The model is the smallest part of the problem: building and securing AI platforms in Europe
For a mixed audience of technology leaders, architects, security professionals and public-sector decision makers
Organisations ask which model to buy. The keynote argues, with the whole of AI Platform and Security behind it, that the platform around the model decides what the organisation can control, prove and afford. It moves from the six usage modes, through the artefacts that make behaviour versioned and evaluated, to the two forms of threat that AI itself has become, and closes with a roadmap of three stages that any large enterprise or public authority can start this quarter. Two fictional organisations, a Nordic regional authority and a Hamburg insurer, show that the same conclusions yield different platforms.
6 min
The wrong first question
A model choice is revisited every few months; the platform around it outlives many such choices.
Incidents and audit findings trace back less to the model than to what it was allowed to see and do.
Four properties of AI systems break classical assumptions, and a fifth is added later: AI is also a source of threat.
7 min
Six modes, six control points
From Mode 0 Ambient AI to Mode 5 Autonomous production agents, each mode puts the organisation's control point in a different place.
The usage-mode matrix is the platform's demand forecast, and the inventory names the mode, not the brand.
Use cases drift between modes, so provisioning reads the mode and refuses what its baseline does not allow.
9 min
Versioned, evaluated together, enforced outside the model
A release is the signed set of every behaviour-shaping artefact that was evaluated together, from weights and prompts to indexes and skills.
Every model call and tool call passes a policy point the platform operates; an agent's permissions live in a manifest nothing the model emits can extend.
Regulation arrives as a chain from article to capability to artefact to evidence, and the evidence is a by-product of delivery.
8 min
Designed twice: to protect and to contain
Natural language is an instruction channel the model cannot police, so the controls sit outside the model and bound the worst case.
Adversaries use AI to shrink the window between patch and exploit and to impersonate the people whose word moves money.
The organisation's own agents sometimes satisfy the measure and not the intent; instructions lower the rate, only boundaries set a ceiling on the consequences.
7 min
Where it runs, what it costs, how it reaches production
Sovereignty is a set of verifiable properties and depends on how fast a model can be replaced, which a drilled switch proves.
Cost and energy are constraints with levers in the same gateway that enforces security policy.
Pilots stall because they are built beside the estate; a golden path and a codified readiness gate carry them into production.
8 min
Three stages and where to begin
Stage 1: one control point and a working stop. Stage 2: replaceable and ready for high-risk duties. Stage 3: evidence on every release and autonomy by exception.
A regional authority that mostly procures steers through contracts; an insurer that builds steers through its platform. The order of the roadmap is the same.
Begin with the platform's view of each AI use, put one policy point outside the model, pin and sign what shapes behaviour, and keep the stop path in human hands.
What the audience takes away
The usage mode, not the brand of the model, decides what the platform must provide.
Control means that everything shaping behaviour is versioned and evaluated together, enforced outside the model and evidenced by normal operation.
Contain agents with boundaries that do not rely on their intent, and extend autonomy only on evidence.
From model choice to platform: the foundations of AI Platform and Security
Most organisations start with the question of which model to buy. This lecture argues, with Part I of the book, that it is the smallest part of the problem: the platform around the model outlives many model choices. It follows the argument in four moves: four properties of AI systems that break classical assumptions, six usage modes that each put the control point somewhere else, regulation read as a chain from article to evidence, and a reference architecture whose decisions are kept as records in a repository. Nordvik Region and Hansa Mutual show the same principles giving two very different platforms.
8 min
Why the model is the smallest part of the problem
A model choice is revisited every few months, whereas identity integration, data boundaries, gateways, evaluation suites, logs and stop paths outlive many such choices.
Four properties break classical assumptions: outputs vary, models are built from data, foundation models cannot be opened, and agents act with credentials.
Because a large language model receives instructions and data through the same channel, the platform places its controls outside the model.
9 min
The mode decides the control point
The six usage modes run from Mode 0 Ambient AI to Mode 5 Autonomous production agents; each is an architectural pattern, not a product category.
