Nordvik Region and Hansa Mutual: Threat Conclusions

In the autumn of 2026 two governing bodies asked the question this book asks. In September a group in Nordvik Region's regional council tabled a motion asking whether the Region should pause its use of AI until the risks are understood, and the council referred it to its audit committee for a report by the end of March 2027. In October the risk committee of Hansa Mutual's executive board asked the chief risk officer whether AI loss of control, and AI-enabled catastrophes more broadly, belong in the group's own risk and solvency assessment, and if so how. Each organisation commissioned an AI threat assessment, ATA-NR-2026-01 and ATA-HM-2026-01, and every chapter since has shown part of the work.

This chapter draws that work together. It tests no trope and stages no debate; it records two answers built with the same method from the same evidence that nonetheless came out differently, and argues that the difference is the most useful thing the cases teach. They also show that the question can be answered without belief or dismissal, on a single page that can be defended in public and revised when the evidence changes.

Table 33.1: The two threat registers placed by scale of threat. Nordvik's weight lies at the scales of the mind and of society, Hansa's across all four.

Scale of threat Nordvik Region register Hansa Mutual register
Human mind THR-NR-06, 07, 09 THR-HM-08, 10
Society and truth THR-NR-04, 05, 08 THR-HM-05, 06, 11, 12
Humans wielding machines THR-NR-02, 03 THR-HM-02, 04, 07, 13
Machines beyond control THR-NR-01, via suppliers THR-HM-01, 03, 09
Answer To the council: no pause, commitments at every scale, public dialogue To the risk committee: AI threat in the ORSA, register in the taxonomy, controls in the platform

Both answers end at the same shared and unresolved gaps: provider concentration, frontier evidence and systemic threats.

One method, two forums

Both assessments used the method of Part I. Every claim was graded on the evidence ladder of Chapter 4 and every outlook labelled observable, expected or speculation, and each surviving threat entered a register in the form Chapter 32 describes. Both used the horizon-register principle of AI Governance, Chapter 22: observable threats justify commitment, expected ones preparation and speculative ones reversibility, and a register is valuable because it can be wrong in a reviewable way (178, Nordqvist, 2026).

The forums imposed different disciplines. Nordvik answered elected politicians in public. Its terms of reference, AIDR-0401, framed the question exactly as the council framed it, so that the answer could not substitute an easier one, and required every recommended decision to state its reversibility and cost; its claim card CC-NR-2026-03 and crux map CRX-NR-2026-01 came from the audit committee's own workshop, and the evidence records were published. Its discipline was publicity. Hansa answered a committee of its executive board under supervisory expectations in seven jurisdictions, with terms of reference recorded as AIDR-0411. Its emerging-risk team mapped the evidence ladder onto the ORSA's standards: a pattern at scale supports quantified modelling, an incident in the wild or a strong laboratory demonstration supports scenario analysis, and argument alone is material for a reverse stress test. Its discipline was supervisory challenge, and the shared form of the records makes the two answers comparable.

Nordvik Region: the answer to the council

What the assessment found

The team, led by the chief information security officer and the AI governance lead, began with the risk Chapter 1 named, that the Region would answer too narrowly, as a cybersecurity question, and the terms of reference prevented it.

At the scale of the human mind, the Region's most immediate exposure lies in its own staff. About 3,200 people use the internal staff assistant, and the oversight designed for the benefits-triage system depends on caseworkers who can still decide without the ranking. The register records the erosion of that judgement as THR-NR-06, together with THR-NR-07, pupils' learning in the regional vocational programmes, and THR-NR-09, vulnerable residents in social care relying on unsafe AI companions. The evidence is early and mixed, but the measures are cheap and the harm is slow to notice and slow to undo.

