References and Sources

This section lists the sources cited throughout the book. The numbered source index, ordered by source number, is the canonical bibliography: every inline citation of the form (N, author or organisation, year) links to the entry with that number. The index is grouped by category so that readers can locate European legislation, standards, research, and practitioner literature quickly. All URLs were last checked on 2026-10-31.

Numbered source index

European legislation and policy

Source [1]: European Parliament and Council of the European Union. Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union, 12 July 2024. Available at: https://eur-lex.europa.eu/eli/reg/2024/1689/oj (accessed 2026-10-31). Referenced in: Chapter 1: Introduction to AI Platform and Security, Chapter 2: Usage Modes and the Platform: What Each Mode Demands, Chapter 3: Regulatory Requirements as Engineering Constraints, Chapter 4: A Reference Architecture for AI in Large Organisations, Chapter 5: AI Decision Records, Model Cards and the Architecture Repository, Chapter 6: Data Architecture for AI, Chapter 7: Model Lifecycle Management: MLOps and LLMOps as Code, Chapter 8: Setting Up an Effective DevSecMLOps Loop, Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop, Chapter 10: Foundation Models, Retrieval and Grounding, Chapter 11: Agentic Architectures and Orchestration, Chapter 12: Integrating AI into the Enterprise Landscape, Chapter 13: Infrastructure, Compute and European Digital Sovereignty, Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges, Chapter 16: Security for AI Systems, Chapter 17: AI Security Engineering in Practice, Chapter 18: When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window, Chapter 19: When Your Own Agents Exceed Their Mandate: Containment That Does Not Depend on Intent, Chapter 20: Evaluation and Testing of AI Systems, Chapter 21: Observability, Monitoring and Drift in Production, Chapter 22: Cost, Capacity and Sustainability of AI, Chapter 23: From Pilot to Production: Scaling AI Across the Organisation, Chapter 24: Nordvik Region and Hansa Mutual: Platform and Security Conclusions, Chapter 25: Conclusions: Building and Securing AI Platforms, Glossary.
Source [2]: European Parliament and Council of the European Union. Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation). Official Journal of the European Union, 4 May 2016. Available at: https://eur-lex.europa.eu/eli/reg/2016/679/oj (accessed 2026-10-31). Referenced in: Chapter 1: Introduction to AI Platform and Security, Chapter 3: Regulatory Requirements as Engineering Constraints, Chapter 4: A Reference Architecture for AI in Large Organisations, Chapter 5: AI Decision Records, Model Cards and the Architecture Repository, Chapter 6: Data Architecture for AI, Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop, Chapter 11: Agentic Architectures and Orchestration, Chapter 12: Integrating AI into the Enterprise Landscape, Chapter 13: Infrastructure, Compute and European Digital Sovereignty, Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges, Chapter 15: Hybrid Agentic Work: Self-Hosted and Cloud Models for Sensitive Information, Chapter 16: Security for AI Systems, Chapter 21: Observability, Monitoring and Drift in Production, Chapter 23: From Pilot to Production: Scaling AI Across the Organisation, Chapter 24: Nordvik Region and Hansa Mutual: Platform and Security Conclusions, Chapter 25: Conclusions: Building and Securing AI Platforms.
Source [3]: European Parliament and Council of the European Union. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). Official Journal of the European Union, 27 December 2022. Available at: https://eur-lex.europa.eu/eli/reg/2022/2554/oj (accessed 2026-10-31). Referenced in: Chapter 1: Introduction to AI Platform and Security, Chapter 3: Regulatory Requirements as Engineering Constraints, Chapter 4: A Reference Architecture for AI in Large Organisations, Chapter 7: Model Lifecycle Management: MLOps and LLMOps as Code, Chapter 8: Setting Up an Effective DevSecMLOps Loop, Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop, Chapter 11: Agentic Architectures and Orchestration, Chapter 13: Infrastructure, Compute and European Digital Sovereignty, Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges, Chapter 16: Security for AI Systems, Chapter 17: AI Security Engineering in Practice, Chapter 18: When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window, Chapter 19: When Your Own Agents Exceed Their Mandate: Containment That Does Not Depend on Intent, Chapter 21: Observability, Monitoring and Drift in Production, Chapter 24: Nordvik Region and Hansa Mutual: Platform and Security Conclusions, Chapter 25: Conclusions: Building and Securing AI Platforms.
Source [4]: European Parliament and Council of the European Union. Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive). Official Journal of the European Union, 27 December 2022. Available at: https://eur-lex.europa.eu/eli/dir/2022/2555/oj (accessed 2026-10-31). Referenced in: Chapter 1: Introduction to AI Platform and Security, Chapter 3: Regulatory Requirements as Engineering Constraints, Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop, Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges, Chapter 16: Security for AI Systems, Chapter 17: AI Security Engineering in Practice, Chapter 18: When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window, Chapter 21: Observability, Monitoring and Drift in Production, Chapter 24: Nordvik Region and Hansa Mutual: Platform and Security Conclusions.
Source [5]: European Parliament and Council of the European Union. Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data (Data Act). Official Journal of the European Union, 22 December 2023. Available at: https://eur-lex.europa.eu/eli/reg/2023/2854/oj (accessed 2026-10-31). Referenced in: Chapter 6: Data Architecture for AI, Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges.
Source [6]: European Parliament and Council of the European Union. Regulation (EU) 2022/868 on European data governance (Data Governance Act). Official Journal of the European Union, 3 June 2022. Available at: https://eur-lex.europa.eu/eli/reg/2022/868/oj (accessed 2026-10-31). Referenced in: Chapter 6: Data Architecture for AI.
Source [7]: European Parliament and Council of the European Union. Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act). Official Journal of the European Union, 20 November 2024. Available at: https://eur-lex.europa.eu/eli/reg/2024/2847/oj (accessed 2026-10-31). Referenced in: Chapter 1: Introduction to AI Platform and Security, Chapter 3: Regulatory Requirements as Engineering Constraints, Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop, Chapter 16: Security for AI Systems, Chapter 17: AI Security Engineering in Practice, Chapter 18: When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window, Chapter 25: Conclusions: Building and Securing AI Platforms.
Source [8]: European Parliament and Council of the European Union. Regulation (EU) 2024/903 laying down measures for a high level of public sector interoperability across the Union (Interoperable Europe Act). Official Journal of the European Union, 22 March 2024. Available at: https://eur-lex.europa.eu/eli/reg/2024/903/oj (accessed 2026-10-31). Referenced in: Chapter 12: Integrating AI into the Enterprise Landscape.
Source [9]: European Parliament and Council of the European Union. Directive 2014/24/EU on public procurement. Official Journal of the European Union, 28 March 2014. Available at: https://eur-lex.europa.eu/eli/dir/2014/24/oj (accessed 2026-10-31). Referenced in: Chapter 7: Model Lifecycle Management: MLOps and LLMOps as Code, Chapter 13: Infrastructure, Compute and European Digital Sovereignty, Chapter 23: From Pilot to Production: Scaling AI Across the Organisation, Chapter 24: Nordvik Region and Hansa Mutual: Platform and Security Conclusions.
Source [10]: European Parliament and Council of the European Union. Regulation (EU) 2024/1183 amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framework. Official Journal of the European Union, 30 April 2024. Available at: https://eur-lex.europa.eu/eli/reg/2024/1183/oj (accessed 2026-10-31). Referenced in: Chapter 12: Integrating AI into the Enterprise Landscape.
Source [11]: European Parliament and Council of the European Union. Regulation (EU) 2025/327 on the European Health Data Space. Official Journal of the European Union, 5 March 2025. Available at: https://eur-lex.europa.eu/eli/reg/2025/327/oj (accessed 2026-10-31). Referenced in: Chapter 6: Data Architecture for AI.
Source [12]: European Commission. A European strategy for data. COM(2020) 66 final, 19 February 2020. Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52020DC0066 (accessed 2026-10-31). Referenced in: Chapter 6: Data Architecture for AI.
Source [13]: European Commission. Common European Data Spaces. Shaping Europe's digital future policy pages. Available at: https://digital-strategy.ec.europa.eu/en/policies/data-spaces (accessed 2026-10-31). Referenced in: Chapter 6: Data Architecture for AI.
Source [14]: European Commission. The General-Purpose AI Code of Practice. European AI Office, 10 July 2025. Available at: https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai (accessed 2026-10-31). Referenced in: Chapter 3: Regulatory Requirements as Engineering Constraints, Chapter 10: Foundation Models, Retrieval and Grounding, Chapter 18: When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window, Chapter 19: When Your Own Agents Exceed Their Mandate: Containment That Does Not Depend on Intent.
Source [15]: European Commission. AI Continent Action Plan. COM(2025) 165 final, 9 April 2025. Available at: https://digital-strategy.ec.europa.eu/en/library/ai-continent-action-plan (accessed 2026-10-31). Referenced in: Chapter 1: Introduction to AI Platform and Security, Chapter 13: Infrastructure, Compute and European Digital Sovereignty, Chapter 25: Conclusions: Building and Securing AI Platforms.
Source [16]: European Commission. New European Interoperability Framework: Promoting seamless services and data flows for European public administrations. Publications Office of the European Union, 2017. Available at: https://ec.europa.eu/isa2/eif_en/ (accessed 2026-10-31). Referenced in: Chapter 12: Integrating AI into the Enterprise Landscape.
Source [17]: European Data Protection Board. Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models. Adopted 17 December 2024. Available at: https://www.edpb.europa.eu/our-work-tools/our-documents/opinion-board-art-64/opinion-282024-certain-data-protection-aspects_en (accessed 2026-10-31). Referenced in: Chapter 6: Data Architecture for AI.
Source [18]: Court of Justice of the European Union. Judgment in Case C-311/18, Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems ("Schrems II"). 16 July 2020. Available at: https://curia.europa.eu/juris/liste.jsf?num=C-311/18 (accessed 2026-10-31). Referenced in: Chapter 13: Infrastructure, Compute and European Digital Sovereignty.
Source [19]: European Union Agency for Cybersecurity (ENISA). Multilayer Framework for Good Cybersecurity Practices for AI. June 2023. Available at: https://www.enisa.europa.eu/publications/multilayer-framework-for-good-cybersecurity-practices-for-ai (accessed 2026-10-31). Referenced in: Chapter 16: Security for AI Systems, Chapter 17: AI Security Engineering in Practice, Chapter 25: Conclusions: Building and Securing AI Platforms.
Source [20]: CEN-CENELEC. Joint Technical Committee 21 – Artificial Intelligence. Available at: https://www.cencenelec.eu/areas-of-work/cen-cenelec-topics/artificial-intelligence/ (accessed 2026-10-31). Referenced in: Chapter 3: Regulatory Requirements as Engineering Constraints.
Source [21]: EuroHPC Joint Undertaking. AI Factories. Available at: https://eurohpc-ju.europa.eu/ai-factories_en (accessed 2026-10-31). Referenced in: Chapter 13: Infrastructure, Compute and European Digital Sovereignty, Chapter 25: Conclusions: Building and Securing AI Platforms.
Source [22]: Gaia-X European Association for Data and Cloud AISBL. Gaia-X: A Federated Secure Data Infrastructure. Available at: https://gaia-x.eu/ (accessed 2026-10-31). Referenced in: Chapter 4: A Reference Architecture for AI in Large Organisations, Chapter 13: Infrastructure, Compute and European Digital Sovereignty.
Source [23]: European Parliament and Council of the European Union. Regulation (EU) 2026/1744 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI). Official Journal of the European Union, 24 July 2026. Available at: https://eur-lex.europa.eu/eli/reg/2026/1744/oj (accessed 2026-10-31). Referenced in: Chapter 1: Introduction to AI Platform and Security, Chapter 3: Regulatory Requirements as Engineering Constraints, Chapter 24: Nordvik Region and Hansa Mutual: Platform and Security Conclusions, Chapter 25: Conclusions: Building and Securing AI Platforms, Glossary.

