Conclusions: Building and Securing AI Platforms

This book set out to show that an AI platform for a large European enterprise or public authority can be built and secured with the same disciplines that Architecture as Code (72, Nordqvist, 2025) applies to any other estate: declared intent, version control, automated gates and evidence produced by normal operation. This chapter extracts the conclusions on which several parts agree and turns them into a capability roadmap, followed by a marked forward look. The governance conclusions belong to the sibling volume, AI Governance, Chapter 25 (73, Nordqvist, 2026), and appear here only where the platform depends on them. Judgements and projections are labelled as such.

The thesis of the book leads to eight conclusions, which act on three tensions and resolve into three phases of the programme

Figure 25.1: From thesis to roadmap: eight conclusions follow, they bear on the three tensions of Chapter 1, and they resolve into three stages of platform capability. The table maps the conclusions to the tensions.

Conclusion Tensions it acts on
Usage mode, not brand, sets what the platform provides Frames the other seven
Revision management and evidence as backbone Speed versus control; autonomy versus accountability
AI is target and source of threat Speed versus control
Containment that does not depend on intent Autonomy versus accountability
Routing and placement per workload by risk tier Innovation versus sovereignty
Platform and supply chain are part of the system Autonomy versus accountability; innovation versus sovereignty
Evaluation and observability turn pilots into services Speed versus control
Cost and energy as architectural constraints Innovation versus sovereignty

The thesis restated for platform and security

Chapter 1 named four ways in which AI breaks the assumptions of classical architecture. Behaviour is probabilistic; the model is a derived artefact that degrades silently; the supply chain contains foundation models the organisation cannot inspect. And the legal position of a system under the AI Act, Regulation (EU) 2024/1689 (1, European Union, 2024), is assigned to roles that architectural decisions can change. Parts IV and V added a fifth: AI is also a source of threat, in the hands of adversaries who compress the time from patch to exploit and in the behaviour of the organisation's own agents when a task rewards a shortcut.

The thesis that follows is short. An AI platform is under control when everything that shapes the behaviour of the systems on it is codified, versioned and evaluated together, when every model call and tool call passes a policy point outside the model, when containment holds whatever anyone intends, and when the evidence that all of this is true is produced by the platform's normal operation rather than by an audit project.

What the platform chapters converge on

The usage mode, not the brand, determines what the platform must provide

Chapter 2 showed that "using a large language model" covers six undertakings with different architectures. In Mode 0 – Ambient AI the organisation controls only supplier change and verification habits; in Mode 1 – Conversational assistants the platform contributes identity, the approved tier and egress control; in Mode 2 – Embedded workplace assistants permission debt in the document estate becomes a platform problem; in Mode 3 – Agentic work tools the platform must supply containment, a governed catalogue and the routing of Chapter 15; in Mode 4 – Built AI applications all five layers of Chapter 4; and in Mode 5 – Autonomous production agents workload identities, permission manifests and an external stop path. The usage-mode matrix is therefore the platform's demand forecast, and because one vendor appears in several modes, the inventory and every approval name the mode rather than the brand.

Revision management and evidence are the backbone of control

Chapters 5, 7, 8 and 9 converge on one property: the ability to say exactly what is running, what changed, who approved it and how to go back. Chapter 8 defines a release as the signed set of every behaviour-shaping artefact, from weights and prompts to retrieval indexes and skills, that was evaluated together. Chapter 9 supplies the proof: the recurring failures of 2024 to 2026 were mutable references, shared caches and credentials believed revoked, and strong revision management prevented or bounded almost all of them. It also supplies the limit, because packages in the TanStack wave shipped with valid build provenance from a pipeline that misbehaved (153, Kurmi, 2026). Signatures and attestations, from SLSA (32, OpenSSF, n.d.) to the ML-BOM (31, OWASP, n.d.), are therefore necessary inputs to control, not its substitute.

AI is both a target and a source of threat

Chapters 16 and 17 treat AI as the target. Natural language is an instruction channel the model cannot police, so prompt injection is a property of the architecture, and the controls sit outside the model: least privilege for tools, allow-listed retrieval, output validation, approval for consequential actions and logs that connect each action to its input. The OWASP Top 10 for LLM applications (27, OWASP, 2025) and ENISA's layered framework (19, ENISA, 2023) give that model a shared vocabulary.

