Nordvik Region and Hansa Mutual: Conclusions for Two Organisations

Two questions were put to the two organisations in September 2028, and both are answered in this chapter on the date the first reports fall due, 2029-03-31. The regional executive committee of Nordvik Region asked its Head of IT and Digitalisation what operations becomes when the platform team's tools and the providers' AI act on the estate, and what the Region can prove about recovery (AIDR-0900). The risk committee of Hansa Mutual's executive board asked the group chief information officer whether the autonomy of the IT-operations agent can extend from restart, certificate renewal and scaling to rollback and failover, and what evidence the group would show a supervisor (AIDR-0950). The chapter draws the book's conclusions for each organisation, sets a twelve-month plan for each, names the five decisions that go to each board, defines the indicators by which the book's own claims will be tested, and lists the risks that would change the plan. It concerns all five operations functions: O1 Observe, O2 Diagnose, O3 Change, O4 Restore and O5 Sustain.

The chapter is dated 2029-03-31, month 7 of the year told in Chapter 29, and states only what was known on that date; the plan it sets begins on 2029-04-01, and Chapter 29 shows, with hindsight, how its first five months went (for example the portal re-test that failed on 2029-04-10 and passed on 2029-06-05). Where the two chapters seem to differ, the date of each decides. The chapter adds no new theory. Its conclusions are the book's own, drawn from Chapters 2 to 28, and every fact about the two organisations is one that those chapters establish. The plans are decisions that illustrative organisations could take. They are not forecasts, and where a sentence looks forward it carries one of the three labels of AI Governance, Chapter 22: observable, expected or speculation (296, Nordqvist, 2026). The external sources cited support the parts that rest on law, on public post-incident reports and on research. The plans themselves are recommendations for fictional organisations, and Chapter 31 judges the thesis they test.

Figure 30.1: The two organisations from the report date to the end of the plan, with what stays outside both plans.

What the book concludes

The thesis of the book has five parts (Chapter 1), and each has a consequence that holds for any organisation. The list below states the consequences in the form in which the plans use them. Each is the book's own conclusion, supported by the sources the earlier chapters cite.

1. Operations is transformed, not abolished (Chapters 2 to 4). The work moves from the queue to the control loop. What an organisation owns is the objectives, the runbooks, the mandates, the observer and the records. The rest it buys, and it buys it under terms. The operator becomes the accountable conductor of the loop, and no one who answers for a service is removed from it.
2. Autonomy follows reversibility, blast radius and evidence, and it has a budget (Chapters 4, 10 and 16). The degree of delegation is set per function and action class as the lowest of four answers, and a class that spends its budget falls a level. Level 4 Autonomous is never used for an irreversible action on production data, for an action outside an authorised change window or freeze on a critical function, for an action that disables the observation or the stop path itself, or for an action that decides about a named person's access to work.
3. The operator's AI is part of the estate it operates (Chapters 16 and 18). The credentials of a runbook runner and the map held by an observability pipeline make them Tier 0 assets. The Region's audit found a standing administrator key before any agent used it. The group's policy decision point refused a restore request that a ticket had induced. In both cases the control that mattered sat outside the agent.
4. A loop closed by machines alone can hide its own failure (Chapter 17). The observer principle has three tests: independence of the verification, an observer that does not depend on the observed, and a stop path that works when the platform does not. The group's agent verified a restart with the endpoint that the restart resets, and a probe it could not alter caught the fault in 61 seconds.
5. Resilience and competence are claims that need evidence (Chapters 19 and 26). A claim has a scope, an objective, a measurement, a date and a result, and it expires. Only a verified claim counts as recoverable. Skill that is not exercised decays, a point Bainbridge made for process operators in 1983 and that Parasuraman and Manzey's review of complacency and bias in the use of automation supports (217, Bainbridge, 1983) (218, Parasuraman & Manzey, 2010).

Two further conclusions come from the middle of the book and shape every plan below. A finding closes when a re-test passes and not when a change is implemented (Chapter 12). And the first honest numbers are lower than the first dashboards, the pattern that AI Purple, Chapter 13, found for the loop between red and blue (304, Nordqvist, 2026). A plan that begins with a register of failed and expired claims is therefore the normal case, and the chapter treats it so.

The legal frame is the same for both and differs in force. DORA, Regulation (EU) 2022/2554, applies to Hansa Mutual and places the approval and oversight of ICT risk on the management body (Article 5), requires business continuity and recovery plans to be tested at least yearly, for systems supporting all functions, and after substantive change to systems supporting critical or important functions (Article 11(6)(a)), and requires at least yearly tests on those systems (Article 24(6)) (2, European Union, 2022). It does not apply to Nordvik Region. NIS 2, Directive (EU) 2022/2555, places the approval and oversight of risk-management measures on management bodies (Article 20) and lists business continuity, such as backup management and disaster recovery, among the minimum measures (Article 21(2)(c)); the Region plans as if its Tier 1 services were in scope, and national transposition decides (3, European Union, 2022). These are architectural implications and not legal advice. Their practical effect on both plans is the same: the board owns the question, and the evidence has to exist before the question is asked.

Nordvik Region: the answer to AIDR-0900

Where the Region stands

At the date of the report the records of Chapters 4, 12, 17 to 20 and 22 to 28 give the following picture. It is the starting line of the plan and not a verdict on the team.