Standards and frameworks

Source [24]: International Organization for Standardization and International Electrotechnical Commission. ISO/IEC 42001:2023 Information technology — Artificial intelligence — Management system. Geneva: ISO, December 2023. Available at: https://www.iso.org/standard/42001 (accessed 2026-10-31). Referenced in: Chapter 3: Regulatory Requirements as Engineering Constraints, Chapter 8: Setting Up an Effective DevSecMLOps Loop, Chapter 17: AI Security Engineering in Practice.
Source [25]: International Organization for Standardization and International Electrotechnical Commission. ISO/IEC 22989:2022 Information technology — Artificial intelligence — Artificial intelligence concepts and terminology. Geneva: ISO, July 2022. Available at: https://www.iso.org/standard/74296.html (accessed 2026-10-31). Referenced in: Chapter 1: Introduction to AI Platform and Security.
Source [26]: National Institute of Standards and Technology. Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. NIST AI 600-1, July 2024. Available at: https://doi.org/10.6028/NIST.AI.600-1 (accessed 2026-10-31). Referenced in: Chapter 20: Evaluation and Testing of AI Systems.
Source [27]: OWASP Foundation. OWASP Top 10 for LLM Applications 2025. OWASP GenAI Security Project. Available at: https://genai.owasp.org/llm-top-10/ (accessed 2026-10-31). Referenced in: Chapter 1: Introduction to AI Platform and Security, Chapter 2: Usage Modes and the Platform: What Each Mode Demands, Chapter 3: Regulatory Requirements as Engineering Constraints, Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop, Chapter 15: Hybrid Agentic Work: Self-Hosted and Cloud Models for Sensitive Information, Chapter 16: Security for AI Systems, Chapter 17: AI Security Engineering in Practice, Chapter 25: Conclusions: Building and Securing AI Platforms.
Source [28]: MITRE Corporation. MITRE ATLAS: Adversarial Threat Landscape for AI Systems. Available at: https://atlas.mitre.org/ (accessed 2026-10-31). Referenced in: Chapter 3: Regulatory Requirements as Engineering Constraints, Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop, Chapter 16: Security for AI Systems, Chapter 17: AI Security Engineering in Practice.
Source [29]: Open Source Initiative. The Open Source AI Definition, version 1.0. 28 October 2024. Available at: https://opensource.org/ai/open-source-ai-definition (accessed 2026-10-31). Referenced in: Chapter 13: Infrastructure, Compute and European Digital Sovereignty, Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges.
Source [30]: Green Software Foundation. Software Carbon Intensity (SCI) Specification (ISO/IEC 21031:2024). Available at: https://sci.greensoftware.foundation/ (accessed 2026-10-31). Referenced in: Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges, Chapter 22: Cost, Capacity and Sustainability of AI, Chapter 25: Conclusions: Building and Securing AI Platforms.
Source [31]: OWASP Foundation. CycloneDX Machine Learning Bill of Materials (ML-BOM). Available at: https://cyclonedx.org/capabilities/mlbom/ (accessed 2026-10-31). Referenced in: Chapter 1: Introduction to AI Platform and Security, Chapter 3: Regulatory Requirements as Engineering Constraints, Chapter 8: Setting Up an Effective DevSecMLOps Loop, Chapter 16: Security for AI Systems, Chapter 17: AI Security Engineering in Practice, Chapter 25: Conclusions: Building and Securing AI Platforms.
Source [32]: Open Source Security Foundation. Supply-chain Levels for Software Artifacts (SLSA). Available at: https://slsa.dev/ (accessed 2026-10-31). Referenced in: Chapter 8: Setting Up an Effective DevSecMLOps Loop, Chapter 16: Security for AI Systems, Chapter 17: AI Security Engineering in Practice, Chapter 25: Conclusions: Building and Securing AI Platforms.
Source [33]: Sigstore Project. Sigstore: Signing, verification and provenance for software artefacts. Available at: https://www.sigstore.dev/ (accessed 2026-10-31). Referenced in: Chapter 16: Security for AI Systems, Chapter 17: AI Security Engineering in Practice.
Source [34]: OpenTelemetry Authors. OpenTelemetry Documentation, including the Semantic Conventions for Generative AI systems. Cloud Native Computing Foundation. Available at: https://opentelemetry.io/docs/ (accessed 2026-10-31). Referenced in: Chapter 3: Regulatory Requirements as Engineering Constraints, Chapter 4: A Reference Architecture for AI in Large Organisations, Chapter 11: Agentic Architectures and Orchestration, Chapter 12: Integrating AI into the Enterprise Landscape, Chapter 21: Observability, Monitoring and Drift in Production.
Source [35]: Open Policy Agent Contributors. Open Policy Agent Documentation. Cloud Native Computing Foundation. Available at: https://www.openpolicyagent.org/docs/ (accessed 2026-10-31). Referenced in: Chapter 4: A Reference Architecture for AI in Large Organisations, Chapter 8: Setting Up an Effective DevSecMLOps Loop, Chapter 11: Agentic Architectures and Orchestration, Chapter 17: AI Security Engineering in Practice.
Source [36]: Anthropic. Model Context Protocol Specification. November 2024, revised 2025. Available at: https://modelcontextprotocol.io/ (accessed 2026-10-31). Referenced in: Chapter 4: A Reference Architecture for AI in Large Organisations, Chapter 11: Agentic Architectures and Orchestration, Chapter 25: Conclusions: Building and Securing AI Platforms.
Source [37]: MLflow Project. MLflow Documentation. LF Projects, LLC. Available at: https://mlflow.org/docs/latest/ (accessed 2026-10-31). Referenced in: Chapter 7: Model Lifecycle Management: MLOps and LLMOps as Code, Chapter 8: Setting Up an Effective DevSecMLOps Loop.
Source [38]: Kubeflow Authors. Kubeflow Documentation. Cloud Native Computing Foundation. Available at: https://www.kubeflow.org/docs/ (accessed 2026-10-31). Referenced in: Chapter 7: Model Lifecycle Management: MLOps and LLMOps as Code.
Source [39]: Brown, S. The C4 model for visualising software architecture. Available at: https://c4model.com/ (accessed 2026-10-31). Referenced in: Chapter 4: A Reference Architecture for AI in Large Organisations.
Source [40]: Nygard, M. Documenting Architecture Decisions. Cognitect blog, 15 November 2011. Available at: https://cognitect.com/blog/2011/11/15/documenting-architecture-decisions (accessed 2026-10-31). Referenced in: Chapter 5: AI Decision Records, Model Cards and the Architecture Repository.