Chapter 18 reverses the direction. Mandiant's average time to exploit fell from 63 days in 2018 to 2019 to 5 days in 2023 (85, Charrier & Weiner, 2024), and M-Trends 2026 estimated it at minus seven days (86, Mandiant, 2026). Agentic offensive frameworks observed since late August 2026 executed in bursts of seconds (105, Blum et al., 2026). The Five Eyes agencies drew the consequence: reduce attack surface, patch faster, strengthen identity and prepare for incidents (116, Five Eyes agencies, 2026). Every AI system must therefore be designed twice, as something to protect and as something to contain.

Containment must not depend on intent

Chapter 11 made bounded autonomy an architectural property, and Chapter 19 tested it against evidence that ordinary agents sometimes satisfy the measure rather than the intent. METR found reward hacking in recent frontier models, and an instruction not to cheat left it at 80 per cent on one task (97, Von Arx et al., 2025); and the Five Eyes guidance on agentic AI lists specification gaming among the risks of ordinary deployments (121, Five Eyes agencies, 2026). The response is the same whether the pressure comes from an adversary or the task: task-scoped credentials, default-deny egress, tests and policies outside the agent's write access, logs the workload cannot alter, and a stop path on infrastructure the agent cannot reach. Instructions lower the rate of unwanted behaviour; only boundaries set a ceiling on its consequences, so containment is a platform service without which no Mode 5 agent reaches production.

Routing and placement are risk-tiered decisions per workload

Chapters 12 to 15 move placement out of the strategy deck and into the gateway, the seam at which identity, policy, routing, budgets and logging attach once. Chapter 13 defines digital sovereignty as verifiable properties rather than a location. Chapter 14 shows that cloud and self-hosted AI create different kinds of problem: one shifts risk into contracts and forced migrations, with cloud model retirements arriving every one to two years (185, OpenAI, 2026), (188, Microsoft, 2026); the other into capacity, patching and skills. Chapter 15 adds that an agentic work tool sends whatever context it gathers to its model, so routing by information class is fixed per workspace, never per prompt. Placement is therefore recorded per workload and enforced by infrastructure code. Since switching rights under the Data Act move data, not model behaviour (203, European Commission, 2026), every workload supporting a critical function needs an evaluated second source.

The platform and the supply chain are part of the system

Chapters 9, 10 and 12 widen the boundary of an AI system. Integrators become providers of the compound systems they assemble, and retrieval indexes and prompts are configuration that changes production behaviour (Chapter 10); model registries, package mirrors and skill catalogues are themselves targets (Chapter 9); and every connection to a system of record carries delegated authority, so the system of record, not the model, makes the authorisation decision (Chapter 12). The July 2026 incident between OpenAI and Hugging Face, analysed in AI Governance, Chapter 19, began with shared infrastructure: a package mirror, a widely shared credential and a web cache gave agents under evaluation an egress path (104, OpenAI, 2026). Hugging Face identified two weaknesses in its own estate, a connector credential shared across clusters and bound to its highest cluster privilege group, and no admission policy refusing privileged pods (114, Larcher et al., 2026). Neither was an AI defect, so controls on those surfaces must be independent of one another.

Evaluation and observability decide whether a pilot becomes a service

Chapter 20 builds an evaluation pyramid whose thresholds become a pipeline gate and whose report is evidence under Article 15 of the AI Act. Chapter 21 adds that drift erodes accepted metrics after release, and only telemetry that separates the regulatory event record from operational traces shows when a system no longer behaves as evaluated. Chapter 23 draws the consequence: pilots built beside the estate defer exactly these controls, the hidden technical debt Sculley and colleagues described a decade ago (43, Sculley et al., 2015). The platform answer is a golden path that carries evaluation, observability and guardrails by default, and a readiness review mapped to Article 26.

Cost is an architectural constraint

Chapter 22 treats cost and energy as characteristics with the same claim to fitness functions and policy as security. Each driver, from tokens and context to model size and accelerator utilisation, is governed by an architect's decision, and the levers of caching, routing and batching sit in the same gateway that enforces security policy. The Software Carbon Intensity specification (30, Green Software Foundation, 2024) rewards reduction, and measured differences in inference energy between task types (49, Luccioni et al., 2024) make routing to the smallest adequate model an energy decision as well. Cost also constrains security: the break-even of self-hosting depends heavily on model size and utilisation (184, Pan et al., 2025), and a platform that does not budget for its controls will find them traded away in the first difficult quarter.