What the Region can prove about recovery. No Tier 1 service is verified recoverable. The restore of the case-management database (RST-NR-2027-001, 2027-04-20) passed at 3 hours 5 minutes against 4 hours, and its clock ended on 2027-10-17, so the claim is expired. The failover of the portal to the recovery site at SamDrift (RST-NR-2027-002, 2027-10-12) took 5 hours 20 minutes against 2 hours and failed, on a DNS time-to-live and an unrenewed certificate at the site, and no re-test has run in the seventeen months since. The benefits-triage service and the staff identity service have no record. The corrective actions of the failed test are implemented and unverified, with an age that passed 336 days by the date of the commission. The first exit test for a provider-hosted service, RST-NR-2029-001 of 2029-02-27 for the staff assistant SVC-NR-006, met its time objective and missed its quality gate at 0.87 against 0.90, with a re-test due 2029-04-24. The standing risk acceptance DRF-NR-001/RA-01, by which the Head of IT and Digitalisation, Henrik Dahl, lets the duty manager attempt a portal failover with the platform lead's concurrence, expires on 2029-03-31 or at the first passing re-test.

What the Region has built. The operations assistant NR-OPS-001 (AIDR-0901) is at Level 0 Advisory. No agent holds a credential that can change production without a person's recorded approval (AIDR-0916). The pipeline's standing administrator key has gone, replaced by ten-minute tokens bound to a change record (AIDR-0918, in force by 2029-01-31), and the break-glass route local to the management plane gave two named people access in 9 minutes against 15 on 2029-02-07, a result valid until 2029-05-07. The observer manifest OBS-NR-0001 is in force from 2028-11-20 on a different provider and network from the Region Cloud and SamDrift (AIDR-0910), and no scripted runbook may reach Level 3 Bounded without it. Its detection time of two failures at a 60-second interval is a design value that no seeded fault has yet measured in the records of this book. The annex OPA-NR-SD-01 to the SamDrift framework agreement NR-2026-088 (AIDR-0924) adds a release-notice principle, a machine-readable incident feed, a secondary authoritative name service, test windows and a stop right outside SamDrift's platform. The on-call charter ONC-NR-2029-01 (AIDR-0925) has applied since 2029-03-01, the apprenticeship plan PLAN-NR-OPS-2029-01 (AIDR-0926) starts on 2029-04-01, and the re-tests of the three anti-pattern records are due on 2029-04-30, 2029-05-07 and 2029-06-30 (AIDR-0935).

Conclusions for the Region

N1. Operations becomes a small, owned loop around a bought base. The Region owns more than seven platform engineers can operate alone, so it keeps what it must be able to defend and writes the rest into contracts. It owns the objectives (SLO-NR-*), the few runbooks that Joakim Wester writes, the observer and the register. It buys network operations, DNS, identity federation and the recovery site from SamDrift, and the accelerators from a hosting provider, on terms that give notice of change, visibility of rules, the right to test and a stop right outside the provider's platform. The conductor role is held by the four duty managers and is not created as a post (Chapter 21).

N2. What the Region can prove today is nothing at Tier 1, and the first job is to change that. The rule of Chapter 4 is that only a verified claim may be written as recoverable. The most valuable thing the Region can show a supervisor, an auditor or its executive committee a year from now is a register in which every Tier 1 service has a claim with a date, a measured time and a named attester. The cost is about one Tier 1 test a month, which is what seven people can carry alongside the rota, and Chapter 28 reached the same conclusion about the quarterly work.

N3. The observer comes before any agent action, and it has to be shown to work. An observer that has never caught a seeded fault is a declared control (Chapter 17). The Region's detection time of two failures at a 60-second interval is a target until the quarterly seeded faults have measured it. The pattern of its history is a monitor that saw the DNS fault of INC-NR-2027-0298 22 minutes after the provider's status page did, so the plan treats the observer as the first deliverable of O1 Observe and not as a refinement.

N4. Autonomy stays at Level 2 or below until three conditions hold together. The Region's rule that it has no autonomous production agent stands. A scripted runbook may be raised from Level 2 Supervised to Level 3 Bounded only when the observer has caught seeded faults for that class within target, a stop drill has met its target, and every window in which the runbook runs has two evidenced holders of the conductor role. Certificate renewal is the first candidate because an expired certificate caused INC-NR-2026-0071 and contributed to the failed failover. The assistant may be proposed for Level 1 Assisted after its shadow period. Failover and restore-overwrite stay at Level 1 Assisted.

N5. The contract is the Region's leverage, and procurement lead times of 9 to 14 months make timing the constraint. Two of the Region's baseline incidents came from supplier releases that the Region could not ring (INC-NR-2026-0214 and INC-NR-2027-0129). A notice period written into the next tender arrives, at best, in 2030, so the annex to the existing framework agreement is the instrument that can act within the plan.

N6. The craft is concentrated in one person, and the plan is built around that. Joakim Wester writes the runbooks and takes the most weekend on-call. The apprenticeship seat, the re-profiled vacancy and the monthly tabletops of AIDR-0926 are the operational form of the conclusion of Chapter 26: a skill not exercised decays, and a route into the craft has to be designed when entry tasks disappear. Bainbridge's point is that the situations left to the operator are the ones that automation could not handle (217, Bainbridge, 1983). A team of seven has no spare capacity to relearn them in a crisis.

The answer

The answer to AIDR-0900 has two parts. Operations at Nordvik Region becomes a conducted loop that the Region owns at its centre and buys at its edge, with an assistant at Level 0 Advisory moving at most to Level 1 Assisted, runbooks at Level 2 Supervised and at most one class at Level 3 Bounded, and an observer on another provider. And what the Region can prove about recovery is, today, nothing at Tier 1; the plan sets the dates on which that changes, and no sentence about recovery is written in a board paper that the register does not support.