Research literature

Source [41]: Mitchell, M., Wu, S., Zaldivar, A., Barnes, P., Vasserman, L., Hutchinson, B., Spitzer, E., Raji, I. D. & Gebru, T. (2019). Model Cards for Model Reporting. Proceedings of the Conference on Fairness, Accountability, and Transparency (FAT* '19), pp. 220–229. Available at: https://doi.org/10.1145/3287560.3287596 (accessed 2026-10-31). Referenced in: Chapter 3: Regulatory Requirements as Engineering Constraints, Chapter 5: AI Decision Records, Model Cards and the Architecture Repository.
Source [42]: Gebru, T., Morgenstern, J., Vecchione, B., Vaughan, J. W., Wallach, H., Daumé III, H. & Crawford, K. (2021). Datasheets for Datasets. Communications of the ACM, 64(12), pp. 86–92. Available at: https://doi.org/10.1145/3458723 (accessed 2026-10-31). Referenced in: Chapter 3: Regulatory Requirements as Engineering Constraints, Chapter 5: AI Decision Records, Model Cards and the Architecture Repository, Chapter 6: Data Architecture for AI, Chapter 20: Evaluation and Testing of AI Systems.
Source [43]: Sculley, D., Holt, G., Golovin, D., Davydov, E., Phillips, T., Ebner, D., Chaudhary, V., Young, M., Crespo, J.-F. & Dennison, D. (2015). Hidden Technical Debt in Machine Learning Systems. Advances in Neural Information Processing Systems 28 (NeurIPS 2015). Available at: https://papers.nips.cc/paper/2015/hash/86df7dcfd896fcaf2674f757a2463eba-Abstract.html (accessed 2026-10-31). Referenced in: Chapter 1: Introduction to AI Platform and Security, Chapter 6: Data Architecture for AI, Chapter 7: Model Lifecycle Management: MLOps and LLMOps as Code, Chapter 11: Agentic Architectures and Orchestration, Chapter 21: Observability, Monitoring and Drift in Production, Chapter 23: From Pilot to Production: Scaling AI Across the Organisation, Chapter 25: Conclusions: Building and Securing AI Platforms.
Source [44]: Lewis, P., Perez, E., Piktus, A., Petroni, F., Karpukhin, V., Goyal, N., Küttler, H., Lewis, M., Yih, W., Rocktäschel, T., Riedel, S. & Kiela, D. (2020). Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks. Advances in Neural Information Processing Systems 33 (NeurIPS 2020). Available at: https://arxiv.org/abs/2005.11401 (accessed 2026-10-31). Referenced in: Chapter 10: Foundation Models, Retrieval and Grounding.
Source [45]: Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A. N., Kaiser, Ł. & Polosukhin, I. (2017). Attention Is All You Need. Advances in Neural Information Processing Systems 30 (NeurIPS 2017). Available at: https://arxiv.org/abs/1706.03762 (accessed 2026-10-31). Referenced in: Chapter 10: Foundation Models, Retrieval and Grounding.
Source [46]: Bommasani, R. et al. (2021). On the Opportunities and Risks of Foundation Models. Stanford Center for Research on Foundation Models. Available at: https://arxiv.org/abs/2108.07258 (accessed 2026-10-31). Referenced in: Chapter 1: Introduction to AI Platform and Security, Chapter 10: Foundation Models, Retrieval and Grounding.
Source [47]: Strubell, E., Ganesh, A. & McCallum, A. (2019). Energy and Policy Considerations for Deep Learning in NLP. Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pp. 3645–3650. Available at: https://arxiv.org/abs/1906.02243 (accessed 2026-10-31). Referenced in: Chapter 13: Infrastructure, Compute and European Digital Sovereignty, Chapter 22: Cost, Capacity and Sustainability of AI.
Source [48]: Patterson, D., Gonzalez, J., Le, Q., Liang, C., Munguia, L.-M., Rothchild, D., So, D., Texier, M. & Dean, J. (2021). Carbon Emissions and Large Neural Network Training. Available at: https://arxiv.org/abs/2104.10350 (accessed 2026-10-31). Referenced in: Chapter 22: Cost, Capacity and Sustainability of AI.
Source [49]: Luccioni, A. S., Jernite, Y. & Strubell, E. (2024). Power Hungry Processing: Watts Driving the Cost of AI Deployment? Proceedings of the 2024 ACM Conference on Fairness, Accountability, and Transparency (FAccT '24). Available at: https://arxiv.org/abs/2311.16863 (accessed 2026-10-31). Referenced in: Chapter 22: Cost, Capacity and Sustainability of AI, Chapter 25: Conclusions: Building and Securing AI Platforms.
Source [50]: Perez, F. & Ribeiro, I. (2022). Ignore Previous Prompt: Attack Techniques For Language Models. NeurIPS 2022 ML Safety Workshop. Available at: https://arxiv.org/abs/2211.09527 (accessed 2026-10-31). Referenced in: Chapter 16: Security for AI Systems, Chapter 17: AI Security Engineering in Practice.
Source [51]: Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T. & Fritz, M. (2023). Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection. Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AISec '23). Available at: https://arxiv.org/abs/2302.12173 (accessed 2026-10-31). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop, Chapter 11: Agentic Architectures and Orchestration, Chapter 16: Security for AI Systems, Chapter 17: AI Security Engineering in Practice.
Source [52]: Carlini, N., Tramèr, F., Wallace, E., Jagielski, M., Herbert-Voss, A., Lee, K., Roberts, A., Brown, T., Song, D., Erlingsson, Ú., Oprea, A. & Raffel, C. (2021). Extracting Training Data from Large Language Models. Proceedings of the 30th USENIX Security Symposium. Available at: https://arxiv.org/abs/2012.07805 (accessed 2026-10-31). Referenced in: Chapter 16: Security for AI Systems, Chapter 17: AI Security Engineering in Practice.
Source [53]: Shumailov, I., Shumaylov, Z., Zhao, Y., Papernot, N., Anderson, R. & Gal, Y. (2024). AI models collapse when trained on recursively generated data. Nature, 631, pp. 755–759. Available at: https://doi.org/10.1038/s41586-024-07566-y (accessed 2026-10-31). Referenced in: Chapter 6: Data Architecture for AI.
Source [54]: Ji, Z., Lee, N., Frieske, R., Yu, T., Su, D., Xu, Y., Ishii, E., Bang, Y., Madotto, A. & Fung, P. (2023). Survey of Hallucination in Natural Language Generation. ACM Computing Surveys, 55(12), Article 248. Available at: https://doi.org/10.1145/3571730 (accessed 2026-10-31). Referenced in: Chapter 10: Foundation Models, Retrieval and Grounding.
Source [55]: Liang, P. et al. (2022). Holistic Evaluation of Language Models. Stanford Center for Research on Foundation Models. Available at: https://arxiv.org/abs/2211.09110 (accessed 2026-10-31). Referenced in: Chapter 20: Evaluation and Testing of AI Systems.
Source [56]: Zheng, L., Chiang, W.-L., Sheng, Y., Zhuang, S., Wu, Z., Zhuang, Y., Lin, Z., Li, Z., Li, D., Xing, E. P., Zhang, H., Gonzalez, J. E. & Stoica, I. (2023). Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena. Advances in Neural Information Processing Systems 36 (NeurIPS 2023). Available at: https://arxiv.org/abs/2306.05685 (accessed 2026-10-31). Referenced in: Chapter 20: Evaluation and Testing of AI Systems.
Source [57]: Yao, S., Zhao, J., Yu, D., Du, N., Shafran, I., Narasimhan, K. & Cao, Y. (2023). ReAct: Synergizing Reasoning and Acting in Language Models. International Conference on Learning Representations (ICLR 2023). Available at: https://arxiv.org/abs/2210.03629 (accessed 2026-10-31). Referenced in: Chapter 11: Agentic Architectures and Orchestration.
Source [58]: Schick, T., Dwivedi-Yu, J., Dessì, R., Raileanu, R., Lomeli, M., Hambro, E., Zettlemoyer, L., Cancedda, N. & Scialom, T. (2023). Toolformer: Language Models Can Teach Themselves to Use Tools. Advances in Neural Information Processing Systems 36 (NeurIPS 2023). Available at: https://arxiv.org/abs/2302.04761 (accessed 2026-10-31). Referenced in: Chapter 11: Agentic Architectures and Orchestration.
Source [59]: Wu, Q., Bansal, G., Zhang, J., Wu, Y., Li, B., Zhu, E., Jiang, L., Zhang, X., Zhang, S., Liu, J., Awadallah, A. H., White, R. W., Burger, D. & Wang, C. (2023). AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversation. Available at: https://arxiv.org/abs/2308.08155 (accessed 2026-10-31). Referenced in: Chapter 11: Agentic Architectures and Orchestration.
Source [60]: Wei, J., Wang, X., Schuurmans, D., Bosma, M., Ichter, B., Xia, F., Chi, E., Le, Q. & Zhou, D. (2022). Chain-of-Thought Prompting Elicits Reasoning in Large Language Models. Advances in Neural Information Processing Systems 35 (NeurIPS 2022). Available at: https://arxiv.org/abs/2201.11903 (accessed 2026-10-31). Referenced in: Chapter 10: Foundation Models, Retrieval and Grounding.
Source [61]: Hu, E. J., Shen, Y., Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S., Wang, L. & Chen, W. (2022). LoRA: Low-Rank Adaptation of Large Language Models. International Conference on Learning Representations (ICLR 2022). Available at: https://arxiv.org/abs/2106.09685 (accessed 2026-10-31). Referenced in: Chapter 7: Model Lifecycle Management: MLOps and LLMOps as Code.
Source [62]: Gao, Y., Xiong, Y., Gao, X., Jia, K., Pan, J., Bi, Y., Dai, Y., Sun, J., Wang, M. & Wang, H. (2023). Retrieval-Augmented Generation for Large Language Models: A Survey. Available at: https://arxiv.org/abs/2312.10997 (accessed 2026-10-31). Referenced in: Chapter 10: Foundation Models, Retrieval and Grounding.
Source [63]: Zaharia, M., Khattab, O., Chen, L., Davis, J. Q., Miller, H., Potts, C., Zou, J., Carbin, M., Frankle, J., Rao, N. & Ghodsi, A. (2024). The Shift from Models to Compound AI Systems. Berkeley Artificial Intelligence Research blog, 18 February 2024. Available at: https://bair.berkeley.edu/blog/2024/02/18/compound-ai-systems/ (accessed 2026-10-31). Referenced in: Chapter 1: Introduction to AI Platform and Security, Chapter 4: A Reference Architecture for AI in Large Organisations, Chapter 5: AI Decision Records, Model Cards and the Architecture Repository, Chapter 11: Agentic Architectures and Orchestration, Chapter 12: Integrating AI into the Enterprise Landscape, Chapter 25: Conclusions: Building and Securing AI Platforms.
Source [64]: Anthropic. Building effective agents. Anthropic research blog, 19 December 2024. Available at: https://www.anthropic.com/research/building-effective-agents (accessed 2026-10-31). Referenced in: Chapter 11: Agentic Architectures and Orchestration.
Source [65]: Amershi, S., Begel, A., Bird, C., DeLine, R., Gall, H., Kamar, E., Nagappan, N., Nushi, B. & Zimmermann, T. (2019). Software Engineering for Machine Learning: A Case Study. Proceedings of the 41st International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP '19), pp. 291–300. Available at: https://doi.org/10.1109/ICSE-SEIP.2019.00042 (accessed 2026-10-31). Referenced in: Chapter 7: Model Lifecycle Management: MLOps and LLMOps as Code, Chapter 23: From Pilot to Production: Scaling AI Across the Organisation.
Source [66]: Breck, E., Cai, S., Nielsen, E., Salib, M. & Sculley, D. (2017). The ML Test Score: A Rubric for ML Production Readiness and Technical Debt Reduction. Proceedings of the 2017 IEEE International Conference on Big Data, pp. 1123–1132. Available at: https://doi.org/10.1109/BigData.2017.8258038 (accessed 2026-10-31). Referenced in: Chapter 7: Model Lifecycle Management: MLOps and LLMOps as Code, Chapter 8: Setting Up an Effective DevSecMLOps Loop, Chapter 20: Evaluation and Testing of AI Systems, Chapter 23: From Pilot to Production: Scaling AI Across the Organisation.
Source [67]: Paleyes, A., Urma, R.-G. & Lawrence, N. D. (2022). Challenges in Deploying Machine Learning: A Survey of Case Studies. ACM Computing Surveys, 55(6), Article 114. Available at: https://doi.org/10.1145/3533378 (accessed 2026-10-31). Referenced in: Chapter 23: From Pilot to Production: Scaling AI Across the Organisation.
Source [68]: Kreuzberger, D., Kühl, N. & Hirschl, S. (2023). Machine Learning Operations (MLOps): Overview, Definition, and Architecture. IEEE Access, 11, pp. 31866–31879. Available at: https://doi.org/10.1109/ACCESS.2023.3262138 (accessed 2026-10-31). Referenced in: Chapter 4: A Reference Architecture for AI in Large Organisations, Chapter 7: Model Lifecycle Management: MLOps and LLMOps as Code.
Source [69]: Gama, J., Žliobaitė, I., Bifet, A., Pechenizkiy, M. & Bouchachia, A. (2014). A survey on concept drift adaptation. ACM Computing Surveys, 46(4), Article 44. Available at: https://doi.org/10.1145/2523813 (accessed 2026-10-31). Referenced in: Chapter 21: Observability, Monitoring and Drift in Production.
Source [70]: Hutchinson, B., Smart, A., Hanna, A., Denton, E., Greer, C., Kjartansson, O., Barnes, P. & Mitchell, M. (2021). Towards Accountability for Machine Learning Datasets: Practices from Software Engineering and Infrastructure. Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency (FAccT '21), pp. 560–575. Available at: https://doi.org/10.1145/3442188.3445918 (accessed 2026-10-31). Referenced in: Chapter 5: AI Decision Records, Model Cards and the Architecture Repository, Chapter 6: Data Architecture for AI.
Source [71]: International Energy Agency. Electricity 2024: Analysis and forecast to 2026. IEA, January 2024. Available at: https://www.iea.org/reports/electricity-2024 (accessed 2026-10-31). Referenced in: Chapter 22: Cost, Capacity and Sustainability of AI, Chapter 25: Conclusions: Building and Securing AI Platforms.

Books and practitioner literature

Source [72]: Nordqvist, G. (2025). Architecture as Code. The Transformed Architecture, Book 1, published at aac.geon.se. Available at: https://aac.geon.se/ (accessed 2026-10-31). Referenced in: Chapter 1: Introduction to AI Platform and Security, Chapter 3: Regulatory Requirements as Engineering Constraints, Chapter 4: A Reference Architecture for AI in Large Organisations, Chapter 5: AI Decision Records, Model Cards and the Architecture Repository, Chapter 6: Data Architecture for AI, Chapter 7: Model Lifecycle Management: MLOps and LLMOps as Code, Chapter 8: Setting Up an Effective DevSecMLOps Loop, Chapter 10: Foundation Models, Retrieval and Grounding, Chapter 11: Agentic Architectures and Orchestration, Chapter 12: Integrating AI into the Enterprise Landscape, Chapter 13: Infrastructure, Compute and European Digital Sovereignty, Chapter 16: Security for AI Systems, Chapter 17: AI Security Engineering in Practice, Chapter 18: When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window, Chapter 19: When Your Own Agents Exceed Their Mandate: Containment That Does Not Depend on Intent, Chapter 20: Evaluation and Testing of AI Systems, Chapter 21: Observability, Monitoring and Drift in Production, Chapter 22: Cost, Capacity and Sustainability of AI, Chapter 23: From Pilot to Production: Scaling AI Across the Organisation, Chapter 25: Conclusions: Building and Securing AI Platforms, About the Author.
Source [73]: Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. The Transformed Architecture, Book 2, published at aig.geon.se. Available at: https://aig.geon.se/ (accessed 2026-11-01). Conceived and directed by Nordqvist; text written by AI agents. Referenced in: Chapter 1: Introduction to AI Platform and Security, Chapter 2: Usage Modes and the Platform: What Each Mode Demands, Chapter 3: Regulatory Requirements as Engineering Constraints, Chapter 5: AI Decision Records, Model Cards and the Architecture Repository, Chapter 24: Nordvik Region and Hansa Mutual: Platform and Security Conclusions, Chapter 25: Conclusions: Building and Securing AI Platforms, About the Author.
Source [74]: Huyen, C. (2022). Designing Machine Learning Systems: An Iterative Process for Production-Ready Applications. Sebastopol, CA: O'Reilly Media. ISBN 978-1-0981-0796-3. Referenced in: Chapter 4: A Reference Architecture for AI in Large Organisations, Chapter 21: Observability, Monitoring and Drift in Production.
Source [75]: Huyen, C. (2025). AI Engineering: Building Applications with Foundation Models. Sebastopol, CA: O'Reilly Media. ISBN 978-1-0981-6630-4. Referenced in: Chapter 10: Foundation Models, Retrieval and Grounding.
Source [76]: Dehghani, Z. (2022). Data Mesh: Delivering Data-Driven Value at Scale. Sebastopol, CA: O'Reilly Media. ISBN 978-1-4920-9239-1. Referenced in: Chapter 6: Data Architecture for AI.
Source [77]: Kleppmann, M. (2017). Designing Data-Intensive Applications. Sebastopol, CA: O'Reilly Media. ISBN 978-1-4493-7332-0. Referenced in: Chapter 6: Data Architecture for AI, Chapter 12: Integrating AI into the Enterprise Landscape.
Source [78]: Skelton, M. & Pais, M. (2019). Team Topologies: Organizing Business and Technology Teams for Fast Flow. Portland, OR: IT Revolution Press. ISBN 978-1-942788-81-2. Referenced in: Chapter 23: From Pilot to Production: Scaling AI Across the Organisation.
Source [79]: Forsgren, N., Humble, J. & Kim, G. (2018). Accelerate: The Science of Lean Software and DevOps. Portland, OR: IT Revolution Press. ISBN 978-1-942788-33-1. Referenced in: Chapter 8: Setting Up an Effective DevSecMLOps Loop, Chapter 23: From Pilot to Production: Scaling AI Across the Organisation.
Source [80]: Richards, M. & Ford, N. (2020). Fundamentals of Software Architecture: An Engineering Approach. Sebastopol, CA: O'Reilly Media. ISBN 978-1-4920-4345-4. Referenced in: Chapter 12: Integrating AI into the Enterprise Landscape.
Source [81]: Google Cloud. Practitioners guide to MLOps: A framework for continuous delivery and automation of machine learning. White paper, May 2021. Available at: https://cloud.google.com/resources/mlops-whitepaper (accessed 2026-10-31). Referenced in: Chapter 7: Model Lifecycle Management: MLOps and LLMOps as Code.
Source [82]: Kvadrat AB. Kvadrat – Sweden's largest network of self-employed consultants. Available at: https://www.kvadrat.se/ (accessed 2026-10-31). Referenced in: About the Author.