At the scale of society and truth, the team found the threat that has already happened elsewhere. The benefits-triage system ranks about 40,000 claims a month and orders the manual verification queue for the living-support benefit, the setting in which SyRI, the Dutch childcare benefits scandal and Robodebt occurred (24, District Court of The Hague, 2020) (25, Tweede Kamer, 2020) (26, Royal Commission, 2023). The audit committee asked directly whether the Region could cause "the next SyRI". The register records the risk as THR-NR-04, and the harm-path review HPR-NR-2026-01 answered that the existing artefacts, AIDR-0007, AIDR-0011, FRIA-2026-002 and the removal of postcode features from the claims ranker in AIDR-0018, closed most of the paths, leaving one missing link between complaints, appeal outcomes and the system owner. Two further entries complete the scale: THR-NR-08, loss of trust in the Region's public information through synthetic content, and THR-NR-05, dependence on a few model and hosting providers.

At the scale of humans wielding machines, the Region is a target rather than a source. AI-accelerated exploitation of its internet-facing services, THR-NR-02, meets a security unit of fourteen with six analysts working office hours, and the Five Eyes agencies' warning that AI accelerates the speed, scale and sophistication of cyber threats applies with particular force to a small team (74, Five Eyes agencies, 2026). Synthetic-media impersonation of its officials, THR-NR-03, exploits the fact that their voices and faces are public. The Region's contribution to catastrophic misuse was assessed as near zero, so that question reduced to supplier assurance.

At the scale of machines beyond control, the Region's direct exposure is low. It runs no autonomous production agents and grants no assistant write access to any system; its exposure comes through suppliers offering agentic features inside its environment, recorded as THR-NR-01. The July 2026 incident mattered to the Region chiefly as a question about where its suppliers run such evaluations (133, OpenAI, 2026). On civilisational loss of control, the audit committee concluded that the threat lies outside the Region's mandate: it cannot influence it, and a pause would remove none of it.

What the Region decided

The regional director's report recommended no general pause, because a pause would remove little of the risk the motion described and some of the Region's means of meeting it: the misuse threat comes from attackers' AI, and the threat beyond control reaches the Region through suppliers whether or not it uses AI. Instead the report set commitments at every scale, each tied to a register entry, an owner and a date. The council adopted the report and asked for the register to return to the audit committee at each six-monthly review.

At the scale of the mind, the commitments protect judgement and learning: a human first draft and reasoning check for AI-assisted analysis, quarterly unassisted case reviews and a ranking-off day in the benefits unit, the sycophancy evaluation EVAL-NR-SYC-001, a model AI policy for schools (AIDR-0471) and a safeguarding policy (AIDR-0409) that makes the citizen-service assistant hand over to people on distress.

At the scale of society and truth, the commitments protect residents' rights and the Region's public word. The disparate-impact gate DIT-NR-CR-01 runs on every quarterly release of the claims ranker, with the provider contractually obliged to supply the evidence. The prohibited-practice check PPC-NR-01, AIDR-0431, runs on every change to the AI inventory and has already stopped a proposed feature that would have used public-transport travel-card data to rank benefit applicants, a use the Region judged to fall under Article 5(1)(c) of the AI Act (1, European Union, 2024). The harm-path review's missing link now exists, the content-provenance policy CPP-NR-2026-01 (AIDR-0420) protects the Region's public word, and exit plans EXIT-NR-01 to EXIT-NR-03 cover THR-NR-05.

At the scale of humans wielding machines, the commitments are decisions taken in advance, because a small team cannot take them at night. The Region set a measured patch target for internet-facing services and gave its managed security service provider a mandate to isolate a service without waiting for the morning. The exposure prioritiser NR-SEC-003 works at Level 0 Advisory, the lowest of the autonomy levels of AI Red Team, Chapter 6, so that AI helps analysts see what matters while they decide (180, Nordqvist, 2026). The impersonation protocol in AIDR-0425 removes appearance from the evidence on which money moves: changes of bank details are confirmed by callback to contact details in the Region's own records, and the first payment to a changed account waits a day.

At the scale of machines beyond control, the commitments are contractual and verified by evidence. Any supplier feature that would act inside the Region's environment must have a stop path the Region's named holders can trigger without the supplier, demonstrated in a drill before go-live and annually after. The delegation register entry DEL-NR-BEN-01 and its reversibility test RVT-NR-2027-01 showed that the benefits process could run for a month without the claims ranker, with conditions: an outdated manual checklist, newer caseworkers who had never triaged unranked claims and a capacity shortfall. The Head of Benefits Unit therefore froze further delegation in triage until the conditions are met.