Hansa Mutual: the answer to AIDR-0950

Where the group stands

What the group can prove about recovery. The claims core restore into Cloud B (RST-HM-2027-004, 2027-06-15) took 5 hours 40 minutes against 4 hours, with a recovery point of 9 minutes against 15, and the claim SVC-HM-001 / restore-from-immutable-backup stands withdrawn. The failover of payments from Frankfurt to Cloud A (RST-HM-2027-007, 2027-10-05) took 1 hour 35 minutes against 2 hours and passed. Its clock ended on 2028-04-02 under the 180-day default of Chapter 19, and it is more than a year old, which is beyond the yearly cycle that Articles 11(6)(a) and 24(6) of DORA set as the floor for systems supporting critical or important functions (2, European Union, 2022). The path to Cloud B for the claims core's recovery copy and the fallback model service is a declaration until the re-test passes (Chapter 24). In the group's own terms, none of the five Tier 1 services that support critical or important functions has a verified recoverability claim at the date of the report.

What the group has built. HM-OPS-001 acts at Level 3 Bounded for restart, scale and certificate renewal, at Level 2 Supervised for other configuration change and for rollback, at Level 1 Assisted for failover, and has nothing delegated for deploy, delete or restore-overwrite (DLG-HM-OPS-001, MND-HM-OPS-001, AIDR-0027). Its budget cap is EUR 6,000 a month. In a 28-day window of the fourth quarter of 2028 it executed 1,184 restarts, an independent probe confirmed 1,171, and 13 actions were faulty, which is 1.1 per cent against an allowance of 1.5 per cent and a consumption of 73 per cent (MET-HM-0009, Chapter 20). The game day of 2028-10-24 seeded a silent failure (SDF-HM-2028-002): the agent's own verification passed and the independent probe failed the claim-registration transaction after 61 seconds. AIDR-0960 (2028-11-06) made the restart class conditional on OBS-HM-0001 and kept rollback at Level 2 and failover at Level 1 until the catch-rate and drill conditions are met. The stop drill of the same day took 4 minutes 10 seconds against 5, where the first drill of 2027 took 17. On 2029-01-23 the policy decision point refused a restore request that a ticket had induced (INC-HM-2029-0031, a near miss), and mandate version 1.4.0 (AIDR-0968) added the writer classes, the inheritance rule and the corroboration requirement. The ceiling suite REG-HM-OPS-010 ended in 24 expected refusals out of 24 on 2029-02-13, a result that stands for 30 days.

The group's governance records are in place: the horizon register HZN-HM-OPS-01 (AIDR-0977, review due 2029-08-14), the regulation mapping RCM-HM-OPS-2028-01 (AIDR-0973, next review 2029-05-28), the dark-day cycle of AIDR-0976 with the first DKD-HM-2028-Q4 on 2028-12-07, the agent team's mandates (AIDR-0966), the on-call charter ONC-HM-2029-01 (AIDR-0975, 2029-03-27) and the closure rule for the five anti-pattern records (AIDR-0985).

Conclusions for the group

H1. Hansa's agent has a record, and the record is not yet the evidence a supervisor would ask for. The agent's restart class earns its Level 3 by an independent probe, a drilled stop and a budget that is counted by something other than the agent. The same agent's reach beyond that class has no verified recovery claim behind it. Article 5 of DORA places the setting of roles and responsibilities and the approval of the digital operational resilience strategy on the management body (2, European Union, 2022), and a body that is asked to widen an agent's reach is entitled to see the claim that the widening depends on.

H2. The first deliverable is a passing re-test of the claims core restore, and it comes before any change of level. The design rule of Chapter 19 is that an action class rises to a higher level only while a verified claim stands behind the recovery it performs. Rollback of a release does not need a database restore, but failover does need a claim that the target is healthy, and the claims core's disaster-recovery copy and the fallback model service share Cloud B (Chapter 24). The re-test therefore serves the question of AIDR-0950 directly.

H3. Self-verification is the failure that the group has already seen, and its share has to stay at zero for any Level 3 class. The share of actions whose only verification came from the executing agent or from a system sharing its model family and failure domain is reported beside the budget (Chapter 20). Kim and colleagues found that capable models from different providers make highly correlated errors, so a second model family reduces the risk less than its cost suggests (103, Kim et al., 2025). The outcome probe that uses no model is the control that works, and the plan extends it before it extends the agent.

H4. The group's concentration risk is in the seams. Alster Managed Services runs the night operations of SVC-HM-003 with monitoring AI the group did not choose; Lumenscope supplies observability and an assistant, and its ingestion failure of 2027-05-20 left 14 services unobserved for 3 hours 10 minutes. The annex terms of Chapter 24 are brought to both before their scope widens, and the DORA register of information (Article 28) stays in step with every new arrangement, as it did for Cloud B on 2029-02-20 (AIDR-0974).

H5. The rota is where the agent's reach will be tested first. The night window, with Ewa Kowalczyk as agent operator, is the place where supervision of a Level 3 agent changes the work of a rota that already exists. The rule of Chapter 21 that a window with fewer than two evidenced conductors caps the agent at Level 2 is the protection, and the dark day is how the evidence is renewed. The agreement KBV-IT-2024-OPS-01 places drills in working time and -02 keeps every measure at team level with a minimum group size of five.

The answer

The answer to AIDR-0950 is conditional and in three parts. At the date of the report neither rollback nor failover may be extended, because no recovery claim stands behind them. Rollback may be raised to Level 3 Bounded for catalogued pairs when the seeded-fault catch rate of OBS-HM-0001 has reached 0.90 for four quarters, the stop drill has met its 5-minute target, and the budget has not been exhausted in the period; the group's own record would first meet that condition after the third quarter of 2029, so the decision cannot be taken before the review that follows 2029-09-30 (trend T05, Chapter 27). Failover rises one step, from Level 1 Assisted to Level 2 Supervised, as supervised failovers are run and passed, and Level 3 for the payments pair from Frankfurt to Cloud A waits for three supervised failovers that passed and a claim verified within 180 days (trend T06). The plan collects that evidence and does not claim it. To a supervisor the group would show the delegation profile, the register rows with their derived statuses, the observer manifest with its catch rates, the stop-drill times, the budget consumption and the ceiling-suite results, each with its date and its attester. The question is a question about evidence, and the group's task is to produce it.