AI-enabled threats and vulnerability management

Source [83]: Brumley, D., Poosankam, P., Song, D. & Zheng, J. (2008). Automatic Patch-Based Exploit Generation is Possible: Techniques and Implications. 2008 IEEE Symposium on Security and Privacy, pp. 143–157. Available at: https://doi.org/10.1109/SP.2008.17 (accessed 2026-11-01). Referenced in: Chapter 18: When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window.
Source [84]: Fang, R., Bindu, R., Gupta, A. & Kang, D. (2024). LLM Agents can Autonomously Exploit One-day Vulnerabilities. arXiv:2404.08144. Available at: https://arxiv.org/abs/2404.08144 (accessed 2026-11-01). Referenced in: Chapter 1: Introduction to AI Platform and Security, Chapter 18: When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window.
Source [85]: Charrier, C. & Weiner, R. (2024). How Low Can You Go? An Analysis of 2023 Time-to-Exploit Trends. Mandiant, Google Cloud Blog, 15 October 2024. Available at: https://cloud.google.com/blog/topics/threat-intelligence/time-to-exploit-trends-2023 (accessed 2026-11-01). Referenced in: Chapter 18: When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window, Chapter 25: Conclusions: Building and Securing AI Platforms.
Source [86]: Mandiant (2026). M-Trends 2026: Data, Insights, and Strategies From the Frontlines. Google Cloud Blog, 23 March 2026. Available at: https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026 (accessed 2026-11-01). Referenced in: Chapter 18: When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window, Chapter 25: Conclusions: Building and Securing AI Platforms.
Source [87]: Anthropic (2025). Disrupting the first reported AI-orchestrated cyber espionage campaign. 13 November 2025. Available at: https://www.anthropic.com/news/disrupting-AI-espionage (accessed 2026-11-01). Referenced in: Chapter 18: When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window.
Source [88]: Defense Advanced Research Projects Agency (2025). AI Cyber Challenge marks pivotal inflection point for cyber defense. DARPA, 8 August 2025. Available at: https://www.darpa.mil/news/2025/aixcc-results (accessed 2026-11-01). Referenced in: Chapter 18: When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window.
Source [89]: Forum of Incident Response and Security Teams. Exploit Prediction Scoring System (EPSS). FIRST; academic basis Jacobs, J. et al. (2021), Digital Threats: Research and Practice 2(3), https://doi.org/10.1145/3436242. Available at: https://www.first.org/epss/ (accessed 2026-11-01). Referenced in: Chapter 18: When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window.
Source [90]: Cybersecurity and Infrastructure Security Agency. Known Exploited Vulnerabilities Catalog. CISA. Available at: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop, Chapter 18: When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window.
Source [91]: European Union Agency for Cybersecurity (2025). European Vulnerability Database (EUVD). Launched 13 May 2025 under the NIS 2 Directive. Available at: https://euvd.enisa.europa.eu/ (accessed 2026-11-01). Referenced in: Chapter 18: When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window.
Source [92]: Magramo, K. (2024). Arup revealed as victim of $25 million deepfake scam involving Hong Kong employee. CNN Business, 16 May 2024. Available at: https://edition.cnn.com/2024/05/16/tech/arup-deepfake-scam-loss-hong-kong-intl-hnk (accessed 2026-11-01). Referenced in: Chapter 18: When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window.
Source [93]: Europol (2026). The evolving threat landscape. How encryption, proxies and AI are expanding cybercrime – Internet Organised Crime Threat Assessment (IOCTA) 2026. Luxembourg: Publications Office of the European Union. ISBN 978-92-9414-096-8. Available at: https://doi.org/10.2813/5737847 (accessed 2026-11-01). Referenced in: Chapter 18: When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window.

Agents that exceed their mandate and AI incidents

Source [94]: OpenAI (2024). OpenAI o1 System Card. 12 September 2024. Available at: https://cdn.openai.com/o1-system-card.pdf (accessed 2026-11-01). Referenced in: Chapter 19: When Your Own Agents Exceed Their Mandate: Containment That Does Not Depend on Intent.
Source [95]: Lynch, A., Wright, B., Larson, C., Ritchie, S. J., Mindermann, S., Hubinger, E., Perez, E. & Troy, K. (2025). Agentic Misalignment: How LLMs could be insider threats. Anthropic, 20 June 2025; arXiv:2510.05179. Available at: https://www.anthropic.com/research/agentic-misalignment (accessed 2026-11-01). Referenced in: Chapter 19: When Your Own Agents Exceed Their Mandate: Containment That Does Not Depend on Intent.
Source [96]: Schlatter, J., Weinstein-Raun, B. & Ladish, J. (2026). Incomplete Tasks Induce Shutdown Resistance in Some Frontier LLMs. Transactions on Machine Learning Research; arXiv:2509.14260v2. Available at: https://doi.org/10.48550/arXiv.2509.14260 (accessed 2026-11-01). Referenced in: Chapter 19: When Your Own Agents Exceed Their Mandate: Containment That Does Not Depend on Intent.
Source [97]: Von Arx, S., Chan, L. & Barnes, B. (2025). Recent Frontier Models Are Reward Hacking. METR, 5 June 2025. Available at: https://metr.org/blog/2025-06-05-recent-reward-hacking/ (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop, Chapter 19: When Your Own Agents Exceed Their Mandate: Containment That Does Not Depend on Intent, Chapter 25: Conclusions: Building and Securing AI Platforms.
Source [98]: Lu, C., Lu, C., Lange, R. T., Foerster, J., Clune, J. & Ha, D. (2024). The AI Scientist: Towards Fully Automated Open-Ended Scientific Discovery. Sakana AI, arXiv:2408.06292. Available at: https://doi.org/10.48550/arXiv.2408.06292 (accessed 2026-11-01). Referenced in: Chapter 19: When Your Own Agents Exceed Their Mandate: Containment That Does Not Depend on Intent.
Source [99]: Krakovna, V., Uesato, J., Mikulik, V., Rahtz, M., Everitt, T., Kumar, R., Kenton, Z., Leike, J. & Legg, S. (2020). Specification gaming: the flip side of AI ingenuity. DeepMind, 21 April 2020. Available at: https://deepmind.google/discover/blog/specification-gaming-the-flip-side-of-ai-ingenuity/ (accessed 2026-11-01). Referenced in: Chapter 19: When Your Own Agents Exceed Their Mandate: Containment That Does Not Depend on Intent.
Source [100]: Nolan, B. (2025). An AI-powered coding tool wiped out a software company's database, then apologized for a 'catastrophic failure on my part'. Fortune, 23 July 2025. Available at: https://fortune.com/2025/07/23/ai-coding-tool-replit-wiped-database-called-it-a-catastrophic-failure/ (accessed 2026-11-01). Referenced in: Chapter 19: When Your Own Agents Exceed Their Mandate: Containment That Does Not Depend on Intent.
Source [101]: Brewster, C. & Chávez, L. H. (2025). Inside Replit's Snapshot Engine: The Tech Making AI Agents Safe. Replit, 18 December 2025. Available at: https://frontier.replit.com/inside-replits-snapshot-engine/ (accessed 2026-11-01). Referenced in: Chapter 19: When Your Own Agents Exceed Their Mandate: Containment That Does Not Depend on Intent.
Source [102]: OWASP Foundation (2025). OWASP Top 10 for Agentic Applications for 2026. OWASP GenAI Security Project, 9 December 2025. Available at: https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/ (accessed 2026-11-01). Referenced in: Chapter 1: Introduction to AI Platform and Security, Chapter 2: Usage Modes and the Platform: What Each Mode Demands, Chapter 4: A Reference Architecture for AI in Large Organisations, Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [103]: AI Security Institute (2026). Incident Report: unsanctioned agent behaviour during cyber testing. UK AISI, 4 August 2026. Available at: https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing (accessed 2026-11-01). Referenced in: Chapter 19: When Your Own Agents Exceed Their Mandate: Containment That Does Not Depend on Intent.
Source [104]: OpenAI (2026). OpenAI – Hugging Face Incident Technical Report. 26 August 2026. Available at: https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop, Chapter 19: When Your Own Agents Exceed Their Mandate: Containment That Does Not Depend on Intent, Chapter 25: Conclusions: Building and Securing AI Platforms.