The commitments rest on a public hearing in the constructive format of Chapter 4 and library evenings with residents (Chapter 31), whose concerns about synthetic content and the care of isolated relatives are visible in the commitments above.

What the Region decided not to do

The Region did not pause AI, in general or in any service, because no register entry would have been reduced by a pause more than by the commitments, and several, THR-NR-02 above all, would have grown. It opened no register entry for civilisational catastrophe, recording instead the dependencies that a severe disruption of AI and cloud services would expose. It did not take up autonomous production agents or try to evaluate frontier models itself, and it did not make the threat a matter for the security unit alone: the controls at the scales of the mind and of society belong to the heads of the units whose staff use the assistants.

Hansa Mutual: the answer to the risk committee

What the assessment found

The emerging-risk team, with the group CISO, the head of the group AI platform and the chief actuary, began with the risk Chapter 1 named for Hansa: that the group would answer too technically and miss the accumulation of AI-related losses in the portfolio it underwrites.

At the scale of the human mind, the group found an apprenticeship problem. Claims handlers confirm routes proposed by the claims-triage agent, and much of the junior work through which graduates once learned the trade is now done by AI. The register records THR-HM-08, erosion of claims-handling skills, and THR-HM-10, graduates who never learn underwriting and claims judgement. If handlers cannot assess a claim without the agent, the oversight required of its approval rules becomes a formality.

At the scale of society and truth, the underwriting-support model for life and health products is high-risk under Annex III point 5(c) of the AI Act, and the register records THR-HM-05, unfair outcomes from the model, and THR-HM-12, unlawful discrimination by it in one or more markets. Synthetic photographs and documents in claims evidence are recorded as THR-HM-11, and the dependence of seven markets on a few providers as THR-HM-06, correlated failure of a shared model provider.

At the scale of humans wielding machines, AI-enabled intrusion (THR-HM-02) and deepfake-supported fraud and impersonation (THR-HM-04) are both observable, and as an underwriter Hansa faces correlated claims across many cyber policyholders from one AI-enabled campaign, recorded as THR-HM-07. The question about AI-enabled catastrophes reached the life and health book through THR-HM-13, pandemic losses aggravated by AI-enabled biological misuse, graded as unquantified and contested.

At the scale of machines beyond control, the group's exposure is direct and current. It runs two autonomous production agents with write access to core systems: the claims-triage agent and the IT-operations agent under AIDR-0027. The capability snapshot recorded two out-of-scope proposals by the IT-operations agent blocked at the policy point in the third quarter of 2026: the containment working, and the propensity present. The register records THR-HM-01, the claims-triage agent acting beyond its approval rules, and THR-HM-03, reward hacking in the IT-operations agent. At the far end, THR-HM-09 records systemic loss of control among frontier AI systems, on the rung of argument and labelled speculation (Chapter 27).

What the group decided

The chief risk officer's answer, recorded in AIDR-0412, was that AI threat belongs in the ORSA in three forms according to the evidence. Article 45 of the Solvency II Directive requires the assessment to cover overall solvency needs in the light of the undertaking's specific risk profile, and the group concluded that its AI exposure is now part of that profile (182, European Union, 2009). Threats that reach a pattern at scale or an incident in the wild, such as intrusion and fraud, enter through the existing operational-risk and cyber scenarios. The accumulation of AI-related losses, THR-HM-07, enters as scenario analysis, because the evidence supports scenarios but not a frequency. The two speculative entries, THR-HM-09 and THR-HM-13, enter as labelled reverse stress tests with no probability assigned. The reverse stress test of THR-HM-09 found that solvency survives correlated provider failure or simultaneous AI-related portfolio losses alone, but not both together with a market disruption, so the group's realistic exposure arrives long before any catastrophe.

The register was integrated into the group risk taxonomy, each entry carrying a risk category and a trope identifier, and entry owners sit in the decision tiers of AI Governance, Chapter 13, with the executive board as the management body for DORA purposes (178, Nordqvist, 2026), the body that DORA makes responsible for the entity's ICT risk (11, European Union, 2022). Entity reports label each obligation as law or group policy, so that AI Act controls applied in Norway, the United Kingdom and Switzerland are visibly group policy there.