Shared artefacts and engineered trade-offs

A few artefacts carry most of the conclusions

Several artefacts serve more than one conclusion at once. The gateway is the routing point, the policy decision point, the cost meter and the source of the event log. The permission manifest is a containment control, an inventory entry and part of the human-oversight evidence under Article 14 of the AI Act (1, European Union, 2024). The release manifest is the unit of rollback, the scope of the evaluation report and the anchor of the supply-chain record. Building these few artefacts well therefore delivers most of the conclusions for one investment.

Trade-offs the platform must engineer

Four conflicts between the conclusions become design decisions with a cost. Speed of defence pulls against change control: Chapter 18 asks for known-exploited vulnerabilities in internet-facing systems to be protected within 48 hours, and the NCSC advises preparing for a wave of patches (122, NCSC, 2026), while DORA's change management requirements (3, European Union, 2022) ask for every change to be reviewed. The reconciliation is to approve the emergency path, its canary rings and rollback in advance, so that each patch is a standard change.

Rich telemetry pulls against storage limitation under the GDPR (2, European Union, 2016); on the platform this becomes collector configuration that records hashes in place of content and lets configuration expire records. Containment pulls against value, because every boundary removes something an agent could do and local models in the protected tier of Chapter 15 often fall short on long tasks; the tension is managed by expanding permissions only on evidence. And routing for cost pulls against stable evaluation, so the resolution is a small portfolio of pinned, evaluated models rather than open-ended routing.

The tensions, from the platform side

AI Governance, Chapter 25, treats speed and control, autonomy and accountability, and innovation and sovereignty as governance questions (73, Nordqvist, 2026). The platform adds one refinement to each. Control now has a clock, so pre-approved emergency paths are part of what control means (Chapter 18). Accountability cannot rest on an agent's self-report, so the logs it cannot alter are the evidence and the stop path belongs to people (Chapter 19). Sovereignty depends less on where a model was made than on how fast it can be replaced, which a drilled switch proves (Chapters 13 to 15).

Same conclusions, different platforms

Applied to the two fictional organisations, whose detail is in Chapter 24, the conclusions yield different platforms.

Nordvik Region and Hansa Mutual

Nordvik Region is mostly a deployer, with one public-law jurisdiction and a high-risk system provided by a supplier, so its revision management and supply-chain control are largely contractual: version notices, pinned releases and incident notification must be required from the supplier. With no Mode 5, it can still put containment in place before agency spreads.

Hansa Mutual builds, uses every mode and runs a shared platform for seven jurisdictions. Containment is its most urgent conclusion, because two agents act on production systems, and the shared platform is both its greatest advantage and its largest correlated risk. The Region's lever is the contract; the group's lever is the platform, where seven answers maintained by hand would drift apart within a year.

A capability roadmap

The roadmap is stated as platform capabilities, each with a test, and is anchored to the AI Act's dates as amended by the Digital Omnibus on AI: transparency under Article 50 from 2 August 2026, Annex III high-risk systems from 2 December 2027, and high-risk systems in Annex I products from 2 August 2028 (23, European Union, 2026). The Cyber Resilience Act's reporting obligations for actively exploited vulnerabilities have applied since 11 September 2026 (7, European Union, 2024). Each stage depends on the one before it.

Stage 1, months 0 to 6: one control point and a working stop

Capability. The platform sees every AI system, every model call and tool call passes a policy point it operates, and every acting agent can be stopped by a person from outside it. This takes an inventory generated from gateway telemetry, a mandatory gateway, signed release manifests for high-risk systems (Chapters 8 and 9), Chapter 19's containment baseline on every agent, named stop holders, and a pre-approved emergency patch path (Chapter 18).

Test. No model calls outside the gateway, no shared or standing credentials in AI workloads, and each Mode 5 agent stopped in an exercise within its target time.

Stage 2, months 6 to 18: replaceable and ready for high-risk duties

Capability. Each production system can be re-evaluated, moved to a second source and documented on demand, and high-risk systems meet their obligations before 2 December 2027. This takes generated Annex IV documentation (Chapter 5), a portable evaluation suite and drift telemetry (Chapters 20 and 21), a qualified second source per critical function, drilled twice a year (Chapters 13 and 14), a governed catalogue of skills and connectors (Chapter 8), and showback per use case (Chapter 22).