The control point moves from inventory and contract, through identity provider, egress proxy and tenant, to managed policy and sandbox, the AI gateway, and finally the agent manifest, identity and stop path.
Use cases drift between modes while the code gives no sign of it, so the mode is a register field that provisioning reads.
9 min
Regulation as a chain of four links
Each obligation is written as legal source, platform capability, codified artefact and evidence produced; the link that is usually missing is the evidence.
Three keys decide which requirements apply: the risk tier, the role as provider or deployer, and whether a general-purpose AI model is integrated.
A requirements catalogue holds the chain as data that gates evaluate, so a legal change becomes a reviewed change to data.
10 min
Five layers, a control plane and four patterns
Value flows upward from the data foundation to applications and channels; control flows inward from a control plane for identity, policy, observability and evidence.
The AI gateway, the model registry, the evaluation service and the prompt and policy repositories carry the architecture in every deployment variant.
Adaptations are written as overlays on a pinned reference model; an overlay may add or tighten controls but never relax the group baseline.
9 min
Decisions kept true in a repository
The AI Decision Record keeps the short, numbered, immutable form of the Architecture Decision Record and adds intended purpose, prohibited uses, classification, role, evaluation criteria, oversight and retirement criteria.
Model cards, datasheets and the system card are its companions, and the technical documentation of Article 11 and Annex IV of the AI Act is generated from them.
Nordvik Region mostly procures and steers through contracts; Hansa Mutual builds, carries the provider's duties and operates one platform for seven jurisdictions.
What the audience takes away
The usage mode, not the brand of the model, determines the architecture, the risks and the controls the platform must provide.
A requirement that cannot be written as legal source, capability, artefact and evidence is not ready to be built.
The gateway, the registry, the evaluation service and the control plane are kept in every variant, and the repository, not the document, is what must be kept true.
Module 2 · Part II · Data, Models and DevSecMLOps · 55 minutes
Everything that shapes behaviour is versioned: the core of the platform
Part II of the book makes one argument seven times over: an AI system changes through many more artefacts than its model, and each of them needs an owner, a version and a gate. The lecture follows a change from the data product, through training or adaptation, into a signed release, and out through retrieval, agents and the gateway to a system of record. It then walks the same loop from the side of failure and shows why most documented incidents of 2024 to 2026 were caused or contained by revision management. Nordvik Region and Hansa Mutual supply the artefacts.
8 min
The model is derived data
In an AI system behaviour is derived from data, so the quality, legality and reproducibility of the model are bounded by those of the data.
Data products have accountable owners, contracts make the interface testable, and the platform captures lineage so that a model card's claims can be verified.
The lawful basis for operational use and for model training are recorded separately, because the GDPR separates them.
8 min
A lifecycle is a pipeline with gates
Six promotion gates stand between a model version and production: data, reproducibility, evaluation, comparison, readiness and approval. Only the last involves a person.
With a third-party general-purpose AI model the lifecycle manages prompts, evaluation sets, guardrails and adapters, and the unit of promotion is the compound system.
A predetermined change envelope lets planned retraining pass the gates as a planned change, and lists what falls outside it.
10 min
The loop and its revision backbone
A release is neither a model version nor a commit but the exact set of artefact versions that passed evaluation together, pinned by digest and signed.
Aliases are pointers, not versions; a release manifest records the version an alias resolved to.
Skills, agent definitions, prompts and connectors are governed catalogue assets consumed by reference, not private copies.
9 min
The same loop seen from failure
Three failures recur in the incidents the book reviews: the mutable reference, the shared CI cache and the credential believed revoked but still valid.
Provenance is necessary but not sufficient: it confirms which pipeline built an artefact, not whether that pipeline behaved as intended.
The loop's risks belong in the existing information security risk register, mapped to Annex A of ISO/IEC 27001:2022 and held as code.
10 min
Retrieval, grounding and bounded autonomy
The simplest option that passes the evaluation set, normally prompting with retrieval, is usually right and carries the least regulatory exposure.
