\cleardoublepage \part{The Loop in the Organisation} \setbookpart{The Loop in the Organisation}

Part V: The Loop in the Organisation

A loop that works in a pipeline still has to live in an organisation. It needs a definition of what it has shown, measures that cannot be gamed, a team and an operating model, decision rights, a legal frame and relations with the providers, peers and authorities that stand outside the organisation's walls. Part V treats these six questions.

The first two chapters are about evidence. Coverage is a claim, and a claim has an age, a condition and a result; the measures of the loop must reward yield, not activity. The next two are about who does the work and who decides: operating models from the in-house red team of Hansa Mutual to the contracted tester of Nordvik Region, and the decision rights that authorise, stop and close. The last two are about constraint: the European law that frames emulation, and the boundaries the loop crosses when it tests through a provider or shares what it learns.

Chapters in this part:

  • Chapter 17, Coverage as a Claim, treats P3 Observe and P5 Verify: the coverage record, evidence age and detection decay.
  • Chapter 18, Measuring the Loop, treats P3 Observe, P4 Improve and P5 Verify: cycle time, yield, re-test pass rate and the metrics that mislead.
  • Chapter 19, Operating Models and Team Design, treats all five stages: in-house, contracted, hybrid and sovereign loops, and the roles each needs.
  • Chapter 20, Decision Rights, Authorisation and the White Team, treats P1 Target, P2 Emulate, P4 Improve and P5 Verify: who authorises, stops, accepts risk and declares a technique covered.
  • Chapter 21, Regulation as Constraint, treats P1 Target and P2 Emulate: DORA, TIBER-EU, NIS 2, the AI Act, the GDPR and the rights of staff.
  • Chapter 22, Across Boundaries, treats P2 Emulate, P3 Observe and P4 Improve: providers, sector exercises, sharing and disclosure.

Stages in this part. Each chapter names the stages it concerns, by their exact names.

The thread from the series. Decision tiers and forums are those of AI Governance, Chapter 13; the blue team's operating models, roles and decision rights are those of AI Blue, Chapters 16 to 20; surveillance and co-determination are those of AI Boss, Chapters 13 and 23. Legal content is attributed to the instrument and article and framed as architectural implication, not legal advice.

What you will learn in this part:

  • What a statement of coverage must contain to be believed
  • Which measures of the loop to use and which to avoid
  • How to choose an operating model and charter its roles
  • Who decides what, and what the law requires of an exercise

Part VI turns to the people who run the loop.