Decisions for the board

Each board takes the same five decisions, and each decision has a form for each organisation. A decision is a record, with an owner, a review date and a consequence, so that a later board can see what was decided and on what evidence.

#	Decision	Nordvik Region (regional executive committee)	Hansa Mutual (executive board risk committee)
D1	Adopt the register as the measure of resilience. The denominator is every claim, and only verified claims count as recoverable	Renew the standing acceptance DRF-NR-001/RA-01 once, to 2029-06-30 or the first passing portal re-test, with the manual fallback for fee payments as its compensating control, and report the register to the committee at each review	Report the register to the risk committee in DORA terms, with the 180-day clock beside the yearly legal clock and the claims core claim shown as failed until a re-test passes
D2	Set the rule that a level rises only on evidence. The board does not approve a level; it approves the conditions	No Level 3 Bounded class before the three conditions of N4; assistant to Level 1 Assisted at the review of 2029-09-30 if its shadow period supports it	Rollback to Level 3 only on the trigger of T05; failover to Level 2 now and to Level 3 for the payments pair only on T06; restore-overwrite stays at Level 1 Assisted
D3	Fund independent verification and the capacity to review. What verifies must not be what acted, and reviewers are a limit	Keep OBS-NR-0001 on a separate provider and run the first quarterly seeded fault; use one of the two vacant posts as the first rung of the apprenticeship	Extend OBS-HM-0001 to the payments service before the first supervised failover, and keep the second line's attestation independent of Group Site Reliability and Incident Management
D4	Hold providers to operational terms. Notice of change, visibility of the provider's AI, a right to test, a stop right outside the provider, an exit test	Put OPA-NR-SD-01 into force with SamDrift by 2029-06-30, and carry the notice period and the right to hold a release into the next tender	Bring Alster Managed Services and Lumenscope under the annex terms before their scope widens, and run the parallel-use exit test for observability
D5	Protect the craft and the people. Agents-off exercises, a route into the craft, rotas agreed with representatives	Keep the secondary seat and the monthly tabletops; no exercise log is reported by name (MBL-NR-IT-2027-01)	Hold the quarterly dark day and the rule of two evidenced holders per window; agree any command logging with the Konzernbetriebsrat before it starts (KBV-IT-2024-OPS-03)

Two points about the table. First, D1 and D2 are the decisions on which the answers to AIDR-0900 and AIDR-0950 rest. They are also the decisions that a supervisor or an auditor would read first, since both Article 5 of DORA and Article 20 of NIS 2 place the approval and oversight of these measures on the management body and not on a tool (2, European Union, 2022) (3, European Union, 2022). Second, the plan asks for no figure for budget. It asks for the posts, tests and contract terms that the board can price against the 2029 budget it has already set, and the one post that Nordvik Region uses is a vacancy it already holds.

The twelve-month plans

The plans run from 2029-04-01 to 2030-03-31, with reviews on 2029-09-30 and 2030-03-31. They are recorded as AIDR-0949 (Nordvik Region) and AIDR-0999 (Hansa Mutual), dated 2029-03-31, and they answer the commissions AIDR-0900 and AIDR-0950. Each organisation's own horizon register (HZN-NR-OPS-01, HZN-HM-OPS-01) continues to set the reviews of its ceilings in 2030 and 2033 against evidence.

Worked example: the two plans as records

The two records below are illustrative and fictional. They carry the milestones that Chapters 12, 17, 19, 24, 26 and 28 already date, and the additional tests the plan schedules. The dates added by the plan are marked planned.

plan: OPL-NR-2029-01              # illustrative
decision_record: AIDR-0949
answers: AIDR-0900
date: 2029-03-31
period: {from: 2029-04-01, to: 2030-03-31}
owner: "Henrik Dahl"
keeper: "Maja Lindqvist"
consulted: [CISO, AI architect, data protection officer, union joint committee]
agreement: MBL-NR-IT-2027-01        # results for teams and services, never by name
ceilings:
  assistant_NR-OPS-001: {now: "Level 0 Advisory", gate: "shadow period supports it", target: "Level 1 Assisted"}
  certificate_renewal: {now: "Level 2 Supervised", gate: "N4 conditions", target: "Level 3 Bounded at most"}
  failover_and_restore_overwrite: {now: "Level 1 Assisted", target: "Level 1 Assisted"}
milestones:
  - {date: 2029-03-31, what: "RA-01 renewed once to 2029-06-30 or first passing re-test"}
  - {date: 2029-04-24, what: "re-test RST-NR-2029-001, staff assistant quality gate 0.90"}
  - {date: 2029-04-30, what: "AP-NR-OPS-02 re-test: observer and heartbeat, seeded fault"}
  - {date: 2029-05-07, what: "AP-NR-OPS-01 re-test: break-glass without federation"}
  - {date: 2029-06-30, what: "AP-NR-OPS-03: portal failover re-test with SamDrift under OPA-NR-SD-01"}
  - {date: 2029-08-31, what: "restore of case-management database", status: planned}
  - {date: 2029-09-30, what: "first review; assistant to Level 1 Assisted decided", status: planned}
  - {date: 2029-10-31, what: "restore test, staff identity", status: planned}
  - {date: 2029-11-30, what: "restore test, benefits triage, TriageSoft taking part", status: planned}
  - {date: 2029-12-15, what: "portal failover re-run before the clock ends 2029-12-27", status: planned}
  - {date: 2030-02-15, what: "case-management restore re-run before the clock ends 2030-02-27", status: planned}
  - {date: 2030-03-31, what: "closing review; report to the executive committee", status: planned}
cadence: {tier1_test_per_month: 1, seeded_fault: quarterly, stop_drill: quarterly}
stop_rule: "a failed re-test withdraws the claim and freezes every gate for that service"
review: {dates: [2029-09-30, 2030-03-31]}

