partner who holds the log and does not read telemetry by name (HR director, chief risk officer); an evidence owner for each measure who is independent of the system measured (quality engineer, controlling, platform lead); counsel and the data protection officer; the employee representatives, who are told what is kept and what is excluded.

Inputs. The claims register with dates and expiries (AVR-*); the delegation profiles and mandates and their review dates; the ownership records and the inventory; the verification plans and review records; the exit and restore tests; the negotiation or works agreement and its status; the calendar of contracts, budgets and legal dates.

Steps.

1. List every claim, record and test that has expired or stands open, with its last value, its date and its owner. Treat an entry without a closing record as an open item.
2. Order the work: close the expired first, open what the closed records support second, decide third, read fourth. Do not open a new tool in a quarter that still has expired claims from the last.
3. For each step name an owner who can do it, a date and the record that closes it. Put the dates that cannot move (contract renewals, budget rounds, agreement reviews, legal clocks) in first.
4. For each measure name a baseline, a proposal for month 12, a method, an owner, an evidence owner and the age at which the evidence expires.
5. Write the stop rule: who may stop which step, and where the stop sits outside the tool that is stopped.
6. Check the prohibitions. State that no step is at Level 4 and that the people class is untouched, or name the step and stop.
7. Take the plan to the representatives and reviewers before the decision, and record the decision as an AI Decision Record.
8. Read the plan quarterly against the records. At month 12 write the read-out and list what did not close.

Artefact. A plan file in version control (governance/twelve-month-plan-2031.yaml) and the AI Decision Record that adopts it (AIDR-1132, AIDR-1182).

Across the usage modes

The plans do not move the ladder. They write down why. The table shows, per usage mode, the highest degree of delegation each organisation has allowed for developers and the ceiling the plan proposes for month 12.

Usage mode	Nordvik Region now	Nordvik in twelve months	Hansa Mutual now	Hansa in twelve months
Mode 0 Ambient AI	Completion in the licensed IDEs, generate at Level 1 Assisted; decided retrospectively (AIDR-1102)	Unchanged; a vendor update that changes a feature needs a record before it is switched on	Ambient AI in IDEs and platform; the managed-service provider's assistance is outside the group's knowledge	Unchanged; provenance right-to-know clause for the mainframe batch assistance
Mode 1 Conversational assistants	Approved enterprise assistant; not for special-category data, credentials or benefits-triage rules; Level 1	Unchanged; AI-tool clause for consultants	Approved enterprise tiers; Level 1	Unchanged
Mode 2 Embedded workplace assistants	Pilot NR-DEV-001, 12 developers; generate and test Level 1 Assisted, document Level 2	No widening before result, agreement and gateway; no rise	HM-DEV-001, 340 licences; generate Level 2 outside the security-critical and payment paths, Level 1 inside	Licences not above 340 before signature; exit re-tested
Mode 3 Agentic work tools	Four of seven platform engineers; drafting infrastructure code and runbooks, never applying change; Level 1 at the mandate's start and Level 2 Supervised from AIDR-1116 (18 November 2030)	One class, one level, recorded; no extension to Applications and Integration without a mandate	About 120 engineers; MND-HM-DEV-02: generate and refactor Level 2, test Level 1, review and migrate Level 0; one Level 3 Bounded class, merged by the pipeline	Pilot not widened before signature; Level 3 class renewed or lowered
Mode 4 Built AI applications	None for developers	None	HM-DEV-002 test drafting Level 1; HM-DEV-003 legacy explainer Level 0	Level 0 for HM-DEV-003; neither is an oracle
Mode 5 Autonomous production agents	None, by rule	None	No coding agent merges or deploys alone	None

Level 4 Autonomous appears nowhere in either plan. The five prohibitions of Chapter 4 are not tested by a request to cross them, because nothing in either organisation asks for it. They are tested by pressure: a number, a deadline and a pull request queue that pull towards treating a tool's output as the change. The plans answer the pressure with a profile reviewed every 90 days and a named owner for each class.

Nordvik Region and Hansa Mutual

Both commissions named in Chapter 1 asked for a description. AIDR-1100 set 30 June 2031 for the Region's first report and AIDR-1150 set 30 April 2031 for the group's; Chapter 31 records that they were filed on 27 June and 28 April. This chapter is the book's own conclusion from the records that the commissions led to. It advises a rule, close what has expired, an order of work and ten measures. The decisions are the CIOs', the executive committee's, the executive board's and the works councils' and unions', and the plans are proposals until those people decide.

