Public Authorities and Multinationals: Sovereignty, Procurement and Many Legal Regimes

All courses / The Transformed Security Architect / Module 4 / Chapter 20

Learning objectives

After the lesson the participant can:

• Explain the three moves by which a procuring architect holds a boundary in a system a supplier builds and runs.
• Write a testable security requirement with identifier, result, level, verification at three moments, consequence and catalogue link.
• Translate digital sovereignty into four properties, each with a check and evidence.
• Review a market overlay for any value weaker than the baseline.

Key concepts

Testable requirement

A requirement with an identifier, the result required in functional terms, a level of mandatory or weighted, a verification naming method, evidence and frequency at evaluation, acceptance and operation, a consequence of failure and a link to its catalogue control.

Contracts as controls

A contract clause is a control only when it has an owner, produces evidence and is tested, so each clause family, such as stop path, logs and access, change notice, audit rights, incident notification and exit, is a catalogue entry with the supplier as evidence source.

Rehearsed exit

An exit plan that says what leaves, in what formats and how fast, what keeps the function running, and who has tried. For a procured system the realistic exit is often the process without the AI, so the plan includes a test of it.

Sovereignty as verifiable properties

Knowing where workloads run, which law governs them, being able to move them and being able to continue if a provider fails. Each becomes a check with evidence, such as region pinning, key custody, an exit test record and a failover drill.

Tightening-only overlay

A market overlay on a pinned baseline that records regime, placement, timing and mappings to existing controls. A pipeline check fails when any overlay value is weaker than the baseline: shorter retention, fewer recipients, a later deadline or a control removed.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. A requirement tested only at tender protects the authority only on the day of signature. Which requirements in your current contracts are verified in operation, and which only at award?
2. The chapter says the architect makes the facts of ownership, operation and key custody visible and leaves the legal reach of third-country law to counsel. Why is that division of work the right one?
3. Where a local rule appears to require less than the group baseline, the overlay may not relax silently. What are the two alternatives the chapter offers, and when would you choose each?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. By default, how many mandatory requirements does the chapter's guide allow per tender, and what happens to the rest?

   1. No more than five, and the rest are dropped
   2. No more than twelve, with the rest weighted under the award criteria
   3. No limit, as long as each has a verification
   4. No more than twenty, with the rest moved to the contract schedule
   Show the answer

   B. No more than twelve, with the rest weighted under the award criteria
   Mandatory requirements are kept to what law or risk appetite makes non-negotiable, by default no more than twelve per tender, with the rest weighted under the award criteria of Article 67 of Directive 2014/24/EU.

2. Why does Nordvik's requirement SR-02 set log retention at twelve months when AI Act Article 26(6) sets a floor of six?

   1. Because NIS 2 Article 23 requires twelve months for significant incidents
   2. Because the supplier's log store cannot delete earlier
   3. Because the Region's archives law forbids shorter retention for all records
   4. Because appeals can arrive later than the six-month floor
   Show the answer

   D. Because appeals can arrive later than the six-month floor
   SR-02 requires every ranking, with inputs and model version, in the Region's log store within 15 minutes and kept at least 12 months, beyond the six-month floor, because appeals can arrive later.

3. What makes the pipeline check fail when a market overlay is added to Hansa's catalogue?

   1. Any overlay value weaker than the baseline, or a protected control missing
   2. Any overlay that adds recipients or tightens a deadline
   3. Any mapping owned by a local security officer and not by the group
   4. Any regime in which the AI Act applies as group policy and not as law
   Show the answer

   A. Any overlay value weaker than the baseline, or a protected control missing
   The tightening check fails the pipeline if any value is weaker than the baseline, such as a shorter retention, fewer notification recipients, a later deadline or a control removed, or if a protected control is missing.