plan: OPL-HM-2029-01              # illustrative
decision_record: AIDR-0999
answers: AIDR-0950
date: 2029-03-31
period: {from: 2029-04-01, to: 2030-03-31}
owner: "Group chief information officer"
keeper: "Tobias Richter"
approver: "head of operational resilience"
consulted: [CRO, group AI governance board, Konzernbetriebsrat]
agreement: KBV-IT-2024-OPS         # annex clauses -01, -02 and -03
ceilings:
  restart_scale_certificate: {now: "Level 3 Bounded", target: "Level 3 Bounded", condition: "OBS-HM-0001"}
  roll_back: {now: "Level 2 Supervised", target: "Level 3 Bounded for catalogued pairs", trigger: "T05, not before 2029-10"}
  fail_over: {now: "Level 1 Assisted", target: "Level 2 Supervised", level_3: "T06, outside this plan"}
  restore_overwrite_and_delete_production_data: {now: "Level 1 Assisted", target: "Level 1 Assisted"}
milestones:
  - {date: 2029-04-12, what: "REG-HM-OPS-010 re-run; then every 30 days", status: planned}
  - {date: 2029-05-28, what: "regulation mapping RCM-HM-OPS-2028-01 reviewed"}
  - {date: 2029-05-31, what: "re-test, payments failover Frankfurt to Cloud A, agent verification excluded", status: planned}
  - {date: 2029-06-30, what: "re-test RST-HM-2027-004 successor: claims core restore into Cloud B, run by a person who did not write the runbook", status: planned}
  - {date: 2029-08-14, what: "horizon register HZN-HM-OPS-01 reviewed"}
  - {date: 2029-09-30, what: "every critical or important function has a test inside 12 months; first review", status: planned}
  - {date: 2029-12-15, what: "claims core restore re-run before the clock ends 2029-12-27", status: planned}
  - {date: 2029-12-31, what: "three supervised failovers of the payments pair passed", status: planned}
  - {date: 2030-03-15, what: "second cycle of tests for SVC-HM-002, -003 and -006 before their clocks end", status: planned}
  - {date: 2030-03-31, what: "closing review; report to the risk committee", status: planned}
cadence: {seeded_fault: quarterly, stop_drill: quarterly, dark_day: quarterly}
targets: {stop_drill_seconds: 300, catch_rate_floor: 0.80, catch_rate_for_raise: 0.90, self_verification_share: 0}
stop_rule: "budget exhausted, catch rate below floor or stop drill over target lowers the class one level at once"
review: {dates: [2029-09-30, 2030-03-31]}

Both records make the same structural choices. A plan has a gate for every level it proposes, a date for every test, a stop rule that lowers or freezes without a meeting, and a review at which a named person raises anything. Both keep the register's rule that a failed re-test withdraws the claim and does not change what the plan assumes.

The year in four quarters

The first quarter (April to June 2029) is the quarter of re-tests. Nordvik Region runs four re-tests in a quarter, one of them a Tier 1 recovery test, while seven engineers also carry the rota. That is the most the team can carry, and the plan puts nothing else on its calendar. The portal failover of 2029-06-30 is the one that the Region cannot run without SamDrift, and the annex is the reason the plan can schedule it. If SamDrift declines, the claim stays asserted, and the Region has said so to its executive committee in the same paragraph in which it records the standing acceptance. Hansa Mutual re-runs its ceiling suite within 30 days of its last result, and tests the payments failover and the claims core restore within the quarter. The re-test of the claims core restore is run by someone other than the author of the runbook, with an independent probe, and attested by the head of operational resilience. A pass is recorded with its measured time, which has to beat 4 hours, and a fail withdraws the claim again and opens a problem record under the closure rule of Chapter 12.

The second quarter (July to September) is the quarter of coverage. Nordvik Region tests the case-management restore and reviews its first six months of seeded faults and drills. Hansa Mutual completes tests for every critical or important function so that each has a record inside twelve months, and the review of 2029-09-30 reads the four quarters of seeded-fault evidence on which trend T05 depends. Both organisations hold their first formal reviews on 2029-09-30. Both reviews are decisions about levels, and both use the indicators of the next section.

The third quarter (October to December) is the quarter of the second tests. Nordvik Region tests the identity and benefits-triage services, which closes the first round of Tier 1 claims, and re-runs the portal failover before its clock ends on 2029-12-27. The case-management restore, verified at the end of August, is re-run by 2030-02-15 for the same reason. Hansa Mutual runs the supervised failovers that trend T06 needs, each against a verified claim at the moment it starts. A supervised failover is a Level 2 action with a named incident commander as approver, an independent probe and a stop right held outside the platform, and its definition of done includes what can be undone and the time it takes.

The fourth quarter (January to March 2030) is the quarter of the report. Both organisations write the closing review as a register: the claims, their statuses, their ages, and the changes of level with the evidence behind each. Where a gate was not met, the report says so, and the level stays where it was.

Practical guide: a board paper outline

Purpose. Give the regional executive committee or the risk committee one paper that states the question, the evidence, the decisions requested and the indicators by which the next paper will be judged.