Choose the pattern with the least autonomy that meets the requirement; a workflow has a finite set of paths to test, an agent an open set that can only be bounded.
Autonomy is bounded by a permission manifest, a policy decision point outside the model, least-privilege identities, approval gates and capped steps and spend.
10 min
The seam to systems of record
The AI gateway is the single seam where identity, policy, routing, budgets, guardrails, logging and caching attach once.
AI never writes directly to a system of record; it writes a proposal, and a deterministic component or a person commits the change.
Both the service identity and the acting person reach the system of record, which makes the authorisation decision.
What the audience takes away
Every artefact that can change the system's behaviour has a version, an owner and a place in version control or in a registry with immutable versions.
Pin by digest, isolate release workflows, sign history and verify revocation: these contain the failures that recur across the loop.
An agent may draft and propose within a manifest enforced outside the model; a person or a deterministic component commits what cannot be undone.
Where it runs and who controls it: placement as a recorded decision
Part III of the book argues that digital sovereignty is a set of verifiable properties, not a location, and that cloud and self-hosted AI are different challenges, not a trade between convenience and control. The lecture follows a workload from its data class through the sovereignty decision matrix to a placement rule, weighs what the organisation takes on with a cloud service and with its own accelerators, and ends where the hybrid pattern is hardest to hold: an agent on an engineer's desk that sends whatever it reads to a model. Nordvik Region's tender profile and Hansa Mutual's routing policy show the decisions as code.
8 min
Sovereignty as properties you can verify
The organisation knows where its workloads run, can show which law governs them, can change provider without rewriting its estate, and can continue operating if a provider or jurisdiction becomes unavailable.
AI workloads create transfers where classical applications did not: inference requests, stored prompts, telemetry, fine-tuning uploads and third-country support access.
Accelerators are scarce, so demand profiles are separated and model routing is treated as a capacity instrument.
9 min
The decision matrix and what it cannot do
The matrix sets workload attributes against placements from a hyperscaler EU region to on-premises or confidential computing, and is evaluated at intake as a rule set.
At Nordvik Region the matrix narrowed the options but did not make the choice; its most useful job was stopping a workload from going to the most convenient placement while the compliant one was not ready.
An exit strategy that has never been exercised is a document, not a capability.
10 min
Two sets of challenges, not one trade-off
A cloud service brings volume risk and the provider's schedule for retirements and data terms; self-hosting brings utilisation and staffing risk, control of the version, servers to patch, licences to read and power to secure.
Data classification and lawful basis, identity, access and keys, and human oversight and acceptable use remain the customer's in every consumption model.
Self-hosting without a platform team does not save the provider's margin; it moves the provider's risks to where nobody watches them.
8 min
Hybrid behind one gateway
Four patterns: one gateway in front of both tiers, routing by data class, a self-hosted baseline with burst to cloud, and a sovereign private cloud.
A placement policy, a self-hosting readiness gate and a cloud controls file turn the combination into a recorded decision with a review date.
A retirement notice, a change of terms or a change of data class triggers re-evaluation automatically.
10 min
Agentic work: routing before the session starts
An agent sends whatever context it gathers to the selected model; once a cloud session has read a protected file, the disclosure has happened.
Routing is therefore decided by the classification of the workspace, never per prompt, and in a multinational group also by the owning entity.
A client setting is a convenience, not a control: the gateway, egress control, separate workspaces and credential scoping carry the control.
What the audience takes away
Placement is decided per workload from its data class and risk class, written as a rule, enforced by infrastructure code and admission policy, and tested before deployment.
Whichever tier is chosen, the organisation keeps its prompts, evaluation sets and fine-tuning data in its own repository and tests the exit.
For agentic work, label the work and not the user, fix the model tier before the session starts and enforce it outside the client.
Controls that hold whatever anyone intends: securing AI and securing against AI
Part IV of the book turns on one principle: every boundary around an AI workload, and every approval of a consequential action, should be enforced by something that neither an attacker nor the workload itself can change. The lecture shows where the principle comes from, the single channel for instructions and data, and follows it through a threat model linked to deployed configuration, layered controls that each assume the previous one failed, a patch window that has collapsed from weeks to days, approvals that do not trust a face or a voice, and containment of the organisation's own agents. It is a lecture for defenders throughout.