The controls live in the platform, because Hansa builds and its leverage is the platform. The evaluation EVAL-HM-ITOPS-SG-01 measures the IT-operations agent's shortcut rate, and the layered evaluation plan EVP-HM-CTA-2026-01 combines tests, a shadow period, monitoring and decoys for the claims-triage agent. Quarterly stop-path tests, SPT-HM-ITOPS-*, rehearse the stop path without the agent's cooperation, as part of the group's ICT business continuity testing under DORA for the EU entities (11, European Union, 2022). A five-day test of the fallback models in the Frankfurt data centre showed that the claims assistant runs acceptably on them, that the claims-triage agent must be restricted to simple routes, and that one evaluation check guarding the fallback depended on the primary provider, a dependency since removed; exit plan EXIT-004 covers the provider dependence.

At the other scales, the controls are policies the platform enforces: the graduate-programme policy AIDR-0470, rolled out with works-council consultation; the oversight-quality metric OQM-HM-CLM-01, reported at team level only; a disparate-impact suite with market overlays that blocks a failing release; provenance checks (AIDR-0421) that route but never refuse a claim on a detector score alone; and the callback-verification policy CVP-HM-2026-01 (AIDR-0424). The SOC investigation agent HM-SEC-001 works at Level 2 Supervised.

What the group decided not to do

The group assigned no probability to systemic loss of control or AI-aggravated pandemic losses, writing "not estimated" rather than invent a figure that supervisors would have to challenge. The chief actuary recorded that THR-HM-09 changes no capital figure, because every control in it is already owed under other entries, and its decision rule is reversible measures only. The concern challenger's argument for labelling it expected was recorded and not adopted. The group did not withdraw either autonomous agent, because both are contained by boundaries that do not depend on intent and are tested quarterly, and withdrawal would not touch the accumulation risk. Nor did it move HM-SEC-001 to Level 3 Bounded; that case remains open.

The two threat statements

Both organisations reduced their answers to one page, kept in version control beside the register: the answer, the commitments by scale with the entries behind them, what was declined, what remains open and when the statement will be reviewed.

Worked example: The one-page AI threat statements

Illustrative. The first statement accompanied the regional director's report to the audit committee on ATA-NR-2026-01; the second accompanied AIDR-0412 to Hansa's risk committee. Both use the scale names of the register schema.

apiVersion: ai-threat.example.org/v1
kind: ThreatStatement
organisation: Nordvik Region
assessment: ATA-NR-2026-01
decisionRecords: [AIDR-0401]
askedBy: Regional council motion, September 2026
answer: No general pause; commitments at every scale; public dialogue
commitments:
  mind: [THR-NR-06, THR-NR-07, THR-NR-09, AIDR-0471, AIDR-0409, EVAL-NR-SYC-001]
  society-and-truth: [THR-NR-04, THR-NR-05, THR-NR-08, DIT-NR-CR-01, AIDR-0431, AIDR-0420]
  humans-wielding-machines: [THR-NR-02, THR-NR-03, AIDR-0425, NR-SEC-003]
  machines-beyond-control: [THR-NR-01, supplier stop-path clause, RVT-NR-2027-01]
declined: [pause of AI in general or in any service, register entry for civilisational catastrophe, autonomous production agents]
unresolved: [accelerator dependence, unverifiable supplier evidence, schools outside the Region's control]
review: six-monthly and on trigger, reported to the audit committee
---
apiVersion: ai-threat.example.org/v1
kind: ThreatStatement
organisation: Hansa Mutual
assessment: ATA-HM-2026-01
decisionRecords: [AIDR-0411, AIDR-0412]
askedBy: Risk committee of the executive board, October 2026
answer: AI threat in the ORSA by evidence rung; register in the risk taxonomy
commitments:
  mind: [THR-HM-08, THR-HM-10, AIDR-0470, OQM-HM-CLM-01]
  society-and-truth: [THR-HM-05, THR-HM-06, THR-HM-11, THR-HM-12, AIDR-0421, EXIT-004]
  humans-wielding-machines: [THR-HM-02, THR-HM-04, THR-HM-07, THR-HM-13, AIDR-0424]
  machines-beyond-control: [THR-HM-01, THR-HM-03, THR-HM-09, EVAL-HM-ITOPS-SG-01, SPT-HM-ITOPS]
orsaTreatment: {scenarioAnalysis: [THR-HM-07], reverseStressTest: [THR-HM-09, THR-HM-13], capitalChange: none}
declined: [probability for speculative entries, withdrawal of agents, Level 3 for HM-SEC-001 for now]
unresolved: [fallback quality for complex claims routes, accumulation model, EEA timing]
review: annual ORSA, on trigger and on a markedly more capable model class