Roles. The Head of IT and Digitalisation or the group chief information officer owns the paper. The platform lead or the head of Group Site Reliability and Incident Management keeps the register and the indicators. The head of operational resilience (Hansa Mutual) or the head of the IT management office (Nordvik Region) attests the evidence. The CISO, the data protection officer and the employee representatives are consulted.

Steps.

1. State the question in the board's own words and cite the commissioning decision record. Keep it to one sentence.
2. Give the answer in three sentences: what the organisation concludes, what it can prove, and what it asks the board to decide.
3. Attach the register as it stands on the date of the paper, with every claim in the denominator and the derived status of each. Never replace it with a summary that omits failed, expired or untested claims.
4. State the five decisions of this chapter in the form of the table, each with an owner and a review date.
5. State the indicators, their baseline, their target at the next review and the misuse notes, and say which of them an agent can influence and where the independent source is.
6. Give the plan as at most twelve milestones with dates. Mark those that depend on a provider, and say what the paper assumes if the provider declines.
7. Give the risks as triggers with the plan change each would produce. At least one must be a risk that would be bad news for the plan.
8. Record who was consulted and what they said. Where employee representatives raised a point, record how it was met.
9. Send the paper ten working days before the meeting, with the underlying records in version control, and keep the length to two pages and an annex.

Definition of done. The paper is in version control; the register is attached and derived by rule; the decisions are phrased as records; the indicators carry a baseline and a target; each risk has a trigger and a plan change; the attester is independent of the team that ran the tests; and the employee representatives have seen the parts that concern them. Adapt the lead time and the length to the board's own rules.

Indicators of the book's own claims

The thesis predicts a pattern, and the plan is a way of finding out whether the pattern holds. The indicators below are the book's own claims turned into numbers that the organisations' records can compute. Each carries a baseline from the chapters, a target at each review, a source that is not the system measured, and a misuse note. They are the book's design and not a standard. They are reported for teams, services and delegation profiles, never for a named engineer.

Claim of the book	Indicator	Nordvik Region: baseline, 2029-09-30, 2030-03-31	Hansa Mutual: baseline, 2029-09-30, 2030-03-31	Misuse to watch
Resilience is a claim (Chapter 19)	Tier 1 services with a verified recoverability claim	0 of 4; 2 of 4; 4 of 4	0 of 5 critical or important; all 5 tested within 12 months, at least 2 verified; 5 of 5 verified	A scope narrowed until the test passes (the claim at the wrong scale of Chapter 28)
Evidence expires (Chapter 19)	Age of the oldest verified Tier 1 claim, days	none verified; at most 180; at most 180	none verified; at most 180; at most 180	Re-testing the same easy scenario to keep the age low
What verifies is independent (Chapter 17)	Seeded-fault catch rate per quarter, floor 0.80	not yet measured; at least 0.80; at least 0.80	1 of 1 caught on 2028-10-24; at least 0.90 for the quarters that count toward T05; at least 0.90	Seeds that the observers' authors wrote
A stop path outside the platform (Chapters 4 and 17)	Stop-drill time against 300 seconds	one drill of the Region's agent on 2028-11-07; two drills, within 300; three drills, within 300	250 seconds on 2028-10-24; each quarterly drill within 300; each within 300	A drill announced in advance to the person who stops
Autonomy has a budget (Chapter 4)	Consumption of the budget of each Level 3 class, review at 70 per cent	no Level 3 class; none unless N4 holds; at most one class, below 70 per cent	73 per cent for restarts in the Q4 2028 window; below 70 per cent for 3 of 4 quarters; same	Retries and split actions that keep each below the fault definition
A finding closes on a re-test (Chapter 12)	Actions implemented and unverified for more than 90 days	2 at 336 days or more; 0; 0	the five anti-pattern records open, each with a re-test date; 0; 0	Closing on the change record and calling the re-test later
The craft is exercised (Chapter 26)	Windows with two evidenced conductors; agents-off exercises per holder per quarter	not yet recorded; first measurement by 2029-06-30, then at least 1; same	recorded for the night window since 2028-12-07; every window; every window	Counting attendance and not the exercise result
Providers are held to terms (Chapter 24)	Providers whose scope is wider than their annex terms allow	SamDrift annex in force by 2029-06-30; 0; 0	Alster, Lumenscope and Cloud B arrangements under annex terms; 0; 0	Terms that no one tests

Three of the indicators are the book's central claims in a form that could be refuted. If a quarter of seeded faults is caught at a rate above the floor, and the share of actions verified only by the agent is zero, and the budget stays below its review line, then the book's second and fourth claims have held for that organisation for that quarter. If the portal re-test fails again, or if the claims core restore passes only for a scope smaller than the one claimed, the fifth claim has been confirmed by its failure, and the register will say so. The book does not need its organisations to succeed. It needs their records to be honest.

Risks and what would change the plan

Each risk below has a trigger that the organisation's own records can compute and a change of plan that follows without a meeting. Triggers come from the controls of the chapters, and the changes follow the rule of Chapter 16 that lowering is immediate and raising is a named decision.