AI-enabled threats, defence and incidents in 2026

Source [105]: Blum, Mainor, Nambiar et al. (2026). ARTEX and Friends: Enter Agentic Offensive Frameworks. Google Threat Intelligence Group and Mandiant, Google Cloud Blog, 30 October 2026. Available at: https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks (accessed 2026-11-01). Referenced in: Chapter 18: When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window, Chapter 25: Conclusions: Building and Securing AI Platforms.
Source [106]: Grunewald, R., Mazumdar, S. & Vanderlee, K. (2026). Vulnerability Discovery and Exploitation Trends in the AI Era. Google Threat Intelligence Group, Google Cloud Blog, 30 September 2026. Available at: https://cloud.google.com/blog/topics/threat-intelligence/vulnerability-discovery-and-exploitation-trends-in-the-ai-era (accessed 2026-11-01). Referenced in: Chapter 18: When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window.
Source [107]: AI Security Institute (2026). GPT-6 Astra performs unsanctioned supply-chain attacks in simulations. UK AISI, 28 September 2026. Available at: https://www.aisi.gov.uk/blog/gpt-6-astra-performs-unsanctioned-supply-chain-attacks-in-simulations (accessed 2026-11-01). Referenced in: Chapter 19: When Your Own Agents Exceed Their Mandate: Containment That Does Not Depend on Intent.
Source [108]: European Union Agency for Cybersecurity (2026). ENISA Threat Landscape 2026. September 2026. Available at: https://www.enisa.europa.eu/sites/default/files/2026-09/ENISA%20Threat%20Landscape%202026_Final.pdf (accessed 2026-11-01). Referenced in: Chapter 1: Introduction to AI Platform and Security, Chapter 18: When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window.
Source [109]: European Union Agency for Cybersecurity (2026). The CRA Single Reporting Platform is launched. 11 September 2026. Available at: https://www.enisa.europa.eu/news/the-cra-single-reporting-platform-is-launched (accessed 2026-11-01). Referenced in: Chapter 18: When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window.
Source [110]: European Commission (2026). Cyber Resilience Act – Reporting obligations. Shaping Europe's digital future, updated 11 September 2026. Available at: https://digital-strategy.ec.europa.eu/en/policies/cra-reporting (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [111]: Anthropic (2026). Detecting and countering misuse of AI: September 2026. Threat Intelligence Report, September 2026. Available at: https://www.anthropic.com/threat-intelligence-report-september-2026 (accessed 2026-11-01). Referenced in: Chapter 18: When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window.
Source [112]: Google Threat Intelligence Group (2026). GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI. Google Cloud Blog, 8 September 2026. Available at: https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai (accessed 2026-11-01). Referenced in: Chapter 18: When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window.
Source [113]: National Cyber Security Centre (2026). NCSC statement in response to recent incidents resulting from frontier AI evaluations. 4 August 2026. Available at: https://www.ncsc.gov.uk/news/ncsc-statement-in-response-to-recent-incidents-resulting-from-frontier-ai-evaluations (accessed 2026-11-01). Referenced in: Chapter 19: When Your Own Agents Exceed Their Mandate: Containment That Does Not Depend on Intent.
Source [114]: Larcher, H., Carreira, A. et al. (2026). Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident. Hugging Face blog, 27 July 2026. Available at: https://huggingface.co/blog/agent-intrusion-technical-timeline (accessed 2026-11-01). Referenced in: Chapter 25: Conclusions: Building and Securing AI Platforms.
Source [115]: AI Security Institute (2026). Cheating behaviour in frontier model evaluations. UK AISI, 21 July 2026. Available at: https://www.aisi.gov.uk/blog/cheating-behaviour-in-frontier-model-evaluations (accessed 2026-11-01). Referenced in: Chapter 19: When Your Own Agents Exceed Their Mandate: Containment That Does Not Depend on Intent.
Source [116]: Five Eyes cyber security agencies: ASD's ACSC, Canadian Centre for Cyber Security, NCSC-NZ, NCSC-UK, NSA and CISA (2026). The AI shift in cyber risk: why leaders must act now. Joint statement, 22 June 2026. Available at: https://www.ncsc.gov.uk/sites/default/files/2026-06/Five-Eyes-cyber-security-agencies-statement-ai-shift.pdf (accessed 2026-11-01). Referenced in: Chapter 1: Introduction to AI Platform and Security, Chapter 18: When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window, Chapter 25: Conclusions: Building and Securing AI Platforms.
Source [117]: Anthropic (2026). Project Glasswing: Securing critical software for the AI era. 7 April 2026, updated 6 October 2026. Available at: https://www.anthropic.com/glasswing (accessed 2026-11-01). Referenced in: Chapter 18: When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window.
Source [118]: Carlini, N., Cheng, N., Lucas, K. et al. (2026). Assessing Claude Mythos Preview's cybersecurity capabilities. Anthropic Frontier Red Team, 7 April 2026. Available at: https://www.anthropic.com/research/mythos-preview (accessed 2026-11-01). Referenced in: Chapter 18: When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window.
Source [119]: Anthropic (2026). Project Glasswing: An initial update. 22 May 2026. Available at: https://www.anthropic.com/news/glasswing-initial-update (accessed 2026-11-01). Referenced in: Chapter 18: When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window.
Source [120]: Anthropic (2026). Expanding Project Glasswing. 2 June 2026. Available at: https://www.anthropic.com/news/expanding-project-glasswing (accessed 2026-11-01). Referenced in: Chapter 18: When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window.
Source [121]: Five Eyes cyber security agencies: ASD's ACSC, CISA, NSA, Canadian Centre for Cyber Security, NCSC-NZ and NCSC-UK (2026). Careful adoption of agentic AI services. Joint guidance, 1 May 2026. Available at: https://www.ncsc.govt.nz/assets/guidance/Documents/Careful-adoption-of-agentic-AI-services_FINAL.pdf (accessed 2026-11-01). Referenced in: Chapter 19: When Your Own Agents Exceed Their Mandate: Containment That Does Not Depend on Intent, Chapter 25: Conclusions: Building and Securing AI Platforms.
Source [122]: National Cyber Security Centre (2026). Preparing for a 'vulnerability patch wave'. NCSC blog, 1 May 2026. Available at: https://www.ncsc.gov.uk/blogs/prepare-for-vulnerability-patch-wave (accessed 2026-11-01). Referenced in: Chapter 18: When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window, Chapter 25: Conclusions: Building and Securing AI Platforms.

The OpenAI–Hugging Face incident: further sources

Source [123]: JFrog (2026). JFrog Security Advisories: CVE-2026-66384, CVE-2026-65616, CVE-2026-65617 and related Artifactory advisories. July–August 2026. Available at: https://docs.jfrog.com/releases/docs/jfrog-security-advisories (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.

Information security management standards

Source [124]: International Organization for Standardization and International Electrotechnical Commission (2022). ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection — Information security management systems — Requirements. Geneva: ISO, October 2022. Available at: https://www.iso.org/standard/27001 (accessed 2026-11-01). Referenced in: Chapter 8: Setting Up an Effective DevSecMLOps Loop, Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop, Chapter 15: Hybrid Agentic Work: Self-Hosted and Cloud Models for Sensitive Information.
Source [125]: International Organization for Standardization and International Electrotechnical Commission (2022). ISO/IEC 27002:2022 Information security, cybersecurity and privacy protection — Information security controls. Geneva: ISO, February 2022. Available at: https://www.iso.org/standard/75652.html (accessed 2026-11-01). Referenced in: Chapter 8: Setting Up an Effective DevSecMLOps Loop, Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop, Chapter 15: Hybrid Agentic Work: Self-Hosted and Cloud Models for Sensitive Information.