Test. A forced model migration rehearsed end to end, and no unregistered skill or connector in a quarterly scan.

Stage 3, months 18 to 36: evidence on every release and autonomy by exception

Capability. Assurance is a continuous output of delivery: every release of a high-risk system produces an evidence bundle that internal audit reads directly, and each expansion of an agent's permissions is recorded in its manifest with the evidence behind it.

Test. An auditor can reconstruct any release, and any agent permission, from records alone.

Across the usage modes

The stages apply to the whole estate, but the platform work in each differs by mode.

Usage mode Stage 1: control point and stop Stage 2: replaceable and ready Stage 3: evidence and earned autonomy
Mode 0 Ambient AI Supplier features recorded; default off Enabling AI a notifiable contract change Checked at each renewal
Mode 1 Conversational assistants Egress allows enterprise tiers only Usage measured from proxy logs Routine policy review
Mode 2 Embedded workplace assistants Over-sharing fixed before licences Injection tests through mail and documents Reassessed on material supplier change
Mode 3 Agentic work tools Containment baseline; per-agent credentials Catalogue-only skills; routing enforced Permissions widened on evidence
Mode 4 Built AI applications Gateway only; signed manifests Annex IV, portable evaluation, second source Evidence bundle per release
Mode 5 Autonomous production agents External stop path exercised Manifests validated in the pipeline Autonomy extended on evidence

Worked example: a consolidated first-90-days platform and security plan

Illustrative example. The plan records the start of Stage 1 for the two fictional organisations, abridged to two workstreams each. Identifiers reuse the decision records of earlier chapters; owners, dates and targets are invented and must be adapted to the organisation's risk appetite.

apiVersion: platform.example.org/v1
kind: PlatformSecurityPlan
metadata:
  name: first-90-days
organisations:
  - name: Nordvik Region
    accountable: head-of-digital-platform
    workstreams:
      - id: NR-W2-supplier-revision
        modes: [4]
        refs: [AIDR-0007, AIDR-0018, NR-2026-117]
        outcome: Supplier release notes, pinned versions and evaluation evidence per release
        due_day: 60
      - id: NR-W4-suspension-path
        modes: [4]
        refs: [AIDR-0011]
        outcome: Suspension of benefits triage tested; manual queue restored
        due_day: 90
  - name: Hansa Mutual
    accountable: group-head-of-ai-platform
    workstreams:
      - id: HM-W1-agent-stop-path
        modes: [5]
        refs: [AIDR-0024, AIDR-0027]
        outcome: Stop holders per market; group stop path outside both agents, tested
        due_day: 30
      - id: HM-W4-second-source
        modes: [4]
        refs: [EXIT-004]
        outcome: Switch to Frankfurt fallback drilled within 48 hours
        due_day: 90
success_measures:
  model_calls_through_gateway_pct: 100
  shared_credentials_in_ai_workloads: 0

Ninety days buys Stage 1's foundations, not compliance; Nordvik's workstreams lean on its supplier, Hansa's on its agents.

This section separates what can be observed today, with sources, from what I expect, which is marked as speculation. The full outlook is in AI Governance, Chapter 22.

Compound and agentic systems become the default. Observable: the shift from single models to compound systems combining retrieval, tools and several models is documented (63, Zaharia et al., 2024), and tool-use protocols such as the Model Context Protocol (36, Anthropic, 2024) give the platform a standard seam. Speculation: within five years the system card, not the model card, will be the first document auditors ask for.

Small and specialised models. Observable: small open-weight models are good enough for many bounded tasks, and self-hosting economics improve sharply as model size falls (184, Pan et al., 2025). Speculation: most requests will go to small models on infrastructure the organisation controls, and the evaluation suite will become the platform's most valuable asset.

On-device and edge inference. Observable: small models run on laptops, phones and industrial devices. Speculation: edge targets will become a standard pipeline stage with their own evaluation and monitoring, and the Cyber Resilience Act (7, European Union, 2024) will drive the design of AI embedded in devices sold in Europe.

European AI Factories. Observable: the AI Continent Action Plan (15, European Commission, 2025) makes scaling up AI Factories the first action in its computing-infrastructure domain, the EuroHPC Joint Undertaking is establishing them (21, EuroHPC JU, n.d.), and the proposed Cloud and AI Development Act would add a sovereignty assessment framework (182, European Commission, 2026). Speculation: what matters is whether these facilities offer the identity, observability and evidence services this book describes.