Risk	Trigger	What changes
A re-test fails again (both)	A claim's re-test misses the objective or an integrity check	The claim stays withdrawn, a problem record opens, and no gate that depends on the claim is considered until a re-test passes; the plan's dates move, the register does not
Seven engineers cannot carry the plan (Nordvik)	Two Tier 1 tests slip in a quarter, or the on-call page ceiling of ONC-NR-2029-01 is exceeded for two months	The plan drops the assistant's Level 1 proposal and the optional tabletops before it drops a test, and the executive committee is told which claims move
A provider declines to take part (Nordvik)	SamDrift does not confirm a test window by 2029-05-31	The portal claim stays declared, the standing acceptance is renewed only with a dated escalation, and the exit options of Chapter 24 are examined
Key-person loss (Nordvik)	Joakim Wester is absent for the portal re-test or leaves	The re-test follows the runbook as written, run by the secondary seat holder, and its time is the one the claim uses (Chapter 19)
The observer wears down trust (both)	Pages from the independent probe that are false exceed the noise budget for two months	The noise budget is reviewed, the probe is tuned by a person, and the heartbeat and the silence rule are never held
The agent finds a shortcut (Hansa)	The independent probe disagrees with the agent's verification, or a silenced alert appears in the policy log	The class falls one level at once, a seeded fault reproduces the shortcut, and the shortcut-rate evaluation EVAL-HM-ITOPS-SG-01 is re-run
Verification becomes the bottleneck (Hansa)	The median age of unreviewed agent proposals exceeds 2 working days (T09)	Promotion pauses; the group adds reviewers or narrows the agent's classes, and does not widen them
Mandate drift (Hansa)	REG-HM-OPS-010 is more than 30 days old, or a change of model, skill or tool is not covered by evaluation	The agent returns to the level that the evidence supports, which may be Level 0 Advisory for the classes concerned
Rota and agreement (both)	The employee representatives withhold agreement on a tool that logs engineers' commands, or the page ceiling is exceeded	The tool is not switched on; operational measures stay at team level, and the plan proceeds with the measures that do not need it
A provider's AI changes without notice (both)	A notice that arrives with no period, or a change seen in telemetry first (INC-NR-2027-0129)	The notice is treated as a change request (AIDR-0902); the provider's embedded AI is accepted, constrained or switched off in a delegation profile
The sources of evidence move (both)	The AI Act timetable, the ESA critical provider list or national transposition changes a duty	The mapping record is reviewed within 30 days and the plan is amended by decision record

What would show the thesis wrong for these organisations. The book's own test, set out in its disposition and carried here, is evidence over several years from independent incident data that autonomous remediation without independent verification and without practice of manual operation produces fewer and shorter customer-impacting incidents and less severe tail events than a loop that keeps those properties. The plans do not test that claim over several years. They produce one year of records, which can contradict it for the organisation if, for example, the catch rate stays at 1.0 while the agent's self-verification, left on, yields no customer-visible fault. The result that this chapter holds expected, on a stated trend and not as a forecast, is the opposite, and the evidence for it is the group's own seeded fault, GitLab's untested backups (89, GitLab, 2017), and Atlassian's restore capability, which held for individual customers or a small set of customers and not for hundreds of deleted sites (266, Atlassian, 2022). These show what happens when a claim has not been tested at the scale or in the way that matters. They do not show that independent verification is always cheaper.

Across the degrees of delegation

The plans set target levels per function and action class. A target is a ceiling that an organisation sets for itself in a delegation profile, reached only if the gate holds, and no row moves to Level 4 Autonomous for a class the prohibitions of Chapter 4 exclude. The table gives the level at the date of the report and the ceiling at the closing review if every gate is met. Where a gate is not met, the level stays where it was.

Function and action class	Nordvik Region, 2029-03-31	Nordvik Region, 2030-03-31 if gates hold	Hansa Mutual, 2029-03-31	Hansa Mutual, 2030-03-31 if gates hold
O1 Observe: read, annotate	Level 4 within the data class for read-only tooling; the assistant is read-only	Same	Level 4 within the data class with redaction	Same
O1 Observe: change an alert, threshold or monitor	Level 0 Advisory	Level 0 Advisory	Level 0 Advisory	Level 0 Advisory
O2 Diagnose: propose a diagnosis	Level 0 Advisory (NR-OPS-001, retrieval only)	Level 1 Assisted after the shadow period	Level 1 Assisted (HM-OPS-002)	Level 1 Assisted; the stop rule on the replay hit rate stays
O3 Change: deploy a standard change	Level 2 Supervised; no standard class yet	Level 2 Supervised	Level 2 Supervised (HM-OPS-003 at Level 0 Advisory scores risk)	Level 2 Supervised; Level 3 only inside progressive delivery for a class with a history
O4 Restore: restart, scale, certificate renewal	Level 2 Supervised for three portal runbooks (NR-OPS-003)	Certificate renewal at Level 3 Bounded at most, on the three conditions	Level 3 Bounded, condition OBS-HM-0001	Level 3 Bounded; budget below 70 per cent
O4 Restore: roll back	Level 2 Supervised for a gateway route only	Level 2 Supervised	Level 2 Supervised	Level 3 Bounded for catalogued pairs only on T05, else Level 2 Supervised
O4 Restore: fail over	Level 1 Assisted; the duty manager attempts under RA-01	Level 1 Assisted	Level 1 Assisted	Level 2 Supervised; Level 3 for the payments pair outside this plan
O4 Restore: delete production data, restore-overwrite	Level 1 Assisted	Level 1 Assisted	Level 1 Assisted	Level 1 Assisted
O5 Sustain: spend, rightsize, retire	Level 0 Advisory	Level 1 Assisted	Level 1 Assisted (HM-OPS-004)	Level 1 Assisted; spend approved by a person

The table is deliberately modest. It records how much of the book's argument is about not moving: in a year, at most one class at Nordvik Region and one class at Hansa Mutual may rise to Level 3 Bounded, and a second may rise by one step. This is the book's conclusion drawn from the evidence of Chapters 10, 17 and 19. Raising a level is a decision with a record, and the evidence for it ages after 90 days (Chapter 16).

Outlook labels

The plans are recommendations and decisions proposed to the two boards, not forecasts. A recommendation says what to do and on which evidence a gate opens; it does not say what will happen. Where the chapter looks beyond its dates, the statement carries a label of AI Governance, Chapter 22, and the book's own projections about the future of operations are kept to Chapters 27 and 31.