DevSecMLOps loop and its risks

Source [126]: Nordqvist, G. (2025). Version Control and Code Structure. Architecture as Code, Chapter 3. Available at: https://aac.geon.se/03_version_control/ (accessed 2026-11-01). Referenced in: Chapter 8: Setting Up an Effective DevSecMLOps Loop.
Source [127]: Nordqvist, G. (2025). Automation, DevOps and CI/CD for Architecture as Code. Architecture as Code, Chapter 5. Available at: https://aac.geon.se/05_automation_devops_cicd/ (accessed 2026-11-01). Referenced in: Chapter 8: Setting Up an Effective DevSecMLOps Loop.
Source [128]: Nordqvist, G. (2025). Policy and Security as Code in Detail. Architecture as Code, Chapter 10. Available at: https://aac.geon.se/10_policy_and_security/ (accessed 2026-11-01). Referenced in: Chapter 8: Setting Up an Effective DevSecMLOps Loop, Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [129]: Nordqvist, G. (2025). Testing Strategies for Infrastructure as Code. Architecture as Code, Chapter 13. Available at: https://aac.geon.se/13_testing_strategies/ (accessed 2026-11-01). Referenced in: Chapter 8: Setting Up an Effective DevSecMLOps Loop.
Source [130]: Nordqvist, G. (2025). Evidence as Code and Continuous Assurance. Architecture as Code, Chapter 15A. Available at: https://aac.geon.se/15a_evidence_as_code/ (accessed 2026-11-01). Referenced in: Chapter 8: Setting Up an Effective DevSecMLOps Loop, Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [131]: Booth, H., Ogata, M., Kent, K., Souppaya, M. & Dodson, D. (2025). Secure Software Development Framework (SSDF) Version 1.2: Recommendations for Mitigating the Risk of Software Vulnerabilities. NIST SP 800-218 Rev. 1, Initial Public Draft. National Institute of Standards and Technology, 17 December 2025. Available at: https://csrc.nist.gov/pubs/sp/800/218/r1/ipd (accessed 2026-11-01). Referenced in: Chapter 8: Setting Up an Effective DevSecMLOps Loop.
Source [132]: Booth, H., Souppaya, M., Vassilev, A., Ogata, M., Stanley, M. & Scarfone, K. (2024). Secure Software Development Practices for Generative AI and Dual-Use Foundation Models: An SSDF Community Profile. NIST SP 800-218A. National Institute of Standards and Technology, 26 July 2024. Available at: https://doi.org/10.6028/NIST.SP.800-218A (accessed 2026-11-01). Referenced in: Chapter 8: Setting Up an Effective DevSecMLOps Loop.
Source [133]: SLSA Community (2025). Announcing SLSA v1.2 and SLSA v1.2 Source Track: requirements. slsa.dev, 24 November 2025. Available at: https://slsa.dev/spec/v1.2/source-requirements (accessed 2026-11-01). Referenced in: Chapter 8: Setting Up an Effective DevSecMLOps Loop, Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [134]: Maruseac, M., Wickens, E., Major, D. & Sablotny, M. (2025). An Introduction to the OpenSSF Model Signing (OMS) Specification: Model Signing for Secure and Trusted AI Supply Chains. OpenSSF blog, 25 June 2025. Available at: https://openssf.org/blog/2025/06/25/an-introduction-to-the-openssf-model-signing-oms-specification/ (accessed 2026-11-01). Referenced in: Chapter 8: Setting Up an Effective DevSecMLOps Loop, Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [135]: Ecma International (2025). ECMA-424: CycloneDX Bill of Materials Specification, 2nd edition. Ecma International, December 2025. Available at: https://ecma-international.org/publications-and-standards/standards/ecma-424/ (accessed 2026-11-01). Referenced in: Chapter 3: Regulatory Requirements as Engineering Constraints, Chapter 8: Setting Up an Effective DevSecMLOps Loop.
Source [136]: Harvey, N. & DeBellis, D. (2025). Announcing the 2025 DORA Report: State of AI-assisted Software Development. Google Cloud Blog, 23 September 2025. Available at: https://cloud.google.com/blog/products/ai-machine-learning/announcing-the-2025-dora-report (accessed 2026-11-01). Referenced in: Chapter 8: Setting Up an Effective DevSecMLOps Loop.
Source [137]: Storer, K. M. & DeBellis, D. (2025). Introducing DORA's inaugural AI Capabilities Model. Google Cloud Blog, 23 September 2025. Available at: https://cloud.google.com/blog/products/ai-machine-learning/introducing-doras-inaugural-ai-capabilities-model (accessed 2026-11-01). Referenced in: Chapter 8: Setting Up an Effective DevSecMLOps Loop.
Source [138]: lakeFS (2025). lakeFS Acquires DVC, Uniting Data Version Control Pioneers to Accelerate AI-Ready Data. Press release, 18 November 2025. Available at: https://lakefs.io/blog/lakefs-acquires-dvc/ (accessed 2026-11-01). Referenced in: Chapter 8: Setting Up an Effective DevSecMLOps Loop.
Source [139]: MLflow Project (2026). Prompt Registry. MLflow documentation. Available at: https://mlflow.org/docs/latest/genai/prompt-registry/ (accessed 2026-11-01). Referenced in: Chapter 8: Setting Up an Effective DevSecMLOps Loop, Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [140]: GitHub (2026). Available rules for rulesets. GitHub Docs. Available at: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets (accessed 2026-11-01). Referenced in: Chapter 8: Setting Up an Effective DevSecMLOps Loop, Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [141]: Sigstore Project (2026). gitsign: Keyless Git signing using Sigstore. GitHub repository. Available at: https://github.com/sigstore/gitsign (accessed 2026-11-01). Referenced in: Chapter 8: Setting Up an Effective DevSecMLOps Loop.
Source [142]: ETSI (2026). ETSI releases world-leading standard for securing AI (ETSI EN 304 223). Press release, 14 January 2026. Available at: https://www.etsi.org/newsroom/press-releases/2627-etsi-releases-world-leading-standard-for-securing-ai (accessed 2026-11-01). Referenced in: Chapter 8: Setting Up an Effective DevSecMLOps Loop.
Source [143]: Five Eyes cyber security agencies: NSA AISC, CISA, FBI, ASD's ACSC, NCSC-NZ and NCSC-UK (2025). AI Data Security: Best Practices for Securing Data Used to Train & Operate AI Systems. Cybersecurity Information Sheet, 22 May 2025. Available at: https://www.cisa.gov/resources-tools/resources/ai-data-security-best-practices-securing-data-used-train-operate-ai-systems (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [144]: Vassilev, A., Oprea, A., Fordyce, A., Anderson, H., Davies, X. & Hamin, M. (2025). Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations. NIST AI 100-2 E2025. National Institute of Standards and Technology, 24 March 2025. Available at: https://doi.org/10.6028/NIST.AI.100-2e2025 (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [145]: Anthropic (2025). Introducing Agent Skills. Claude blog, 16 October 2025, updated 18 December 2025. Available at: https://claude.com/blog/skills (accessed 2026-11-01). Referenced in: Chapter 8: Setting Up an Effective DevSecMLOps Loop.
Source [146]: Agent Skills (2026). Agent Skills Overview and Specification. agentskills.io. Available at: https://agentskills.io/ (accessed 2026-11-01). Referenced in: Chapter 8: Setting Up an Effective DevSecMLOps Loop.
Source [147]: OpenAI (2026). Build skills (Codex agent skills documentation). Available at: https://learn.chatgpt.com/docs/build-skills (accessed 2026-11-01). Referenced in: Chapter 8: Setting Up an Effective DevSecMLOps Loop.
Source [148]: Soria Parra, D., Jones, A., Antanavicius, T., Padilla, T. & Chu, T. (2025). Introducing the MCP Registry. Model Context Protocol blog, 8 September 2025. Available at: https://blog.modelcontextprotocol.io/posts/2025-09-08-mcp-registry-preview/ (accessed 2026-11-01). Referenced in: Chapter 8: Setting Up an Effective DevSecMLOps Loop, Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [149]: Lamanna, C. (2025). Microsoft Agent 365: The control plane for AI agents. Microsoft 365 Blog, 18 November 2025. Available at: https://www.microsoft.com/en-us/microsoft-365/blog/2025/11/18/microsoft-agent-365-the-control-plane-for-ai-agents/ (accessed 2026-11-01). Referenced in: Chapter 2: Usage Modes and the Platform: What Each Mode Demands, Chapter 4: A Reference Architecture for AI in Large Organisations, Chapter 8: Setting Up an Effective DevSecMLOps Loop.
Source [150]: Beurer-Kellner, L., Kudrinskii, A., Milanta, M., Bonde Nielsen, K., Sarkar, H. & Tal, L. (2026). Snyk Finds Prompt Injection in 36%, 1467 Malicious Payloads in a ToxicSkills Study of Agent Skills Supply Chain Compromise. Snyk blog, 5 February 2026. Available at: https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [151]: Lakshmanan, R. (2026). Researchers Find 341 Malicious ClawHub Skills Stealing Data from OpenClaw Users. The Hacker News, 2 February 2026. Available at: https://thehackernews.com/2026/02/researchers-find-341-malicious-clawhub.html (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [152]: Elastic Security Labs (2026). Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages. Elastic, 6 August 2026. Available at: https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [153]: Kurmi, A. (2026). TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages. StepSecurity, 11 May 2026. Available at: https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop, Chapter 25: Conclusions: Building and Securing AI Platforms.
Source [154]: National Vulnerability Database (2026). CVE-2026-33634: Trivy v0.69.4 supply chain compromise. NIST NVD, published 23 March 2026. Available at: https://nvd.nist.gov/vuln/detail/CVE-2026-33634 (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [155]: GitGuardian (2026). The State of Secrets Sprawl 2026. GitGuardian, March 2026. Available at: https://www.gitguardian.com/state-of-secrets-sprawl-report-2026 (accessed 2026-11-01). Referenced in: Chapter 8: Setting Up an Effective DevSecMLOps Loop, Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [156]: Cybersecurity and Infrastructure Security Agency (2025). Widespread Supply Chain Compromise Impacting npm Ecosystem. CISA Alert, 23 September 2025. Available at: https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [157]: Strumpflohner, J. (2025). S1ngularity – What Happened, How We Responded, What We Learned. Nx blog, 5 September 2025. Available at: https://nx.dev/blog/s1ngularity-postmortem (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [158]: Sharma, V. (2025). Harden-Runner detection: tj-actions/changed-files action is compromised. StepSecurity, 14 March 2025. Available at: https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [159]: PyPI (2024). Supply-chain attack analysis: Ultralytics. The Python Package Index Blog, 11 December 2024. Available at: https://blog.pypi.org/posts/2024-12-11-ultralytics-attack-analysis/ (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [160]: Brombacher, F. (2026). Spring 2026 GenAI Code Security Update: Despite Claims, AI Models Are Still Failing Security. Veracode, 24 March 2026. Available at: https://www.veracode.com/?p=28620 (accessed 2026-11-01). Referenced in: Chapter 8: Setting Up an Effective DevSecMLOps Loop, Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [161]: Rizwan, S. (2026). Post-mortem: Unauthorized Cline CLI npm publish on February 17, 2026. Cline blog, 24 February 2026. Available at: https://cline.bot/blog/post-mortem-unauthorized-cline-cli-npm (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [162]: Khan, A. (2026). Clinejection — Compromising Cline's Production Releases just by Prompting an Issue Triager. 9 February 2026, updated 18 February 2026. Available at: https://adnanthekhan.com/posts/clinejection/ (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [163]: Milanta, M. & Beurer-Kellner, L. (2025). GitHub MCP Exploited: Accessing private repositories via MCP. Invariant Labs, 26 May 2025. Available at: https://invariantlabs.ai/blog/mcp-github-vulnerability (accessed 2026-11-01). Referenced in: Chapter 2: Usage Modes and the Platform: What Each Mode Demands, Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [164]: Karliner, Z. et al. (2025). New Vulnerability in GitHub Copilot and Cursor: How Hackers Can Weaponize Code Agents. Pillar Security, 18 March 2025. Available at: https://www.pillar.security/blog/new-vulnerability-in-github-copilot-and-cursor-how-hackers-can-weaponize-code-agents (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [165]: Souly, A., Rando, J., Chapman, E., Davies, X., Hasircioglu, B., Shereen, E., Mougan, C., Mavroudis, V., Jones, E., Hicks, C., Carlini, N., Gal, Y. & Kirk, R. (2025). A small number of samples can poison LLMs of any size. Anthropic, UK AI Security Institute and Alan Turing Institute, 9 October 2025; arXiv:2510.07192. Available at: https://www.anthropic.com/research/small-samples-poison (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [166]: Liang, S., Garg, S. & Zilouchian Moghaddam, R. (2025). The SWE-Bench Illusion: When State-of-the-Art LLMs Remember Instead of Reason. arXiv:2506.12286, v4 1 December 2025. Available at: https://arxiv.org/abs/2506.12286 (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [167]: Carlini, N., Jagielski, M., Choquette-Choo, C. A., Paleka, D., Pearce, W., Anderson, H., Terzis, A., Thomas, K. & Tramèr, F. (2023). Poisoning Web-Scale Training Datasets is Practical. arXiv:2302.10149, v2 6 May 2024. Available at: https://arxiv.org/abs/2302.10149 (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [168]: PyTorch Foundation (2026). PyTorch Foundation Announces Safetensors as Newest Contributed Project to Secure AI Model Execution. Linux Foundation press release, 8 April 2026. Available at: https://www.linuxfoundation.org/press/pyTorch-foundation-announces-safetensors-as-newest-contributed-project-to-secure-ai-model-execution (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [169]: PyTorch (2025). Remote Code Execution in torch.load with weights_only=True (GHSA-53q9-r3pm-6pq6, CVE-2025-32434). GitHub Security Advisory, 17 April 2025. Available at: https://github.com/pytorch/pytorch/security/advisories/GHSA-53q9-r3pm-6pq6 (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [170]: Zanki, K. (2025). Malicious ML models discovered on Hugging Face platform. ReversingLabs, 6 February 2025. Available at: https://www.reversinglabs.com/blog/rl-identifies-malware-ml-model-hosted-on-hugging-face (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [171]: National Vulnerability Database (2025). CVE-2025-11201: MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution. NIST NVD, published 29 October 2025. Available at: https://nvd.nist.gov/vuln/detail/CVE-2025-11201 (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [172]: National Vulnerability Database (2026). CVE-2026-66384: JFrog Artifactory Docker remote-cache path handling. NIST NVD, published 12 August 2026. Available at: https://nvd.nist.gov/vuln/detail/CVE-2026-66384 (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [173]: National Vulnerability Database (2026). CVE-2026-27893: vLLM model files hardcode trust_remote_code=True. NIST NVD, published 27 March 2026. Available at: https://nvd.nist.gov/vuln/detail/CVE-2026-27893 (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop, Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges.
Source [174]: National Vulnerability Database (2025). CVE-2025-32444: vLLM Mooncake integration remote code execution. NIST NVD, published 30 April 2025. Available at: https://nvd.nist.gov/vuln/detail/CVE-2025-32444 (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [175]: Shustin, R. & Ohfeld, N. (2025). Breaking NVIDIA Triton: CVE-2025-23319 – A Vulnerability Chain Leading to AI Server Takeover. Wiz Research, 4 August 2025. Available at: https://www.wiz.io/blog/nvidia-triton-cve-2025-23319-vuln-chain-to-ai-server (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [176]: Bernadett-Shapiro, G. & Cutler, S. (2026). Silent Brothers: Ollama Hosts Form Anonymous AI Network Beyond Platform Guardrails. SentinelLABS, January 2026, updated 6 March 2026. Available at: https://www.sentinelone.com/labs/silent-brothers-ollama-hosts-form-anonymous-ai-network-beyond-platform-guardrails/ (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [177]: Blauzvern, H. (2025). Rekor v2 GA – Cheaper to run, simpler to maintain. Sigstore blog, 10 October 2025. Available at: https://blog.sigstore.dev/rekor-v2-ga/ (accessed 2026-11-01). Referenced in: Chapter 8: Setting Up an Effective DevSecMLOps Loop, Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [178]: GitHub (2026). Removing sensitive data from a repository. GitHub Docs. Available at: https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository (accessed 2026-11-01). Referenced in: Chapter 9: Risks and Vulnerabilities Across the DevSecMLOps Loop.
Source [179]: Anthropic. Use skills in Claude. Claude Help Center, living document. Available at: https://support.claude.com/en/articles/12512180-using-skills-in-claude (accessed 2026-11-01). Referenced in: Chapter 8: Setting Up an Effective DevSecMLOps Loop.

