Nordvik Region and Hansa Mutual: Conclusions for Two Organisations

All courses / AI Governance / Module 6 / Chapter 23

Learning objectives

After the lesson the participant can:

• Summarise the governance decisions each organisation took and the artefacts that record them.
• Explain the four parts of Hansa Mutual's answer to legal fragmentation.
• Compare the two organisations by legal regime, AI Act role, usage-mode profile, lever and main risk.
• Draft a prioritised 24-month governance roadmap with gates for the participant's own organisation.

Key concepts

Depth versus number of regimes

Nordvik Region shows governance under a single legal regime, where the depth of public-law duty sets the difficulty. Hansa Mutual shows governance under seven regimes, where the difficulty is keeping one set of decisions consistent across them.

Market overlay

A per-market addition to the group policy, maintained by the market liaison, covering what differs, from Norway's incorporation status to retention periods and consultation procedures. An overlay may add a control but never remove a group one.

Bounded mandate of the group board

The board in Hamburg decides the group baseline, the risk appetite and what the tiers route to it, but each subsidiary board keeps its entity-level duties, and a group decision becomes final in a market only when that entity's consultation is recorded.

Roadmap gate

A commitment the organisation will not trade for speed. For Nordvik Region: no Mode 5 use case without containment, a stop authority, evaluation evidence and a committee decision. For Hansa Mutual: no expansion of agency without evidence and no overlay that weakens the baseline.

Decision recorded in advance

What the most useful artefacts in both organisations had in common: a retirement criterion, a stop authority, an exception with an expiry date, a consultation commitment written as a control, and an exit plan that had been drilled.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. Because the condition for retiring the triage model was named in advance, a parity breach was handled as a planned decision and not as a crisis. Which decisions in your organisation would benefit most from being taken before they are needed?
2. At the Polish service centre, the agent's permissions, log retention and consultation record must vary by the market of the claim, not by the location of the server. What does that demand of a shared platform?
3. Nordvik Region's narrow usage-mode profile is a choice it can still make; Hansa Mutual's is a fact it must govern. Which describes your organisation, and what would it take to keep or regain the choice?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. What did Nordvik Region's first assessment round find, as the chapter recalls?

   1. No AI in use beyond the procured benefits-triage system
   2. Eleven AI services in use, three of them reached by staff without any review
   3. Two autonomous production agents running without a stop authority
   4. Seven suppliers that refused to disclose their model versions
   Show the answer

   B. Eleven AI services in use, three of them reached by staff without any review
   A cautious authority discovered that it was already using more AI than it governed, and that most of it had arrived through suppliers: eleven services, three without review.

2. Which rule governs the relation between Hansa Mutual's group policy and its market overlays?

   1. An overlay replaces the group policy wherever national law differs
   2. An overlay applies only in entities outside the Union and the EEA
   3. An overlay may add a control but never remove a group one
   4. An overlay may relax a group control with the consent of the entity board
   Show the answer

   C. An overlay may add a control but never remove a group one
   The group policy expresses what holds everywhere and each overlay adds what differs. An overlay may add a control but never remove a group one, and controls applied where an instrument is not law are labelled as group policy.

3. What can Nordvik Region take from Hansa Mutual, according to the chapter's comparison?

   1. Drilled exit plans, since its records show no rehearsal of an exit from its triage supplier
   2. Autonomous production agents, since the Region has none
   3. A group governance board, since the Region has only an elected committee
   4. Public transparency generated from the descriptors of deployed systems, since the Region publishes little
   Show the answer

   A. Drilled exit plans, since its records show no rehearsal of an exit from its triage supplier
   Hansa's drilled exit plans, and its exceptions with expiry and automatic reversion, would serve the Region. In the other direction, the Region's practice of generating public transparency from the same descriptors as its deployed systems would serve Hansa.