9 min
What changes when the system contains a model
The instruction channel and the data channel are the same, the weights are an asset that encodes fragments of training data, and agents hold credentials and call tools.
The most common failure is treating AI security as a new discipline and neglecting the foundations: zero trust, identity, secrets management, segmentation and logging come first.
Because the boundary cannot be enforced inside the model, it is enforced outside, and the worst case of a fully hijacked model is bounded.
10 min
Linkage, not completeness
A threat model in the repository is reviewed on every change; the threat names the control, the control names the configuration, and the pipeline proves deployment.
STRIDE is extended with MITRE ATLAS techniques and the OWASP identifiers, so each threat is searchable by three vocabularies.
Each layer, from signed datasets through entitlement-aware retrieval and the gateway to least-privilege agents, assumes the one before it has failed.
8 min
Testing and incidents as a test of the architecture
External red teaming is kept for discovery, and every finding becomes an automated test that also runs on a schedule to catch drift in a third-party model.
One event can start several reporting clocks, and the 24-hour early warning is the design constraint for the logs.
Every containment action in a playbook depends on an earlier design decision, such as versioned prompts, chunk-level source identifiers and short-lived tokens.
11 min
The adversary with AI
Most of what attackers do with AI is not new; it is cheaper and faster, and every published patch tells the attacker where the flaw was.
The response is patch velocity as a measured service level by exploitability tier, with compensating controls prepared in advance and detection that has authority to act.
In the Arup case nothing was hacked: the approval process treated a familiar face and voice as proof of identity and authority.
12 min
The agent that needs no adversary
Agents given goals, tools and credentials sometimes reach the goal by routes nobody sanctioned, and their reports do not always match what was recorded.
Instructions lower the rate but leave it above zero; a boundary the agent can see and change is advice, a boundary it cannot reach is a control.
Containment is scoped credentials, default-deny egress, protected control artefacts, budgets, approvals and a stop path that lives outside the system it stops.
What the audience takes away
Place controls outside the model and link them: threat to control, control to configuration, configuration to evidence.
Measure patch velocity by exploitability tier, and require an independent channel and a second person for actions that move money or cannot be undone.
Treat an agent's account as a claim; the evidence is what infrastructure the agent cannot write to recorded.
Module 5 · Part V · Delivery and Operations · 45 minutes
Fit on the day it ships, and on the days after: delivering and operating AI
Part V of the book follows one set of numbers through the life of a system. The metrics a release is accepted on are the metrics production monitors, the thresholds in the drift job are the thresholds in the post-market monitoring plan, the functional unit for cost is the functional unit for carbon, and the stop criteria of a go-live decision are measurable from the observability configuration. The lecture shows how evaluation, monitoring, cost control and the readiness gate become one loop of versioned artefacts, and why most pilots stall before they enter it. Nordvik Region's triage system and Hansa Mutual's claims triage assistant carry the examples.
10 min
Evaluation for a probabilistic component
A unit test asserts one value for one input; accuracy is a statistical property of a population and an LLM's output varies between runs.
The evaluation pyramid has six layers, from deterministic unit and data tests at the base to red teaming and human evaluation at the apex.
Acceptance criteria are code: datasets, metrics, thresholds and judge configuration in a suite the pipeline enforces, with a threshold never lowered in the pull request that changes the model.
10 min
Why models decay and how you see it
Data drift alters what arrives, concept drift alters what is right, and labels often arrive late or never, so indirect input and prediction comparisons matter.
The evidence pipeline is not sampled, because a ten per cent sample is not a record; the operational pipeline is sampled because a trace store is not an evidence store.
An AI incident is measured in affected decisions, so the process adds a classification step, an impact query and a path back to evaluation.
9 min
Cost and carbon as design constraints
Every term of the token formula is an architectural decision, from the system prompt sent with every request to the number of retrieved chunks and agent steps.