Cloud versus on-premises AI

Source [180]: TrendForce (2026). Memory Prices Soar; DRAM and NAND Flash to Account for 68% of Major CSP CapEx in 2027, Says TrendForce. TrendForce press centre, 25 August 2026. Available at: https://www.trendforce.com/presscenter/news/20260825-13198.html (accessed 2026-11-01). Referenced in: Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges.
Source [181]: Patil, C. (2026). Beyond Per-Token Pricing: A Concurrency-Aware Methodology for LLM Infrastructure Cost Estimation. arXiv:2606.11690 (preprint), June 2026. Available at: https://huggingface.co/papers/2606.11690 (accessed 2026-11-01). Referenced in: Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges, Chapter 22: Cost, Capacity and Sustainability of AI.
Source [182]: European Commission (2026). Proposal for the Cloud and AI Development Act (CADA). COM(2026) 502, 3 June 2026. Available at: https://digital-strategy.ec.europa.eu/en/library/proposal-cloud-and-ai-development-act-cada (accessed 2026-11-01). Referenced in: Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges, Chapter 25: Conclusions: Building and Securing AI Platforms.
Source [183]: EirGrid (2026). Data Centre Constrained Area Overview. EirGrid, May 2026. Available at: https://cms.eirgrid.ie/sites/default/files/publications/Data-Centre-Constrained-Area-Overview-May-2026.pdf (accessed 2026-11-01). Referenced in: Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges.
Source [184]: Pan, G., Chodnekar, V., Roy, A. & Wang, H. (2025). A Cost-Benefit Analysis of On-Premise Large Language Model Deployment: Breaking Even with Commercial LLM Services. arXiv:2509.18101v3 (preprint), 11 November 2025. Available at: https://arxiv.org/abs/2509.18101 (accessed 2026-11-01). Referenced in: Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges, Chapter 25: Conclusions: Building and Securing AI Platforms.
Source [185]: OpenAI (2026). Deprecations. OpenAI API documentation, latest entry 14 October 2026. Available at: https://developers.openai.com/api/docs/deprecations (accessed 2026-11-01). Referenced in: Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges, Chapter 25: Conclusions: Building and Securing AI Platforms.
Source [186]: Anthropic (2026). Model deprecations. Claude Platform documentation, latest entry 30 September 2026. Available at: https://platform.claude.com/docs/en/about-claude/model-deprecations (accessed 2026-11-01). Referenced in: Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges.
Source [187]: Amazon Web Services (2026). Model lifecycle. Amazon Bedrock User Guide, policy for models launched on or after 7 September 2026. Available at: https://docs.aws.amazon.com/bedrock/latest/userguide/model-lifecycle.html (accessed 2026-11-01). Referenced in: Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges.
Source [188]: Microsoft (2026). Foundry Models lifecycle and support policy. Microsoft Learn, 24 July 2026. Available at: https://learn.microsoft.com/en-us/azure/foundry/openai/concepts/model-retirements (accessed 2026-11-01). Referenced in: Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges, Chapter 25: Conclusions: Building and Securing AI Platforms.
Source [189]: Anthropic (2026). Data residency and API and data retention. Claude Platform documentation, living pages read 1 November 2026. Available at: https://platform.claude.com/docs/en/manage-claude/data-residency; https://platform.claude.com/docs/en/manage-claude/api-and-data-retention (accessed 2026-11-01). Referenced in: Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges.
Source [190]: OpenAI (2026). Data controls in the OpenAI platform. OpenAI API documentation, living page read 1 November 2026. Available at: https://developers.openai.com/api/docs/guides/your-data (accessed 2026-11-01). Referenced in: Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges.
Source [191]: Lorimer, P. (2025). Microsoft offers in-country data processing to 15 countries to strengthen sovereign controls for Microsoft 365 Copilot. Microsoft Copilot Blog, 4 November 2025, editor's note of 3 April 2026. Available at: https://www.microsoft.com/en-us/microsoft-365/blog/2025/11/04/microsoft-offers-in-country-data-processing-to-15-countries-to-strengthen-sovereign-controls-for-microsoft-365-copilot/ (accessed 2026-11-01). Referenced in: Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges.
Source [192]: United States District Court for the Southern District of New York (2025). Stipulation and Order to Terminate OpenAI's Ongoing Obligations under the Preservation Order at ECF 33. In re OpenAI, Inc. Copyright Infringement Litigation, 25-md-03143, Document 922, 9 October 2025. Available at: https://blogs.duanemorris.com/classactiondefense/wp-content/uploads/sites/56/2025/10/In-re-Open-AI-Inc.-Copyright-Infringement-Litig.-10.9.25-Order-ECF-No.-992.pdf (accessed 2026-11-01). Referenced in: Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges.
Source [193]: Anthropic (2025). A postmortem of three recent issues. Anthropic Engineering, 17 September 2025. Available at: https://www.anthropic.com/engineering/a-postmortem-of-three-recent-issues (accessed 2026-11-01). Referenced in: Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges.
Source [194]: Microsoft (2026). Artificial intelligence shared responsibility model and AI agent shared responsibility model. Microsoft Learn, August 2026, updated 8 October 2026. Available at: https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility-ai; https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility-ai-agent (accessed 2026-11-01). Referenced in: Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges.
Source [195]: Bregkou, M. (2026). AI Controls Matrix v1.1: Strengthening the Foundation for Trustworthy AI. Cloud Security Alliance, 14 July 2026. Available at: https://cloudsecurityalliance.org/articles/ai-controls-matrix-v1-1-strengthening-the-foundation-for-trustworthy-ai (accessed 2026-11-01). Referenced in: Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges.
Source [196]: Amazon Web Services. Generative AI Security Scoping Matrix. aws.amazon.com, undated. Available at: https://aws.amazon.com/ai/generative-ai/security/scoping-matrix/ (accessed 2026-11-01). Referenced in: Chapter 2: Usage Modes and the Platform: What Each Mode Demands, Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges.
Source [197]: Cloud Security Alliance AI Safety Initiative (2026). Exposed AI Infrastructure: Self-Hosted Services Under Attack. CSA Labs research note, 7 May 2026. Available at: https://labs.cloudsecurityalliance.org/research/csa-research-note-exposed-ai-infrastructure-selfhosted-secur/ (accessed 2026-11-01). Referenced in: Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges.
Source [198]: Cyera Research (2026). Bleeding Llama: A Critical Memory Leak in the World's Most Popular Local AI Platform. Cyera, 5 May 2026; with NIST NVD, CVE-2026-7482, 4 May 2026. Available at: https://www.cyera.com/blog/bleeding-llama-a-critical-memory-leak-in-the-worlds-most-popular-local-ai-platform; https://nvd.nist.gov/vuln/detail/CVE-2026-7482 (accessed 2026-11-01). Referenced in: Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges.
Source [199]: Meta Platforms (2025). Llama 4 Community License Agreement. 5 April 2025. Available at: https://dev.meta.ai/llama/llama4/license/ (accessed 2026-11-01). Referenced in: Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges.
Source [200]: Hugging Face (2026). Model cards and licence files for google/gemma-4-31B-it, mistralai/Mistral-Medium-3.5-128B, mistralai/Mistral-Large-3-675B-Instruct-2512, Qwen/Qwen3-8B, Qwen/Qwen3.8-27B and openai/gpt-oss-120b. huggingface.co, read 1 November 2026. Available at: https://huggingface.co/mistralai/Mistral-Medium-3.5-128B/blob/main/LICENSE (accessed 2026-11-01). Referenced in: Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges.
Source [201]: Rijksoverheid (2026). Strengere regels voor het gebruik van clouddiensten door de Rijksoverheid. Ministerie van Economische Zaken en Klimaat, 3 July 2026. Available at: https://www.rijksoverheid.nl/actueel/nieuws/2026/07/03/strengere-regels-voor-het-gebruik-van-clouddiensten-door-de-rijksoverheid (accessed 2026-11-01). Referenced in: Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges.
Source [202]: Regeringskansliet (2026). Ny molnpolicy ska bidra till ökad digital suveränitet i offentlig förvaltning. Finansdepartementet, 28 May 2026, with the policy En molnpolicy för Sverige. Available at: https://regeringen.se/pressmeddelanden/2026/05/ny-molnpolicy-ska-bidra-till-okad-digital-suveranitet-i-offentlig-forvaltning/ (accessed 2026-11-01). Referenced in: Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges.
Source [203]: European Commission (2026). Frequently Asked Questions – Data Act, version 1.4. 22 January 2026. Available at: https://ec.europa.eu/newsroom/dae/redirection/document/108144 (accessed 2026-11-01). Referenced in: Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges, Chapter 25: Conclusions: Building and Securing AI Platforms.
Source [204]: European Supervisory Authorities: EBA, EIOPA and ESMA (2025). European Supervisory Authorities designate critical ICT third-party providers and List of designated CTPPs. ESMA, 18 November 2025. Available at: https://www.esma.europa.eu/press-news/esma-news/european-supervisory-authorities-designate-critical-ict-third-party-providers (accessed 2026-11-01). Referenced in: Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges.
Source [205]: European Commission (2025). Guidelines on the scope of the obligations for general-purpose AI models established by Regulation (EU) 2024/1689 (AI Act). Annex to C(2025) 5045 final, 18 July 2025. Available at: https://digital-strategy.ec.europa.eu/en/library/guidelines-scope-obligations-providers-general-purpose-ai-models-under-ai-act (accessed 2026-11-01). Referenced in: Chapter 3: Regulatory Requirements as Engineering Constraints, Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges.
Source [206]: Amazon (2026). AWS Launches AWS European Sovereign Cloud and Announces Expansion Across Europe. Amazon press release, 15 January 2026. Available at: https://press.aboutamazon.com/aws/2026/1/aws-launches-aws-european-sovereign-cloud-and-announces-expansion-across-europe (accessed 2026-11-01). Referenced in: Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges.

Decision forums and AI governance

Source [207]: Federal Republic of Germany (2001). Betriebsverfassungsgesetz (BetrVG) (Works Constitution Act), as last amended on 19 July 2024. Federal Ministry of Justice, Gesetze im Internet. Available at: https://www.gesetze-im-internet.de/betrvg/ (accessed 2026-11-01). Referenced in: Chapter 1: Introduction to AI Platform and Security, Chapter 24: Nordvik Region and Hansa Mutual: Platform and Security Conclusions.

Geopolitics and model origin

Worked examples: Parts A and B

Source [208]: Agent Skills Contributors. Agent Skills Specification. Available at: https://agentskills.io/specification (accessed 2026-11-01). Referenced in: Chapter 11: Agentic Architectures and Orchestration.
Source [209]: AGENTS.md Contributors. AGENTS.md: a simple, open format for guiding coding agents. Available at: https://agents.md/ (accessed 2026-11-01). Referenced in: Chapter 11: Agentic Architectures and Orchestration.

Usage modes of large language models

Source [210]: OpenAI (2026). What is the ChatGPT Enterprise and Business data policy? OpenAI Help Center, living page read 1 November 2026. Available at: https://help.openai.com/en/articles/8983130-what-is-the-chatgpt-enterprise-and-team-data-policy (accessed 2026-11-01). Referenced in: Chapter 2: Usage Modes and the Platform: What Each Mode Demands.
Source [211]: Anthropic (2025). Updates to Consumer Terms and Privacy Policy. Anthropic, 28 August 2025. Available at: https://www.anthropic.com/news/updates-to-our-consumer-terms (accessed 2026-11-01). Referenced in: Chapter 2: Usage Modes and the Platform: What Each Mode Demands.
Source [212]: Microsoft (2026). Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat. Microsoft Learn, updated 31 October 2026. Available at: https://learn.microsoft.com/en-us/copilot/microsoft-365/enterprise-data-protection (accessed 2026-11-01). Referenced in: Chapter 2: Usage Modes and the Platform: What Each Mode Demands.
Source [213]: Reddy, P. & Gujral, A. S. (2025). EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System. arXiv:2509.10540, AAAI Fall Symposium Series 2025. Available at: https://arxiv.org/abs/2509.10540 (accessed 2026-11-01). Referenced in: Chapter 2: Usage Modes and the Platform: What Each Mode Demands.
Source [214]: Anthropic. Configure permissions and Configure the sandboxed Bash tool. Claude Code documentation, living page. Available at: https://code.claude.com/docs/en/permissions; https://code.claude.com/docs/en/sandboxing (accessed 2026-11-01). Referenced in: Chapter 2: Usage Modes and the Platform: What Each Mode Demands.
Source [215]: OpenAI. Agent approvals & security. Codex documentation, living page. Available at: https://learn.chatgpt.com/docs/agent-approvals-security (accessed 2026-11-01). Referenced in: Chapter 2: Usage Modes and the Platform: What Each Mode Demands.
Source [216]: GitHub. Risks and mitigations for GitHub Copilot cloud agent. GitHub Docs, living page. Available at: https://docs.github.com/en/copilot/concepts/agents/cloud-agent/risks-and-mitigations (accessed 2026-11-01). Referenced in: Chapter 2: Usage Modes and the Platform: What Each Mode Demands.
Source [217]: Microsoft (2026). Event triggers overview – Microsoft Copilot Studio. Microsoft Learn, updated 10 September 2026. Available at: https://learn.microsoft.com/en-us/microsoft-copilot-studio/authoring-triggers-about (accessed 2026-11-01). Referenced in: Chapter 2: Usage Modes and the Platform: What Each Mode Demands.
Source [218]: OpenCode (2026). OpenCode documentation: Intro, with the linked Providers and Agents pages. Last updated 1 November 2026; repository licensed under MIT. Available at: https://opencode.ai/docs (accessed 2026-11-01). Referenced in: Chapter 2: Usage Modes and the Platform: What Each Mode Demands, Chapter 15: Hybrid Agentic Work: Self-Hosted and Cloud Models for Sensitive Information.

