Forensic Outcome

The roadmap describes moving to autonomous Service Areas, but which specific executive sponsor holds veto-proof authority to terminate the contracts — or materially reduce the scope — of CGI, Innofactor, and Ambientia mid-programme, and what is the contractual exit cost and notice period for each vendor?

The critique identifies a severe Conway's Law violation: Veritas has effectively outsourced architectural decision-making to three external vendors whose commercial incentives are structurally misaligned with decoupling. As Conway's Law makes clear, organizational communication structures directly produce the technical architecture — meaning no architectural change is achievable without first changing the vendor governance model. The roadmap phases name domain decoupling and internal capability seeding, but contain zero reference to contract renegotiation timelines, exit clauses, or the identification of a C-suite owner with the authority and political will to execute those changes. Without this, Phase 2 pilot decoupling will be quietly sabotaged by vendor change-request processes, and Phase 3 operationalization will never achieve independent release cadence. The embedded finance window is closing: the European embedded insurance market is forecast to grow at a 34.8% CAGR through 2031, and online, API-first distribution already commands over 93% of 2025 European embedded insurance premiums. Every quarter of vendor contract ambiguity is a quarter of compounding strategic disadvantage.

The roadmap targets an 18-month horizon for the first externally consumable insurance service interface, but has Veritas modelled the total cost of delay — specifically the revenue opportunity cost of remaining architecturally ineligible for B2B2C embedded finance partnerships while the European embedded insurance market compounds at ~35% CAGR — against the full internal capability-build investment required across all four phases?

Veritas's financial fortress (124.2% solvency, EUR 5B+ investments, 12% premium growth) creates a dangerous institutional blind spot: the organisation is measuring transformation cost but not the cost of delay. The European embedded insurance market is projected to reach USD 18.29 billion by 2031 from USD 3.05 billion in 2025, growing at a 34.8% CAGR — and online, API-first distribution already commands overwhelming market primacy. Deloitte's analysis is explicit that 'playing it safe by not engaging early on could end up being the riskiest move of all' for insurers. The roadmap's phased structure implicitly accepts 18 months of architectural ineligibility for these partnerships, but nowhere quantifies what that forfeiture costs in foregone premium at current growth rates, nor does it model whether a more aggressive, higher-investment Phase 1-2 compression would generate positive NPV by accelerating ecosystem entry. Without a rigorous cost-of-delay model anchored to the European embedded insurance growth trajectory, the Board will default to underfunding the programme — replicating the exact 'Pilot Purgatory' pattern the critique identifies with AI.

The roadmap proposes seeding internal engineering capability in Phase 2, but what is the explicit talent acquisition and retention strategy for engineers who can own domain services end-to-end, given that Veritas currently has zero internal ML engineering and no public engineering presence — and how will the organisation prevent the gravitational pull of its existing command-and-control 'ylhaalta alaspain' management culture from re-absorbing and neutralising newly hired autonomous engineers before Phase 3?

The critique diagnoses Digital Taylorism masquerading as Agile: top-down work organisation, quarterly resource allocation dictated by a development manager, and vendor-mediated release gates. This is precisely the environment that drives autonomous, product-minded engineers to exit. The Inverse Conway Maneuver — deliberately restructuring teams to produce the desired architecture — requires small, long-lived, cross-functional teams with full ownership of their services and autonomous release authority. However, if newly hired engineers are embedded into the existing functional hierarchy where a development manager adjudicates prioritisation disputes and external vendor contracts control deployment pipelines, Conway's Law guarantees the new organisational structure will simply re-produce the old fragmented architecture under a new label. The roadmap names 'internal capability seeding' but contains no answer to: What reporting line do new engineers have? Who protects their autonomy from quarterly planning cycles? What is the compensation model that makes Veritas competitive against Helsinki's fintech and insurtech talent market? These questions must be resolved before Phase 2 begins, not discovered during it.

Before committing to domain boundary definitions in Phase 1's Forensic Clarity exercise, has Veritas mapped the data residency, ownership, and contractual data rights across all twenty legacy systems — specifically identifying which datasets are legally owned by CGI, Innofactor, or Ambientia under current SLAs — since the EU AI Act's strict data provenance requirements and FIDA's forthcoming interoperability mandates will make data trapped in vendor-controlled schemas an immediate hard blocker for both AI deployment in Phase 3 and the API-driven embedded finance interfaces in Phase 4?

The roadmap's Phase 1 focuses on forensic clarity and domain discovery, but the critique explicitly warns that data is locked in twenty legacy systems managed by external consultants. This is not merely a technical inconvenience — it is a legal and regulatory exposure. Under FIDA (Financial Data Access Regulation), which is enforcing interoperability standards by 2026, insurers must be able to assert data sovereignty and provide structured access to partner ecosystems. The EU AI Act demands strict data provenance and lineage for any deployed model. If the forensic mapping in Phase 1 does not produce a definitive data rights and ownership register — including which vendors hold contractual claims over schema designs, historical datasets, or derived models — then Phase 3's AI deployment objectives will be blocked not by engineering capability but by legal ambiguity, and Phase 4's externally consumable interfaces will expose Veritas to regulatory liability the moment a partner attempts to consume policyholder data via the API layer. The distributed monolith risk is equally acute: without this mapping, domain decoupling risks producing tightly coupled systems spread over network calls rather than genuinely independent services.

The roadmap assumes the award-winning humanistic culture (4.29/5 responsibility score, Oikotie Responsible Workplace recognition) is an asset that will accelerate adoption of the Service Area model — but has it been stress-tested against the specific psychological threat that domain decoupling poses to the application owners, development manager, and functional leads whose identity, authority, and job security are currently anchored to the fragmented system landscape the roadmap intends to eliminate?

The critique correctly identifies that Veritas's people are capable of the Fluid model but trapped in a Rigid vehicle. However, 'humanistic culture' and 'psychological safety' are not synonymous. A high-trust, responsibility-oriented culture can paradoxically intensify resistance to modernisation when individuals perceive the change as a threat to relational equity — the informal authority structures, vendor relationships, and domain knowledge that constitute their professional identity within the organisation. The application owners who currently broker prioritisation decisions, and the development manager who resolves disputes when they cannot agree, are not merely process nodes — they are power holders. The roadmap's Phase 2 pilot decoupling will require these individuals to either redefine their roles or accept a material reduction in influence. Without a deliberate change management programme that reframes these roles around the new Service Area model — giving former gatekeepers a meaningful stake in the new architecture's success — resistance will not manifest as open defiance (inconsistent with the culture) but as passive friction: slow knowledge transfer to new engineers, selective vendor escalations, and 'compliance theatre' with the new domain boundaries while informal authority structures remain intact.