The two organisations arrive at the same rule by different roads. The Region's runs through a public-law duty to explain, an archives law that may make a prompt a record, a union on the Swedish pattern and a platform team of seven. The group's runs through DORA's rules on change and on third parties, a works council that co-determines and a platform with the capacity to build its own gateway. In both, the person who answers for a change is named, and in both the plan asks whether that person can explain it and revert it on a day they did not choose.

Observable, expected, speculation

Observable. The baselines in the measures are the dated figures of Chapters 1 to 31, and their ages at 31 August 2031 are computed from those dates. Both organisations hold the records that the plans refer to. Both started with an adoption claim that had reached a senior body without its evidence age, and both ended the recorded period with claims that said how old they were. The legal dates quoted are those of the Official Journal text read on 11 November 2026 (5, European Union, 2026); (242, European Union, 2024); (243, European Union, 2024).

Expected. Supervisors, auditors and unions are expected to ask for the age of a claim as well as its value, because the obligations on the toolchain (the measures to support AI literacy that Article 4 of the AI Act requires, as replaced by Regulation (EU) 2026/1744 (1, European Union, 2024) (5, European Union, 2026), the Cyber Resilience Act's duties on manufacturers, the duty of NIS 2 Article 21(2)(e) on security in acquisition, development and maintenance (3, European Union, 2022) and DORA's change-management rule in Article 9(4)(e) (2, European Union, 2022)) are written as duties that an entity must be able to show. The author expects the first quarter of each plan to find more expired records than the owners believe, because Chapters 20, 30 and 31 found expired claims in both organisations.

Speculation. That a cleaner record leads to a faster delivery rate is plausible and unevidenced. That the measures will change a leader's mind about headcount is also unevidenced. The plans do not rest on either. The author's own projections for the role are in Chapter 29 and Chapter 33, and none is made here.

Summary

This chapter drew conclusions for Nordvik Region and Hansa Mutual from the records of Chapters 1 to 31 and proposed a twelve-month plan for each, from September 2031 to August 2032, on all five functions of the developer loop. In D1 Frame, the plans keep acceptance criteria and the assumptions behind them as records that a named person adopts before code is generated, and they restate the two adoption claims with their method and their age. In D2 Design, they set the ceilings in the delegation profiles, raise none, and list eight decisions for each organisation's leaders, each with the reason it belongs to them. In D3 Build, they keep every class at its recorded level, renew or lower the one Level 3 class at Hansa and hold the pilot at Nordvik until its result and its agreement exist.

In D4 Prove, they put the independent oracle, the second reviewer and the seeded fault on a calendar with owners who did not write the thing they check. In D5 Steward, they close the ownership gaps, test the exits and the reverts, and keep a named person for every repository, service and mainframe component. The ten measures tie the plans to the five parts of the thesis and each says what would count against a claim of the book. The rule that runs through both plans is to close what has expired before opening anything new.

Nordvik's exposure is the platform team of seven as single owner of tools and serving stack, the consultants whose tools nothing binds and the inherited systems that cannot yet be tested. Hansa's exposure is reviewer hours against agent-authored changes, a board that holds a figure without its age and a mainframe estate whose knowledge is leaving. The reader can do one thing on Monday: write the age of the oldest claim in the reader's area at the top of a page, name who re-measures it and enter the date. Chapter 33 judges the thesis against the evidence of the whole book.

Sources

1. European Parliament and Council of the European Union. Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union, 12 July 2024. (1, European Union, 2024)
2. European Parliament and Council of the European Union. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). Official Journal of the European Union, 27 December 2022. (2, European Union, 2022)
3. European Parliament and Council of the European Union. Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive). Official Journal of the European Union, 27 December 2022. (3, European Union, 2022)
4. European Parliament and Council of the European Union. Regulation (EU) 2026/1744 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence. (5, European Union, 2026)
5. Becker, J., Rush, N., Barnes, E. & Rein, D. (2025). Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity. METR; arXiv:2507.09089. (63, Becker et al., 2025)
6. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. The Architecture as Code Series, Book 2, published at aig.geon.se. (162, Nordqvist, 2026)
7. Nordqvist, G. (2026). AI Leader: How Leadership Roles Change When AI Is Used Broadly in European Enterprises and Public Authorities. The Architecture as Code Series, Book 11, published at leader.geon.se. (174, Nordqvist, 2026)
8. European Parliament and Council of the European Union. Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act). Official Journal of the European Union, 20 November 2024. (242, European Union, 2024)
9. European Parliament and Council of the European Union. Directive (EU) 2024/2853 on liability for defective products and repealing Council Directive 85/374/EEC. Official Journal of the European Union, 18 November 2024. (243, European Union, 2024)