Reality is the architecture: three conversations in one week

Three conversations in three days, three sectors, three problems that are normally handed to three different departments. Standards and compliance. Institutional knowledge in an ageing facility. Digitalisation across a group of municipalities. By the third one it was obvious that the same fault line runs under all of them, and that the same move closes it.

The fault line is this: the work is documented in a form that has no place in it. Boxes, arrows, matrices, phases, maturity levels. All accurate, all unusable for the three questions that actually decide anything — where is it, who notices when it breaks, and what number moved.

What each conversation was really about

Standards. An organisation is covered by dozens of standards simultaneously, revised on their own schedules, with requirements that increasingly carry dates and personal accountability. The failure mode is not ignorance. It is that no one can say which requirement applies to which asset, so compliance becomes a document rather than a state.

Institutional knowledge. A facility operated and extended over decades holds most of what matters in the heads of a small number of people. Scans and models exist. The reasoning does not, because reasoning has never had an address to be filed under.

Public-sector digitalisation. Shared IT organisations produce strategy decks of twenty to thirty slides describing the same organisation three different ways, while the operational question — who is affected, where, and how fast — has no owner and no view.

The same move, three times

Put the world under the work. Not as an illustration produced at the end, but as the surface the work is done on.

In practice that means the target architecture stops being a diagram of systems and becomes a picture of reality: where residents and users are, where facilities sit, where equipment stands, who is responsible, and what is meant to get better. Every specialist keeps their own tools and their own depth. The shared surface is what they point at when they need to be understood by someone who is not them.

Two properties make it work. It is legible without training, because everyone already knows the territory. And it is stable across reorganisation, because departments get renamed while schools, networks and server rooms stay exactly where they are.

The chain nobody draws

Take the clearest example in public service: a resident with an alarm pendant. The chain runs resident, service unit, service, application, virtual machine, rack and hall, network, power. Eight links, and every one of them exists whether or not it has been drawn.

Read it downward and it is a cost and value conversation: what this service gives and what it costs to run. Read it upward and it is a continuity analysis: if this link fails, who is affected, where, and within how long. Same chain, two directions, and both are ordinary questions that most organisations currently answer with an estimate.

Care operations are where this bites hardest, because the last link in the chain is a person in a home rather than a report in a system. It is also where the argument for investment stops being abstract: a security budget defended by describing a threat landscape is a hard sell, while the same budget defended by naming the care homes that lose alarm reception is a short meeting.

Why this year and not next

Requirements have started to arrive with dates attached, and the dates move without asking.

The Swedish cybersecurity act entered into force on 15 January 2026 and places responsibility clearly at management and board level. The Cyber Resilience Act applies in stages, with reporting obligations from 11 September 2026 and full application on 11 December 2027, which makes support periods and vulnerability handling a procurement question now rather than a supplier question later. And the AI Act's high-risk obligations moved during the summer to 2 December 2027 for standalone systems and 2 August 2028 for embedded ones, while the transparency duties in Article 50 have applied since 2 August 2026.

That last one is the argument in miniature. An organisation that had planned against a single date found the date changed two weeks before it arrived. Whoever had tied requirements to assets could see immediately what was affected. Whoever had a project plan had to start the interpretation over.

What we do about it

A standards fabric that attaches requirements to the assets they govern and watches for change continuously, so a revision lands on a node with an owner instead of in a newsletter nobody opens.

A method for capturing what people know, anchored spatially, that takes thirty minutes per person and produces a shared current state in two to four weeks rather than a year.

A minimum viable twin aimed at one decision that is currently made slowly or badly, proven in days, with scope earned rather than assumed.

Outcome gates on initiatives, so "delivered and fully implemented" is a delivery rather than an ending, and the number that justified the work is measured or explicitly written off by the person who owns the need.

Four things worth stealing even if we never speak

One. Ask of every slide in your own strategy material: where does this happen, who notices when it is done, and what number should have moved. If none of the three can be answered from the slide, the slide describes work rather than value.

Two. Measure decision latency — days from a registered need to a decision. It is the only number that captures whether collaboration is real, and almost nobody has it.

Three. Put an outcome measure next to every service level. Service levels measure the supplier. Outcome measures tell you whether anything got better for the person the service exists for.

Four. Run one failure as a table-top exercise this quarter. What cannot be rehearsed cannot be relied on, and the first time should not be the real one.

What is coming

A training programme for public-sector organisations — getting started, getting further, succeeding — with eight modules, six exercises and a ninety-day plan. Whitepapers on the cybersecurity act, the Cyber Resilience Act, the standards landscape and governance that survives moving requirements. And a working note series from the standards fabric as it hardens.

If any of the three conversations above sounds like a week you have had, the useful next step is the smallest one: pick the service where a failure is noticed fastest by an actual person, and draw its eight links. The gaps in that drawing are your roadmap, and they take an afternoon to find.