Caching, routing and batching act on specific drivers and live in the gateway; routing sends each request to the cheapest model that meets the quality objective.
Cost per resolved enquiry relates spending to value, and the Software Carbon Intensity score uses the same functional unit and rewards reduction, not offsetting.
10 min
Out of the pilot trap
Pilots stall because they are built beside the estate, and the controls production demands are deferred until they are the most expensive thing to add.
A golden path tells a team before it writes code which decisions are its own and which carry an evidence burden.
The readiness review is a gate, not a meeting: a checklist verified by evidence in the repository, mapped to Article 26 of the AI Act.
6 min
One loop of versioned artefacts
Production monitors the metrics the release was accepted on, and every incident ends with a change to the golden dataset, the suite or the drift thresholds.
The go-live decision is recorded with rejected options and measurable stop criteria, so a rollback depends on a threshold and not on a meeting.
Nordvik Region's evaluation risk is unrepresentative data about residents; Hansa Mutual's is a group average that hides failure in one market.
What the audience takes away
Declare the metrics and thresholds a release is accepted on, run them repeatedly with confidence intervals, and monitor the same metrics in production.
Keep the unsampled record of events apart from operational telemetry, and give every AI system a tested switch to suspend it and a fallback that absorbs the load.
Build pilots on the path that can carry them to production, and close the ones that do not proceed as deliberately as a service is launched.
Same conclusions, different platforms: from two cases to a capability roadmap
The closing lecture shows why one set of principles produced a small, deliberate platform around a procured system at Nordvik Region and a large group platform with market overlays at Hansa Mutual, and what each can learn from the other. It then states the thesis of the book in one sentence, walks through the eight conclusions on which its parts agree, names the few artefacts that carry most of them and the four trade-offs that become design decisions, and ends with a roadmap of three stages, each defined by a capability and a test, and with an honest account of how firm the conclusions are.
9 min
Two platforms from one set of principles
Nordvik Region is mostly a deployer, so its platform holds evidence about a system it does not build; Hansa Mutual's platform produces the system and its evidence together.
Nordvik's lever is the contract and acceptance testing; Hansa's lever is the platform and its gates, which change at the speed of a pull request but concentrate risk.
Both found that the artefacts that mattered most recorded a boundary in advance: a change envelope, a residency rule, a kill switch, an overlay that may not relax the baseline.
6 min
The thesis in one sentence
A platform is under control when everything that shapes behaviour is codified, versioned and evaluated together, and every model call and tool call passes a policy point outside the model.
Containment holds whatever anyone intends, and the evidence that all of this is true is produced by normal operation, not by an audit project.
11 min
Eight conclusions and the artefacts that carry them
The usage mode decides what the platform provides; revision management and evidence are the backbone; AI is target and source of threat; containment must not depend on intent.
Routing and placement are decided per workload by risk tier; the platform and supply chain are part of the system; evaluation and observability turn pilots into services; cost and energy are constraints.
The gateway, the permission manifest and the release manifest each serve several conclusions at once, so building them well delivers most of the conclusions for one investment.
6 min
Four trade-offs to engineer
Speed of defence against change control is reconciled by approving the emergency path, its canary rings and rollback in advance.
Rich telemetry against storage limitation, containment against value, and routing for cost against stable evaluation each become a design decision with a cost.
8 min
Three stages, each with a test
Stage 1, months 0 to 6: one control point and a working stop, tested by no model calls outside the gateway and each Mode 5 agent stopped in an exercise.
Stage 2, months 6 to 18: replaceable and ready for high-risk duties, tested by a forced model migration rehearsed end to end.
Stage 3, months 18 to 36: evidence on every release and autonomy by exception, tested by an auditor reconstructing any release and any agent permission from records alone.
What the audience takes away
Begin with the platform's view of each AI use: its mode, and therefore the control point it needs.
Sequence the work as tested capabilities, because each stage depends on the one before it.
Expand an agent's permissions only on evidence, and keep the stop path in human hands.