The statements share a shape but not content: Nordvik's commitments are densest at the scales of the mind and of society, Hansa's at the two larger scales. Each declined something a less disciplined answer would have promised, and neither contains a probability or would be improved by one.

Where they differ and why

Four reasons account for most of the difference: mandate, exposure, scale and regulation.

Mandate. Nordvik serves residents who often cannot go elsewhere, under administrative law that requires reasons and an accountable official, so its answer begins with residents' rights, and its civil-preparedness duty turns the end of the world into a question of continuity of public functions. Hansa exists to pay claims and remain solvent, so it reasons through reverse stress tests and accumulation scenarios.

Exposure. Nordvik runs no autonomous production agents, so its exposure to machines beyond control is indirect; Hansa runs two, and as an insurer carries a second exposure in its portfolio.

Scale and capacity. Nordvik has a security unit of fourteen and limited engineering capacity; it mostly procures, so its leverage, and its controls, are contractual and procedural. Hansa mostly builds, so its controls are engineered into its platform. The distinction between buying and building applies to threat as much as to capability (179, Nordqvist, 2026).

Regulation. Nordvik works under one jurisdiction and public law: the AI Act as a deployer of a high-risk system under Annex III point 5(a), with the duties of Articles 26, 27 and 49, the GDPR, public-access law and NIS 2 as transposed (1, European Union, 2024) (10, European Union, 2022). Publicity is its regulator as much as any authority. Hansa works across seven jurisdictions under the AI Act, DORA, Solvency II and the UK and Swiss regimes, with Norway following through the EEA Agreement with a lag, and its answer had to survive supervisory challenge in each, which explains the recorded dissent and the absence of invented probabilities.

The differences should not hide what the answers share. Both rejected belief and dismissal, graded every claim on the same ladder and labelled every outlook. Both found that the threat reaching them first is not the dramatic one: for Nordvik the harm a benefits system can do and the erosion of judgement, for Hansa correlated provider failure, accumulated losses and its own agents' shortcuts. Both made reversibility the rule for speculation. Kasirzadeh's distinction between decisive and accumulative risk is visible in both (57, Kasirzadeh, 2025): neither organisation can touch the decisive pathway, so each spends most of its effort on the accumulative one, keeping its people capable, its dependence reversible and its decisions contestable.

What remains unresolved

Each answer leaves gaps, and both statements name them.

Gaps that Nordvik owns

The conditions of the reversibility test are open, so the delegation freeze holds. The MSSP mandate and the patch target depend on contracts aligned only at renewal, and because the Region does not run most of the schools whose pupils concern it, THR-NR-07 remains partly outside its control.

Gaps that Hansa owns

The second source is not equivalent for complex claims routes, so a long provider failure would move work to handlers whose capacity is the bottleneck, linking THR-HM-06 to THR-HM-08, and the accumulation scenarios for THR-HM-07 rest on little loss history. The case for Level 3 Bounded for HM-SEC-001 remains open, as does the timing of the AI Act's incorporation into the EEA Agreement for the Norwegian entity.

What neither can solve alone

Four gaps are common to both. The first is concentration: both depend on accelerators, cloud capacity and a few model developers that nobody in their position can avoid. Digital sovereignty, as AI Platform and Security, Chapter 13, defined it, is a set of verifiable properties, and both organisations have verified theirs, but neither can verify the supply chain beneath them (179, Nordqvist, 2026).