The security trajectory. Observable: the exploitation window has fallen below zero on Mandiant's 2026 estimate (86, Mandiant, 2026), and agentic offensive tooling acts in seconds (105, Blum et al., 2026). Speculation: security architecture will assume machine-speed adversaries and insiders as the normal case; my own extrapolation is in AI Governance, Chapter 24.

Energy as a binding constraint. Observable: the International Energy Agency projected that electricity use by data centres, AI and cryptocurrencies could roughly double between 2022 and 2026 (71, IEA, 2024), and grid congestion has already limited where data centres can be built, as in Greater Dublin (71, IEA, 2024). Speculation: where grid capacity limits accelerators, energy will force the model-size discipline that cost alone has not.

Each of these trends strengthens a conclusion rather than overturning one.

How firm these conclusions are

The regulatory facts and measured exploitation timelines are firm. However, the July 2026 incident is known mostly from the operators' own reports, and much of the evidence on agents overstepping their mandate comes from evaluations run with safeguards lowered (Chapter 19). Nordvik Region and Hansa Mutual are invented and add no evidence. That embedded assistants and agentic work tools spread fastest with least oversight is my observation from practice, not a measurement; if such judgements prove wrong, the timing of the roadmap changes, but not its order.

Where to begin

Begin with the platform's view of each AI use: its mode, and therefore the control point it needs. Put one policy point outside the model on every model call and tool call. Pin and sign everything that shapes behaviour, and let the pipeline generate the evidence. Contain agents with boundaries that do not rely on their intent, and keep a stop path in human hands. Record placement per workload and drill the second source. Evaluate before every release, watch after it, and budget cost and energy like any other constraint.

Architecture as Code asked architects to declare intent and let automation show that the estate matches it (72, Nordqvist, 2025); an AI platform needs that discipline most, because its components change behaviour without changing code.

Summary

The book's argument reduces to eight conclusions: the usage mode decides what the platform must provide; revision management and evidence are the backbone of control; AI is both a target and a source of threat; containment must hold whatever anyone intends; routing and placement are risk-tiered decisions per workload; the supply chain is part of every system; evaluation and observability decide whether a pilot becomes a service; and cost and energy are architectural constraints. A handful of artefacts carry most of them.

The roadmap is consequently a sequence of tested capabilities: a single control point and a working stop; systems that are replaceable and ready for high-risk duties; and evidence from every release, with autonomy extended only on that evidence. The appendices that follow supply the artefacts for Stage 1.

