All courses / The Transformed Security Architect / Module 4 / Chapter 18
Learning objectives
After the lesson the participant can:
- Apply the four reading rules, addressee, verb, date and limit, to an article of a European instrument.
- Identify, for each of the four instruments, the articles the chapter treats and the architectural implication of each.
- Distinguish the accountability of the management body, the control owner and the architect's professional responsibility.
- Convert one article into a catalogue control with a property, a test, evidence and a recorded reading.
Key concepts
- Four reading rules
- Read the addressee, the verb, the date and the limit. Approve, oversee or be trained describe a person's act; ensure, keep, implement or notify describe a property that architecture can provide and a test can check. Whether a reading is legally right belongs to counsel.
- Under its control
- The architectural hinge of AI Act Article 26: a deployer cannot keep for at least six months logs that a supplier writes only to its own environment, so the requirement belongs in the contract and the data flow.
- Professional responsibility
- What the architect answers for, as defined in the role charter: the soundness of the design advised, the faithfulness of the mapping from article to control, the honesty of the evidence classification and the escalation of a risk the architect cannot accept.
- Property statement
- The form in which an article becomes engineering: X holds for Y, checked every Z. If no test can fail, it is not yet an engineering statement. If the verb is approve or oversee, the output is an information requirement, not a control.
- One incident pipeline
- The design answer to overlapping reporting clocks: one awareness timestamp, one classification step that evaluates every regime and one evidence record from which each report is assembled.
Interactive exercises
Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.
Interactive exercise 1 · Sort
Which instrument asks for it
Sort each requirement under the instrument the chapter attributes it to.
Interactive exercise 2 · Put in order
From article to control
Put the six steps of the chapter's practical guide for turning an article into a control in order.
Teaching plan
| 15 min | Lecture on regulation as a design input and the four reading rules; participants apply the verb rule to five article extracts the teacher reads out. |
| 20 min | Groups each take one instrument, the AI Act, NIS 2, DORA or the Cyber Resilience Act, and present the chapter's articles with their architectural implications. |
| 10 min | The teacher walks through Table 18.1 on reporting clocks and Hansa's mapping MAP-HM-CLAIMS-TRIAGE-01, including the conditional Article 26 entry held as declared. |
| 35 min | Exercise: participants turn one article into a control using the six steps and record the reading with a reviewer. |
| 10 min | Debrief on personal accountability: what the architect owes the management body, and the one failure the architect cannot allow. |
Discussion
- Reporting a declared control as verified is the one failure the architect cannot allow. What pressures in your organisation push towards that failure, and what protects against it?
- The chapter says a control owned by a team alias is a failed control, whatever its test says. How many of your controls would survive that rule?
- Hansa records for each entry whether an obligation is law or group policy. Why does that distinction matter in entities where the instruments do not apply by law?
Written exercise
Exercise · 35 minutes
Turn an article into a control
Choose one article the chapter treats that applies to your organisation, for example NIS 2 Article 23(4) on the early warning, AI Act Article 26(6) on logs under the deployer's control, or DORA Article 28(3) on the register of information. Follow the six steps. Identify the addressee and the verb. State the property in the form X holds for Y, checked every Z. Search your catalogue for an existing control and reuse it if one fits. Write a test that fails when the property is false and say when it runs. Name the evidence and its keeper and classify the control as verified, declared or failed. Record the reading with a reviewer other than yourself, review triggers and a review date.
Deliverable: One mapping entry in the form of Hansa's regulatory mapping, with article, property, control, test, cadence and status, plus a short record of the reading and its reviewer.
Self-test
Choose an answer to see whether it is right, or open the answer below each question.
In the chapter's example for NIS 2 Article 23(4)(a), what does the quarterly test assert?
Show the answer
D. That a synthetic incident replay produces an early-warning draft in under four hours
The test replays a synthetic incident and asserts an early-warning draft in under four hours, leaving most of the 24 hours for human judgement. A new control covers the awareness timestamp.Why is the claims-triage agent recorded as not high-risk in Hansa's mapping?
Show the answer
B. Because Annex III, point 5(c), concerns risk assessment and pricing for life and health insurance, not claims routing
Annex III, point 5(c), concerns risk assessment and pricing for life and health insurance, not claims routing. Article 26 is therefore conditional for the agent, and the pre-built oversight control is honestly held as declared.What does CRA Article 12 mean for supplier evidence, as the chapter reads it?
Show the answer
C. A high-risk AI system meeting the CRA's essential requirements is deemed, as far as its declaration shows, to meet AI Act Article 15
Under CRA Article 12 such a system is deemed to meet the cybersecurity requirement of AI Act Article 15 in so far as its declaration of conformity shows it, so one piece of supplier evidence serves two instruments.