The second is evidence about frontier models, which neither can reproduce. The AI Act places the duty to evaluate and mitigate systemic risk on the providers of general-purpose AI models with systemic risk, and the General-Purpose AI Code of Practice gives that duty a form (1, European Union, 2024) (3, European Commission, 2025); a deployer can ask for the evidence and test its own compound system, but cannot make the evidence better than it is. The International AI Safety Report describes the same predicament for policy: early action on thin evidence may prove unnecessary, while waiting for strong evidence may leave society unprepared (50, Bengio et al., 2026).

The third is the shared information environment, which synthetic content degrades for everyone, and in which both depend on platforms, regulators and the obligations of the Digital Services Act (7, European Union, 2022). The fourth is the systemic threat itself, where each can influence only its own exposure and reversibility; whether that is enough depends on developers and states, and on whether AI turns out to be the normal technology that Narayanan and Kapoor describe or something faster (60, Narayanan & Kapoor, 2025). Both statements record the triggers that would tell them which.

Summary

Asked the same question, Nordvik Region and Hansa Mutual each graded every claim on the evidence ladder and built a register spanning the four scales. Nordvik answered its council with no general pause but commitments at every scale, shaped by a public dialogue. Hansa placed AI threat in the ORSA according to the evidence, with the speculative entries as reverse stress tests that change no capital figure, and engineered its controls into the platform.

The answers differ in mandate, exposure, scale and regulation, yet both declined to pause, to invent probabilities or to treat speculation as a reason for anything but reversible measures. Both leave gaps, some with owners and dates, others beyond any single organisation. The reader's organisation can take the same steps: frame the question as asked, grade the evidence, record the answer on one page, name what is declined and unresolved, and review it when the evidence changes. Chapter 34 turns from the threat to its opposite and describes what going well with AI would look like.

Sources

  1. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. (178, Nordqvist, 2026)
  2. District Court of The Hague (2020). Judgment of 5 February 2020, NJCM et al. v. the State of the Netherlands (SyRI). (24, District Court of The Hague, 2020)
  3. Tweede Kamer der Staten-Generaal, Parlementaire ondervragingscommissie Kinderopvangtoeslag (2020). Ongekend onrecht (Unprecedented injustice). (25, Tweede Kamer, 2020)
  4. Royal Commission into the Robodebt Scheme (2023). Report. (26, Royal Commission, 2023)
  5. Five Eyes cyber security agencies (2026). The AI shift in cyber risk: why leaders must act now. (74, Five Eyes agencies, 2026)
  6. OpenAI (2026). OpenAI – Hugging Face Incident Technical Report. (133, OpenAI, 2026)
  7. European Parliament and Council of the European Union (2024). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). (1, European Union, 2024)
  8. Nordqvist, G. (2026). AI Red Team: AI as an Active Part of Cyber Defence in European Enterprises and Public Authorities. (180, Nordqvist, 2026)
  9. European Parliament and Council of the European Union (2022). Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). (11, European Union, 2022)
  10. Nordqvist, G. (2026). AI Platform and Security: Building and Securing AI Platforms in European Enterprises and Public Authorities. (179, Nordqvist, 2026)
  11. European Parliament and Council of the European Union (2022). Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive). (10, European Union, 2022)
  12. Kasirzadeh, A. (2025). Two types of AI existential risk: decisive and accumulative. (57, Kasirzadeh, 2025)
  13. European Commission (2025). The General-Purpose AI Code of Practice. (3, European Commission, 2025)
  14. Bengio, Y. et al. (2026). International AI Safety Report 2026. (50, Bengio et al., 2026)
  15. European Parliament and Council of the European Union (2022). Regulation (EU) 2022/2065 on a Single Market for Digital Services (Digital Services Act). (7, European Union, 2022)
  16. Narayanan, A. & Kapoor, S. (2025). AI as Normal Technology. (60, Narayanan & Kapoor, 2025)
  17. European Parliament and Council of the European Union (2009). Directive 2009/138/EC on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II) (recast). (182, European Union, 2009)