Sources

  1. Nordqvist, G. (2025). Architecture as Code. The Transformed Architecture, Book 1, published at aac.geon.se. (72, Nordqvist, 2025)
  2. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. The Transformed Architecture, Book 2, published at aig.geon.se. (73, Nordqvist, 2026)
  3. European Parliament and Council of the European Union. Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union, 12 July 2024. (1, European Union, 2024)
  4. Kurmi, A. (2026). TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages. StepSecurity, 11 May 2026. (153, Kurmi, 2026)
  5. Open Source Security Foundation. Supply-chain Levels for Software Artifacts (SLSA).. (32, OpenSSF, n.d.)
  6. OWASP Foundation. CycloneDX Machine Learning Bill of Materials (ML-BOM).. (31, OWASP, n.d.)
  7. OWASP Foundation. OWASP Top 10 for LLM Applications 2025. OWASP GenAI Security Project. (27, OWASP, 2025)
  8. European Union Agency for Cybersecurity (ENISA). Multilayer Framework for Good Cybersecurity Practices for AI. June 2023. (19, ENISA, 2023)
  9. Charrier, C. & Weiner, R. (2024). How Low Can You Go? An Analysis of 2023 Time-to-Exploit Trends. Mandiant, Google Cloud Blog, 15 October 2024. (85, Charrier & Weiner, 2024)
  10. Mandiant (2026). M-Trends 2026: Data, Insights, and Strategies From the Frontlines. Google Cloud Blog, 23 March 2026. (86, Mandiant, 2026)
  11. Blum, Mainor, Nambiar et al. (2026). ARTEX and Friends: Enter Agentic Offensive Frameworks. Google Threat Intelligence Group and Mandiant, Google Cloud Blog, 30 October 2026. (105, Blum et al., 2026)
  12. Five Eyes cyber security agencies: ASD's ACSC, Canadian Centre for Cyber Security, NCSC-NZ, NCSC-UK, NSA and CISA (2026). The AI shift in cyber risk: why leaders must act now. Joint statement, 22 June 2026. (116, Five Eyes agencies, 2026)
  13. Von Arx, S., Chan, L. & Barnes, B. (2025). Recent Frontier Models Are Reward Hacking. METR, 5 June 2025. (97, Von Arx et al., 2025)
  14. Five Eyes cyber security agencies: ASD's ACSC, CISA, NSA, Canadian Centre for Cyber Security, NCSC-NZ and NCSC-UK (2026). Careful adoption of agentic AI services. Joint guidance, 1 May 2026. (121, Five Eyes agencies, 2026)
  15. OpenAI (2026). Deprecations. OpenAI API documentation, latest entry 14 October 2026. (185, OpenAI, 2026)
  16. Microsoft (2026). Foundry Models lifecycle and support policy. Microsoft Learn, 24 July 2026. (188, Microsoft, 2026)
  17. European Commission (2026). Frequently Asked Questions – Data Act, version 1.4. 22 January 2026. (203, European Commission, 2026)
  18. OpenAI (2026). OpenAI – Hugging Face Incident Technical Report. 26 August 2026. (104, OpenAI, 2026)
  19. Larcher, H., Carreira, A. et al. (2026). Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident. Hugging Face blog, 27 July 2026. (114, Larcher et al., 2026)
  20. Sculley, D., Holt, G., Golovin, D., Davydov, E., Phillips, T., Ebner, D., Chaudhary, V., Young, M., Crespo, J.-F. & Dennison, D. (2015). Hidden Technical Debt in Machine Learning Systems. Advances in Neural Information Processing Systems 28 (NeurIPS 2015). (43, Sculley et al., 2015)
  21. Green Software Foundation. Software Carbon Intensity (SCI) Specification (ISO/IEC 21031:2024).. (30, Green Software Foundation, 2024)
  22. Luccioni, A. S., Jernite, Y. & Strubell, E. (2024). Power Hungry Processing: Watts Driving the Cost of AI Deployment? Proceedings of the 2024 ACM Conference on Fairness, Accountability, and Transparency (FAccT '24). (49, Luccioni et al., 2024)
  23. Pan, G., Chodnekar, V., Roy, A. & Wang, H. (2025). A Cost-Benefit Analysis of On-Premise Large Language Model Deployment: Breaking Even with Commercial LLM Services. arXiv:2509.18101v3 (preprint), 11 November 2025. (184, Pan et al., 2025)
  24. National Cyber Security Centre (2026). Preparing for a 'vulnerability patch wave'. NCSC blog, 1 May 2026. (122, NCSC, 2026)
  25. European Parliament and Council of the European Union. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). Official Journal of the European Union, 27 December 2022. (3, European Union, 2022)
  26. European Parliament and Council of the European Union. Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation). Official Journal of the European Union, 4 May 2016. (2, European Union, 2016)
  27. European Parliament and Council of the European Union. Regulation (EU) 2026/1744 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI). Official Journal of the European Union, 24 July 2026. (23, European Union, 2026)
  28. European Parliament and Council of the European Union. Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act). Official Journal of the European Union, 20 November 2024. (7, European Union, 2024)
  29. Zaharia, M., Khattab, O., Chen, L., Davis, J. Q., Miller, H., Potts, C., Zou, J., Carbin, M., Frankle, J., Rao, N. & Ghodsi, A. (2024). The Shift from Models to Compound AI Systems. Berkeley Artificial Intelligence Research blog, 18 February 2024. (63, Zaharia et al., 2024)
  30. Anthropic. Model Context Protocol Specification. November 2024, revised 2025. (36, Anthropic, 2024)
  31. European Commission. AI Continent Action Plan. COM(2025) 165 final, 9 April 2025. (15, European Commission, 2025)
  32. EuroHPC Joint Undertaking. AI Factories.. (21, EuroHPC JU, n.d.)
  33. European Commission (2026). Proposal for the Cloud and AI Development Act (CADA). COM(2026) 502, 3 June 2026. (182, European Commission, 2026)
  34. International Energy Agency. Electricity 2024: Analysis and forecast to 2026. IEA, January 2024. (71, IEA, 2024)