Hybrid agentic work

Source [219]: Anomaly (2026). Config, with the published configuration schema. OpenCode documentation, read 1 November 2026. Available at: https://opencode.ai/docs/config/ (accessed 2026-11-01). Referenced in: Chapter 15: Hybrid Agentic Work: Self-Hosted and Cloud Models for Sensitive Information.
Source [220]: Anomaly (2026). Providers. OpenCode documentation, read 1 November 2026. Available at: https://opencode.ai/docs/providers/ (accessed 2026-11-01). Referenced in: Chapter 15: Hybrid Agentic Work: Self-Hosted and Cloud Models for Sensitive Information.
Source [221]: Anomaly (2026). Agents. OpenCode documentation, read 1 November 2026. Available at: https://opencode.ai/docs/agents/ (accessed 2026-11-01). Referenced in: Chapter 15: Hybrid Agentic Work: Self-Hosted and Cloud Models for Sensitive Information.
Source [222]: Anomaly (2026). Permissions. OpenCode documentation, read 1 November 2026. Available at: https://opencode.ai/docs/permissions/ (accessed 2026-11-01). Referenced in: Chapter 15: Hybrid Agentic Work: Self-Hosted and Cloud Models for Sensitive Information.
Source [223]: Anomaly (2026). MCP servers. OpenCode documentation, read 1 November 2026. Available at: https://opencode.ai/docs/mcp-servers/ (accessed 2026-11-01). Referenced in: Chapter 15: Hybrid Agentic Work: Self-Hosted and Cloud Models for Sensitive Information.
Source [224]: Anomaly (2026). Enterprise. OpenCode documentation, read 1 November 2026. Available at: https://opencode.ai/docs/enterprise/ (accessed 2026-11-01). Referenced in: Chapter 15: Hybrid Agentic Work: Self-Hosted and Cloud Models for Sensitive Information.
Source [225]: Anomaly (2026). OpenCode Privacy Policy. Effective 6 March 2026. Available at: https://opencode.ai/legal/privacy-policy (accessed 2026-11-01). Referenced in: Chapter 15: Hybrid Agentic Work: Self-Hosted and Cloud Models for Sensitive Information.
Source [226]: Anomaly (2025). opencode: The open source coding agent, LICENSE file (MIT License, copyright 2025 opencode). GitHub repository anomalyco/opencode, formerly sst/opencode. Available at: https://github.com/anomalyco/opencode/blob/dev/LICENSE (accessed 2026-11-01). Referenced in: Chapter 15: Hybrid Agentic Work: Self-Hosted and Cloud Models for Sensitive Information.
Source [227]: vLLM project (2026). OpenAI-Compatible Server. vLLM documentation (latest), read 1 November 2026. Available at: https://docs.vllm.ai/en/latest/serving/online_serving/openai_compatible_server/ (accessed 2026-11-01). Referenced in: Chapter 15: Hybrid Agentic Work: Self-Hosted and Cloud Models for Sensitive Information.
Source [228]: Ollama (2026). OpenAI compatibility. Ollama documentation, read 1 November 2026. Available at: https://docs.ollama.com/api/openai-compatibility (accessed 2026-11-01). Referenced in: Chapter 15: Hybrid Agentic Work: Self-Hosted and Cloud Models for Sensitive Information.
Source [229]: Model Context Protocol (2025). Security Best Practices. MCP specification version 2025-11-25. Available at: https://modelcontextprotocol.io/specification/2025-11-25/basic/security_best_practices (accessed 2026-11-01). Referenced in: Chapter 4: A Reference Architecture for AI in Large Organisations, Chapter 15: Hybrid Agentic Work: Self-Hosted and Cloud Models for Sensitive Information.
Source [230]: Cline (2026). Enterprise Provider Configuration (remote configuration). Cline documentation, read 1 November 2026. Available at: https://docs.cline.bot/enterprise-solutions/configuration/remote-configuration/overview (accessed 2026-11-01). Referenced in: Chapter 15: Hybrid Agentic Work: Self-Hosted and Cloud Models for Sensitive Information.
Source [231]: Cline (2026). Local models and Ollama. Cline documentation, read 1 November 2026. Available at: https://docs.cline.bot/provider-config/ollama (accessed 2026-11-01). Referenced in: Chapter 15: Hybrid Agentic Work: Self-Hosted and Cloud Models for Sensitive Information.
Source [232]: Continue (2026). OpenAI model provider. Continue documentation, read 1 November 2026. Available at: https://docs.continue.dev/customize/model-providers/top-level/openai (accessed 2026-11-01). Referenced in: Chapter 15: Hybrid Agentic Work: Self-Hosted and Cloud Models for Sensitive Information.
Source [233]: Aider (2026). Other LLMs and Ollama. Aider documentation, read 1 November 2026. Available at: https://aider.chat/docs/llms/other.html (accessed 2026-11-01). Referenced in: Chapter 15: Hybrid Agentic Work: Self-Hosted and Cloud Models for Sensitive Information.
Source [234]: Goose (2026). Configure LLM Provider and Configuration files. goose documentation, Agentic AI Foundation, read 1 November 2026. Available at: https://goose-docs.ai/docs/getting-started/providers (accessed 2026-11-01). Referenced in: Chapter 15: Hybrid Agentic Work: Self-Hosted and Cloud Models for Sensitive Information.
Source [235]: Charmbracelet (2026). Crush README and LICENSE (Functional Source License 1.1, MIT Future License). GitHub repository charmbracelet/crush, read 1 November 2026. Available at: https://github.com/charmbracelet/crush (accessed 2026-11-01). Referenced in: Chapter 15: Hybrid Agentic Work: Self-Hosted and Cloud Models for Sensitive Information.
Source [236]: OpenAI (2026). Advanced configuration (Codex CLI: open-source model providers and custom model providers). Codex documentation, read 1 November 2026. Available at: https://developers.openai.com/codex/config-advanced (accessed 2026-11-01). Referenced in: Chapter 15: Hybrid Agentic Work: Self-Hosted and Cloud Models for Sensitive Information.
Source [237]: OpenAI (2026). Managed configuration (Codex requirements and managed defaults). Codex documentation, read 1 November 2026. Available at: https://learn.chatgpt.com/docs/enterprise/managed-configuration (accessed 2026-11-01). Referenced in: Chapter 15: Hybrid Agentic Work: Self-Hosted and Cloud Models for Sensitive Information.
Source [238]: npm (2026). Download counts for the packages @openai/codex and opencode-ai, 30 September to 29 October 2026. npm registry downloads API; the second package at https://api.npmjs.org/downloads/point/last-month/opencode-ai. Available at: https://api.npmjs.org/downloads/point/last-month/@openai/codex (accessed 2026-11-01). Referenced in: Chapter 15: Hybrid Agentic Work: Self-Hosted and Cloud Models for Sensitive Information.

Conclusions for the two example organisations

Source [239]: European Parliament and Council of the European Union (2009). Directive 2009/138/EC on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II) (recast). Official Journal of the European Union, L 335, 17 December 2009. Available at: https://eur-lex.europa.eu/eli/dir/2009/138/oj (accessed 2026-11-01). Referenced in: Chapter 7: Model Lifecycle Management: MLOps and LLMOps as Code.
Source [240]: European Insurance and Occupational Pensions Authority (2025). Opinion on Artificial Intelligence governance and risk management. EIOPA, 6 August 2025. Available at: https://www.eiopa.europa.eu/publications/opinion-artificial-intelligence-governance-and-risk-management_en (accessed 2026-11-01). Referenced in: Chapter 7: Model Lifecycle Management: MLOps and LLMOps as Code.
Source [241]: European Free Trade Association. EEA-Lex factsheet 32024R1689: the Artificial Intelligence Act. EFTA. Available at: https://www.efta.int/eea-lex/32024r1689 (accessed 2026-11-01). Referenced in: Chapter 3: Regulatory Requirements as Engineering Constraints, Chapter 4: A Reference Architecture for AI in Large Organisations, Chapter 5: AI Decision Records, Model Cards and the Architecture Repository, Chapter 24: Nordvik Region and Hansa Mutual: Platform and Security Conclusions.
Source [242]: Department for Science, Innovation and Technology and Office for Artificial Intelligence (2023). A pro-innovation approach to AI regulation (CP 815). UK Government, 29 March 2023. Available at: https://www.gov.uk/government/publications/ai-regulation-a-pro-innovation-approach/white-paper (accessed 2026-11-01). Referenced in: Chapter 3: Regulatory Requirements as Engineering Constraints, Chapter 4: A Reference Architecture for AI in Large Organisations.
Source [243]: European Commission (2025). Commission Implementing Decision (EU) 2025/2574 amending Implementing Decision (EU) 2021/1772 on the adequate protection of personal data by the United Kingdom. Official Journal of the European Union, 23 December 2025. Available at: https://eur-lex.europa.eu/eli/dec_impl/2025/2574/oj (accessed 2026-11-01). Referenced in: Chapter 6: Data Architecture for AI, Chapter 13: Infrastructure, Compute and European Digital Sovereignty, Chapter 24: Nordvik Region and Hansa Mutual: Platform and Security Conclusions.
Source [244]: Swiss Federal Assembly (2020). Federal Act of 25 September 2020 on Data Protection (Data Protection Act, FADP), SR 235.1. Fedlex, in force 1 September 2023. Available at: https://www.fedlex.admin.ch/eli/cc/2022/491/en (accessed 2026-11-01). Referenced in: Chapter 3: Regulatory Requirements as Engineering Constraints, Chapter 5: AI Decision Records, Model Cards and the Architecture Repository, Chapter 6: Data Architecture for AI, Chapter 13: Infrastructure, Compute and European Digital Sovereignty, Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges, Chapter 21: Observability, Monitoring and Drift in Production, Chapter 24: Nordvik Region and Hansa Mutual: Platform and Security Conclusions.
Source [245]: European Commission (2000). Commission Decision 2000/518/EC on the adequate protection of personal data provided in Switzerland. Official Journal of the European Communities, L 215, 25 August 2000. Available at: https://eur-lex.europa.eu/eli/dec/2000/518/oj (accessed 2026-11-01). Referenced in: Chapter 6: Data Architecture for AI, Chapter 13: Infrastructure, Compute and European Digital Sovereignty, Chapter 24: Nordvik Region and Hansa Mutual: Platform and Security Conclusions.
Source [246]: Swiss Financial Market Supervisory Authority (2024). FINMA Guidance 08/2024: Governance and risk management when using artificial intelligence. FINMA, 18 December 2024. Available at: https://www.finma.ch/news/2024/12/20241218-mm-finma-am-08-24/ (accessed 2026-11-01). Referenced in: Chapter 24: Nordvik Region and Hansa Mutual: Platform and Security Conclusions.

Example organisations and multinational settings

Source [247]: European Parliament and Council of the European Union (2016). Directive (EU) 2016/97 on insurance distribution (recast). Official Journal of the European Union, 2 February 2016. Available at: https://eur-lex.europa.eu/eli/dir/2016/97/oj (accessed 2026-11-01). Referenced in: Chapter 10: Foundation Models, Retrieval and Grounding.
Source [248]: United Kingdom (2018). Data Protection Act 2018 (c. 12), with the UK General Data Protection Regulation. Available at: https://www.legislation.gov.uk/ukpga/2018/12/contents (accessed 2026-11-01). Referenced in: Chapter 4: A Reference Architecture for AI in Large Organisations, Chapter 5: AI Decision Records, Model Cards and the Architecture Repository, Chapter 6: Data Architecture for AI, Chapter 13: Infrastructure, Compute and European Digital Sovereignty, Chapter 14: Cloud AI Services versus On-Premises AI: Different Challenges, Chapter 24: Nordvik Region and Hansa Mutual: Platform and Security Conclusions.
Source [249]: Bundesarbeitsgericht (Federal Labour Court of Germany) (2024). Beschluss vom 16. Juli 2024 – 1 ABR 16/23 (Technische Überwachungseinrichtung – Headset-System – betriebliche Mitbestimmung – Gesamtbetriebsrat). ECLI:DE:BAG:2024:160724.B.1ABR16.23.0. Available at: https://www.bundesarbeitsgericht.de/entscheidung/1-abr-16-23/ (accessed 2026-11-14). Referenced in: Chapter 1: Introduction to AI Platform and Security, Chapter 24: Nordvik Region and Hansa Mutual: Platform and Security Conclusions.
Source [250]: Jones, M., Nadalin, A., Campbell, B. (Ed.), Bradley, J. & Mortimore, C. (2020). OAuth 2.0 Token Exchange. RFC 8693, Internet Engineering Task Force (IETF), Standards Track, January 2020. Available at: https://www.rfc-editor.org/rfc/rfc8693 (accessed 2026-11-14). Referenced in: Chapter 12: Integrating AI into the Enterprise Landscape.
Source [251]: pandas (2026). pandas.read_parquet and Installation: optional dependencies (pandas documentation). pandas.pydata.org, living pages. Available at: https://pandas.pydata.org/docs/reference/api/pandas.read_parquet.html (accessed 2026-11-14). Referenced in: Appendix A: Code Examples and Technical Implementations.
Source [252]: GitHub (2026). Managing environments for deployment. GitHub Docs, living page. Available at: https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/manage-environments (accessed 2026-11-14). Referenced in: Appendix A: Code Examples and Technical Implementations.

Future trends: 2025 and 2026 developments

Documented European case studies

How to cite

Inline citations give the source number, the author or organisation, and the year, for example (99, Skelton & Pais, 2019), and link to the entry here. Where an author is named in the sentence, the citation carries the year. Each chapter closes with a ## Sources section that lists the works it cites, using the same numbering as this bibliography. New sources are appended to the appropriate category with the next free number; existing numbers are never reused.