Observable. The registers of the two organisations show failed, expired and untested claims at Tier 1. A probe in a separate failure domain caught a fault that the agent's own verification missed. Supervisors apply the yearly testing duties of DORA to financial entities. The incident reports of GitLab and Atlassian describe recovery claims that failed on scope.

Conditions, not forecasts. The plans' dates hold if the tests run as scheduled and the teams have the capacity. A first Level 3 Bounded class at Nordvik Region, and rollback at Level 3 Bounded at Hansa Mutual, are considered only when the gates of the plan are met. The testing and documentation requirements of DORA Articles 11, 12 and 24 and of Delegated Regulation (EU) 2024/1774, Article 25, which asks that test results be documented and that deficiencies be analysed, addressed and reported to the management body, are the reason the register carries scope, date and attester (2, European Union, 2022) (8, European Commission, 2024). What supervisors will ask for next, whether unattended recovery of a whole estate is within reach, and whether a provider's own loop could make the customer-side observer redundant are questions of the future, taken up with their labels in Chapters 27 and 31.

Nordvik Region and Hansa Mutual

Both organisations arrive at the same place from different starting points, and the difference between them is a difference in what is missing. Nordvik Region has no agent above Level 2 and no verified Tier 1 claim, and its plan is to build the evidence before it has anything to extend. Its risk is a plan that starts and then slips when the rota is under pressure, because seven engineers carry both the tests and the pager. Its protection is the register, which shows the board each month what has and has not been shown, and the rule that tests take precedence over every optional item. Hansa Mutual has an agent at Level 3 Bounded with a good record in one class and a failed claim in the database that the agent's reach would depend on. Its plan is to earn each step with evidence. Its risk is a loop that runs without anyone questioning it: an agent that has behaved well for several quarters, an observer that has never been surprised, and a board that has stopped asking.

Both organisations are revisited on 2030-03-31 against the same tests. The Region is measured by whether it can show, for every Tier 1 service, a claim with a date and a measured time less than 180 days old, and whether its first Level 3 class is backed by a seeded-fault catch rate and a drilled stop. The group is measured by whether it can show a supervisor, for each critical or important function, a claim inside its yearly clock, a catch rate that supports the level of each class, and a stop drill inside its target. The result is not known at the date of this chapter, and the plan is built so that either outcome is visible.

Summary

This chapter drew the book's conclusions for the two organisations and concerns all five operations functions: O1 Observe, where the independent observer is the first deliverable; O2 Diagnose, where the assistant stays advisory and the incident commander's decisions are recorded; O3 Change, where no change skips the first ring and the standard class has a history; O4 Restore, where only a verified claim counts as recoverable and where levels rise only on evidence; and O5 Sustain, where problem records close on re-tests and the craft is exercised. For Nordvik Region, the answer to AIDR-0900 is a conducted loop owned at the centre and bought under terms at the edge, with nothing at Tier 1 yet provable and a plan that changes that by dated tests. For Hansa Mutual, the answer to AIDR-0950 is that neither rollback nor failover may be extended now, that rollback may reach Level 3 Bounded for catalogued pairs on the trigger of four quarters of seeded-fault catch rate at 0.90 and a drilled stop, and that failover stays at Level 1 Assisted now and is proposed to rise one step to Level 2 Supervised as supervised failovers are run and pass, while the evidence for more is collected.

Five decisions go to each board: adopt the register as the measure of resilience, set the rule that a level rises only on evidence, fund independent verification and review capacity, hold providers to operational terms, and protect the craft and the people. Eight indicators turn the book's claims into numbers with baselines, targets, sources outside the system measured and misuse notes. The risks have triggers, and each trigger has a change of plan that follows without a meeting. The plans are recommendations to illustrative organisations, not forecasts, and the one year of records they produce can contradict the thesis for the organisation concerned. Level 4 Autonomous is never used for an irreversible action on production data, for an action outside an authorised change window or freeze on a critical function, for an action that disables the observation or the stop path itself, or for an action that decides about a named person's access to work, and no plan in this chapter relaxes that. Chapter 31 judges the thesis against the evidence of the whole book, and ends with five things a reader can do on Monday.

Sources

1. European Parliament and Council of the European Union. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). Official Journal of the European Union, 27 December 2022. (2, European Union, 2022)
2. European Parliament and Council of the European Union. Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive). Official Journal of the European Union, 27 December 2022. (3, European Union, 2022)
3. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. The Transformed Architecture, Book 2. (296, Nordqvist, 2026)
4. Bainbridge, L. (1983). Ironies of Automation. Automatica 19(6), 775-779. (217, Bainbridge, 1983)
5. Parasuraman, R. & Manzey, D. H. (2010). Complacency and Bias in Human Use of Automation: An Attentional Integration. Human Factors 52(3), 381-410. (218, Parasuraman & Manzey, 2010)
6. Nordqvist, G. (2026). AI Purple: How Red and Blue Learn Together When AI Joins the Loop in European Enterprises and Public Authorities. The Transformed Architecture, Book 9. (304, Nordqvist, 2026)
7. Kim, E., Garg, A., Peng, K. & Garg, N. (2025). Correlated Errors in Large Language Models. ICML 2025; arXiv:2506.07962. (103, Kim et al., 2025)
8. European Commission. Commission Delegated Regulation (EU) 2024/1774 supplementing Regulation (EU) 2022/2554 with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework. Official Journal of the European Union, 25 June 2024. (8, European Commission, 2024)
9. GitLab (2017). Postmortem of database outage of January 31. GitLab blog, 10 February 2017. (89, GitLab, 2017)
10. Atlassian (2022). Post-Incident Review on the Atlassian April 2022 outage. Atlassian Engineering, 29 April 2022. (266, Atlassian, 2022)